To The NSA, The Word 'Security' Is Synonymous With 'Gaping, Unpatched Holes In US Developers' Software'

from the Vulnerability-EXPLOITATION-Process dept

A former Defense Intelligence Agency officer has taken to LinkedIn to point out to all of us griping about the broken Vulnerability Equities Process -- exposed by hackers holding NSA zero-days -- have it all wrong. Michael Tanji says the NSA isn't here to protect developers from malicious attacks. It never was and it's never going to be.

Intelligence agencies exist to gather information, analyze it, and deliver their findings to policymakers so that they can make decisions about how to deal with threats to the nation. Period. You can, and agencies often do, dress this up and expand on it in order to motivate the workforce, or more likely grab more money and authority, but when it comes down to it, stealing and making sense of other people’s information is the job. Doing code reviews and QA for Cisco is not the mission.

Suck it up, Cisco. That gaping hole uncovered by the Shadow Brokers was discovered at least three years ago by the NSA and if it chose not to tell you about it, it had its reasons. Namely: national security.

The Obama administration made sympathetic noises in the wake of the Snowden leaks, suggesting the NSA err on the side of disclosure. It simultaneously gave the agency no reason to ever do that by appending "unless national security, etc." to the statement.

But part of the phrase "national security" is the word "security." (And the other part -- "national" -- suggests this directive also covers protecting US companies from attacks, not just the more amorphous "American public.") Allowing tech companies who provide network security software and hardware to other prime hacking targets to remain unaware of security holes doesn't exactly serve the nation or its security. So, while Tanji may claim the NSA isn't in the QA business, it sort of is. The thing is the NSA prefers to exploit QA issues, rather than give affected developers a chance to patch them.

And if an NSA operative left behind a bag of tech tools in a compromised server, it really doesn't do much for the argument that the government can be trusted with encryption backdoors -- the sort of thing FBI Director James Comey is still hoping will materialize as a result of his never ending "going dark" sales pitch. Julian Sanchez, writing for Cato, points out the NSA's mistake should lead to some pretty severe trust issues.

This hack also ought to give pause to anyone swayed by the government’s assurances that we can mandate government backdoors in encryption software and services, allowing the “good guys” (law enforcement and intelligence agencies) to access the communications of criminals and terrorists without compromising the security of millions of innocent users. If even the NSA’s most closely guarded hacking tools cannot be secured, why would any reasonable person believe that keys to cryptographic backdoors could be adequately protected by far less sophisticated law enforcement agencies? The Equation Group hack is a disturbingly concrete demonstration of what network security experts have been saying all along: Once you create a backdoor, there is no realistic way to guarantee that only the good guys will be able to walk through it.

So, that's one huge problem with both the hoarding of exploits and the NSA's refusal to actually participate in the Vulnerability Equities Process. The definition the NSA has chosen for "national security" doesn't mesh with statements made by its cybersecurity overseers.

Back in 2014, federal cybersecurity coordinator Michael Daniel insisted in a post on the White House blog that the process is strongly weighted in favor of disclosure. The government, he assured the public, understands that “[b]uilding up a huge stockpile of undisclosed vulnerabilities while leaving the Internet vulnerable and the American people unprotected would not be in our national security interest.”

Maybe things have changed in the past couple of years, but they haven't changed as much as Michael Tanji claims. He states that the NSA is no longer charged with playing cyber-defense.

The one element in the intelligence community that was charged with supporting defense is no more. I didn’t like it then, and it seems pretty damn foolish now, but there you are, all in the name of “agility.” NSA’s IAD had the potential to do the things that all the security and privacy pundits imagine should be done for the private sector, but their job was still keeping Uncle Sam secure, not Wal-Mart.

That's simply not true. The NSA may secretly wish it had been completely rerouted to "attack" mode. That would more easily justify the hoarding of vulnerabilities and its ongoing refusal to hand over info to affected developers. But it's still supposed to be playing defense -- which means it has an obligation to both the American public who use software/hardware the NSA would rather see left unpatched, as well as the developers it's purposefully leaving open to malicious attacks.

The NSA has decided the best way to handle these competing directives is to muddy the waters by making them inseparable.

Because computers are now the easiest way to spy on people, and because everyone — even U.S. adversaries — uses the same Internet, there has long been what officials like to call a "healthy" or "creative" tension between the foreign espionage mission and the information assurance mission of the NSA.

Crudely put, the IA's cyber mission is to find security holes in Internet infrastructure and common software and patch them; the signals intelligence mission is to find the same holes and keep them open as long as possible so they can be used to spy on foreigners.

When the two directorates merge, some fear that the much larger and better funded signals intelligence mission will simply absorb the IA mission.

As it stands now, the offensive side of the NSA's cybersquad is roughly twice the size of its defensive team -- which clearly indicates which end of the equation the NSA believes is more important to its national security mission.

The NSA's actions in regards to the Vulnerability Equities Process shows it believes some forms of national security are more equal than others. It's far more interested in ensuring its collections continue to be fed than it is with patching security holes -- holes it has often created -- that affect millions of US citizens and dozens of hacker-tempting firms.

It also shows the government is not to be trusted when it demands "good guy only" access. It can't protect the backdoors it's already created and it has only the slightest interest in protecting the nation from the bad guys that will inevitably find its secret entrances.

Filed Under: defense, hacking, nsa, offense, protection, vep, vulnerabilities

Why Are The Congressional Intelligence Committees So Quiet On The NSA Malware Leaks?

from the speak-up,-feinstein,-we-can't-hear-you dept

Last week, we wrote about the leak of various NSA hacking tools, that showed it had zero-day exploits for a bunch of hardware, including some from Cisco. This has raised some concerns about how long the NSA sat on these vulnerabilities without telling companies -- along with reaffirming what many people already suspected: that the supposed "Vulnerabilities Equities Program" (VEP), in which the NSA is supposed to disclose the vulnerabilities it finds to the companies to patch, is a complete joke.

But Marcy Wheeler has another important point about all of this. When the Snowden documents originally leaked three plus years ago, the various top members of the House and Senate Intelligence Committees -- the so-called Gang of Four -- were quick to speak out (and condemn) the leak. But, oddly, this time they're staying pretty quiet.

Within hours of the first Snowden leak, Dianne Feinstein and Mike Rogers had issued statements about the phone dragnet. As far as I’ve seen, Adam Schiff is the only Gang of Four member who has weighed in on this

U.S. Rep. Adam Schiff, the ranking Democrat on the House Intelligence Committee, also spoke with Mary Louise. He said he couldn’t comment on the accuracy of any reports about the leak.

But he said, “If these allegations were true, I’d be very concerned about the impact on the intelligence community. I’d also obviously want to know who the responsible parties were. … If this were a Russian actor — and again, this is multiple ‘ifs’ here — we’d have to ask what is causing this escalation.”

Say, Congressman Schiff. Aren’t you the ranking member of the House Intelligence Committee and couldn’t you hold some hearings to get to the bottom of this?

Meanwhile, both Feinstein (who is the only Gang of Four member not campaigning for reelection right now) and Richard Burr have been weighing in on recent events, but not the Shadow Brokers release.

If the House and Senate Intelligence Committees were really about "oversight" of the NSA, then shouldn't they have jumped on this immediately? Shouldn't they be looking into how the NSA manages the VEP? Shouldn't they be looking into how these tools got out? Why are they just staying silent or giving meaningless statements like Schiff's?

Filed Under: 0days, adam schiff, devin nunes, dianne feinstein, house intelligence committee, leak, malware, nsa, richard burr, senate intelligence committee, vep, vulnerabilities

Why The NSA's Vulnerability Equities Process Is A Joke (And Why It's Unlikely To Ever Get Better)

from the 'national'-security-still-the-best-kind-of-security,-apparently dept

Two contributors to Lawfare -- offensive security expert Dave Aitel and former GCHQ information security expert Matt Tait -- take on the government's Vulnerability Equities Process (VEP), which is back in the news thanks to a group of hackers absconding with some NSA zero-days.

The question is whether or not the VEP is being used properly. If the NSA discovered its exploits had been accessed by someone other than its own TAO (Tailored Access Operations) team, why did it choose to keep its exploits secret, rather than inform the developers affected? The vulnerabilities exposed so far seem to date as far back as 2013, but only now, after details have been exposed by the Shadow Brokers are companies like Cisco actually aware of these issues.

According to Lawfare's contributors, there are several reasons why the NSA would have kept quiet, even when confronted with evidence that these tools might be in the hands of criminals or antagonistic foreign powers. They claim the entire process -- which is supposed to push the NSA, FBI, et al towards disclosure -- is broken. But not for the reasons you might think.

The Office of the Director of National Intelligence claimed last year that the NSA divulges 90% of the exploits it discovers. Nowhere in this statement were any details as to what the NSA considered to be an acceptable timeframe for disclosure. It's always been assumed the NSA turns these exploits over to developers after they're no longer useful. The Obama administration may have reiterated the presumption of openness when reacting to yet another Snowden leak, but also made it clear that national security concerns will always trump personal security concerns -- even if the latter has the potential to affect more people.

The main thrust of the Lawfare article is that the "broken" part of the equities process is that there should be a presumption of disclosure at all. The authors point out that it might take years to discover or develop a useful exploit and -- given the nature of the NSA's business -- it should be under no pressure to make timely disclosures to developers whose software/hardware the agency is exploiting.

[F]rom an operational standpoint, it takes about two years to fully utilize and integrate a discovered vulnerability. For the intelligence officer charged with managing the offensive security process, the VEP injects uncertainty by requiring inexpert intergovernmental oversight of the actions of your offensive teams, effectively subjects certain classes of bugs to time limits and eventual public exposure—all without any strategic or tactical thought governing the overall process.

[...]

Individual exploitable software vulnerabilities are difficult to find in the first place. But to engineer the discovered vulnerability into an operationally deployable exploit that can bypass modern anti-exploit defenses is far harder. It is a challenge to get policymakers to appreciate how rare the skills are for building operationally reliable exploits. The skillset exists almost exclusively within the IC and in a small set of commercial vendors (many of whom were originally trained in intelligence). This is not an area where capacity can be easily increased by throwing money at it—meaningful development here requires monumental investment of time and resources in training and cultivating a workforce, as well as crafting mechanisms to identify traits of innate talent.

The authors do point out that disclosure can also be useful to intelligence services. If these disclosures result in safer computing for everyone else, then that's apparently an acceptable side effect.

[T]here are three major, non-technical reasons for vulnerability disclosure.

First, disclosure can provide cover in the event that an OPSEC failure leads you to believe a zero-day has been compromised—if there is a heightened risk of malicious use, it allows the vendor time to patch. Second, disclosing to vendors allows the government to out an enemy’s zero-day vulnerability without disclosing how it was found. And third, government disclosure can form the basis of building a better relationship with Silicon Valley.

Saddling intelligence agencies with a presumption of disclosure is possibly a dangerous idea. Less-than-useful exploits that could be divulged to developers might be tied to other exploits still being deployed by intelligence services. Any suggested timeframe for mandatory disclosure would likely cause further harm by forcing the NSA, FBI, etc. to turn over exploits just as they're generating optimal results. On top of that, the authors point out that a push towards disclosure hamstrings US intelligence services as agencies in unfriendly nations will never be constrained by requirements to put the public ahead of their own interests.

But the process is definitely broken, no matter whose side of the argument you take. The NSA says it discloses 90% of the vulnerabilities it discovers, but former personnel involved in these operations note they've never seen a vulnerability disclosed during their years in the agency.

It's unlikely that the process will ever be fixed to everyone's satisfaction. The most likely scenario is that the VEP will continue to trundle along doing absolutely nothing while being ineffectually attacked by those opposing intelligence community secrecy. As it stands now, the presumption of disclosure is completely subject to any national security concerns raised by intelligence and law enforcement agencies. Occasional political climate shifts may provoke transparency pledges from various administrations, but those should be viewed as sympathetic noises -- presidential pats on the head meant to fend off troubling questions and legislative pushes to put weight behind the administration's words.

Filed Under: 0days, exploits, nsa, sharing, surveillance, vep, vulnerabilities, vulnerabilities equities process, zero days

Did The NSA Continue To Stay Silent On Zero-Day Vulnerabilities Even After Discovering It Had Been Hacked?

from the Betteridge-and-Glomar-combine-to-say-'we'll-probably-never-know' dept

The NSA's exploit stash is allegedly for sale. As mentioned earlier this week, an individual or a group calling themselves Shadow Brokers claims to be auctioning off parts of the NSA's Tailored Access Operations (TAO) toolkit, containing several zero days -- including one in Cisco's (a favorite NSA TAO target) Adaptive Security Appliance which allows for remote code execution.

The thing about these vulnerabilities is that they aren't new. The exploits being hawked by Shadow Brokers date back to 2013, suggesting the agency has been sitting on these exploits for awhile. The fact that companies affected by them don't know about these flaws means the NSA hasn't been passing on this information.

Back in 2015, the NSA declared that it passed on information about vulnerabilities to affected companies "90% of the time." Of course, this statement contained very few details about how long the NSA exploited vulnerabilities before allowing them to be patched.

The White House told the NSA to make disclosure the preferred method of handling discovered vulnerabilities, but also gave it a sizable loophole to work with -- "a clear national security or law enforcement need."

Ellen Nakashima and Andrea Peterson of the Washington Post spoke to former NSA personnel. The statements they gave suggest there's almost always a "need" that outweighs the general public's security and safety.

Former NSA personnel who worked with the tool cache that was released say that when they worked at the agency, there was an aversion to disclosure.

“While I was there, I can’t think of a single example of a zero-day [flaw]” used by the agency “where we subsequently said, ‘Okay, we’re done with it and let’s turn it over to the defensive side so they can get it patched,’ ” said the former employee, who worked at the agency’s Tailored Access Organization for years. During that time, he said, he saw “hundreds” of such flaws.

He added: “If it’s something in active use, my experience was they fight like all get-out to prevent it from being disclosed.”

Said a second former employee, who also spoke on the condition of anonymity to describe sensitive government operations: “It’s hard to live in a world where you have capabilities and you’re disclosing your capabilities to your defensive team.”

So, there's no presumption of disclosure, not even with a Vulnerability Equities Process in place. If the NSA has a vulnerability to exploit, it will continue doing so until it's no longer effective. The agency's name alone grants it a presumption of secrecy because, after all, nothing has more "national security needs" than the National Security Agency.

This undercuts everything the disclosure process was supposed to do: allow developers to close holes in their software. With its TAO secrets out in the open, the government can no longer pretend stockpiling exploits is a good idea. Nor can it claim it's OK because it's only the "good guys" doing good things with them. The exploits will be sold to the highest bidder -- whether that bidder is a criminal or just another private company stockpiling exploits so it can sell those to highest bidder -- which in some cases may be UN-blacklisted countries with totalitarian governments and long histories of human rights abuses.

Matt Blaze -- referring to the just-disclosed Cisco zero day -- wonders if the NSA only just discovered hackers had made off with its stuff. And if it actually knew for three years these exploits had been compromised, why didn't it disclose the vulnerabilities to affected developers?

I wonder if NSA discovered that they lost the TAO exploit trove in 2013 or just now? If in 2013, why didn't they report the Cisco 0day?

Neither scenario is particularly flattering. Although it's presumed the hackers didn't actually crack an NSA server (theory is the exploits were harvested from a compromised server the NSA was running), not knowing that these vulnerabilities had been obtained by outsiders until possibly three years after it happened is not exactly a flattering look for a security agency.

The alternative is actually worse: that the NSA knew its exploits had been taken but STILL chose not to disclose the vulnerabilities to software developers. In this scenario, there's no longer any "what if" about it. The NSA knew exploits were in the "wrong" hands but withheld this info to continue utilizing the exploits. If that's the case, the NSA is complicit in any exploitation by the "wrong" people because it chose to withhold, rather than disclose, major vulnerabilities even after it knew it had been compromised.

It may be that the NSA truly didn't know about this hacking until the hackers started passing out parts of its exploit hoard, but that's not exactly comforting considering the agency's efforts to be declared the overseer of the US government's CyberWar.

Filed Under: disclosure, exploits, nsa, reporting, tao, vep, vulnerabilities equities program, vulnerability, zero days

Pentagon Issues First Update To Domestic Surveillance Guidelines In 35 Years, Not All Of It Good

from the fixes-need-fixing dept

Cody Poplin at Lawfare points out that the Defense Department has just issued an update on rules governing its intelligence collection activities -- the first major update in over 30 years. These would directly affect the NSA, which operates under the Defense Department.

The most significant alteration appears to be to retention periods for US persons data. While everything is still assumed to be lawful under Executive Order 12333 and DoD Directive 5240.1, the point at which a record is deemed to be "collected" -- starting the clock on the retention period -- has changed.

Under the new rules, “collection” occurs “upon receipt,” whereas the previous manual defined “collection” as occurring when the information was “officially accept[ed] … for use.” The change ensures that all protections governing even the incidental collection of U.S. personal information (USPI) applies upon receipt of that information. The clock starts to run as soon as information is collected, meaning that collected information must be promptly evaluated to determine the proper retention period.

This should result in better minimization of incidentally-collected US persons info as the determination must be made shortly after harvesting, rather than waiting until the collected data is queried. This likely means the NSA may be making more efforts to head off incidental collection, as leaving things the way they are will now result in additional logistics headaches.

This doesn't necessarily mean incidentally-collected info will be swiftly disposed of. The DoD can still hold onto this data for five years. And, if the target of the incidental collection leaves the country during that retention period, the DoD can hold onto the data for a quarter-century.

Info on US persons/entities (still located in the US) is also being granted additional protections, including enhanced minimization procedures for dissemination of collected data to other agencies and other countries.

The NSA will also be expected to make additional trips to the FISA court.

[T]he new manual incorporates new physical search rules that reflect changes to the Foreign Intelligence Surveillance Act since 1982. These include requirements to obtain a FISA warrant for nonconsensual physical searches conducted inside the United States and for targeted collection of U.S. person information outside the United States.

Most of this appears to be changes for the better -- something that likely wouldn't have occurred without Snowden's leaked documents. The last change to these rules was made back in 1982 when no one had any idea the wealth of communications content and data that would be travelling around the globe in digital form.

But a closer look at the details -- especially the part pertaining to "special circumstances" that alter the rules of collection and retention -- suggests there still may be a few exploitable loopholes that would allow the NSA to target US persons and entities.

If DoD agencies wish to target a US person (whether at home or abroad), they're instructed to use the "least intrusive" method of surveillance: public sources. If the information sought can't be found there, the next step is to seek cooperation from other sources that may have the same info. This is basically a consensual search, but involving third parties. The last step is to seek top-level approval from the DoD's general counsel. This will provide some additional oversight, but still makes it a mostly "in-house" process -- something that's not exactly comforting.

The additional restrictions on the collection of US persons in the US seem to limit potential abuse/misuse of surveillance tools.

Other specific limitations apply to collection of USPI inside the United States, including that the information may be collected only if 1) the information is publicly available or 2) the source of the information is advised or otherwise aware that he or she is providing the information.

But the list of exceptions to these limitations appears to directly remove these two stipulations.

In the event that neither or the two previous requirements are met, the Defense Intelligence Component may employ collection methods that are directed at the United States if a) the foreign intelligence is significant and the collection is not undertaken for the purpose of acquiring information about a U.S. person’s domestic activities; b) the intelligence cannot be obtained publicly or from sources who are advised they are providing information to the DoD; or c) the Defense Intelligence Component head concerned or a single delegee has approved as being consistent with the manual and its outlined procedures the use of techniques other than the collection of publicly available information or from an informed source.

Reading these both together suggests that if the DoD can't obtain the info it's seeking from public/advised sources, it can use that limitation as a reason to deploy supposedly foreign-facing surveillance methods against US persons. If that's the correct reading (and the "or" -- rather than an "and" -- in the list of requirements suggests it is), the limitations on domestic surveillance are mostly meaningless.

Filed Under: collection, defense department, incidental collection, nsa, privacy, surveillance

Ed Snowden Explains Why Hackers Published NSA's Hacking Tools

from the you-break-many-things. dept

Yesterday, the news broke that a "mysterious" hacking group had gotten its hands on some NSA hacking tools and was releasing some of the tools as proof (it was also demanding lots of Bitcoin to reveal more). The leak came with a neat little message that feels like it was written by a Hollywood script writer trying to sound Russian.

How much you pay for enemies cyber weapons? Not malware you find in networks. Both sides, RAT + LP, full state sponsor tool set? We find cyber weapons made by creators of stuxnet, duqu, flame. Kaspersky calls Equation Group. We follow Equation Group traffic. We find Equation Group source range. We hack Equation Group. We find many many Equation Group cyber weapons. You see pictures. We give you some Equation Group files free, you see. This is good proof no? You enjoy!!! You break many things. You find many intrusions. You write many words. But not all, we are auction the best files.

You break many things indeed! (For what it's worth, it appears that GitHub and Tumblr both killed the accounts where whoever hacked this stuff first posted it).

The files that were leaked were mostly installation scripts, but also exploits designed for specific routers and firewalls. And, it's noted, that some of the tools named line up with previously leaked NSA codenames. One other interesting point from the Motherboard link above: the files are a bit dated:

The most recent file is dated June 2013, though the hackers could have tampered with the dates. Dmitri Alperovitch, the co-founder of security firm CrowdStrike, theorized that “the leakers were probably sitting on this information for years, waiting for the most opportune time to release.”

Of course, June 2013 is interesting for another reason. That's when Ed Snowden passed on his documents to a small group of reporters and the very first stories based on the Snowden leaks started. So it seems noteworthy that Snowden has put together a bit of a tweetstorm for his take on the hack and release of the hacking tools. To make it easier to read, we've put it all together here:

The hack of an NSA malware staging server is not unprecedented, but the publication of the take is. Here's what you need to know:

NSA traces and targets malware C2 servers in a practice called Counter Computer Network Exploitation, or CCNE. So do our rivals. NSA is often lurking undetected for years on the C2 and ORBs (proxy hops) of state hackers. This is how we follow their operations. This is how we steal their rivals' hacking tools and reverse-engineer them to create "fingerprints" to help us detect them in the future.

Here's where it gets interesting: the NSA is not made of magic. Our rivals do the same thing to us -- and occasionally succeed. Knowing this, NSA's hackers (TAO) are told not to leave their hack tools ("binaries") on the server after an op. But people get lazy.

What's new? NSA malware staging servers getting hacked by a rival is not new. A rival publicly demonstrating they have done so is.

Why did they do it? No one knows, but I suspect this is more diplomacy than intelligence, related to the escalation around the DNC hack. Circumstantial evidence and conventional wisdom indicates Russian responsibility. Here's why that is significant: This leak is likely a warning that someone can prove US responsibility for any attacks that originated from this malware server. That could have significant foreign policy consequences. Particularly if any of those operations targeted US allies. Particularly if any of those operations targeted elections. Accordingly, this may be an effort to influence the calculus of decision-makers wondering how sharply to respond to the DNC hacks.

TL;DR: This leak looks like a somebody sending a message that an escalation in the attribution game could get messy fast.

Bonus: When I came forward, NSA would have migrated offensive operations to new servers as a precaution - it's cheap and easy. So? So... The undetected hacker squatting on this NSA server lost access in June 2013. Rare public data point on the positive results of the leak.

You're welcome, @NSAGov. Lots of love.

Sure, it's speculation, but it's pretty informed speculation and it makes a lot of sense. There's still plenty of talk about what to do about the DNC hack, and we've talked about "cybersecurity firms" (who profit from FUD and scare stories) arguing that we should "declare cyberwar" on Russia based on loose attribution. But, as Snowden notes, this hack and partial release could very well be a warning shot that escalation won't end up looking good for the US if they go that route.

Filed Under: dnc hack, ed snowden, equation group, hacking tools, malware, nsa, surveillance

Snowden Docs Show NSA, New Zealand Spied On Pro-Democracy Activists

from the we-love-democracy,-not-so-much-those-who-advocate-for-it dept

The Intercept has published a few more documents from the Snowden stash -- these ones detailing the NSA's partnership with New Zealand's top intelligence agency to place pro-democracy activists under surveillance.

As part of the spy mission, the NSA used its powerful global surveillance apparatus to intercept the emails and Facebook chats of people associated with a Fijian “thumbs up for democracy” campaign. The agency then passed the messages to its New Zealand counterpart, Government Communications Security Bureau, or GCSB.

One of the main targets was [Tony] Fullman, a New Zealand citizen, whose communications were monitored by the NSA after New Zealand authorities, citing secret evidence, accused him of planning an “an act of terrorism” overseas.

The "act of terrorism" claims were odd, considering Fullman's activism was aligned with the New Zealand government's own views: opposition to neighboring Fiji's authoritarian ruler, Frank Bainimarama. Utilizing PRISM, the NSA intercepted Fullman's Gmail and Facebook messages, along with gathering everything it could from his public postings -- including this data on his apparently terrorism-related personal vehicle.

Both the NSA and its New Zealand partner have refused to comment on the misguided surveillance, stating only that everything done was performed lawfully.

The erroneous assumptions of terrorism seem to be linked to Fullman's lifelong friendship with a top Fijian military official. Fullman grew up in Fiji, where he met Ratu Tevita Mara in the 1960s. Fullman moved to New Zealand while in his 20s before returning to take a government position in 2009. By that point, Mara had moved up in the military to a position as the Fijian army's chief of staff. Mara, however, drew heat from the Fijian government for his opposition to the current regime.

Mara was dissatisfied with the leadership and, in May 2011, he became embroiled in a high-profile dispute with the Bainimarama regime. He was accused of plotting to overthrow the government and charged with uttering a seditious comment. He was hauled before a court, where he was threatened with imprisonment for allegedly uttering the words, “This government is fuck all.”

Mara fled Fiji, remaining in contact with Fullman, who also left Fiji after being questioned by local authorities about his relationship with Mara. A visit to New Zealand with Mara resulted in Fullman's life being turned upside down.

At 7am on July 17, 2012, about a week after Fullman had returned to Australia from the trip to New Zealand, a team of more than a dozen Australian security agents and two Australian federal police detectives arrived at his sister’s home in Sydney looking for weapons and other evidence of the suspected plot.

They seized computers, phones and documents from the premises and confiscated Fullman’s passport on behalf of the New Zealand authorities. Teams of New Zealand Security Intelligence Service officers and police simultaneously raided Fullman’s former apartment in the Wellington suburb of Karori and the homes of at least three other Fiji Freedom and Democracy movement supporters in Auckland, seizing their computers and other property.

In addition, Fullman's passport was revoked by the New Zealand government, which claimed Fullman was part of a group planning to violently overthrow the Fijian government. New Zealand's intelligence agency asked the NSA for assistance in digging up info on Fullman and keeping him under surveillance. The documents published today make Tony Fullman the first confirmed target of the NSA's PRISM surveillance.

According to the documents viewed by The Intercept, the NSA couldn't seem to decide how to classify its surveillance of Fullman, alternating between listing him as a "foreign government" target (even though Fullman no longer worked for the Fijian government) and a "counter-terrorism" target.

Months of surveillance efforts -- shared with New Zealand intelligence operatives -- produced nothing more than what could likely have been observed without all the intercepted emails/Facebook messages, harvested bank statements, and precise GPS data on Fullman's Mitsubishi station wagon.

[T]here was not a single hint of any plans for violence or other clandestine activity.

It would soon become clear that there was no evidence to support the New Zealand authorities’ suspicions. And gradually, their case would fall apart.

Ten months after placing Fullman under surveillance and stripping him of his passport, New Zealand's government returned it to him and declared him to be "no longer" of "national security concern." This determination came two months after Fullman began taking legal action against the New Zealand government for its raid of his sister's home and the cancellation of his passport.

That's not the only bit of suspicious timing: Fullman believes the raid was politically-motivated.

Four days after the raids on Fullman and his fellow campaigners, New Zealand foreign minister Murray McCully traveled to Fiji for trade talks. Fullman believes that the timing was no coincidence — and that the raids targeting the pro-democracy group were used by the New Zealand government as a bargaining chip to curry favor with the Bainimarama regime. “The minister can go to Fiji and say, ‘look we saved you, let’s be friends again, let’s start talking about how we can help each other again’,” Fullman says. “It was part of the frame up.”

The New Zealand government may have felt its efforts fell into "no harm, no foul" territory after it reinstated Fullman's passport and dropped its surveillance. But Fullman points out the high-profile raid it carried out damaged his reputation by erroneously linking him to an assassination plot. On top of that, Fullman is still subjected to additional security screening any time he travels. Fullman was never informed he was under surveillance by a foreign intelligence agency and he has never been compensated, much less apologized to, for his treatment at the hands of his own government.

The surveillance detailed here shows the NSA is willing to help foreign governments spy on their own citizens for politically-motivated reasons involving what would normally be considered protected forms of expression. It also shows that when governments do this sort of thing, they're unlikely to admit any wrongdoing, even when they tacitly admit they placed the wrong person(s) under surveillance.

Filed Under: ed snowden, gcsb, new zealand, nsa, prism, snowden docs, surveillance, tony fullman

NSA Surveillance Compliance Reports Show Typos, Lack Of Communication Resulting In Erroneous Targeting And Collection

from the good-numbers-overall,-though dept

The Director of National Intelligence's office (ODNI) has just released three Section 702 compliance reports covering December 2012 - May 2014. Considering the six-month lag time between the period covered and the reports' release, this is very likely as up to date as it can be at this point.

The ODNI is (almost) justifiably proud of its awkward embrace of government openness.

Consistent with the transparency principles, ODNI coordinated an extensive interagency review process to ensure the greatest transparency while protecting national security information, in order to enhance public understanding of the government’s implementation of Section 702.

Bravo and all that, but that doesn't really explain why we're still missing a handful of older transparency reports. This release covers reports 10, 11, and 12. Reports 1-3 are also available at the ODNI's Tumblr, but the list is still missing reports 4-8.

These aren't really oversight documents, per se -- at least not in terms of independence. They're composed by the agencies involved with the collection and retention of data gathered by the Section 702 program. They appear to be a collaboration between the DOJ and the ODNI, rather than the product of independent auditors or the involved agencies' Inspectors General.

That being said, the NSA still unfortunately erroneously obtains information it shouldn't.

As noted in the Section 707 Report, there were a total of [redacted] compliance incidents that involved noncompliance with the NSA targeting or minimization procedures and [redacted] involving noncompliance with FBI targeting and minimization procedures; for a total of [redacted] incidents involving NSA and/or FBI procedures.

Thanks to the redaction, it's difficult to say how often happen compliance incidents happen, but letter spacing suggests it might be as high as three digits' worth. Overall, it's only a small percentage of the total haul: 0.32%. More than half of the incidents involved tasking or detasking of "facilities" (which may be nothing more than an email address, as the NSA has argued that a "facility" can be anything that "facilitates" communications).

Tasking problems mostly arise from that all-too-common human error: typos.

Over the time periods covered in the above chart, the tasking and detasking incident compliance rate has varied by fractions of a percentage point as compared to the average size of the collection. Tasking errors cover a variety of incidents, ranging from the tasking of an account that the Government should have known was used by a United States person or an individual located in the United States to typographical errors in the initial tasking of the account that affect no United States persons or persons located in the United States.

Detasking, however, doesn't seem to be as prone to keyboard fumbling.

On the other hand, detasking errors more often involve a facility used by a United States person or an individual located in the United States, who may or may not have been the targeted user.

It would seem that being unable to determine whether a target is or isn't a target would result in more errors. And perhaps it does, but either way, the number of errors compared to the total number of targeted facilities is little more than a rounding error. Information provided earlier in the report suggests most detasking issues arise from a lack of communications between agencies. (The FBI and CIA both contribute -- and partake of -- the NSA's 702 collections.)

The report also reminds us how integral the FBI is to the NSA's bulk collection programs and how reliant the NSA is on a mainly-domestic agency to justify its overseas data hauls.

FBI fulfills three separate roles in the implementation of Section 702. First, FBI is authorized under the certifications to acquire foreign intelligence information [redacted] from electronic communication service providers, by targeting facilities that NSA designates for such acquisition (hereinafter “Designated Accounts”). [Redacted] must be conducted pursuant to FBI’s targeting procedures. Second, FBI conveys [redacted] from the electronic communications service providers [redacted] for processing in accordance with the agencies’ FISC-approved minimization procedures. Similarly, FBI also provides [redacted]. Third, FBI may receive [redacted] unminimized Section 702-acquired communications. Such communications must be minimized pursuant to FBI’s Section 702 minimization procedures. Like CIA, FBI has a process for nominating to NSA new facilities to be targeted pursuant to Section 702. During this reporting period, FBI continued to expand this nominating process to its FBI field offices.

So, the FBI not only obtains FISA orders in its name (with the NSA actually taking possession of the collection upon receipt [so to speak…], but it also can tell the NSA what to look for when it sends the FBI back to the FISA court to obtain another order.

The report also points out that incorrect searches don't always contain typos. Sometimes they contain search terms that can significantly broaden the search results.

For example, an overbroad query can be caused when an analyst mistakenly inserts an “or” instead of an “and” in constructing a Boolean query, and thereby potentially received overbroad results as a result of the query.

And, although the number of tasking issues remains low, a large percentage of those are the result of agencies moving ahead without a sufficient amount of suspicion.

In the current reporting period, approximately 20% of the compliance incidents involve initial targeting decisions based upon insufficient information to support a determination that a target was a non-United States person reasonably believed to be located outside the United States. Many of these incidents involve process issues in which the error was a failure to consider the totality of relevant circumstances…

But, on the other hand, it was rarely US persons being inadvertently targeted, so no harm, no foul.

[I]n the vast majority, but not all, of the cases, there is no indication that the individual targeted actually was in the United States or a United States person.

As is to be expected from reports like these, lots of potentially interesting stuff has been redacted completely and anything pertaining to the total number of errors has been excised. Still, after years of never showing its work to the general public, the ODNI's release of these reports in a somewhat timely manner suggests the ODNI is at least trying to make small talk with transparency, if not completely ready to engage in a full embrace.

Filed Under: compliance, mass surveillance, nsa, odni, section 702, surveillance

'Wish I Had The Power' To Hack Enemies' Emails, Says Man Very Close To Having Such Power

from the maybe-time-to-pull-back-nsa-powers dept

This weird presidential election continues to get weirder. Donald Trump, perhaps upset about being overshadowed this week by the Democratic Convention, held a press conference on Wednesday morning where he said a whole bunch of completely nutty stuff. A lot of the attention is being placed on his weird possibly half-joking request that Russia hack into Hillary Clinton's emails and reveal the 33,000 that were deleted (or maybe just give them to the FBI, as he later said in a tweet). That was bizarre on a number of levels, including coming right after denying he had any connection to Russia and the possibility that they had hacked the Democratic National Committee's computer system.

But it was his follow up comment that should be a hell of a lot more terrifying. He claimed that he "wished" he had the power to hack her emails:

"Honestly, I wish I had that power," Trump responded. "I’d love to have that power."

Now, again, there's an argument that this comment was sarcastic in the same manner as the "please, Russia" comment that everyone's been focusing on.

But here's the thing: in just a few months he very well might have that power. The NSA certainly has the ability to hack into just about anyone's emails should they want to. And no matter what we feel about whether or not the NSA has or is currently abusing that power, at the very least the level of abuses aren't nearly as bad as they could be in the hands of someone who just doesn't seem to give a fuck about the Constitution or the law.

As we noted a few months ago, surveillance powers should be designed as if the person you least trust in the world had control over the systems. Whether -- to you -- that's Donald Trump, Hillary Clinton or someone else entirely doesn't really matter. It's a pretty clear reason that we should be massively curtailing the surveillance powers granted by the US government to both the intelligence community and the law enforcement community.

Here we have the nominated presidential candidate joking that he'd make use of the power -- which he'd have -- to hack into the communications of political enemies. And while some will argue this is yet another on the long checklist of reasons why Trump is not fit for the job, it's even more a condemnation of our surveillance powers today. Whatever people think of the candidates, it seems like the one thing we should agree on is vastly limiting the surveillance powers.

Filed Under: donald trump, emails, hacking, hillary clinton, nsa, power, russia, surveillance

Disinformation Works: House Rejects Plan To Stop Backdoor Surveillance Searches Following Devin Nunes Lies

from the sad dept

Earlier this week, we wrote about a ridiculous misinformation campaign that was being sent around by House Intelligence Committee chair Rep. Devin Nunes against an amendment (sponsored by Reps. Thomas Massie and Zoe Lofgren) to a Defense appropriations bill that would block spending on two different kinds of surveillance "backdoors." First, ending backdoor searches, whereby tons of information on Americans that was collected "incidentally" as part of other searches, and then kept, could be scanned without requiring the showing of probable cause. Second, blocking the NSA from requiring backdoors into encryption technologies. A basically identical amendment easily passed in each of the last two years, but was stripped out before a final bill was approved.

With so much focus on things like iPhone encryption this year, some were wondering how the House would handle the amendment this year, and Nunes apparently decided to ramp up the pure FUD and lies against it, sending around a letter that exploited the Orlando shootings from this weekend, falsely claiming that the bill would block law enforcement/intelligence from scanning the 702 database for connections between the shooter and overseas individuals. This is wrong (never mind the fact that the CIA admitted yesterday that it can't find any connections at all). There are plenty of other tools available, including the ability to get a warrant, for officials to search for the relevant data. Nothing in the amendment would have stopped that at all. It only stops the random sniffing through the database, without cause.

But, apparently such disinformation works. The amendment was narrowly voted down by the house, 198 - 222. Massie has said that he thinks Nunes' propaganda campaign was partly to blame.

Rep. Thomas Massie... the sponsor of the amendment the last three years, said he thought there were two reasons the proposal failed on Thursday. "I think it was about Orlando and a stronger disinformation campaign from the committee," he said, referring to a letter from Intelligence Committee Chairman Devin Nunes... that criticized the amendment.

"We had a stiff headwind," Massie continued. "But I think the winds will eventually change, and we'll prevail one day."

And it appears that Nunes' lies worked so well they were parroted by others during the debate:

Rep. Chris Stewart... who said he rose "to oppose the Massie amendment and the inaccurate accusations that underly it," argued that if the proposal were in effect today, the intelligence community would be unable to search the Foreign Intelligence Surveillance Act database for information on the deceased Orlando shooter, Omar Mateen. FISA is a law used to collect data on foreigners, but the National Security Agency dragnet also catches information on U.S. citizens who interact with those foreigners.

"We should be focused on thwarting terrorist attacks," Stewart said Wednesday, "not on thwarting the ability of intelligence professionals to investigate and stop them."

The only inaccurate accusations, though, are the ones put forth by Stewart here. NOTHING in the amendment would have thwarted anyone's ability to investigate the Mateen shooting or any other attack.

Rep. Bob Goodlatte repeated the same false thing as well:

"This amendment prohibits the government from searching data already in its possession, collected lawfully under section 702 of FISA, to determine whether Omar Mateen was in contact with foreign terrorists overseas."

Except it doesn't.

It's disappointing, if not that surprising, that it appears that the blatant misinformation and lies succeed to convince Congress to sanction practices that appear to be in conflict with the 4th Amendment.

Filed Under: backdoor searches, bob goodlatte, chris stewart, devin nunes, encryption, fud, nsa, thomas massie, zoe lofgren