Defense Department Issues Opsec Guidelines For Safe And Secure Pokemon Hunting

from the pokemon-go:-now-literally-played-by-everyone dept

Given the cultural phenomenon that is Pokemon Go, it was only a matter of time before security-conscious government agencies would be forced to confront the inevitable: that their employees would be joining in the quasi-AR madness.

Kristan J. Wheaton of the Sources and Methods blog was handed an apparently official document from the Defense Department that lays down several common sense rules for employees throwing imaginary balls at imaginary creatures. (A screenshot of the original document can be seen in Thomas Rid's tweet, embedded at the bottom of this post.)

One of my contacts (Thanks!) within the intel community put together a tip sheet for friends and family and, having read it, it sounds like good advice for anyone who wants to play Pokemon Go with a reasonable level of safety and privacy. Remember, it is a tip sheet and is designed to be helpful, not comprehensive. If it is not covered here, just remember D²S² – Don’t Do Stupid Stuff.

Considering the source, the list of do's and do not do's is straightforward and on point. And, as Wheaton points out, good advice for anyone playing the game, not just those with high-level security clearances chasing down rarities behind CIA filing cabinets.

In short, make sure you're downloading the authentic application, be aware your location will be recorded, and -- more importantly, given the nature of DoD components -- the photos taken during Pokemon hunts might accidentally reveal something meant to stay hidden.

Be mindful of your surroundings when using this augmented reality (AR) mobile game, especially when taking pictures of Pokemon during the capture process. Note what's in the foreground and background, including reflective surfaces and information revealing identity and or location (street signs, vehicle license plates, Government buildings, etc.). Disabling AR makes Pokemon easier to catch! The location where you take a picture of a Pokemon is also likely embedded in the picture's metadata.

In addition, the DoD suggests employees use something other than their personal Google account to log in and to select usernames that do not reflect their IRL names.

Some classic military-industrial complex paranoia surfaces in the penultimate bullet point, however.

When physically visiting Pokestops and gyms, maintain awareness of your surroundings. Travel with a buddy or remain in your vehicle with the doors locked. It is not necessary to physically enter the real-world establishment where a Pokestop or gym is located, you may be able to interact with the Pokestop/gym from the curb or even across the street.

While there have been reports of strongarm robberies at bogus Pokestops, the whole "situational awareness" vibe adds far more cloak-and-dagger than seems absolutely necessary.

The full list at Wheaton's blog is worth a read, though, whether you're a normal citizen or a DC insider neck deep in redacted drone strike reports/Rattatas.

Filed Under: defense department, dod, opsec, pokemon, pokemon go

Defense Department Screws Over FOIA Requester Repeatedly, Blames Him For 'Breaking' The FOIA Process

from the the-other-FOIA-terrorist dept

The FOIA system is broken. The administration pays lip service to transparency while aggressively deploying exemptions. Agencies routinely complain about FOIA response budgets and staffing levels, yet no one seems motivated to fix this perennial issue. FOIA reform efforts moving forward with bipartisan support are repeatedly killed after receiving pushback from the White House.

Then there's this: a single requester is being blamed for a backlog of FOIA requests at an agency that's never underfunded -- the Department of Defense.

According to its "Chief Freedom of Information Act Officer Report," Nick Turse is the US citizen who has managed to bring the slowly-moving DoD FOIA machinery to a complete halt.

The report, for instance, laments that “despite their best efforts to provide helpful details, great customer service and efficient responses,” some DOD components were “still overwhelmed by one or two requesters who try to monopolize the system by filing a large number of requests or submitting disparate requests in groups which require a great deal of administrative time to adjudicate.” The study went on to call out:

"[o]ne particular requester [who] singlehandedly filed three requests with SOUTHCOM [U.S. Southern Command], 53 requests with AFRICOM, 35 requests with SOCOM [Special Operations Command] and 217 requests with OSD/JS [Office of the Secretary of Defense/ Joint Staff] for a total of 308 cases this fiscal year alone. For AFRICOM, this represents 43 percent of their entire incoming requests for the year and 12 percent for SOCOM. This requester holds over 13 percent of the currently open and pending requests with OSD/JS and over the past two years has filed 415 initial requests and 54 appeals with this one component."

If this seems like a lot of requests from one person, it isn't. This is the way the system works. Agencies routinely delay responses (Turse has been waiting more than four years for responses to some of his FOIA requests) when not redacting them to uselessness, forcing requesters to make multiple requests for the same information or related documents, in hopes of actually receiving some information in response to their information requests.

The percentages may seem high, but AFRICOM isn't exactly a popular FOIA target. This focus relates to Turse's ongoing investigative reporting on abusive behavior by US soldiers stationed at bases in Africa. What he has managed to uncover so far isn't pretty, and his reporting on it has won him no friends in the Pentagon.

I made, for instance, a couple hundred attempts to contact the command for information, comment, and clarification while working on an article about criminal acts and untoward behavior by U.S. troops in Africa — sexual assaults, the shooting of an officer by an enlisted man, drug use, sex with prostitutes, a bar crawl that ended in six deaths. Dozens of phone calls to public affairs personnel went unanswered, countless email requests were ignored.

At one point, I called [DoD Chief of Media Engagement Benjamin] Benson, the AFRICOM media chief, 32 times on a single business day from a phone line that identified me by name. He never picked up. I then placed a call from another number so that my identity would be concealed. He answered on the second ring. Once I identified myself, he claimed the connection was bad and the line went dead.

[...]

Today, when I write to the current AFRICOM public affairs chief, Lt. Cmdr. Anthony Falvo, I receive similar treatment. I often get a return receipt back that tells me my email to him “was deleted without being read.” This happened to me, for example, on Thursday, September 10, 2015; Friday, October 2, 2015; Tuesday, October 6, 2015; Thursday, November 5, 2015; Friday, November 27, 2015; Wednesday, February 10, 2016 … you get the picture.

That the DoD finds itself swamped by Turse's requests is its own fault. Had it simply returned the requested documents in a timely fashion, it would not have this Turse-centric backlog to complain about. Now, it's using an official report to portray the FOIA process as unnecessarily burdensome on the government and prone to abuse by tenacious citizens. This portrayal is not only false, but it obscures the fact that the DoD still controls every interaction with FOIA requesters. It has held Turse at arms length for several years and now it won't even answer his emails and phone calls regarding requests it has yet to answer. But in its report, it complains that it's Turse that has broken the system, rather than this being the FOIA system's natural state: that it only works as well as responding agencies want it to.

Filed Under: africom, defense department, dod, foia, nick turse

Shoe Company New Balance Says US Gov't Basically Offered It A Bribe To Support TPP

from the wow dept

We've mostly focused on the impact of the TPP and trade deals on the internet (and also on national sovereignty), because that's the kind of stuff that interests us most around here. We've spent a lot less time looking at the more traditional free trade arguments, in part because that's not nearly as controversial, and in part because -- despite claims to the contrary -- there really aren't that many tariff-related barriers that make a big difference any more. It's generally good to reduce such tariffs, and in response you see the typical response from firms based on whether or not they benefit from those reduced tariffs. The "benefits" of free trade tend to be focused on the companies looking to expand into those markets where tariffs are being lowered or abandoned -- and not so much for companies competing against products from those same countries. Frankly, I find arguments that the companies who freak out about trade deals because it will mean more competition against them a bit tiresome, because I tend to believe competition is a good thing for innovation.

However, the Boston Globe has quite a story about one such company, the sneaker company New Balance, which was quite worried about how the TPP would increase competition from shoemakers in Vietnam. Again, I find those concerns to be overblown, but the next part of the story is where it gets interesting: New Balance is now claiming that it stopped publicly complaining about the TPP after the US government more or less promised it a big government contract, which never came through:

After several years of resistance to the Trans-Pacific Partnership, a pact aimed at making it easier to conduct trade among the United States and 11 other countries, the Boston company had gone quiet last year. New Balance officials say one big reason is that they were told the Department of Defense would give them serious consideration for a contract to outfit recruits with athletic shoes.

But no order has been placed, and New Balance officials say the Pentagon is intentionally delaying any purchase.

New Balance is reviving its fight against the trade deal...

The US government, of course, is insisting the issue of a contract is entirely separate from the TPP, but New Balance said an explicit offer was made. The company notes that while most of the uniform worn by the military is American made, there has always been an exception for sneakers because so few were actually fully made in the US. New Balance apparently decided to change that in hopes of getting a government contract, and the administration more or less said that this would work if New Balance shut up about opposing the TPP:

In 2014, the Pentagon relented. With competition among US manufacturers, officials said they were ready to consider domestically made shoes.

LeBretton said a representative for the Obama administration then asked New Balance to accept a compromise version of the trade deal, partly in exchange for a pledge of help getting the Department the Defense to expedite the purchase of US-made shoes.

The Globe claims that the Defense Department says the reason that it didn't give New Balance a deal was because its shoes weren't durable or cheap enough, but even if that's true, the very idea that the government more or less tried to buy off the company's opposition to the TPP seems highly questionable.

Of course, I wonder, should the TPP get ratified and should the Defense Department then agree that it will only buy American made sneakers... one wonders if Vietnamese sneaker makers would then have an ISDS corporate sovereignty case against the US government? After all, it would be harming "future profits" that the Vietnamese sneaker-makers would have been expecting, and a "buy American" rule could clearly be seen as a non-tariff trade barrier to foreign goods, no?

Filed Under: competition, defense department, shoes, sneakers, tariffs, tpp, ustr
Companies: new balance

Defense Department Agencies Have Been Operating Drones Domestically Without Cohesive Guidelines

from the introducing-the-military's-new-domestic-routes... dept

It's amazing how much stuff government agencies "take seriously" and claim they're handling in accordance to all sorts of secret, but presumably strict, guidelines… once their actions have been exposed.

The Pentagon has deployed drones to spy over U.S. territory for non-military missions over the past decade, but the flights have been rare and lawful, according to a new report.

The report by a Pentagon inspector general, made public under a Freedom of Information Act request, said spy drones on non-military missions have occurred fewer than 20 times between 2006 and 2015 and always in compliance with existing law.

The thing is, the report says there's actually no existing laws that specifically govern military drone flights over US territory.

There are various controlling federal statutes that define what the DoD is authorized to provide to domestic civil authorities. They include Title 10, Title 32, Title 42, and Title 50. There are no federal statutes that specifically address the employment of the capability provided by a DoD UAS if requested by domestic civil authorities.

So, while the Defense Department's Inspector General found it to be compliant with all "laws, regulations and national policies" in deploying its drones domestically, its agencies are really mostly following their own internal guidelines when they do so.

Therefore, DoD and the Military Services have developed a policy framework for the domestic use of the UAS capability in accordance with the authorities granted for generic defense support. The framework also covers executive level policies that were developed to protect fully the legal rights of all United States persons, including freedoms, civil liberties, and privacy rights guaranteed by Federal law.

The report also says drone usage is governed by Executive Order 12333, which is basically like saying the Pentagon is free to cash in its blank domestic surveillance check from the administration whenever it sees fit.

On the plus side, the CIA's drones are only being deployed about twice a year. This indicates it does take its internal restrictions seriously -- far more seriously than other government entities.

"A U.S. Marine Corp UAS unit told us that once each month their wing hosts a community leadership program where local politicians are invited to view and learn about the capabilities of the various aircraft on base," says the report, which comes from the Department of Defense Inspector General’s office. "During one such event, a local mayor requested UAS support to look for potholes in the area.”

That's the problem with giving the local boys an eyeful of military technology. Their eyes go all pinwheely and they start envisioning the most mundane uses for billions of dollars of warfighting equipment. This mayor sees the DoD providing logistical support for the city's pothole patrol. Law enforcement agencies see armored vehicles and assault rifles as being the crucial elements missing from their warrant service duties.

Fortunately, the Marine Corp. -- which owned this particular drone -- found the request did not make "operational sense." One assumes the report was written with eyes perpetually rolling, something that had been restrained with great difficulty ever since the mayor popped the question.

On the other hand, DoD elements do have a legitimate issue with the restrictions -- internal and otherwise -- imposed on domestic drone usage. How are operators supposed to train if they're not allowed to do so on American soil?

Multiple units told us that as forces using UAS capabilities continue to draw down overseas, opportunities for UAS realistic training and use have decreased. UAS unit commanders explained that providing UAS support to civil authorities could yield more realistic training opportunities and increase operational readiness. However, multiple commanders also stated that as a result of the restrictive approval processes for domestic UAS use, policy confusion, and Internal Service hesitations, potential training opportunities are missed.

Live combat zones in foreign nations are probably not the best place for on-the-job training. Every other aspect of military training is largely performed on US military bases. Not so with the DoD's drones, according to the OIG's report. Unfortunately, the office has no idea what to do about it other than recommend the DoD "address the concerns" in the future.

Each component is operating under its own internal guidelines according to the report, which means the DoD has yet to craft a universal policy for domestic drone deployment. This is also listed under the suggested fixes by the OIG. But overall, the Inspector General feels confident the DoD and its components are doing their best to limit use of drones to those clearly aligned with existing laws and policies -- basically following the same rules governing the use of manned military aircraft for domestic surveillance.

Filed Under: defense department, domestic drones, drones

DOM Defense Department Seeks SUB Hackers, Tech Companies For Partnership Built On Distrust

from the how-do-you-do,-fellow-computer-geeks dept

The Department of Defense (home of the NSA!) has decided it's finally time to start looking to outsiders for help securing government systems. It has started a bug bounty program, which in true cyberwar machine fashion, will scare away more helpful hackers than it will gather.

Under the pilot program, known as “Hack the Pentagon,” participants will be required to register and submit to a background check.

Once vetted, hackers will participate in a controlled, limited duration program allowing them to identify vulnerabilities on a predetermined department system.

So, hackers will pretty much need to obtain security clearance to play around in the Defense Department's walled sandbox, which apparently doesn't contain anything the DoD should really be concerned about.

Of course some areas of the Department, such as “critical, mission-facing systems,” will be off-limits during the pilot.

Despite these limitations, Defense Secretary Ash Carter thinks the program will be a success. He believes the DoD and whatever hackers actually make it past the vetting process will "enhance national security" by playing controlled cyberwar games in a controlled environment.

Carter wants to see more cooperative efforts in the future. But his department has been anything but friendly to security researchers and hackers in the past. In an "open letter" to Secretary Carter, Robert Graham of Errata Security points out he's received veiled threats from the DoD in the past targeting his research efforts.

For security research, I regularly "mass scan" the entire Internet. For example, my latest scan shows between 250,000 and 300,000 devices still vulnerable to Heartbleed. This is legal. This is necessary security research. Yet, I still happily remove those who complain and want me to stop scanning them.

The Department of Defense didn't merely complain, but made threats, forcing me to stop scanning them. You guys were quite nasty about it, forcing me to figure out for myself which address ranges belong to the DoD.

An earlier post on the subject of the government's "war on hackers" adds a few more details, along with the possible consequences of not performing research in accordance with the department's "rules."

I have to exclude the DoD from my scans, because they make non-specific threats toward me in order to get me to stop. This Executive Order makes those threats real -- giving the government the ability to declare my scans "malicious" and to seize all my assets. It's the Treasury Department who makes these decisions -- from their eyes, "security research" is indistinguishable from witchcraft, so all us researchers are malicious.

This sort of thing undermines Ash Carter's olive branches and bug bounties. The Defense Department wants help, but only from certain people (those who can pass its vetting process) and only in certain areas, under direct supervision and for a limited time. The areas where intrusions would wreak the most havoc will not have the benefit of having another set of eyes on them.

Carter wants a partnership but partnerships are built on trust. The DoD has threatened researchers in the past and it's now demanding anyone entering its bug bounty program to survive its vetting process. The DoD isn't willing to trust anyone, but it's asking private companies and citizens to lend it some trustworthiness without offering a repayment plan or even an equitable position on the ground floor.

Filed Under: bug bounty, cybersecurity, defense department, hack the pentagon, hacking

Defense Department Tells MuckRock It Will Need To Come Up With $660 Million To Cover FOIA Request Fees

from the in-other-words,-the-GDP-of-Switzerland dept

Nothing quite tells the public to mind its own business like attaching a ridiculous fee demand to an FOIA response. It's pretty easy to price the public out of the transparency market, seeing as it doesn't have access to the monetary resources its tax dollars are paying for.

We've covered a few of the more ridiculous FOIA fee demands here at Techdirt, like:

The City of Ferguson charging $135/hour for FOIA response work -- a rate roughly 10 times the hourly wage of entry-level city clerk's office employees.

The City of McKinney telling Gawker emails related to a police misconduct investigation would run 9,000 hours and cost $79,000.

The Florida State's Attorney's Office demanding $180,000 to turn over records on a questionable suicide.

The FBI telling MuckRock that it would cost $270,000 to respond to an FOIA request about Booz Allen -- and that's with an electronic file "discount" of over $6,000 applied.

MuckRock has now topped that last number… exponentially. Martin Peck's FOIA request for information on the Dept. of Defense's use of "HotPlug" systems (a portable power pack that keeps seized devices from powering down) has resulted in an FOIA fee estimate exceeding a half-billion dollars.

Mr. Robert R. Jarrett, Director of Operations, Defense Procurement Acquisition Policy, and a FOIA Initial Denial Authority, stated that it is possible that contracts that acquired the requested items are present in the Electronic Documents Access (EDA) system; however, there are more than 30 million contracts in EDA, consisting of more than 45 million documents. No method exists for a complete text search of EDA, as some documents are scans of paper copies. The estimated time required to perform the necessary redactions of proprietary data, assuming 20 minutes per document, is estimated to be 15 million labor hours at an estimated cost of $660 million.

While this amount may be couch change for the DoD (0.1% of its $573 billion budget), it's ridiculously out of reach for any US citizen without billions of dollars to their name. Then there's the question of feasibility. Even if every man, woman and child in America tossed MuckRock a couple of bucks to push this request forward, the estimate of 15 million labor hours suggests the DoD will never fulfill it. If the DoD throws 30 people at the problem 24 hours a day without a day off, Peck still shouldn't expect a response until 2073 at the earliest.

This astronomical estimate says two things about the DoD, though. One, it apparently uses these forensic devices frequently enough that searching for responsive documents will be a massive undertaking. Two, it says the Electronic Document Access system is not nearly as useful as its name would suggest, what with document scans not being searchable. This is a government-wide problem and one that no one's too interested in fixing.

Many FOIA responses contain documents scanned at skewed angles using the worst hard copy available. It happens often enough that it almost appears the government is seeking to maintain a level of obfuscation while still paying lip service to transparency. Sure, a released document is better than no response at all, but the insistence on releasing documents capable of defeating OCR software prevents collation of similar documents and thwarts search efforts for relevant info -- both on the government's end and the public's.

This decision will be appealed and the request narrowed significantly, but I imagine the DoD's database will continue to thwart both its FOIA response team and requesters like Peck, for years to come.

Filed Under: defense department, fees, foia

Silk Road 2.0 Court Docs Show US Government Paid Carnegie Mellon Researchers To Unmask Tor Users

from the you-can-browse-privately,-just-don't-expect-your-privacy-to-hold-up-in-court dept

Rumors that the US government used a university's research institute to uncloak Tor users began floating around nearly two years ago. In July of 2014, the first hint that something weird was going on at Carnegie Mellon took the form of a hastily-cancelled Black Hat Conference talk on the subject of de-anonymizing Tor users. Carnegie Mellon's lawyers stepped in and called the whole thing off at the last minute. The thought process at the time was that CMU's legal team may have been concerned the researchers' actions had broken wiretap laws.

Nearly a year-and-a-half later, hints were dropped that CMU's Tor-related efforts may not have been for research purposes only. An anonymous tipster claimed the FBI had paid CMU $1 million to unmask Tor users. A quasi-confirmation popped up during the DOJ's prosecution of Brian Ferrell, who was allegedly assisting Blake Benthall in running Silk Road 2.0. Ferrell and Benthall were both swept up in the wake of a Tor-related FBI raid known as "Operation Onymous," which began a few months after the hastily-cancelled Black Hat talk.

Included in the information handed over to Farrell's legal representative was the following:

On October 13, 2015, the government provided defense counsel a letter indicating that Mr. Farrell’s involvement with Silk Road 2.0 was identified based on information obtained by a “university-based research institute” that operated its own computers on the anonymous network used by Silk Road 2.0.

Tor Project itself claimed it had noticed a series of attacks during the first six months of 2014, seemingly aimed at de-anonymizing users. The unmasking efforts it noticed occurred shortly before the FBI Silk Road 2.0 raids. All of this was disturbing but also very circumstantial. Both CMU and the FBI (very weakly) denied any involvement in the unmasking effort. Notably, both parties only specifically denied the payment aspect, with CMU reps saying they "were not aware of any payment" and the FBI stating the allegation it had paid CMU $1 million was "inaccurate" -- which is not nearly the same thing as saying the allegation was false.

Three months after the FBI rumor/tip, the government's use of CMU to de-anonymize Tor users has been confirmed. The only aspect that appears to be incorrect is the agency behind the effort. Joseph Cox at Motherboard has the details.

[B]oth the name of the university and the existence of a subpoena have been confirmed in a recent filing in one of the affected criminal cases.

“The record demonstrates that the defendant's IP address was identified by the Software Engineering Institute (“SEI”) of Carnegie Mellon University (CMU”) [sic] when SEI was conducting research on the Tor network which was funded by the Department of Defense (“DOD”),” an order filed on Tuesday in the case of Brian Farrell reads. Farrell is charged with conspiracy to distribute cocaine, heroin, and methamphetamine due to his alleged role as a staff member of the Silk Road 2.0 dark web marketplace.

“Farrell's IP address was observed when SEI was operating its computers on the Tor network. This information was obtained by law enforcement pursuant to a subpoena served on SEI-CMU,” the filing continues.

So, the DoD "hired" CMU researchers to find ways to unmask Tor users. It's probably worth noting here that the NSA... is a part of the DoD. The FBI was not directly involved, as alleged earlier, nor did it hand $1 million to CMU to facilitate its efforts. However, it was Johnny-on-the-Spot when it came to issuing subpoenas for Tor user info. Not that it's interested in discussing its fortuitous timing…

When asked how the FBI knew that a Department of Defense research project on Tor was underway, so that the agency could then subpoena for information, Jillian Stickels, a spokesperson for the FBI, told Motherboard in a phone call that “For that specific question, I would ask them [Carnegie Mellon University]. If that information will be released at all, it will probably be released from them.”

The buck has been passed, but CMU refuses to touch it.

Kenneth Walters, a spokesperson from CMU, told Motherboard in an email, "We have nothing to add beyond our Nov. 18 statement."

This statement says nothing more than CMU receives subpoenas from time to time and hints that everybody is probably wrong about everything because "inaccurate media reports."

Farrell's lawyers have tried to obtain more details on CMU's DoD-funded de-anonymization efforts, but the judge has denied further discovery along these lines. Judge Richard A. Jones, echoing the judge presiding over the FBI's now-infamous "Playpen" case (where the FBI ran a seized child porn site as a honeypot for two weeks), says there's no expectation of privacy in an IP address, even if said IP address was obscured by the use of Tor.

“SEI's identification of the defendant's IP address because of his use of the Tor network did not constitute a search subject to Fourth Amendment scrutiny,” the order reads.

In short, there's no expectation of privacy in the use of a service specifically designed to protect users' privacy. Users may believe they have an expectation of privacy but it's a belief that won't be upheld by this nation's courts. Efforts made by the government to strip this protection away are not viewed as intrusive -- at least not in the Fourth Amendment sense of the word.

So, nearly two years later, the story coheres: the Department of Defense has been seeking ways to unmask Tor users with the assistance of CMU's researchers. And all the while, the FBI has apparently been looking over the DoD's shoulder and firing off subpoenas. No one involved wants to talk about it and now it appears they won't have to, thanks to Judge Richard Jones.

Filed Under: anonymity, defense department, dod, fbi, tor, unmasking
Companies: carnegie mellon, silk road 2.0

Dept. Of Defense Defends Strong Encryption While Its Impetuous Child -- The NSA -- Continues To Lament The Coming Darkness

from the somewhat-admiral-able-(I-AM-SO-SORRY) dept

Between the FBI and the NSA, arguments against encryption that locks bad guys out (and, consequently, the government) have filled the air over the past several months. "Going dark" is the repeated concern, as if encryption would leave the nation's intelligence and investigative agencies without any options to pursue terrorists/child pornographers. It's all FUD and it's all dangerous, because carving small holes in encryption CARVES HOLES IN ENCRYPTION. Never mind the intended uses of golden keys/backdoors. A hole is a hole.

The Department of Defense seems to recognize this fact, making it one of the only government entities involved in fighting worldwide terrorism to openly do so. Bruce Schneier asked Admiral James Winnefeld Jr. (vice-chairman of the Joint Chiefs of Staff) a question about encryption during a recent cybersecurity summit (video here -- relevant part at 32:52) and received something almost entirely removed from the current party line.

Bruce Schneier: I'd like to hear you talk about this need to get beyond signatures and the more robust cyber defense and ask the industry to provide these technologies to make the infrastructure more secure. My question is, the only definition of "us" that makes sense is the world, is everybody. Any technologies that we've developed and built will be used by everyone -- nation-state and non-nation-state. So anything we do to increase our resilience, infrastructure, and security will naturally make Admiral Rogers's both intelligence and attack jobs much harder. Are you okay with that?

Admiral James A. Winnefeld: Yes. I think Mike's okay with that, also. That's a really, really good question. We call that IGL. Anyone know what IGL stands for? Intel gain-loss. And there's this constant tension between the operational community and the intelligence community when a military action could cause the loss of a critical intelligence node. We live this every day. In fact, in ancient times, when we were collecting actual signals in the air, we would be on the operational side, "I want to take down that emitter so it'll make it safer for my airplanes to penetrate the airspace," and they're saying, "No, you've got to keep that emitter up, because I'm getting all kinds of intelligence from it." So this is a familiar problem. But I think we all win if our networks are more secure. And I think I would rather live on the side of secure networks and a harder problem for Mike on the intelligence side than very vulnerable networks and an easy problem for Mike. And part of that -- it's not only the right thing do, but part of that goes to the fact that we are more vulnerable than any other country in the world, on our dependence on cyber. I'm also very confident that Mike has some very clever people working for him. He might actually still be able to get some work done. But it's an excellent question. It really is.

Fittingly, the Department of Defense recognizes the importance of defense. Adding backdoors to encryption weakens defenses, including those used by government agencies and operatives. You can't simply introduce circumvention and pray that nobody other than approved parties make use of it. The FBI/NSA's obsession with government-ordered peepholes makes everything worse for everyone, not just their intended targets.

But these agencies are wholly unconcerned about collateral damage. It's clearly evident from their bulk surveillance programs and use of intercepts that gather everything before searching the data haul for incriminating material or useful intel. Encryption is at odds with haystacking, which these agencies continue to prize highly (and defend heatedly) despite clear evidence that intelligence gathering like this is inefficient at best, and wholly useless at worst.

Schneier goes on to point out that Admiral Mike Rogers, the head of the NSA, continues to push a narrative at odds with the DoD official's answer. Two weeks after this conference, Rogers gave a keynote address at CyCon, repeating his unfounded belief that encryption can be "safely" bypassed without compromising it.

Rogers said a framework to allow law enforcement agencies to gain access to communications is in place within the phone system in the United States and other areas, so "why can't we create a similar kind of framework within the internet and the digital age?"

He added: "I certainly have great respect for those that would argue that the most important thing is to ensure the privacy of our citizens and we shouldn't allow any means for the government to access information. I would argue that's not in the nation's best long term interest, that we've got to create some structure that should enable us to do that mindful that it has to be done in a legal way and mindful that it shouldn't be something arbitrary."

So, the Dept. of Defense says one thing, Mike Rogers (who was in the audience at the first conference) nods in agreement, and then goes on to contradict the stance of those helming the department directly above it in the government's organizational chart.

Rogers' nod to privacy is every bit as meaningless as his faux nod in agreement to Winnefeld's statement. There's very little being done by the NSA to "ensure" the "privacy" of American citizens. One only has to look at its purposeful weakening of NIST standards to see evidence of that. The FBI and NSA are more than willing to respect citizens' rights, but only if doing so doesn't make their intelligence gathering any more difficult. Privacy is always subservient to these agencies' ends, no matter how many statements they offer up that begin with lip service to privacy before adding, "but…"

Filed Under: admiral mike rogers, bruce schneier, defense department, encryption, going dark, igl, james winnefeld, nsa, strong encryption

Judge Looking Into Alleged Destruction Of Exculpatory Evidence By Pentagon In Thomas Drake Prosecution

from the but,-but-he-broke-the-rules!-[breaks-doc-destruction-rules] dept

More government malfeasance is being alleged in the all-over-but-the-Genius-Bar-employment prosecution of whistleblower Thomas Drake. Documents directly related to his whistleblowing efforts -- ones that would possibly have helped him fight the administration's efforts to punish him for supposedly-protected activities -- were allegedly destroyed by the Department of Defense.

Two government watchdog agencies are investigating whether the Pentagon inspector general destroyed evidence improperly during the high-profile leak investigation of former National Security Agency senior official Thomas Drake.

“DOD OIG’s handling of documents . . . is within the scope of an ongoing inquiry by the Office of Special Counsel (OSC),” Raymond Hulser, the chief of the Justice Department’s Public Integrity Section, wrote to U.S. Magistrate Judge Stephanie Gallagher in a letter dated June 11. “In the event that OSC finds evidence of criminal conduct during the course of its work, it will refer that evidence to the Department of Justice for appropriate action.”

Succinctly put, the "proper channels" for whistleblowing were used by Thomas Drake, who was prosecuted under the Espionage Act. The missing files are related to his attempt to utilize those proper channels. Obviously, following procedures can't really be considered "espionage." The government's case against Drake fell apart, resulting in Drake pleading guilty to a single "unauthorized computer use" charge. But the case went on long enough that it drained Drake's personal savings and his revoked security clearance pretty much barred him from further government employment, leading to his current position as an employee of an Apple store.

The government’s handling of documents first became an issue during the evidence-gathering stage of Drake’s prosecution, when his criminal defense lawyers sought records related to his whistleblower cooperation with the Pentagon inspector general’s office in order to defend him.

At the time, the Justice Department told the judge that most of the “hard copy documents” related to the Pentagon inspector general’s office audit that Drake had cooperated with couldn’t be provided to the defense because they’d been destroyed “pursuant to a standard document destruction policy.”

Drake’s current lawyers, who didn’t represent him in the criminal case, told the court in a letter in April that they learned otherwise while representing Drake in his recent whistleblower claim against the NSA.

Drake’s lawyers wrote that the Pentagon inspector general’s office destroyed the documents “outside of normal policy and to impede . . . the criminal case.”

Even if these documents do somehow materialize, there's not much they can do other than vindicate Drake's actions. It won't rebuild his personal finances or return him to his former government position. In fact, even if evidence of wrongdoing is uncovered, it's likely to result in no meaningful actions. The court itself can't do much more than refer the findings to the Department of Justice, which has already noted that it is looking into these allegations. But to what end? Proof of deliberate destruction of evidence is the sort thing routinely wrist-slapped by the DOJ and the administration, both of which will probably allow the DOD to investigate itself and offer various plans to prevent future malfeasance, should it somehow manage not to clear itself of any wrongdoing.

If evidence of document destruction comes to light, the only practical purpose it will serve is to further illustrate how rigged the "justice" card game is -- what with prosecutors playing with incomplete, marked decks provided to them by "victims" of government whistleblowing.

Filed Under: defense department, evidence, nsa, thomas drake

Pentagon Offered 'FOIA Terrorist' Jason Leopold A Stack Of Documents To Just Shut Up And Go Away Forever

from the citing-exemption-'for-the-love-of-god-leave-us-alone'-[(b)404] dept

Jason Leopold has so thoroughly aggravated naturally-secretive government agencies that he has earned the nickname "FOIA terrorist." He routinely files two dozen FOIA requests a week, along with MDRs (Mandatory Declassification Reviews), which force the government to more closely examine documents it has previously withheld in full.

In the course of these activities, Leopold has also filed numerous FOIA lawsuits against government agencies for withholding documents, not performing thorough searches or exceeding the statutory time limits for responses.

Several government agencies hate him. One government agency hates him so much it offered him a one-time deal bordering on illegality.

In his testimony in front of the House Committee on Oversight and Government Reform, Leopold gave up both the agency and its questionable offer.

Leopold: The Office of Net Assessment (ONA) is the Pentagon’s in-house think tank. They spend millions and millions of dollars putting together reports — reports that they contract out about perhaps some futuristic warfare, or what the situation in the Middle East is going to look like with regards to oil. I asked for those reports. I filed a FOIA request; they refused to comply with my FOIA request. They said it was too broad. I narrowed it, they still said it was too broad. I sued them. Recently they said that ‘We’ll give you some documents as long as you promise to never file a FOIA request again and don’t have anyone else file a FOIA request on your behalf.’

Rep. Mark DeSaulnier (D-Calif.): How is that legal?

Leopold: I don’t know but they put this in writing and I’m really looking forward to the day when I write this story up.

This is what one agency was prepared to do just to keep Leopold out of its file cabinets.

But it's not just overt actions like these. It's the little things agencies do to frustrate FOIA requesters, especially journalists like Leopold who are looking for timely information rather than just information. In his testimony, Leopold points out that agencies routinely stonewall journalists in hopes of discouraging them from making further inquiries. If they can delay a release past the point of relevance, it's a PR win for them, especially if the information requested is less than flattering.

As you know, FOIA requires an agency to make a determination on releasing records within 20 business days. An extension of 10 business days is available in “unusual circumstances.” I have submitted thousands of FOIA requests to dozens of different agencies, and in my experience, fewer than one percent of my requests have been decided within the timeframe required by FOIA. My colleagues have had similar experiences.

I routinely experience delays of several years...

Case in point: Leopold's FOIA request for information related to incoming DOJ head Loretta Lynch.

My request to the Executive Office of the United States Attorneys for records about Loretta Lynch illustrates the problems that investigative journalists face in using FOIA. I submitted my request the day that Loretta Lynch’s nomination was announced by President Obama. I sought expedited processing because the records I was requesting relate to Lynch’s performance of her duties as United States Attorney for the Eastern District of New York. When the agency did not rule on my request for expedited processing within the time period allowed by FOIA, I immediately filed suit. The agency conceded that the topic of my request is a “matter of widespread and exceptional interest,” but insisted that it should not have to even begin releasing records for several months. My attorney filed several emergency motions requesting that the Department of Justice process my request and produce records before Lynch’s confirmation hearing, but the judge presiding over the case indicated that he would not have time to rule on the motions for more than a month.

After Lynch was confirmed, my request for expedited treatment became moot. To date, the agency has still not processed the documents I requested.

As he points out, this sort of behavior achieves exactly what the foot-dragging agencies hope it will: it discourages journalists from using FOIA requests in their news gathering. And every journalist persuaded to look elsewhere is one more chance to keep information out of the public's hands.

Then there are the loopholes. Some of these abused exemptions have been addressed by amendments to FOIA laws, but there are still plenty of exploitable areas.

Congress deliberately chose the words “records or information” when it amended Exemption 7 in 1974. Prior to that time, investigatory files compiled for law enforcement purposes were exempt. The problem was that agencies could simply place documents that they wanted to withhold from disclosure inside an investigatory file, and then treat the document as exempted simply because of its location. The 1974 amendment was designed to fix this problem by eliminating the blanket exemption for government records simply because they were found in investigatory files compiled for law enforcement purposes.

Notwithstanding Congress’s clear intention and the plain language of FOIA after the 1974 amendment, the FBI continues to withhold information where the record requested “is located in an investigative file which is exempt from disclosure pursuant to 5 U.S.C. 552(b)(7)(A)” (emphasis added). I have received dozens of denial letters from the FBI based on this erroneous interpretation of FOIA, and the Department of Justice’s Office of Information Policy has affirmed the FBI’s decision in every administrative appeal I have filed. The FBI has not defended its position in court, but instead conducts a new review applying the proper standard once litigation has commenced. As a result, the issue becomes moot.

According to Leopold, the worst agencies to deal with in terms of FOIA requests are the usual suspects: the FBI, the DOJ and the US Southern Command. Thanks to Snowden's prompting of additional interest in the "intelligence community," the NSA has been added to that list.

The oversight committee has its eye on FOIA reform and the government could use a swift kick right in the exemptions. But whether or not a so-called "terrorist's" assertions about near-bribes and SOP stonewalling will push it in that direction remains to be seen.

Filed Under: defense department, foia, intimidation, jason leopold, transparency