House Oversight Head Still Concerned Surveillance He Approves Of Is Being Used Against His Party

from the eyerolling-intensifies dept

House Intelligence Committee chairman Devin Nunes is at it again. After years of unwavering support for NSA surveillance programs -- a one-man booster club operating from inside an oversight committee -- Nunes is now starting to find things he doesn't like about NSA surveillance.

It escalated a few months ago when he was "shocked" to learn NSA surveillance grabs communications between world governments and may have been used to listen in on short-lived National Security Advisor Mike Flynn's conversations with Russian officials.

Nunes' hypocrisy continued when he demanded answers about surveillance activities under Executive Order 12333 -- again in relation to possible surveillance of public officials he liked and supported. Nunes should already have known most of the answers to these questions. After all, he heads a surveillance oversight committee. But he didn't because he's spent most of his tenure with the oversight committee arguing there should be less oversight of Section 702/Executive Order 12333 surveillance programs.

Nunes still won't let it go. He's fired off yet another letter demanding answers about surveillance, this time to new Director of National Intelligence Dan Coats. This time, he's looking to pin surveillance of Trump appointees on the outgoing president -- as if nothing of the sort continues today.

The chairman of the House Intelligence Committee is accusing top political aides of President Obama of making hundreds of requests during the 2016 presidential race to unmask the names of Americans in intelligence reports, including Trump transition officials.

Intelligence Chairman Devin Nunes (R-Calif.), in a letter to Director of National Intelligence Dan Coats, said the requests were made without specific justifications on why the information was needed.

“We have found evidence that current and former government officials had easy access to U.S. person information and that it is possible that they used this information to achieve partisan political purposes, including the selective, anonymous leaking of such information,” Nunes wrote in the letter to Coats.

Nunes claims documents show "hundreds" of unmaskings were performed by Obama aides, giving the former president (and others) access to unminimized intel acquired by the NSA. Whether or not this was justified in every case, the unmasking of officials engaged in conversations with foreign officials is something that happens quite frequently, as this step is needed to provide context for the gathered intel.

The fact that a great number of people in the White House can request unmasking is still a concern, as is the loosening of restrictions on dissemination of unminimized intel Obama put into place right before he left office. The problem here is Nunes is on the wrong side of whatever history's being made here. His NIMBY attitude is particularly grating after years of arguing for greater surveillance powers and less oversight.

If there's any good that will come of this, it might be the belated recognition that these powers are dangerous if abused -- and that if you don't want your political opponents to have them, maybe you'd better do more to limit them while you still have control of the White House.

Filed Under: devin nunes, nsa, section 702, surveillance

2013 Authority Expansion Means A Whole Lot Of People On Capitol Hill Can View Unminimized NSA Collections

from the little-bit-of-comms-dirt-on-everyone dept

The unmasking rules House Intelligence Chair Devin Nunes has been (somewhat disingenuously) complaining about have been around for a few years now. Normally, US persons' identities are minimized before government officials can view intel gathered by the NSA. But in cases where it might be necessary to provide context, the White House can ask for the identities to be unmasked.

This has turned into a mini-firestorm on Capitol Hill, with Nunes striking most of the matches. The problem is Nunes should be aware of these rules, as he's in charge of the intelligence oversight committee. He apparently doesn't, or at least wasn't aware how many people can actually ask for US persons to be unmasked.

The loosening of these restrictions traces back to Obama's second term, as John Solomon of The Hill points out.

Procedures issued by Director of National Intelligence James Clapper in March 2013 formally supplanted a 1992 set of rules that made the dissemination of names of intercepted lawmakers or congressional aides an act of last resort.

The new standard allowed for a lawmaker’s or staffer’s name to be unmasked if “an executive branch recipient of intelligence” believed that learning “the identity of the Member of Congress or the Congressional staff is necessary to understand and assess the associated intelligence and further a lawful activity of the recipient agency,” according to a memo released earlier this month by the DNI's office with little public fanfare.

The unmasking standard has become less of a "standard" as the years have passed, according to this report by The Hill. All the way back in the mid-90's, the rules allowed only one person to sign off on unmasking: the head of the CIA. And this could only be done as a last resort -- if context for the intercepted communications could not be "satisfied in any other fashion."

Since then, there's been nothing but slippage. Now it's not only legislators that can request unmasking, but also their staffers as well, meaning there are potentially hundreds of people with the power to view unminimized NSA intel. (This doesn't even include those on the downstream side of this surveillance: at least 16 federal agencies now have access to unminimized intel.)

Now that the Director of National Intelligence has replaced the CIA Director at the top of the unmasking organizational chart -- something that happened in 2005 -- the rules have been relaxing continuously. In fact, the latest version, which does away with the "as a last resort language," was written into force by James Clapper's office, which saw it as nothing more than a codification of practices the intel community was already engaged in.

(DNI Counsel Bob) Litt said by the time he drafted the 2013 rules, he did not believe he was changing policy, because the procedures had been evolving for years.

“We believed we were formalizing simply what we had inherited,” he explained.

It hasn't slid so far that the exception has become the rule, but unmaskings are becoming far more routine. What used to be limited to a handful of times a year has now become a monthly occurrence. Hence the outrage from members of Congress, which should be viewed a bit skeptically, given they also have the power to perform unmaskings and their outrage tends to adhere to party lines.

The Trump administration has signed off on the 2013 rule change, indicating it feels there's nothing wrong with the status quo. That makes Devin Nunes' demands for answers that much more suspect, as he seems to be motivated more by the fact the rule change resulted in the ousting of short-lived National Security Advisor Mike Flynn (and assisting with the ongoing investigations into the administration's ties to Russia) than any general sense of Constitutional wrongness.

This is a problem. Most requests for unmasking will eventually route through the Director of National Intelligence, but the bar has been lowered, both in terms of when requests can be made, but also by who. Most of the attention is being paid to the unmasking of communications between government officials, but it's also normal, everyday Americans who are being subjected to lower privacy expectations as time goes on. As we head towards the renewal process for Section 702 collections, this is one of the areas Congress should spend some time discussing seriously. If nothing else, it gives lawmakers an opportunity to roll back some of the mission creep.

Filed Under: devin nunes, james clapper, minimization, nsa, surveillance, unmasking

Released Documents Show More Section 702 Violations By The NSA

from the wherein-NSA-PR-does-more-minimization-than-NSA-analysts dept

Always lawful and subject to strict oversight. Those are the NSA's defenses any time someone leaks something about its surveillance programs or obtains documents indicating abuse of snooping powers. It gets a little old when it's document after document showing the astonishing breadth of the NSA's surveillance programs or the continual abuse and misuse of these powers.

The Hill has dug through some recently-released documents and memos from the NSA which show long-term abuse of surveillance programs. The NSA recently ditched part of its Section 702 collection because it just couldn't stop hoovering up Americans' communications. This was "incidental," according to the NSA, and supposedly impossible to stop. But the incidents detailed in these documents suggest a lot of over-collection happened because no one noticed and, if anyone did, no one cared.

They detail specific violations that the NSA or FBI disclosed to the Foreign Intelligence Surveillance Court or the Justice Department's national security division during President Obama’s tenure between 2009 and 2016. The intelligence community isn't due to report on compliance issues for 2017, the first year under the Trump administration, until next spring.

The NSA says that the missteps amount to a small number — less than 1 percent — when compared to the hundreds of thousands of specific phone numbers and email addresses the agencies intercepted through the so-called Section 702 warrantless spying program created by Congress in late 2008.

This is about the only place where any American can become part of the "one percent:" as the unwitting subject of NSA surveillance. NSA spokesman Michael Halbig says evidence of misuse is a sign the oversight is working. But oversight is also supposed to aid in prevention, not just detection of past misuse. And the NSA's internal oversight isn't nearly as "robust" as Halbig attempts to portray it.

The Hill reviewed the new ACLU documents as well as compliance memos released by the NSA inspector general and identified more than 90 incidents where violations specifically cited an impact on Americans. Many incidents involved multiple persons, multiple violations or extended periods of time.

For instance, the government admitted improperly searching the NSA’s foreign intercept data on multiple occasions, including one instance in which an analyst ran the same search query about an American “every work day” for a period between 2013 and 2014.

The NSA also passed on intel to the FBI and CIA without properly minimizing it and made other dissemination errors. The documents show the NSA was also slow to inform other agencies of its minimization failures. Notification is supposed to made within five days of discovery, but in some cases it took the NSA more than three months to inform intel recipients of the error.

This information has been released at a critical time for the NSA. Section 702 powers are sunsetting this year and could be subject to additional modifications prior to their renewal. The FBI --perhaps even more than the NSA -- is looking for a clean reauthorization of Section 702 programs. This administration favors a clean re-auth, which means complaints about a 1% violation rate aren't likely to change anyone's mind. But 1% of several hundred million yearly searches is still a very large number of violations. If Google or Microsoft suffered a breach affecting the privacy of 1% of its users, it would be a huge problem even if the number of affected accounts amounted to a rounding error.

Former House Intelligence Committee Chair Pete Hoekstra -- a former surveillance state cheerleader -- now worries the NSA's collection powers have increased far past the point of reason. As he points, 1% simply isn't an acceptable failure rate.

“One percent or less sounds great, but the truth is 1 percent of my credit card charges don’t come back wrong every month. And in my mind one percent is pretty sloppy when it can impact Americans’ privacy.”

Filed Under: abuse, nsa, privacy, section 702, surveillance

All Quiet On The Tech Front As The Clock Ticks Down On Section 702 Renewal

from the a-little-help? dept

Things have been mostly quiet as Congress heads towards the possible renewal of Section 702 surveillance powers. The NSA, oddly, made the most noise by dropping its "about" collection because it simply couldn't (or wouldn't) stop harvesting US persons' communications. As usual, privacy activists are sounding the alarm but the general level of noise at the Congressional level is nothing compared to the runup to Section 215's renewal.

Quieter is better for the Trump administration, which has already expressed its desire for a clean reauthorization. There are plenty of surveillance hawks who would rather no one messed with the approval process and a few of those have the power to stonewall any legislative reforms that might make their way to the House or Senate in the coming months.

But the noisiest silence is emanating from the tech sector, whose platforms and services are integral to the NSA's harvesting of internet communications and data.

Facebook, Alphabet's Google, Apple and other major technology firms are largely absent from a debate over the renewal of a broad U.S. internet surveillance law, weakening prospects for privacy reforms that would further protect customer data, according to sources familiar with the matter.

While tech companies often lobby Washington on privacy issues, the major firms have been hesitant to enter a fray over a controversial portion of the Foreign Intelligence Surveillance Act (FISA), industry lobbyists, congressional aides and civil liberties advocates said.

Some of this could be due to the fact that some surveillance activities happen without any direct assistance from these companies. The NSA also pulls communications from internet backbones and taps on transatlantic cables. Speaking up against this surveillance may subject companies to additional demands, rather than allow them to go comparatively unmolested.

Other contributing factors are mostly business-related. Interfering with collections (or their authority) may make the worldwide transmission of internet communications a bit more hazardous, especially if the NSA's collections run afoul of foreign privacy laws.

The companies' relative inactivity is explained by several legal challenges in Europe to an agreement between the United States and the European Union, known as the Privacy Shield, the sources said. The litigation hinges on whether U.S. surveillance practices afford enough privacy safeguards. A coalition of human rights organizations has urged Europe to suspend Privacy Shield unless Section 702 is substantially reformed.

U.S. technology companies have privately bristled at those efforts, three industry lobbyists [said], in part because expectations that 702 reforms will pass Congress are low.

"If you link them and you lose one, you lose both," said one of the lobbyists, who like the others requested anonymity to discuss private conversations with technology companies.

Rather than step into the fight, tech companies are on the sideline, holding their collective breaths. The chances of serious reform are minimal, what with the President preferring a clean re-auth. If the European Union decides the United States isn't taking foreigners' privacy seriously, it may act to block collections by booting American tech companies out or requiring sequestered servers that can't be reached by American surveillance efforts.

Obviously, neither outcome works for the NSA either. It needs as much cooperation as possible from foreign partners in order to elude privacy protections the US extends to other nations' citizens. Casting its net in international waters muddies jurisdictions, as do information-routing efforts like Google's that send communications from server to server based on efficiency, rather than country of origin. Relying on foreign intelligence agencies' intercepts also helps both partners evade local restrictions.

The Fortune article also notes there's a distinct lack of clarity to the Section 702 debate at this point, one that doesn't encourage any company to open its mouth when there's billions of dollars of services on the line. Some privacy activists hope this changes as the debate moves forward, but considering the programs aren't directly affecting Americans (unlike Section 230's domestic collections), it's a harder sell. No one is asking for the collections authorized by this statute to be shut down completely. Even ardent privacy activists admit the programs are more targeted and more respectful of Americans' privacy. The problems lie in its oversight, of which there is very little, and other authorities (Executive Order 12333, for one) that aren't open to debate or periodic renewals.

Despite these possible explanations, the silence isn't exactly heartening. Tech companies made plenty of noise when the Snowden leaks hit, exposing multiple programs that gathered communications from international cables and service providers. But they've said little since, at least in terms of Section 702 programs. Many are fighting for users' privacy in court, but those efforts deal with demands from law enforcement, rather than surveillance programs that bypass regular courts completely. If the level of noise doesn't increase in the next few months, it will probably be safe to assume the companies are more interested in salvaging European relationships than possibly upsetting the NSA's Section 702 apple cart.

Filed Under: nsa, privacy shield, section 702, surveillance, tech

Senator Wyden Wants To Know How Many Times Americans Have Been Targeted By Executive Order 12333

from the am-I-free-to-know-am-I-free-to-know-am-I-free-to-know-am-I-free-to-know-am-I-fre dept

That buzzing noise that never seems to leave the Intelligence Community's ears is Sen. Ron Wyden. Wyden's questions -- often unanswered -- are dog whistles for privacy advocates but ear-bleeding tinnitus for agency officials. Persistence is key in Congressional oversight and few are better at it than Wyden is.

For years, Wyden has been asking how many Americans have been hauled in by the NSA's Section 702 dragnet. And for years, the NSA and ODNI have sidestepped the question. The surveillance bosses got close to returning an answer -- right before they announced they were shutting down the collection that netted the most Americans.

Right before Trump was elected, James Clapper finally said he'd cough up the numbers. But with the regime change, the promise is no longer a promise. The NSA may try to keep this buried, using time and distance from the abruptly-abandoned "about" collection to stiff-arm additional requests for domestic surveillance data.

Ever persistent, Wyden has returned with another set of questions [PDF] regarding NSA surveillance. This one pertains to the least-discussed surveillance authorization and the one almost everyone -- including members of oversight committees -- knows nearly nothing about: Executive Order 12333.

Like Section 702, there's a good probability intelligence gathered under this authority is being used by domestic agencies. Backdoor searches of NSA intel have been unofficial common knowledge for years now, so there's very little reason to believe the NSA's most mysterious authority doesn't have its own built-in peepholes for the FBI and other federal agencies.

Wyden is asking for details on this authority, specifically the number of times it has been used to surveil Americans. As he points out, the order allows the deliberate targeting of American citizens with the Attorney General's approval.

Please provide the following information:

1. How many times, in each of the calendar years 2011-2016, has the Attorney General provided this approval?

2. Can the Intelligence Community conduct these searches "for the purpose of targeting a US. person or a person in the United States" without an individual warrant?

3. What limitations and approval requirements would apply to searches for communications that are reasonably likely to be to, from, or about a US. person or a person located in the United States if the purpose of the search is not to "target" that person?

That's the "what." Here's the "why:"

Concerns about warrantless "backdoor" searches for information about Americans are among the reasons I have repeatedly asked the Intelligence Community to publish an estimate of the number of Americans whose communications have been collected under Section 702 of the Foreign Intelligence Surveillance Act (FISA). Concerns about these searches under Section 702 are also why the Intelligence Community now publishes data on the number of these searches, with the notable exception of searches conducted by the FBI.

Executive Order 12333 poses similar, if not greater concerns, given the lack of public awareness of the breadth of that collection, extremely limited oversight, and the vagueness of the procedures governing collection and use. For these reasons, I believe the public has the right both to clarity with regard to those procedures and data related to the frequency with which Americans and individuals in the United States are the subject of these searches.

No sense holding your breath. As much as I appreciate Wyden's effort, the current administration firmly believes surveillance might makes right. The Intelligence Community has been so emboldened by the administration's lack of concern for civil liberties it's already asked to have the "about" collection -- which it shut down voluntarily so it could finally get 702 orders approved by the FISA court -- turned back on.

If any answers do appear, expect them to be vague and deliberately uninteresting. But at this point, it's probably less disappointing to just not expect them at all.

Filed Under: domestic surveillance, eo 12333, executive order 12333, nsa, odni, ron wyden, surveillance

NSA Continues To Dodge 'Incidental Collection' Question, Wants Its 'About' Surveillance Program Back

from the petition-to-return-status-to-quo dept

It's been six years since Senator Ron Wyden first asked the Director of National Intelligence how many Americans' communications are being swept up "incidentally" in the NSA's Section 702 surveillance net. Six years later, he still doesn't have an answer.

Section 702 is up for reauthorization at the end of the year and there's still no information coming from the ODNI [Office of the Director of National Intelligence]. A group of Congressional reps is hoping to pry this info loose before the reauth, but the DNI's been able to hold Wyden off for six years, so…

A U.S. congressional committee on Friday asked the Trump administration to disclose an estimate of the number of Americans whose digital communications are incidentally collected under foreign surveillance programs, according to a letter seen by Reuters.

Such an estimate is "crucial as we contemplate reauthorization," of parts of the Foreign Intelligence Surveillance Act that are due to expire at the end of the year, House Judiciary Committee Chairman Bob Goodlatte, a Republican, and John Conyers, the panel's top Democrat, wrote in a letter addressed to Director of National Intelligence Dan Coats.

The new wrinkle here is going above the head of the DNI and straight to the President. Not that this is any more likely to force a number out of the NSA. The president is all for a clean reauthorization and troubling numbers about "incidental" domestic surveillance will only make that more difficult.

In fact, the DNI's top lawyer just finished telling a Senate committee it won't be turning in its long-overdue homework.

The intelligence community will not produce that number, acting General Counsel for the Director of National Intelligence Bradley Brooker told the Senate Judiciary Committee on Tuesday. Producing the number would take too much time and effort and potentially violate Americans’ privacy in the process, Brooker said, echoing comments DNI Dan Coats made earlier this month. The resulting number might also not be very accurate, he said.

So, that's where this stands now. The DNI promised to pull something together as the previous president headed out the door, but appears to have abandoned its minimal stab at minimal transparency now that the guy up top isn't nearly as interested in curbing the NSA's powers.

Speaking of which, the ODNI is asking to have the "about" collection put back into play, just weeks after the NSA "voluntarily" gave it up.

The panel of intelligence leaders also urged Judiciary Committee members not to restrict so-called “about collection,” in which intelligence agencies collect information from people who are not intelligence targets but mention those targets in emails and text messages.

This would appear to be aimed at Senator Dianne Feinstein's call to codify the end of the "about" collection, which would prevent the NSA from re-implementing it down the road. We haven't even gotten down the road and IC leaders are already trying to rollback the NSA's rollback.

We'll see if this latest move by Congress has any effect. Six years of Ron Wyden (and others) hammering this same question hasn't moved us much closer to seeing how much purely domestic surveillance the NSA engages in. In recent dodges by the new DNI, Dan Coats (in response to Wyden's questions) suggests the NSA is doing far more domestic dabbling than has been disclosed by everyone but the DNI (leaked documents, FOIA'ed court opinions, etc.) These are answers the public needs to have, but they're especially essential to those who will be handling the Section 702 reauthorization. Failure to produce these numbers or answer questions directly should weigh against the sort of reauth the DNI is seeking.

Filed Under: 702, about collection, admiral mike rogers, dan coats, nsa, odni, seciton 702, surveillance

As A New Wave Of Cyberattacks Rolls Out, Rep. Ted Lieu Asks What The NSA's Going To Do About It

from the ETERNALPWNAGE dept

Leaked NSA exploits have now been the basis for two massive cyberattacks. The first -- Wannacry -- caught hospitals and other critical infrastructure across several nations in the crossfire, using a tool built on the NSA's ETERNALBLUE exploit backbone. The second seems to be targeting Ukraine, causing the same sort of havoc but with a couple of particularly nasty twists.

This one, called Petya, demanded ransom from victims. Things went from bad to worse when email provider Posteo shut down the attacker's account. Doing so prevented affected users from receiving decryption keys, even if they paid the ransom.

It soon became apparent it didn't matter what Posteo did, no matter how clueless or ill-advised. There was no retrieving files even if ransoms were paid. Two separate sets of security researchers examined the so-called ransomware and discovered Petya is actually a wiper. Once infected, victims' files are as good as gone. No amount of bitcoin is going to reverse the inevitable. The ransomware notices were only there to draw attention to the infection and away from the malware's true purpose.

Both cases are considered to be attacks by nation states. Inconsistently-applied patches -- most of them released with zero information by Microsoft -- have led to an insane amount of damage.

Through it all, the NSA -- whose tools were leaked -- has remained consistently silent. There's been no indication if the agency is working to mitigate the ongoing threat or whether it's far more concerned with discovering who left behind the malware toolkit first exposed by the ShadowBrokers.

It's unlikely we'll hear much being said publicly by the agency, but Rep. Ted Lieu has sent a letter to NSA chief Mike Rogers demanding answers. The letter [PDF] points out both attacks have been based on NSA exploits (ETERNALBLUE and ETERNALROMANCE). Lieu also states he fears the attacks seen in the past few weeks are only the "tip of the iceberg." The agency's refusal to discuss the attacks apparently isn't going to fly anymore.

Lieu makes two requests: the first is for the agency to see if it has some sort of magic "OFF" switch just laying around.

My first and urgent request is that if the NSA knows how to stop this global malware attack, or has information that can help step the attack, NSA should immediately disclose it. If the NSA has a kill switch for this new malware attack, the NSA should deploy it now.

It's far more likely the NSA has information it would rather not share than it is the agency has a way to shut down this attack, much less prevent future variations on its ETERNAL theme. But that's directly related to the second part of Lieu's request: work with companies whose software is being exploited to prevent further attacks. If the NSA still has security holes it's hoping won't be patched anytime soon, the current situation would seem to call for a rethink of its exploit-hoarding M.O.

What may be in order is the NSA stepping up and playing defense. It has stated a desire to be a larger cog in the US cyberwar machinery, but often seems more interested in playing offense than pitching in to help on the defensive end. That may need to change quickly if the NSA isn't going to be seen as more of a problem than a solution.

Filed Under: attacks, cyberattacks, exploits, leaks, nsa, ransomware, russia, ted lieu, ukraine, vulnerabilities, warfare

NSA Appears To Be Seducing Sen. John Cornyn With Personal Tours And One-On-One Meetings

from the 702-ways-to-leave-your-lover dept

One of the surveillance state's biggest cheerleaders is seeing his years of support pay off.

Two congressional sources confirmed a May meeting, where Sen. John Cornyn, (R-Tex.), a vocal supporter of the intelligence community, got a private audience with the NSA Director Adm. Michael Rogers.

Cornyn also got a private tour of the signals intelligence facility at Fort Meade, Maryland at the same time as the May meeting.

Officials "familiar with the situation" (possibly read "jealous as hell") expressed concern about Cornyn's personal NSA tour. And for good reason. If Rogers and other NSA officials were feeding Cornyn information the rest of the NSA's Congressional oversight isn't privy to, that's a problem. It's more of a problem as the date for Section 702's reauthorization approaches. And it seems even more problematic that Cornyn was given a personal walk-and-talk while oversight members were failing to get substantive answers from the DNI during a Senate hearing.

There's a long history of the IC playing favorites with oversight members (and vice versa) and a long history of those favorites withholding information from other members of Congress. This visit/personal chat may have been innocuous but given its context -- the Section 702 renewal -- it looks shady as hell.

The additional context is the DNI's office believes all is forgiven -- or at least, no longer relevant. Reversing Clapper's promise to hand in something on incidentally-collected US persons' communications, the new Director is saying that's just not going to happen.

The Foreign Policy article notes that it's common for incoming reps and senators to be given a tour and that oversight members routinely visit the NSA as part of their oversight duties, but this Cornyn-only event definitely appears to be the agency making a play for unbridled support from a powerful Senator.

Filed Under: admiral mike rogers, john cornyn, mass surveillance, nsa, oversight, section 702, surveillance

Oversight Report Shows NSA Failed To Secure Its Systems Following The Snowden Leaks

from the NSA-officials:-'feel-good-story-of-2015,-etc.' dept

It appears the NSA hasn't learned much since Ed Snowden left with several thousands of its super-secret documents. Agency officials were quick to claim the leaks would cause untold amounts of damage, but behind the scenes, not much was being done to make sure it didn't happen again.

A Defense Department Inspector General's report obtained via FOIA lawsuit by the New York Times shows the NSA fell short of several security goals in the post-Snowden cleanup. For an agency that was so concerned about being irreparably breached, the NSA still seems primed for more leakage. Charlie Savage reports:

The N.S.A. failed to consistently lock racks of servers storing highly classified data and to secure data center machine rooms, according to the report, an investigation by the Defense Department’s inspector general completed in 2016. The report was classified at the time and made public in redacted form this week in response to a Freedom of Information Act lawsuit by The New York Times.

The agency also failed to meaningfully reduce the number of officials and contractors who were empowered to download and transfer data classified as top secret, as well as the number of “privileged” users, who have greater power to access the N.S.A.’s most sensitive computer systems. And it did not fully implement software to monitor what those users were doing.

Let's not forget the NSA wants to be engaged in ensuring the cybersecurity of the nation. It's repeatedly asked for more power and a better seat in the CyberWar room. But it doesn't even take its OWN security seriously. The NSA told its oversight it was engaging in 40 "Secure the Net" initiatives, directly after the first Snowden leak. Two years later, it told Congress it had completed 34 of 40 STN initiatives. The term "completion" apparently has multiple definitions, depending on who's using the word. The IG sampled only seven of the initiatives and found four were mostly done and three were nowhere near completed. Extrapolating from the sampling, it's safe to assume the NSA's internal security efforts are only slightly more than half-baked.

The three the NSA failed to implement are of crucial importance, especially if it's looking to keep its in-house documents safe at home. From the report [PDF]:

NSA officials did not effectively implement three PRIVAC [Privileged Access]-related STN initiatives:

- fully implement technology to oversee privileged user activities;

- effectively reduce the number of privileged users; and

- effectively reduce the number of authorized DTAs [Data Transfer Agents].

First off, the NSA -- prior to the Snowden leaks -- had no idea how many users had privileged access. Post-Snowden, things hardly improved. Considering the tech capabilities of the agency, it's incredibly amusing to see how the NSA "tracked" privileged users.

NSA officials stated they used a manually kept spreadsheet, which they no longer had, to identify the initial number of privileged users.

Pretty much useless, considering this number the NSA couldn't verify (thanks to its missing spreadsheet) was supposed to be used to establish a baseline for the planned reduction in privileged users. Despite missing this key data, the NSA moved ahead, "arbitrarily revoking access" and asking users to reapply for privileged status. It then reported a reduction by citing the number of users it denied restoration of access privileges. It did not factor in any new users it granted privileged access to or tally up the number of accounts it never bothered to revoke.

As the fully-redacted chart presumably points out (according to the text above it), the NSA had a "continued and consistent increase in the number of privileged users once the [redacted] enrollment process began."

The NSA also claimed it had reduced the number of DTAs. And again, the NSA had no receipts.

Although repeatedly requested, NSA officials could not provide supporting documentation for the total number of DTAs before and after the purge or the actual number of users purged.

The NSA's objectively-terrible internal controls (again) ensured no number could be verified.

NSA did not know how many DTAs it had because the manually kept list was corrupted during the months leading up to the security breach.

The NSA handled these missing numbers the same way it had privileged users: it made up a new baseline, arbitrarily decided it could show a downtrend in DTAs, and delivered this as "proof" of another completed security initiative.

The report points out repeatedly the NSA's failure to provide documentation backing its STN claims -- either from before the initiatives took force or after they supposedly hag been completed. The IG's comments note the NSA's response to the report ignored its detailed description of multiple failures in order to spin this as a "win" for the agency.

Although the Director, Technology Directorate NSA/CSS Chief Information Officer, agreed, he did not address all the specifics of the recommendation. Therefore, we request that the director provide additional comments on the final report that identify specific actions NSA will take.

Here's how the NSA portrayed the report's findings:

While the Media Leak events that led to Secure the Net (STN) were both unforeseen and serious, we consider the extensive progress we made in a short time to be a "good news" story.

Sure, if you consider a half-done job securing NSA assets to be "good news," rather than just an ongoing series of security holes left halfway unplugged while agency officials testify before Congressional oversight in front of a "MISSION ACCOMPLISHED" banner backdrop.

Filed Under: cybersecurity, ed snowden, nsa, security

2008 FISA Transcript Shows NSA Already Knew It Might Have An Incidental Collection Problem

from the where-'about'-means-'how-about-we-just-collect-it-all?' dept

The ODNI has released several documents in response to FOIA lawsuits (EFF, ACLU). The EFF scored 18 of these (handy zip link here) and the ACLU seven. The ACLU's batch has proven more interesting (at least initially). One document it obtained shows a tech company challenged a Section 702 surveillance order in 2014. The challenge was shut down by the FISA court, but with the exception of Yahoo's short-lived defiance, we haven't seen any other evidence of ISP resistance to internet dragnet orders.

Included in the ACLU's batch is a 2008 FISA Court transcript [PDF] that's particularly relevant to the NSA's voluntary shutdown of its "about" collection. In it, the NSA discusses its filtering and oversight procedures, which were already problematic nearly a decade ago.

There are some really interesting tidbits to be gleaned from the often heavily-redacted proceedings, including this statement, which makes it clear the NSA engaged in wholly-domestic surveillance prior to the FISA Amendments Act.

THE COURT: All right. Well, what about the non-U.S. person status, which of course is new under the FISA Amendments Act? Are you going to be changing anything in terms of focusing on that?

[REDACTED GOV'T RESPONDENT]: We already sort of do with respect to the U.S. person status is so intertwined with the location of the target [REDACTED] to the extent that in the past NSA.would actually affirmatively identify targeted U.S. persons to us on the sheets, because one of the additional fields that they put in the sheets is basically a blurb, an explanation and a description of the target.

Clearly, we're not allowed to target US persons anymore, so I don't anticipate seeing any such descriptions on the sheets. But again, since the status of the person, the determination of how that is made is so intertwined with the same information upon which NSA relies to make a foreignness determination, that it would be hard for us not to identify such information as we're conducting the reviews.

Which, of course, means the NSA was allowed to target US persons and their communications previously, contradicting statements made by US officials, including President George W. Bush and Vice President Dick Cheney.

It's stated earlier in the transcript that the NSA does a few things to help minimize examination of US persons' communications. But they're not great. The NSA runs spot checks on analysts' transactions, deploys filters, and relies on self-reporting to guard against Fourth Amendment violations. It sounds like quite a bit, but the details show it's not nearly enough. To start with, the filters meant to filter out US persons' communications don't work.

COURT: The NSA minimization procedures, you're stating, 'contain a provision for allowing retention of information because of limitations on NSA's ability to filter communications.' My question I had was is the filter discussed in targeting the same filtering. I just wanted to understand that, and apparently it is. [The rest of the court's question is redacted.]

GOV'T: I think the inclusion of that provision in the minimization procedures was intended to be prophylactic in the event that the filters don't necessarily work, and NSA has represented that it's been their experience with the filters and [redacted] this provision basically captures instances where the filters may not work in every instance.

And there's a good reason why they won't work "in every instance." Further unredacted discussion reveals the NSA partially relies on an IP address blacklist to filter out US persons' communications. This is better than nothing, but still a long way from being a strong positive indicator of a target's (or incidental target's) location.

The court then asks about the limitations of the filters and… we get several fully-redacted pages as an answer.

The court also asks about the "about" collection -- where targets are discussed but the communications do not directly involve NSA targets.The judge wants to know how often this is being used rather than the more-targeted "to/from" collection and how often it results in incidental collection. Unsurprisingly, the government can't say how often this happens. This is because the NSA saw no reason to track these searches.

GOV'T: As far as the percentage number, we don't have a number for that, because as I mentioned earlier, when we [redacted] we find to's and froms and [redacted] so we don't categorize those separately to be able to count those communications as abouts.

The court then asks why it's not possible to limit the collection to to's and froms. The government's response is that collecting it all just works better for the NSA, even though it apparently possesses the technical ability to keep these collections separate.

It is technically feasible. The problem with doing so is if you end up discarding a number of communications that are truly to-froms that you should be able to collect but [redacted]...

So by trying to limit us to no abouts, then we end up cutting out those kind of communications as well, truly to-froms. So it would be -- we're not surgical enough to take that out of the equation without impacting our ability to do to-froms effectively.

And later in the discussion, there's a bit of a bombshell about the "about" collection. The NSA shut it down because it couldn't find a way to prevent incidental collection of US persons' communications. In this transcript, the government points out incidental collection is just as likely with to-from targeting.

COURT: Is it more or less likely to pick up U.S.-person information in an about than a to or from?

MR. OLSEN: I don't know the answer in practice. At least from my perspective in theory, I wouldn't see why it would be more likely than a targeted to or from collection where the target's outside the United States where there's a similar possibility that that target would be in communication with someone in the United States, with a U.S. person in the United States.

If this is true, the elimination of the "about" collection doesn't do much to curtail incidental collection. And almost a decade ago, the NSA was already making it "impossible" to comply with Congressional requests for incidental collection numbers by refusing to separate its collections, even with the FISA Court raising questions about its Fourth Amendment implications.

Filed Under: 702, domestic surveillance, foia, incidental collection, nsa, section 702, surveillance