CIA Director Freaks Out After Senator Wyden Points Out How The CIA Spied On The Senate

from the not-so-cool-under-fire dept

If you're a CIA Director, one would assume that you know how to be cool under fire, right? Apparently that's not the case for current CIA Director John Brennan who seemed to completely freak out when Senator Ron Wyden started asking questions about the CIA's infamous decision to spy on the network and computers of Senate Intelligence Committee staffers who were compiling a report on the CIA's torture program. The details are a bit complex, but the short version is that the Intelligence Committee, which has oversight powers over the CIA, had been set up in a CIA building, with special access to CIA documents, and a special search tool. Apparently, at some point, that search tool returned a document which the CIA had never intended to share with the intelligence committee staffers. That document, called "the Panetta Review" was a draft document that then-CIA chief Leon Panetta had tasked people internal at the CIA to prepare on what the Senate Intelligence Committee staffers were likely to find as they went through the documents.

Yes, this is fairly meta. You had Senate staffers reviewing CIA documents, and at the same time, the CIA reviewing those same documents to try to get out ahead of any controversy -- and to make matters confusing, the Senate staffers then got access to that CIA review document as part of their regular searches. When the CIA was questioned about this Panetta review, they freaked out, wondering how the Senate staffers got their hands on the document, and did what the CIA does: they spied on the Senate staffers' computers and network to try to determine how they got the document in the first place. This was despite a promise from the CIA that the Senate staffers' computers and network were considered off-limits (due to an even earlier incident). That resulted in Senator Dianne Feinstein accusing the CIA of illegally spying on the Senate (its overseers). In response, Brennan first denied the spying altogether, and then insisted that it was the Senate staffers who broke the law, saying they illegally mishandled classified CIA documents in how they handled the Panetta Review.

Eventually, the DOJ decided that there wasn't enough evidence that either side broke the law, and refused to make any criminal charges either way. While both the CIA's Inspector General and a special review board Brennan himself set up found that the CIA did, in fact, spy on the Senate staffers' network and computers, and that this was inappropriate, neither seemed to say that it rose to a truly controversial level. Not surprisingly, the review board Brennan set up himself cleared him of wrongdoing.

Mixed in with all of this are remaining questions about how involved Brennan himself actually was in all of this (he refuses to say) and an ongoing request for an apology. While the CIA's Inspector General claimed that Brennan apologized for the breach, later reporting by Jason Leopold at Vice showed that Brennan had drafted an apology, but never sent it. Instead, he apparently provided a very narrow apology solely to Feinstein and then vice chair Saxby Chambliss, basically of the "I'm sorry if what did upset you" manner.

Given this, during a rare open Senate Intelligence Committee hearing, Wyden decided to quiz Brennan about all of this, leading to a rather sarcastic and testy exchange that needs to be watched to be believed: Immediately, Brennan gets snarky, noting that "This is the annual threat assessment, is it not? Yes?" implying that he doesn't think it's appropriate for Wyden to be bringing up this "other" topic in such a hearing. And it only gets worse from there. He immediately jumps to the argument, again, that it was the Senate staffers' fault for getting access to a document he didn't want them to see. He then says the CIA therefore had an "obligation" to find out how that happened. And then he, somewhat insultingly, suggests that Senator Wyden had not actually read the IG's account, or the report of the review panel that Brennan himself set up.

Wyden cuts him off, quoting directly from the report and notes that other agencies have all said it would be inappropriate to review Senate oversight computer systems, and asks Brennan if he disagrees. Brennan is clearly pissed off:

Brennan: Yes, I think you mischaracterize both their comments as well as what's in those reports. And I apologized to the Chairman and the Vice Chairman about the de minimis access and inappropriate access that CIA officers made to five emails or so of Senate staffers during that investigation. And I apologized to them for that very specific inappropriate action that was taken as part of a very reasonable investigative action. But do not say that we spied on Senate computers or files. We did not do that. We were fulfilling our responsibilities.

Wyden: I read the exact words of the Inspector General and the Review Board. You appointed the Review Board! They said nobody ought to be punished, but they said there was improper access. And my point is, in our system of government, we have responsibilities to do vigorous oversight. And we can't do vigorous oversight if there are improper procedures used to access our files.

Wyden then admits his time is up... but Brennan's so angry that he won't give up. He breaks all proper Senate hearing protocol and jumps back in, asking Wyden to say, again, that it was the Senate staffers' fault for accessing the Panetta Review:

Do you not agree there was improper access that senate staffers had to CIA internal deliberative documents? Was that not inappropriate or unauthorized?

Wyden angrily points out that everything the Senate staffers did was appropriate, and anyway, he's now asking about the CIA's activities, and points to the Inspector General review and the other review board... all the while with Brennan angrily shaking his head at Wyden. When Wyden finishes, Brennan goes back to being snarky, saying:

And I'm still awaiting the review that was done by the Senate to take a look at what the staffers actions were.

And then there's this:

Separation of powers between the executive, legislative branches, Senator, goes both ways.

In short: even if you have oversight over us, don't mess with the CIA, Senator. That's quite a statement.

He then goes on to again claim that Wyden is mischaracterizing everything, and that what the CIA did was entirely appropriate. Wyden concludes:

It's pretty hard to mischaracterize word for word quotes that use the words "improper access."

Indeed.

Filed Under: cia, john brennan, oversight, ron wyden, senate intelligence committee, separation of powers, spying, torture report

Senate Intelligence Committee Members Ask White House For Official Apology From CIA For Hacking Senate Computers

from the CIA:-it's-time-to-let-unacknowledged-wrongdoing-remain-unacknowledged dept

Ron Wyden, Martin Heinrich and Mazie Hirono -- all members of Senate Intelligence Committee -- have sent a letter to the President demanding an official apology from CIA head John Brennan for the agency's surveillance of Senate staffers working on the Torture Report.

"In January 2014, CIA personnel conducted an unauthorized, unprecedented search of Senate committee files, including the emails and other files of Senate staff investigating the CIA's use of torture," says the letter...

"The CIA Inspector General stated in a July 2014 report that this search involved 'improper agency access to [Senate Intelligence Committee] files.' A review board selected by CIA Director Brennan concluded in December 2014 that this CIA search 'resulted in inappropriate access to [Senate Intelligence Committee] work product'."

[...]

"We believe that it is necessary for you to ensure that senior officials in your administration recognize the importance of adhering to the rule of law," the lawmakers wrote to Obama. "We ask that you instruct Director Brennan to acknowledge that the CIA's unauthorized search of Senate files was improper and will not be repeated."

The White House and CIA have yet to comment on the letter and there's nothing in the history of the incident that suggests either will move forward on this. Obama's on short time and the CIA already cleared itself of all wrongdoing with an in-house "investigation" and further showed its disdain for independent oversight by throwing its Inspector General and his report on the spying efforts under the bus.

Jason Leopold and Vice obtained hundreds of documents through FOIA requests that appeared to show the opposite of what the CIA's internal investigation claimed. But it was the CIA that had the last word, proclaiming itself innocent and simultaneously accusing Senate staffers of improperly accessing restricted documents.

But the most damning document -- at least in the context of a demand for an official apology from the CIA -- was the apology the agency unofficially disavowed when it cleared itself of hacking allegations.

[T]he documents turned over to VICE News included a July 28, 2014 letter from Brennan that was addressed to Feinstein and Saxby Chambliss, who was then the ranking Republican on the Intelligence Committee, in which he apologized to them and admitted that the CIA's penetration of the computer network used by committee staffers reviewing the agency's torture program was improper.

The thing is, Brennan never signed or sent this apology. It just sat in a Torture Report-related file until it was FOIAed. Brennan even offered a closed-door, off-the-record apology to Dianne Feinstein, but to date, the final official word remains the CIA's: we did nothing wrong.

Filed Under: cia, john brennan, martin heinrich, mazie hirono, president obama, ron wyden, senate intelligence committee, spying, torture report

Senator Richard Burr: Confused And Wrong On Encryption

from the this-is-ridiculous dept

Senator Richard Burr, head of the Senate Intelligence Committee and long time friend to the intelligence community, has now penned a ridiculous, misleading, fear-mongering opinion piece for the Wall Street Journal, entitled: Stopping Terrorists From "Going Dark." It's pretty much exactly what you'd expect if you've paid any attention to the ridiculous "going dark" debate in the US. But, let's dig in and show just how bad this one is:

While the terrorist attacks in Paris, San Bernardino, Calif., and Garland, Texas, have brought discussions about encryption to the front pages, criminals in the U.S. have been using this technology for years to cover their tracks. The time has come for Congress and technology companies to discuss how encryption—encoding messages to protect their content—is enabling murderers, pedophiles, drug dealers and, increasingly, terrorists.

Right, except so far officials haven't been able to show evidence of any of those cases actually using encryption. Similarly, law enforcement has failed to show that criminals using encryption have really been that much of a problem either. And that's because it's not a problem. Even in the (still mostly rare) cases where encryption is being used, criminals still reveal plenty of information that would allow law enforcement to track them down. It's called doing basic detective work.

Consumer information should be protected, and the development of stronger and more robust levels of encryption is necessary. Unfortunately, the protection that encryption provides law-abiding citizens is also available to criminals and terrorists. Today’s messaging systems are often designed so that companies’ own developers cannot gain access to encrypted content—and, alarmingly, not even when compelled by a court order. This allows criminals and terrorists, as the law enforcement community says, to “go dark” and plot with abandon.

Yes, criminals and terrorists can use encryption just like law-abiding citizens. But that's true of any technology. There's no way to build technology that "only the good people can use." Criminals use cars and computers and guns. And they eat food and drink too. Some of them talk to each other in person. Yet we don't freak out about any of that other stuff. And, again, it's simply incorrect to say they can "plot with abandon." They cannot. Even when using encryption, many people either mess it up or still leave other clues. Most encrypted communication still reveals metadata about who was contacted, for example.

Leaving aside the terrorism challenges, encryption is affecting the investigations of kidnapping, child pornography, gang activity and other crimes. Federal, state, local and tribal law-enforcement officers can obtain legal authority to conduct electronic communications surveillance on terrorists and criminals. But encrypted devices and applications sometimes block access to the data. This means that even when the government has shown probable cause under the Fourth Amendment, it cannot acquire the evidence it seeks.

Yes, yes, the FBI and folks like the Manhattan DA's office keep making this claim, but every time they're asked to provide actual evidence of investigations stymied because of encryption, they come up empty. Official stats on lawful interception orders show that encryption is almost never a problem. They just don't run into it.

Technology has outpaced the law. The core statute, the Communications Assistance for Law Enforcement Act, was enacted in 1994, more than a decade before the iPhone existed. The law requires telecommunications carriers—for instance, phone companies—to build into their equipment the capability for law enforcement to intercept communications in real time. The problem is that it doesn’t apply to other providers of electronic communications, including those supporting encrypted applications.

This is wrong. Technology has not outpaced the law -- quite the opposite. Thanks to technology, law enforcement has more access to more information about every person alive than ever before in history. Technology now allows police to know where basically everyone has been at any moment in the day, who they spoke with, who they called or who they contacted via email. The fact that one small bit of data might be encrypted is hardly the case that technology has somehow outpaced the law.

Separately, yes, it's true that CALEA (the wiretapping statute) requires that phone calls can be tapped, but that's entirely different than undermining encryption. In fact, as we noted last week law already makes clear that phone companies are not required to backdoor encryption.

Federal Bureau of Investigation Director James Comey has said that one of the two Garland, Texas, shooters who died carrying out an attack on a Muhammad art exhibit in May exchanged 109 messages with an operative overseas. “We have no idea what he said,” Mr. Comey told the Senate this month, “because those messages were encrypted.” He described this as a “big problem”—and I couldn’t agree more.

Yes, yes, this is the example it took Comey over a year to finally come up with, but again it's an incredibly weak one. Note: the encryption did not stop them from knowing who the shooter was communicating with, because the encryption does not impact the metadata. Yes, it may limit the ability to read the exact content of the messages, but the same would be true if they had just communicated via a phone call on an untapped line. Or if they had simply communicated with a simple code that those two knew and the FBI did not. This is really no different than any other criminal investigation situation, and it's not the encryption that's the problem.

Last month Manhattan District Attorney Cyrus R. Vance Jr. released an in-depth report specifically on “smartphone encryption and public safety.” Many cellphones, including those designed by Apple and Google, now encrypt by default all the data they store, which is accessible only with a passcode.

Yeah, and we talked about how ridiculously wrong that report was at the time. And, again, the default mobile encryption only applies to data stored on those phones, not metadata. Apple would still have the keys to most data backed up in the cloud. Same with information shared with others where encryption may not be used. The amount of data that is truly "unobtainable" is minimal -- which is why no one has any really good examples of it being a problem.

The challenges presented by encryption extend to financial transactions. In August Sen. Elizabeth Warren wrote letters to six federal agencies voicing concerns that banks were using Symphony, an encrypted messaging system that could prevent regulators from detecting illegal activities. The letter came shortly after New York’s top banking regulator, the New York State Department of Financial Services, raised the same concern with several major banks and Symphony’s developer.

In response, the banks agreed to store decryption keys with independent custodians, and Symphony agreed to retain electronic communications for seven years. All parties also agreed to a periodic review process to make sure that oversight keeps in sync with new technologies.

It would seem to me that daily financial flows shouldn’t command more attention than terrorist or criminal communications, yet here we are. Although the agreement described above may not be the solution for all encrypted communications, it does show that cooperative solutions are possible.

That is not an apples to apples comparison by any stretch of the imagination. The reason for the concern with the banks is that banks are a highly regulated industry in which they are legally required to keep records of certain communications. That's not true of the general public, and unless Senator Burr is looking to wipe out the 4th Amendment, he shouldn't even pretend these things have anything in common.

Second, what a cheap politician's trick to pull out the "daily financial flows shouldn’t command more attention than terrorist or criminal communications" line. This is blatant fear mongering, because the issue is not about terrorists or criminals, but you, me, and everyone reading this who has an expectation of privacy. The only way to break encryption for "terrorists and criminals" is to make everyone less safe by putting in dangerous backdoors.

And, every time we put backdoors into encryption we see how it's abused -- such as with the recent Juniper vulnerability.

Finally, the "cooperative solution" in the case of the financial industry is an entirely different animal as well. Again, that's a limited use case in a specific, highly regulated industry. To even suggest that because of that specific use case, there must be some sort of "cooperative solution" once again highlights a near total ignorance of how encryption works.

I and other lawmakers in Washington would like to work with America’s leading tech companies to solve this problem, but we fear they may balk. When Apple objected to a recent court order in a New York criminal case requiring it to unlock an iPhone running iOS 7—an operating system that Apple can unlock—the company refused, arguing: “This is a matter for Congress to decide.” On that point, Apple and I agree. It’s time to update the law.

You fear they may balk? You want to know why? Perhaps because your friends in the intelligence community spent the last fifteen years breaking into their systems at every opportunity, undermining the trust and security of all of their users. You think that might have something to do with it? Maybe?

Senator Burr is doing something incredibly dangerous here. He's misleading the American public in a totally ignorant way, that will put our security at risk. He is making the world a more dangerous place, on purpose, because of a misunderstanding of how technology works. He has no place regulating technology issues at all.

Filed Under: backdoors, congress, encryption, going dark, richard burr, senate intelligence committee

DOJ Has Blocked Everyone In The Executive Branch From Reading The Senate's Torture Report

from the this-is-ridiculous dept

A year ago, we were writing a ton on the famed Senate Intelligence Committee's torture report. This report, which Committee staffers spent years on, cost $40 million, and clocked in at nearly 7,000 pages of detailed analysis of the US's hugely questionable (both morally and legally) torture program in the wake of 9/11. After much fighting, the Senate finally released a heavily redacted executive summary, but since then there have been some questions about what happens with the full report. Senator Dianne Feinstein, who was (believe it or not!) the driving force behind the report, had copies of the full report delivered to the Defense Department, the CIA, the State Department and the Justice Department. However, there has been a lot of confusion over whether or not anyone actually read it. The DOJ clearly announced that officials had read the whole thing... but later claimed that no one had even opened the report. Obviously, the DOJ lied with one of those statements.

There had been some hope that ex-Senator Mark Udall might choose to release some of it from the Senate floor before leaving office, but that didn't happen.

And, with the changing of the guard, the new head of the Senate Intelligence Committee, Richard Burr, demanded that all the federal government agencies that received the report should return it to him so he can destroy it and make sure that no one ever sees what's in the report. As we noted, however, this whole thing seemed to be an effort to state publicly that the document was a Congressional record. That matters because Congressional records are not subject to FOIA requests. Executive branch records are subject to FOIA requests -- and the ACLU has made a FOIA request to the exec branch for a copy of the report.

The DOJ has taken Burr's lead and claimed that the report is a Congressional record, and that's also why they insist that no one at the DOJ has opened it -- to maintain that it has not become an executive branch record subject to FOIA. Not surprisingly, Senator Feinstein is pissed off about this -- because her staffers spent years putting together this report, detailing massive abuses by the CIA and others in torturing people, and the whole point of it was to help the government learn how badly it messed up and to stop it from doing it again. But if no one reads it, then that won't happen. And, the DOJ now says that not only has it not read it, it has instructed everyone in the exec branch not to read it for fear that reading it would make it subject to FOIA:

Nearly a year after the Senate released a declassified 500-page summary of the report, the fate of the entire document remains in limbo, the subject of battles in the courts and in Congress. Until those disputes are resolved, the Justice Department has prohibited officials from the government agencies that possess it from even opening the report, effectively keeping the people in charge of America’s counterterrorism future from reading about its past. There is also the possibility that the documents could remain locked in a Senate vault for good.

Senator Feinstein (along with Senator Pat Leahy) has sent a rather angry letter (reasonably so!) to Attorney General Loretta Lynch, expressing her strong displeasure over this state of affairs:

Dear Attorney General Lynch and Director Comey:

We firmly believe that appropriate DOJ and FBI officials must read the full 6,700-page Senate Intelligence Committee Study of the CIA's Detention and Interrogation Program in order to understand what happened and draw appropriate lessons. This is exactly what Director Comey promised during his testimony before the Senate Appropriations Committee on March 12, 2015, when he said he would designate FBI officials to read the full, final version of the Committee's Study and consider the lessons that can be learned from it. Director Comey also acknowledged that former FBI Director Bob Mueller ordered FBI agents not to participate in the CIA program. Unfortunately, as the executive summary of the Study makes clear, the Department of Justice was among those parts of the Executive Branch that were misled about the program, and DOJ officials' understanding of this history is critical to its institutional role going forward.

We are gravely disappointed that, according to Assistant Attorney General Peter Kadzik's letter dated August 5, 2015, the Department of Justice is citing a Freedom of Information Act (FOIA) case, ACLU v. CIA as an excuse to refuse to allow Executive Branch officials to review the full and final Study. This DOJ decision prevents the FBI and other parts of the Executive Branch from reading the full 6,700-page Study and learning from the mistakes of the past to ensure that they are not repeated. Further, personnel at the National Archives and Records Administration have stated that, based on guidance from the Department of Justice, they will not respond to questions about whether the Study constitutes a federal record under the Federal Records Act because the FOIA case is pending.

The record in the FOIA case does not support DOJ's decision. According to the court filings in the FOIA case, DOJ represented that it would "preserve the status quo" pending appeal, but the context in which that commitment arose makes clear that DOJ was agreeing not to return the Study to the Senate Intelligence Committee. DOJ's commitment not to return the Study while the FOIA litigation is pending in no way precludes appropriately cleared individuals in the Executive Branch from reading the Study. We urge that you reconsider your position and disseminate the full and final Committee Study to appropriately cleared senior individuals in the Department of Justice and FBI, and instruct other appropriate federal departments to take the same position. For the same reason, we urge you to explicitly commit to retaining copies of the full 6,700-page Study.

We hope you agree that the legacy of this historic report cannot be buried in the back of a handful of Executive Branch safes, never to be reviewed by those who most need to learn from it. We look forward to hearing from you on this important issue.

The DOJ's argument that it has to block anyone from reading the document, lest it magically switch from a Congressional document to an executive branch one is apparently puzzling to experts.

“It’s quite bizarre, and I cannot think of a precedent,” said Steven Aftergood, the director of the Project on Government Secrecy at the Federation of American Scientists. He said there are any number of classified Senate documents that are shared with intelligence agencies and remain as Congressional records, even if they are read by members of the executive branch.

But it's not at all bizarre when put into the simple context of recognizing that this administration has bent over backwards refusing to look back on the nature of what the CIA did and whether or not it violated the law or international agreements on torture (or basic morality). This is just another way to avoid facing up to the mistakes of the past, and conveniently using a FOIA lawsuit as a method for making sure this information remains in the dark.

Filed Under: dianne feinstein, doj, foia, loretta lynch, richard burr, senate intelligence committee, torture report

Senate Intelligence Committee Forced To Drop 'Terrorist-Activity' Reporting Requirements For Social Media Platforms

from the play-nice-with-the-private-sector-or-the-NSA-has-to-work-for-free dept

Less than three months after announcing it was considering turning major social media platforms into unpaid government informants, the Senate Intelligence Committee is dropping its proposed requirement that Facebook, Twitter, etc. report "terrorist activity" to designated agencies.

Well, "dropping" is the polite phrasing. It's actually been forced to give up this demand (by one of the more rational members of the SIC, Ron Wyden) to ensure it gets its intelligence funding bill passed. As Wyden points out, social media entities should be in the business of social media, not acting as under-equipped stand-ins for law enforcement and intelligence agencies.

“Going after terrorist recruitment and activity online is a serious mission that demands a serous response from our law enforcement and intelligence agencies,” Wyden said in a statement, adding that he will now allow a vote on the intelligence bill. “Social media companies aren't qualified to judge which posts amount to ‘terrorist activity,’ and they shouldn’t be forced against their will to create a Facebook Bureau of Investigations to police their users’ speech.”

The government is rightfully concerned about the use of social media by terrorist groups, but the solution isn't to deploy private companies as ad hoc intelligence operatives. A majority of major social platforms already police their networks for inappropriate content -- which includes obvious terrorist-related postings -- and report these to appropriate authorities. The half-assed directive proposed by Sen. Feinstein would have been, at best, redundant. It would have applied only to social media platforms that already policed their own networks for this content. It would not have forced new entrants into the market to comply with the reporting requirements.

Despite its apparent death, Senator Feinstein still believes the redundant/useless directive is still the right thing to do.

“Sen. Feinstein still believes it’s important to block terrorists’ use of social media to recruit and incite violence and will continue to work on achieving that goal,” Mentzer emphasized.

It should be noted that blocking is a far more severe action than removal and reporting. This wasn't how the proposal was pitched ("“a… low burden” to companies, who would have to report only activity that has been reported to them…). Feinstein's post-defeat statements have exposed her ultimate goal for this directive: an attack on free speech disguised as a minimal burden, and one that once again would displace civil liberties to make room for more (national) security.

Filed Under: dianne feinstein, intelligence authorization, ron wyden, senate intelligence committee, social media, terrorist reporting

Ridiculous 'Terrorist Reporting' Provision In Intelligence Authorization Would Undermine The First Amendment

from the don't-let-it-pass dept

A few weeks ago, we wrote about a troubling provision that the Senate Intelligence Committee had inserted into this year's intelligence authorization bill, which would require social networks to report to the government any "terrorist activity" they see on their systems. As we noted, this has all sorts of problems, and seems more designed to (1) generate headlines and (2) chill free speech than do anything useful. Thankfully, Senator Ron Wyden has put a hold on the bill specifically over this provision.

“There is no question that tracking terrorist activity and preventing online terrorist recruitment should be top priorities for law enforcement and intelligence agencies,” Wyden said, in a statement for the record today. “But I haven’t yet heard any law enforcement or intelligence agencies suggest that this provision will actually help catch terrorists, and I take the concerns that have been raised about its breadth and vagueness seriously.”

“Internet companies should not be subject to broad requirements to police the speech of their users,”Wyden continued.

But the issue goes even deeper than that. As Markham Erickson has written, there are significant free speech concerns raised by this provision, in large part because "terrorist activity" is not defined at all. Anywhere. It's just this vague term -- and given that companies may face liability for not reporting "terrorist activity" to the government, you can bet an awful lot of perfectly fine and protected speech is going to get reported. And that's worrisome.

A key problem with Section 603, however, is that the trigger for the reporting mandate is based on the vague and undefined term “terrorist activity.” This term is not a term of art in the US criminal code and arguably goes well beyond criminal activity to speech that is protected under the First Amendment.

Erickson also points out that the comparison that supporters have made of this bill to one that requires companies to report child porn, is that child porn is "per se unlawful and never protected speech" under the US Constitution. But "terrorist activity" is just vague.

The NCMEC reporting obligations, however, relate to images that are per se unlawful and are never protected speech under the US Constitution. A government mandate that an Internet company report facts and circumstances connected to the vague and overbroad term “terrorist activity” certainly would result in overbroad reporting to the government of speech that is protected under the First Amendment.

And, on top of that, this move would give other countries a blueprint for how to demand tech companies hand over information on users:

More troubling, if adopted, the provision would serve as a global template for other countries to impose reporting requirements for activities those jurisdictions deem unlawful. This would be particularly problematic with countries that regulate speech, including political speech, and with authoritarian regimes that would demand that Internet companies police their citizens’ activities.

And, finally, as noted, with such a vague term, and the threat of serious liability, companies are going to be pressured into serious over-reporting:

Section 603 also creates a practical compliance problem. Because no one knows the definition of “terrorist activity,” how does one counsel a client to establish a compliance protocol under the proposal?

Any company would be at risk that if it did not report “terrorist activity,” it could be liable if there were a subsequent event that resulted in loss of life, limb, or property. Likely, this would result in designing a protocol to over-report anything that could be considered “terrorist activity.” Given the massive scale of content shared and created on the Internet daily, this would result in reporting of items that are not likely to be of material concern to public safety and would create a “needle in the haystack” problem for law enforcement. This serves no one’s purposes and adds privacy concerns to the First Amendment concerns noted above.

This creates a perverse incentive for a company to avoid obtaining knowledge of any activity that would trigger the reporting requirement—the exact opposite of what the proponents of the legislation want. Yet, designing such an avoidance protocol is nearly impossible. If even one low-level employee received an over-the-transom email about a “terrorist activity,” knowledge of the activity can be imputed to the entire company – exacerbating the potential liability faced by an Internet company.

Of course, these days, it seems like most in the Senate go by headlines rather than actual understanding of the issues. Hopefully, at least this one time, they'll actually listen to Senator Wyden.

Filed Under: chilling effects, free speech, intelligence rauthorization, monitoring, ron wyden, senate intelligence committee, social media, terrorist activity

FBI's James Comey: I Know All The Experts Insist Backdooring Encryption Is A Bad Idea, But Maybe It's Because They Haven't Really Tried

from the that's-the-spirit dept

As was widely expected, FBI Director James Comey appeared before two separate Senate Committees yesterday -- the Judiciary and the Intelligence Committees -- to talk about the "risks" of "going dark" if the government is not allowed to backdoor encryption. You can watch the Judiciary Committee hearing and the Intelligence Committee hearing at those two links. I'd embed the videos here on Techdirt as well, but I can't because (guess what?) neither offers an encrypted HTTPS version, so they wouldn't appear on our site, since we force HTTPS connections.

Most of Comey's comments were pretty much what you'd expect him to say, with a few clear themes repeated over and over again:

• American ingenuity is great, so I don't really believe all these computer science experts who say that it's "too hard" to give the government access. I think they haven't really tried.
• I don't have a proposal myself (which experts would ridicule for the problems it would create), but rather I'm just trying to "start a conversation" on this.
• We have no data to actually support the fact that encrypted communication has become a real problem, but I can tell you scary stories about (boo!) ISIS.

That was about the crux of it. There were a few times where he would kind of admit that maybe, just maybe the computer scientists were right, but he still thinks they could try harder. The most ridiculous was where he literally said:

"Maybe the scientists are right. But, I’m not willing to give up on that yet."

Earlier in that same hearing, he said:

"A whole lot of good people have said it’s too hard … maybe that's so.... But my reaction to that is: I’m not sure they’ve really tried."

There are a few problems with all of this. First, he keeps claiming that people are saying it's "too hard." But they're not. They're saying it's impossible to give him what he wants without seriously undermining the basic foundations of private communications online. And that's not just private communications in the form of messaging, but also financial transactions, medical records, business dealings and the like. In short, the "solution" the FBI wants puts everyone at risk.

The second big problem is that it's fairly stunning that Comey keeps insisting that those bright minds in Silicon Valley can sprinkle some magic pixie dust and give him what he wants, but at the same time claims it's too difficult for the FBI to actually quantify how big a problem encryption is for its investigations. Furthermore, he can't even provide a single real world example for where encryption has been a real problem. Even when pushed on this, he noted that when the FBI comes across encrypted communications, they move on to other avenues to investigate those individuals. Which sounds a lot like encryption really isn't that big of a problem.

The lack of an actual proposal, and the idea that he's just "starting a conversation" is equally ridiculous, since this conversation was conducted twenty years ago and it was shown what a bad idea it was to backdoor encryption. The idea that we need to do this all over again is just stupid.

Two other quick comments: A few times Comey noted that some big companies are able to encrypt data, but still get access to the underlying content. He used this to argue that it's "possible." But he leaves out the fact that those are not end-to-end encryption, but something different entirely which is much less secure than end-to-end encryption. He's comparing two very different things without recognizing the massive trade off in security associated with what he's talking about. His technical ignorance -- which he underlined multiple times, is kind of bizarre. If he admits he's so ignorant, why does he brush off the arguments from people who have been in this field working on these issues for decades.

The other comment: multiple times he and some of the Senators hinted that the FBI actually stopped some sort of nefarious plot that was supposed to happen on July 4th weekend. As we noted, despite lots of hype on cable news, the FBI has been making these kinds of failed predictions ever since 9/11 without a single one turning out to be accurate. So it seemed curious that he and others kept hinting at the idea that the FBI had to work overtime last week to actually stop an attack. If true, then you'd think there would be an arrest somewhere, but nothing appears to have been announced. It seems likely that this was just more FUD, but we'll be curious to see if the FBI ever explains something that it actually did to prevent a real attack.

We'll likely have a few more posts about some of what was discussed at the hearing a little later. But it's not just troubling that Director Comey is pushing for efforts to backdoor encryption, he's wasting the time of lots and lots of smart people who should be focusing on making our communications more secure, rather than proving to Comey and elected officials how ridiculously short-sighted it is to make communications less secure.

Filed Under: backdoors, encryption, experts, james comey, security, senate intelligence committee, senate judiciary committee

Senate Intel Committee Wants Facebook, Twitter & YouTube To Report 'Terrorist-Related' Content

from the NSA:-Home-Version dept

Well, we finally received some surveillance reform with the passage of the USA Freedom Act, which, even with its built-in six-month waiting period is still more surveillance reform than we've seen in the past thirty years. So, of course, the intelligence "community" is seeking to counterbalance its "losses" with gains from the private sector. Self-spying will have to replace government spying, if we're expected to run a secure nation.

Social media sites such as Twitter and YouTube would be required to report videos and other content posted by suspected terrorists to federal authorities under legislation approved this past week by the Senate Intelligence Committee.

The measure, contained in the 2016 intelligence authorization, which still has to be voted on by the full Senate, is an effort to help intelligence and law enforcement officials detect threats from the Islamic State and other terrorist groups.

But there is a silver lining, although it makes absolutely no sense.

It would not require companies to monitor their sites if they do not already do so, said a committee aide…

So… to better secure the nation, companies that already do this thing would be forced to continue doing this thing, even though they've had no problem doing so voluntarily. Those who don't wish to do this won't be forced to do it. The only change then would be the "reporting" aspect, which I imagine is also already in place for most of those voluntarily removing terrorist-related content.

The Senate Intelligence Committee is wasting tax dollars on redundancy, and not the good kind of redundancy that keeps government entities from permanently destroying public records. This is the bad kind of redundancy that is "fighting terrorism" by telling companies to do the thing they already do, unless they don't, in which case, never mind.

The government isn't out of stupid, though.

Although officials are generally pleased to see such accounts taken down, they also worry that threats might go unnoticed.

“In our discussions with parts of the executive branch, they said there have been cases where there have been posts of one sort or another taken down” that might have been useful to know about, the aide said.

On one hand, the government complains that leaving the content up could result in "radicalization" of the few citizens that haven't already been swept up by the FBI's Radicalization Program. On the other, it complains that taking the content down makes it harder to keep an eye on those radicalizing potential terrorists. Its solution is to act like the Internet's Recyle Bin. Toss your terrorist posts here so we can browse them before deletion.

Service providers and tech companies are calling it a violation of users' privacy and state that additional monitoring and adding another step in the takedown process will be technically difficult. National security experts, however, aren't nearly as concerned about privacy violations or technical hurdles. National security is the priority. Everything else is just extraneous noise.

“In a core set of cases, when companies are made aware [of terrorist content], there is real value to security, and potentially even to the companies’ reputation,” said Michael Leiter, a former director of the National Counterterrorism Center, now an executive vice president with Leidos, a national security contractor. “Rules like this always implicate complex First Amendment and corporate interests. But ultimately this is a higher-tech version of ‘See something, say something.’ And in that sense, I believe that there is value.”

The technical problems are skirted completely and the tiny nod towards citizens' privacy is swallowed up by "see something, say something" and "value." Intelligence at any cost -- especially if the majority of the cost is absorbed by civil liberties and the private sector.

This casual dismissal of concerns is unsightly. Here's a Senate Intelligence Committee aide also lowballing the cost to people's rights and tech companies' bottom lines:

The committee aide said the measure presents “a pretty low burden” to companies, who would have to report only activity that has been reported to them. “We have heard from federal law enforcement that it would be useful to have this kind of information,” he said.

Basically, it's the same non-argument Michael Leiter makes: "value" and "use" to government agencies is really the only thing that matters. These other concerns aren't even worthy of a thoughtful response.

It's highly discouraging to see that the same mentality prevails despite nearly two years of damaging (to the intelligence community's public reputation, not its actual capabilities) leaks. These reps of the intel world can't even be bothered to sincerely address the public's concerns. All they can think about is how "useful" this would be to them.

And so, they've put together a half-assed law (in response to a Facebook-"enabled" terrorist attack) that can't even be bothered to enforce the strengths of their very minimal convictions. It's almost as though the intelligence community said, "This would be kind of nice to have. Why don't you guys see if you can get that for us?" If the community truly felt this information was "valuable" and "useful," the proposed law would demand that all companies comply, rather than limiting it to those who voluntarily police their platforms. But it doesn't. It just asks for some companies to do what they already do and for others to add them to the "reported posts" mailing list. It's nothing more than an attempt to create informal government informants with the added bonus of turning voluntary actions into mandatory requirements.

Filed Under: monitoring, reporting, senate intelligence committee, social media, terrorism, user generated content
Companies: facebook, twitter, youtube

The Exposure Of CIA Torture Is Finally Costing Someone A Job: Former Senate Staffer Alissa Starzak

from the halls-of-power-still-clogged-with-assholes,-apparently dept

Oh, good. As if there was ever any doubt that the exposure of CIA torture was never going to result in anyone involved being held responsible, the current push to knock a former Senate staffer off her career path further confirms the government's preference for shooting messengers.

Alissa Starzak, a former Democratic majority staffer on the Senate Intelligence Committee, played a critical and controversial role during her time on the panel: She was a lead investigator for the torture report, and was one of two staffers involved in an ongoing feud over damning internal CIA documents obtained by the committee.

Currently serving as deputy general counsel for the Defense Department, Starzak was nominated last July to serve as general counsel to the Army.

But the critics of the torture investigation -- namely, Senate Intelligence Committee Chair Richard Burr (R-N.C.) -- are orchestrating a quiet campaign to stall Starzak's nomination.

Burr confirmed to The Huffington Post that he is working to keep the former investigator from getting approved by the Senate.

This would be the same Richard Burr who ridiculously demanded everyone in possession of the full, unredacted CIA Torture Report return their copies immediately, presumably so he could memory-hole the damning documents as quickly as possible.

So, while everyone else involved walks away with their careers pretty much intact -- and covered by the president's mawkishly-worded admission that "we tortured some folks" -- Starzak will be about the only person to emerge from this horrific debacle with her options limited.

The Senate Intelligence Committee is divided against itself. Feinstein tackled the CIA's torture programs, facing down fellow committee members while doing so. Since Burr can't hang Feinstein -- largely because she's still a very hawkish on NSA surveillance -- he's just going to fit Starzak with a noose and hang Feinstein in effigy.

Starzak wasn't involved with the torture review for long, leaving Feinstein's staff for a job with the Department of Defense in 2011, but she managed to secure a key document that served as a touchstone for future Senate investigative work. While digging through the documents the CIA allowed the Senate to access on its computers in the agency's basement, she came across the files later known as the "Panetta Review." At the time (2010), they seemed unimportant. It wasn't until the CIA began defending itself against claims made in review drafts that Senate staffers realized how instrumental this file was.

It was in June 2013 that the CIA, now under the leadership of John Brennan, sent the committee its official response to the completed torture study. The agency largely defended its use of torture -- in stark contrast with what the Panetta Review said -- which tipped Senate staffers off to the document’s importance.

After the CIA issued its response, Senate investigators sat through dozens of hours of meetings with agency staff in an effort to resolve the discrepancies between the official CIA line and the Senate’s findings. But those meetings yielded little. Newly aware of the relevance of the Panetta Review -- as it backed their findings and undermined the agency’s official response -- staffers slipped the document back to their secure committee spaces sometime in late 2013.

This move led to CIA claims that the Senate had improperly accessed documents… which led to the Senate accusing the CIA of spying on staffers. This finally resulted in CIA opening its own investigation into the Senate allegations and (of course) clearing itself of any wrongdoing, while raising new accusations about Senate staffers' improper access.

So, while CIA, DOJ and administration officials are free to duck questions about their involvement in the approval (either explicit or tacit) of the CIA's torture programs, Burr and others are holding Starzak's future hostage until she answers for this supposed improper behavior.

Critics are now holding up Starzak’s nomination -- and say they are willing to kill it entirely if need be -- to get more answers about the Panetta Review. Specifically, they say, they want the committee’s Democratic staffers to provide more information about how the file was discovered in 2010 and how, in late 2013, staffers slipped the printed documents back to the committee’s secure office spaces, in apparent violation of an agreement with the agency.

“Clearly it looks like … [she] knew that this document existed, knew that people were reading it and as a counsel didn’t try to keep people from doing it,” the lawmaker familiar with the controversy said. “[I want] information that fills in the blanks of what happened. And she clearly knows something.”

It's nothing but thug tactics, wrapped in the faux concern for an intelligence agency's operational security. Burr is irritated that Senate staffers didn't play by the CIA's self-serving ruleset -- not because rules mean much to him, but because it resulted in the exposure of truly vile behavior from officials and operatives Burr routinely defends. And he's willing to let the record show that he prefers punishing those who expose torture to punishing the torturers themselves.

Filed Under: alissa starzak, cia, cia torture, dianne feinstein, panetta review, richard burr, senate, senate intelligence committee, torture report

Senate Intelligence Committee Finally Decides That Maybe It Should Figure Out What The Intelligence Community Is Up To

from the seems-a-bit-late-for-that dept

Both houses of Congress set up their respective "Select Committees on Intelligence" in the mid-1970s as basically permanent extensions of the Church and Pike Committees that dug into widespread abuses of the US intelligence community in the preceding decades. The idea was that by creating permanent oversight committees, it would prevent the kinds of abuses that were commonly done by the FBI, NSA and CIA. And yet, as we've noted many times, the intelligence committees don't seem to function as an oversight committee these days. Rather, they seem to be the committee designed to whitewash any abuses and to help the intelligence communities give a false veneer of legitimacy to their widespread abuses.

Just to put an exclamation point on the lack of real oversight, the Associated Press is now reporting that, in the wake of the Snowden revelations, then Senate Intelligence Committee boss (now "ranking member"), Dianne Feinstein, asked the committee to create a "secret encyclopedia" of all the various intelligence programs, because members and staffers apparently hadn't been keeping track:

Trying to get a handle on hundreds of sensitive, closely held surveillance programs, a Senate committee is compiling a secret encyclopedia of American intelligence collection. It’s part of an effort to improve congressional oversight of the government’s sprawling global spying effort.

Sen. Dianne Feinstein launched the review in October 2013, after a leak by former National Security Agency systems administrator Edward Snowden disclosed that the NSA had been eavesdropping on German Chancellor Angela Merkel’s cellphone. Four months earlier, Snowden had revealed the existence of other programs that vacuumed up Americans’ and foreigners’ phone call records and electronic communications.

“We’re trying right now to look at every intelligence program,” Feinstein told the Associated Press. “There are hundreds of programs we have found ... sprinkled all over. Many people in the departments don’t even know (they) are going on.”

Later in the article, Feinstein admits that the committee had not been "satisfactorily informed" about certain surveillance programs.

In other words, the committee clearly hasn't been doing much "oversight." Part of the problem is that so much of the work done by the intelligence community actually falls under executive order 12333. That's the executive order issued by Reagan under which most of the key intelligence programs fall -- and which Congress technically has no oversight mandate.

If the program started back in 2013, why is it only coming out now? Well, because with the changing of the guard in the latest Congress, Senator Richard Burr took over the Senate Intelligence Committee leadership, and he's even more of an intelligence community defender than Feinstein ever was. In the past, he's even argued that there should be no public hearings by the committee, and he's basically fought against any effort for transparency, and always sides with the intelligence community. Given that, many expected him to just kill off Feinstein's attempt at cataloging these programs -- but apparently Burr and Feinstein worked out "a deal" to continue -- but it appears that the "deal" also involves ending this effort by September, and no longer using two staffers from the executive branch who were familiar with these programs:

Feinstein, a California Democrat, initially wasn’t sure that Sen. Richard Burr of North Carolina, who took her place as chairman of the panel when Republicans took control of the Senate in January, would agree to continue the review. But Burr and Feinstein recently reached an agreement to do so, said Senate aides. They were not authorized to discuss the inner committee workings publicly and spoke only on condition of anonymity.

Two executive branch officials who had been detailed to the committee are returning to the executive branch and will not be replaced, the aides said, so the effort will be entirely the work of congressional staff. The project will end in September, the aides said.

Of course, for the past few years, Feinstein had insisted that the Committee was fully informed -- and only now it's coming out that she admits they weren't really. Except, now the committee is controlled by someone who is even more in the bag for the intelligence community than she was. Does anyone honestly think that the intelligence committees will now suddenly start doing a better job keeping the rest of Congress informed about what the intelligence community is up to?

Filed Under: dianne feinstein, executive order 12333, oversight, richard burr, senate, senate intelligence committee, surveillance