Clapper: The Attacks We Didn't Prevent In The Past Can't Be Prevented In The Future If Section 215 Is Allowed To Die

from the faith-based-surveillance dept

Over a decade has passed since the 9/11 attacks, and the intelligence community still won't let the attack it didn't prevent be laid to rest. It is exhumed over and over again -- its tattered remains waved in front of legislators and the public, accompanied by shouts of, "YOU SEE THIS?!? THIS IS WHAT HAPPENS WHEN WE DON'T GET OUR WAY!"

It's grotesque and ghastly and -- quite frankly -- more than a little tiresome. The NSA's Section 215 program is set to expire on June 1st and James Clapper is making statements in its defense -- statements that read like someone attempting to sound more disappointed than angry. But this is James Clapper speaking, and all prior evidence points to him being unwilling to make any concessions on the domestic surveillance front.

Here's what he had to say about the impending death of the bulk phone records collection:

"In the end, the Congress giveth and the Congress taketh away," he said. "If the Congress, in its wisdom, decides the candle isn't worth the flame, the juice isn't worth the squeeze, whatever metaphor you want to use, that's fine."

"The intelligence community will do all we can within the law to do what we can to protect the country. I have to say that every time we lose another tool in our toolkit, it raises the risk," he added. "If that tool is taken away from us, 215, and, some untoward incident happens which should have been thwarted had we had it, I hope everyone involved in that decision assumes the responsibility and it not be blamed, if we have another failure, exclusively on the intelligence community."

The subtext is clear and Jason Koebler at Vice spells it out succinctly: Kill Section 215, but don't blame us if another 9/11 happens.

The intelligence community continues to argue -- without evidence -- that the program has aided in combating terrorism. It can't say how or offer any details as to attacks thwarted, but it makes the assertion all the same. The Privacy and Civil Liberties Oversight Board (PCLOB) has access to intelligence documents most Americans will never see and yet it came to this conclusion: the bulk records program is both useless and a violation of civil liberties.

Clapper's defense of the program seems to be faith-based. In a single clumsy metaphor, Clapper summons the spirit of two Simpsons characters.

"215, to me, is much like my fire insurance policy for my home," he said. "The house never burns down, but I buy fire insurance, just in case."

Lisa Simpson argued against Homer's specious "bear patrol" reasoning by claiming a rock she found on the ground could keep tigers away -- noting that the lack of nearby tigers "proved" the rock worked. This is Clapper's sales pitch: the lack of another 9/11 attack is "proof" the program is necessary. Well, we haven't had a Summer Olympics hosted in this country since 1996, so it could also be claimed that Section 215 of the PATRIOT Act has been instrumental in preventing the US from hosting this extremely destructive parasite momentous event. After all, the roots of Section 215 also trace back to a 1990s partnership between the NSA and DEA to collect phone records on calls to foreign countries originating in the US.

Ned Flanders -- perhaps the most upstanding (and naïve) Springfieldian -- notably considered insurance coverage to be a form of gambling. Clapper's "gamble" -- his supposed "insurance" -- bets on surveillance state wins while putting Americans' privacy up as collateral. Even when viewed through Clapper's twisted perspective, the metaphor fails.

The difference here, is that the NSA's "insurance" is intrusive information on just about every citizen in the United States, regardless of whether or not they've done anything wrong.

The defenders of the surveillance framework always point to attacks they didn't prevent (like the Boston Bombing) as justification for intrusive spy programs. That argument alone should be greeted with riotous, disbelieving laughter. But they press this even further, giving themselves credit for every lull between major attacks and ignoring every report or investigation that shows their favorite programs do little more than make the job of counterterrorism more difficult.

Clapper seems to believe the death of the Section 215 program will be the death of us all. It's an absurd belief. Unfortunately, it's shared by far too many of those in the position to prevent its expiration.

Filed Under: james clapper, nsa, odni, patriot act, patriot act reauthorization, section 215, surveillance, terrorism

James Clapper Claims That Sony Hack 'The Most Serious Cyberattack On The US Yet'; Which Suggests No Serious Cyberattacks

from the go-on-with-your-day dept

At a cybersecurity conference at Fordham university, Director of National Intelligence James Clapper apparently claimed that the Sony Hack was "the most serious cyberattack" made to date against the US. If that's true (and it's likely not), then that really kind of undermines all the claims about just how "serious" cyberattacks are to national security. Yes, the Sony Hack was incredibly embarrassing to Sony and some individuals and partners. Yes, it may cost Sony a significant amount of money in cleaning up the mess. But no one died. No serious long-term problems were created by it. No one has to "rebuild" a city. The actual impact of the hack on the day-to-day lives of most people is next to nothing. For years, people like Clapper have been warning of the pending "cyber Pearl Harbor," and if this is the best they've got so far... sorry, but that's just not that serious.

At the same event, Clapper apparently insisted not only that he was sure North Korea was behind the hack, but that he knew who ordered it. He also revealed some more info on the (little known) fact that he had traveled to North Korea two weeks before the hack, where he met with the guy he now says is responsible. Marcy Wheeler raises some questions about whether Clapper's trip had something to do with the hack (if it really was done by North Korea).

Speaking of which, at the very same event, FBI director James Comey, once again, insisted that North Korea was responsible and claimed that the hackers "got sloppy" and revealed their own IP addresses. It could be that. Or whoever did it could have been slightly more sophisticated, leaving false markers pointing to North Korea. But, as of right now the FBI is sure that sloppiness is a better excuse.

Either way, it still seems like much more is being made of the Sony Hack than it deserves. Yes, it was a big hack, and yes, it revealed a ton of private documents that clearly has embarrassed Sony quite a bit. But if the future of war involves embarrassing big companies, rather than killing thousands of people -- I think I'd make that trade off.

Filed Under: cybersecurity, james clapper, odni, sony hack
Companies: sony

Newly-Released Documents Show NSA Claiming An Email Address Is A 'Facility,' Skirting Probable Cause Requirements

from the so,-you-know,-more-of-the-same dept

If it's late Friday afternoon and the public's attention is focused elsewhere, it must mean it's time for another document release from James Clapper's office (ODNI). The heavily-redacted documents dumped by the ODNI deal with the precursors to the FISA Amendments Act (FAA): the Terrorist Surveillance Program (TSP) and 2007's interim legislation (Protect America Act or PAA) that bridged the gap between the TSP and the FAA.

The most interesting document in the release is an April 3, 2007 order [pdf link] from the FISA court which contains some rare hesitation from a FISA judge (Roger Vinson) as he deals with the NSA's desire to capture communications without providing probable cause support for its actions.

A footnote attached to the first paragraph of the order makes it clear Judge Vinson felt he was drifting into uncharted waters, with much of that being due to the NSA's shifting definitions of surveillance terms in its previous legal arguments.

This order and opinion rests on an assumption, rather than a holding, that the surveillance at issue is 'electronic surveillance' as defined at 50 U.S.C. 1801(f), and that the application is within the jurisdiction of this Court.

Vinson's order points out that the NSA attempted to change the rules of its interception program, both in terms of the evidence it provides as well as its desire to collect communications of known US persons.

Until recently, these were the only circumstances in which the government had sought, or this Court had entered, a FISA order authorizing electronic surveillance of the telephone or e-mail communications of suspected international terrorists. However, on December 13, 2006, in Docket No. [redacted], the government filed an application seeking an order that would authorize the electronic surveillance of telephone numbers and e-mail addresses thought to be used by international terrorists without a judge's making the probable cause findings described above, either before the initiation of surveillance of within the 72 hours specified in 1805(f)...

The NSA claimed in its support memos that the probable cause finding was preventing the agency from working at maximum efficiency, causing it to fall behind a constantly moving terrorist threat. In addition, its January 2007 requests included one seeking permission to collect communications from known US persons, again without meeting even the lowered bar of probable cause required by the FISA court. While the court did hand down a number of stipulations, it allowed the NSA to use its proposed "emergency FISA application" to skirt probable cause requirements and the 72-hour notice period. It also granted this for rolling 90-day periods, subject to renewal. By doing this, the FISA court turned "emergency" surveillance into the new normal.

Beyond that, the NSA also sought to expand its set of "selectors." Previously, email addresses and phone numbers known to be used by (or about to be used by) members or agents of "foreign powers" or other redacted terrorist organizations were the only ones allowed to be used as selectors when collecting communications. In these applications, the NSA wanted to start contact chaining -- tasking email addresses or phone numbers that referred to previous selectors as new selectors. Judge Vinson's order notes that there's no way the NSA can hope to meet the probable cause requirement by doing this.

The acquisition of e-mail communications because they refer to a selector e-mail address does not appear to have been authorized under FISA prior to Docket [redacted] and is discussed further below.

The "further discussion" includes Vinson highlighting this relevant part of the FISA court's probable cause requirements.

(B) each of the facilities or places at which the electronic surveillance is directed is being used, or is about to be used, by a foreign power or an agent of a foreign power.

Because the NSA couldn't credibly claim that these new guilty-by-association selectors are being used by the targets it was authorized to collect from, the agency deployed a number of word games. Vinson points out that one memorandum of law defines "facilities" one way (more traditionally as an operations base), while the most recent one defined the word quite differently. (In particular, the NSA maintained that an email address or phone number is a "facility" in and of itself, simply because both "facilitate the transmission of communications." Footnote on page 32.)

Underlying the government's position, therefore, is the premise that 1805(a)(3)(B) can be applied so variously that a FISA judge has great discretion in determining what "facilities" should be the subject of the judge's probable cause analysis.

Much of what follows is redacted, especially where further clarification would be extremely useful. Reading between the black blocks, it appears the NSA attempted to argue that the collection of communications was distinct from the term "electronic surveillance," except for the gathering of internet communications, which it claims is synonymous with the statutory definition. After reading through the government's multiple citations (most of which the judge deems irrelevant) in support of its seemingly contrary arguments, Vinson arrives at this conclusion.

Tellingly, none of the cited eases stand for the proposition on which this application rests that electronic surveillance is not 'directed' at particular phone numbers and e-mail addresses.

That would be the NSA's argument that a "facility" can be an email address, except for the times when the more traditional definition allows it to cast a wider net. Vinson further points out that accepting the NSA's arguments means discarding the intent of Congress and removing the court's ability to act as a check against executive branch overreach.

However, even if the statutory language were as elastic as the government contends, it would still be incumbent on me to apply the language in the manner that furthers the intent of Congress. In determining what interpretation would best further congressional intent, it is appropriate to consult legislative history. That legislative history makes clear that the purpose of pre-surveillance judicial review is to protect the fourth amendment rights of US persons. Congress intended the pre-surveillance "judicial warrant procedure," and particularly the judge's probable cause findings, to provide an "external check" on executive branch decisions to conduct surveillance.

Contrary to this intent of Congress, the probable cause inquiry proposed by the government could not possibly restrain executive branch decisions to direct surveillance at any particular individual, telephone number or e-mail address.

[...]

Thus, under the government's interpretation, the judge's probable cause findings have no bearing on the salient question: whether the communications to be acquired will relate to the targeted foreign powers. As discussed below, the government would have all of the probable cause findings bearing on that question made by executive branch officials, subject to after-the-fact reporting to the Court, through processes characterized by the government as minimization. That result cannot be squared with the statutory purpose of providing a pre-surveillance "external check" on surveillance decisions, or with the expectation of Congress that the role of the FISA judge would be the same as that of judges under existing law enforcement warrant procedures.

He concludes:

I am unable, on the basis of the facts submitted by the applicant, to find probable cause to believe that each of these facilities "is being used, or is about to be used, by a foreign power or an agent of a foreign power." The application contains no facts that would support such a finding.

In this, we see the NSA behaving much like its spiritual brethren in law enforcement and investigative agencies -- seeking to route around probable cause requirements under the pretense that bad guys will always be at least one step ahead if the government is forced to follow the rules. Rather than stay within the confines, the NSA plays word games in an effort to bypass governing statutes. The agency has demonstrated repeatedly that it has little desire to work within the framework of the law and has on multiple occasions attempted to short-circuit the system by feeding the court bad information and pursuing elliptical legal arguments. The end result is the current surveillance framework, thanks to the FISA Amendments Act's codifying of the NSA's questionable collections under the Protect America Act.

Filed Under: 4th amendment, email, james clapper, nsa, odni, probable cause, surveillance

Former NSA, CIA Director Claims Only ISIS Likes USA Freedom Act, Even As James Clapper Supports It

from the ridiculousness dept

As the cloture vote is set to happen tonight on the Senate version of the USA Freedom Act, the hysterics are getting... well, more hysterical. Michael Hayden (former NSA and CIA director) and Michael Mukasey (former Attorney General) have an opinion piece in the Wall Street Journal dubbing the bill "NSA Reform That Only ISIS Could Love," which is kind of hilarious given that current Director of National Intelligence, James Clapper (who usually sings in perfect harmony with Hayden) has come out in support of the bill. While the bill has some problems, it is still a step forward (and yes, I'm aware that not everyone agrees with that). But Hayden/Mukasey make a bunch of statements that are just not at all accurate. It starts off with the usual FUD about ISIS and then questions why Reid would present this bill given that:

In that threat environment, one would think that the last thing on the “to do” list of the 113th Congress would be to add to the grim news. Yet Senate Majority Leader Harry Reid has announced that he will bring to the floor the extravagantly misnamed USA Freedom Act, a major new bill exquisitely crafted to hobble the gathering of electronic intelligence.

Except that's not true. The bill is not designed to "hobble" electronic intelligence, but to respect at least some of our 4th Amendment rights, and to bar mass collection of the information without limits. Then there's this:

For starters, the bill ends the National Security Agency’s bulk collection of what is called telephone metadata. This includes the date, time, duration and telephone numbers for all calls, but not their content or the identity of the caller or called, and is information already held by telephone companies. The bill would substitute a cumbersome and untried process that would require the NSA, when it seeks to check on which telephone numbers have called or been called by a number reasonably associated with terrorist activity, to obtain a warrant from the Foreign Intelligence Surveillance Court, or FISA court, and then scurry to each of the nation’s telephone-service providers to comb through the information that remains in their hands rather than in the NSA’s.

First off, they're simply wrong. It doesn't require a warrant, but a FISA court order under Section 215. It just limits how broad those orders can be. The reason it's not a warrant is you can't get such a broad warrant. Second, the "cumbersome and untried process" is neither cumbersome nor untried. It's how lots of investigations work today. When law enforcement needs info, it goes to court, gets a court order, and voila. And does anyone actually believe, in this digital age, that there's any actual "scurrying"? Hell, to make this process easier for the DEA in the past, AT&T was willing to embed employees with the DEA to give them faster access to the database. If anything, these are reasons why the bill doesn't go far enough. The idea that it somehow takes away US intelligence capabilities is ludicrous. Furthermore, it's already been noted that ISIS knows how to evade such surveillance: by not using electronic communications. So this has nothing to do with ISIS at all. At all.

Nothing in the bill requires the telephone companies to preserve the metadata for any prescribed period. Current Federal Communications Commission regulations impose an 18-month retention requirement, but administrative regulations are subject to change. It isn’t hard to envision companies that wish to offer subscribers the attraction of rapid destruction of these records, or a complaisant bureaucracy that lets them do it.

So we shouldn't pass this bill because at some future date the FCC might possibly allow companies not to keep these records? Really?

The bill’s imposition of the warrant requirement on the NSA would be more burdensome than what any assistant U.S. attorney must do to get metadata in a routine criminal case, which is simply to aver that the information is needed in connection with a criminal investigation—period.

Again, misleading in the extreme. When the DOJ is seeking metadata in a criminal case, it's seeking specific metadata concerning the crime being investigated. This is about stopping the collection of all phone records. Notice that Hayden and Mukasey never bother to explain this distinction. Because they're being incredibly dishonest.

There's much more in there, but nearly all of it is dishonest. It claims that "there is no immediate or emergency need" for the bill, totally leaving out the systematic violation of Americans' 4th Amendment rights and an independent review board finding the program illegal and unconstitutional and a President who asked Congress to end the program. Yet, Hayden and Mukasey insist this program -- which has yet to show a single successful example of being used to prevent terrorism -- has to remain in place? Really?

And, of course, Hayden and Mukasey have friends. Incoming Senate Majority Leader Mitch McConnell similarly called out the specter of ISIS, despite the fact it's widely acknowledged that ISIS already knows how to avoid our surveillance efforts (and is focused on the middle east, while the USA Freedom Act is just about domestic phone records inside the US).

The USA Freedom Act has its problems, but it also has some important and useful aspects. The claim that it will somehow help ISIS by preventing such bulk data collection is simply ridiculous and untrue.

Filed Under: bulk collection, fud, isis, james clapper, michael hayden, michael mukasey, patrick leahy, surveillance, usa freedom act

James Clapper's Report On Progress Towards President's Surveillance Reforms Mainly Explores Executive Branch Loopholes

from the not-so-much-what-it-can-do,-but-what-it-can-get-away-with dept

James Clapper, the Director of National Intelligence, has issued an interim report on the intelligence community's minimal progress towards minimal compliance with the minimal reforms ordered by the administration last year in response to the Snowden leaks. Presidential Policy Directive 28 (PPD-28) was issued in January and Jame Clapper's office is proud to announce that it's still in the process of thinking about complying with the stuff the President asked them to do so many months ago.

As we work to meet the January 2015 deadline, PPD-28 called on the Director of National Intelligence to prepare an interim report on the status of our efforts and to evaluate, in coordination with the Department of Justice and the rest of the Intelligence Community, additional retention and dissemination safeguards.

The DNI's interim report is now being made available to the public in line with our pledge to share as much information about sensitive intelligence activities as is possible, consistent with our national security.

We're blown away with all the openness, Mr. Clapper. This must be the same transparency that has seen Clapper's office dump documents without referencing the federal lawsuits prompting this "largesse." Or the same transparency that tossed out the above-mentioned presidential directive -- one month after it went public -- with a self-congratulatory Tumblr post. (Yes. That is the world we live in now. The Director of National Intelligence speaks to the public through Tumblr, a venue more known for its porn gifs and faint odor of Yahoo! desperation. Thanks, Obama Snowden.)

At this point, the interim effort is mostly talk. There's little that indicates any movement has been made towards the goals of the directive. In fact, any detectable movement is limited to shrugs of deference towards the Executive Branch, as the EFF points out.

Here are a few choice sections from our initial read of today's report:

"To that end, PPD-28 states that personal information of non-U.S. persons shall be retained and disseminated only if the retention and dissemination 'of comparable information concerning U.S. persons would be permitted under section 2.3 of Executive Order 12333.'"

We are disheartened to see ODNI pinning its privacy protections to Executive Order 12333. EO 12333 is a poorly-understood Reagan-era authority; one former State Department chief said:

"…Section 215 permits the bulk collection only of U.S. telephone metadata — lists of incoming and outgoing phone numbers — but not audio of the calls.

Executive Order 12333 contains no such protections for U.S. persons if the collection occurs outside U.S. borders. Issued by President Ronald Reagan in 1981 to authorize foreign intelligence investigations, 12333 is not a statute and has never been subject to meaningful oversight from Congress or any court…"

Repeatedly, the interim report addresses the new ideals… and then immediately appends, "unless EO 12333 says we can do otherwise." Admittedly, this flaw traces back to the administration's directive, which contains much of the "unless EO 12333" language referred to in the report.

Somewhat surprisingly, the ODNI's report calls out the overly-broad language contained in EO 12333.

Executive Order 12333 defines this term as "information relating to the capabilities, intentions, or activities of foreign governments or elements thereof, foreign organizations, foreign persons, or international terrorists." This definition ensures that the Intelligence Community is able to retain and disseminate information necessary for the United States to advance its national security and foreign policy interests. Nonetheless, the definition's reference to "information relating to . . . activities of. . . foreign persons,' if read literally, could permit an element to permanently retain or to disseminate any information about any activity of any foreign person. Intelligence Community elements should permanently retain or disseminate such personal information only if the personal information relates to an authorized intelligence requirement, is reasonably believed to be evidence of a crime, or meets one of the other standards for retention or dissemination identified in section 2.3 of Executive Order 12333 for U.S. person information, and not solely because of the person's non-U.S. person status.

The EFF asks if the NSA has ever used this reading to its own advantage. Certainly no answer is expected, but the agency has long been a fan of fluid terms and malleable definitions. Which brings us to the ultimate show of executive branch deference, albeit one that implies the administration will help the agency do the things it really wants to, Presidential Policy Directive or no.

It is important that elements have the ability to deviate from their procedures when national security requires doing so, but only with approval at a senior level within the Intelligence Community element and notice to the DNI and the Attorney General.

Even the most modest of reforms still apparently needs ample breathing room and the ODNI carves out plenty with this single paragraph -- all without even bothering to address the mass surveillance programs that prompted the reforms in the first place.

Filed Under: james clapper, nsa, odni, reform, surveillance

Two Top Intelligence Officials, Both Of Whom Admitted To Lying In The Past, Now Try To Rewrite History And Deny The Lies

from the don't-get-dizzy-from-all-that-spin dept

Apparently the US intelligence community has decided that they should start trying to totally rewrite the history of two of its top officials directly lying to Congress. First up: Director of National Intelligence (DNI) James Clapper. This lie is the famous one, in which while testifying before Congress, Senator Ron Wyden engaged in this exchange:

Wyden: Does the NSA collect any type of data at all on millions or hundreds of millions of Americans?

Clapper: No sir.

Wyden: It does not?

Clapper: Not wittingly. There are cases where they could, inadvertently perhaps, collect—but not wittingly.

At first, Clapper denied lying, saying he merely misunderstood the question, and thought it was about "voyeuristically" poring through emails. But the question is pretty explicit: "any type of data at all." Later, Clapper changed his story to claim that he did understand the question, but was taken off guard by it and gave "the least untruthful answer" he could. At that point, Wyden pointed out that he had actually given Clapper the questions a day earlier and then reached out to his office after to confirm that his answers were accurate, leaving Clapper plenty of opportunity to correct his error -- but Clapper did not. At that point, Clapper finally admitted he had lied and gave a semi-apology to Wyden, saying: "mistakes will happen, and when I make one, I correct it."

Except, now, over a year later, Clapper is back to denying that he lied. Before a "friendly" audience of defense and intelligence contractors (one of the questions to him started out, "You have a very supportive private sector in front of you..."), Clapper again pretended that he never lied to Congress at all. Even worse, he did so while introducing new "principles of professional ethics" for the intelligence community, and arguing that he did so because of the awful situation he endured when he was falsely accused of lying:

“When I got accused of lying to congress because of a mistake ... I had to answer on the spot about a specific classified program in a general, unsecure setting.”

Except, almost none of that is true. It wasn't on the spot. Wyden gave him the questions a day earlier. He didn't have to answer the question (before and since that questioning, Clapper and others have responded to nearly identical questions by saying they could only give details in a classified setting). And, again, Wyden gave Clapper a chance to correct the answer via a letter, and Clapper stood by the original letter. In other words, he lied. He flat out lied. And then he stood by it afterwards when he had a chance to correct the lie. And now he's lying about the lying. Oh, and as for the new "ethics" principles? 1) mission; 2) truth; 3) lawfulness; 4) integrity; 5) stewardship; 6) excellence; and 7) diversity.

And just to add to this mess, Clapper also claimed that the intelligence community has not been shown to have violated the law. That's also flat out false. Both a federal judge and the federal government's privacy and civil liberties oversight board (PCLOB) found the program unconstitutional and illegal.

Moving on, we've got CIA director John Brennan. After the big mess with Senator Dianne Feinstein accusing the CIA of spying on Senate staffers, Brennan tried to deny it (while his denials more or less confirmed the facts). However, he specifically told reporters:

"Let me assure you the CIA was in no way spying on [the Senate Intelligence Committee] or the Senate."

He also claimed that "when the facts come out on this," those who claimed that there was "spying" by the CIA "will be proved wrong." Fast forward a few months and the CIA's Inspector General confirmed everything in Feinstein's story, leading Brennan to apologize to Feinstein. In fact, the full CIA report revealed that the spying was even worse than Feinstein initially detailed.

And... guess what? Brennan is now denying he lied. At the very same conference he pulled a "who, me?" routine:

"Thwart the investigation? Hacking in? We did not."

Note that he's parsing words carefully. He's focusing on "thwarting the investigation" and "hacking" in -- though that depends on your definition of hacking. Under the DOJ's definition, what the CIA did was clearly hacking. It's why Senators Wyden and Udall asked Brennan about whether or not the US hacking statute, the CFAA, applied to the CIA. Because the CIA clearly was unauthorized to access the Senate staffers' network, based on a previous fight with the Senate Intelligence Committee, as detailed by Feinstein when she revealed the details:

Per an exchange of letters in 2009, then-Vice Chairman Bond, then-Director Panetta, and I agreed in an exchange of letters that the CIA was to provide a “stand-alone computer system” with a “network drive” “segregated from CIA networks” for the committee that would only be accessed by information technology personnel at the CIA—who would “not be permitted to” “share information from the system with other [CIA] personnel, except as otherwise authorized by the committee.”

Yet, now Brennan is twisting the story, to say that there was no hacking because they were the CIA's computers all along:

On Thursday, he pointed out the computers technically belonged to the CIA, even though they had been partitioned to create private work space for the Senate staffers.

There was more hairsplitting when he explained his apology. “I apologized then to them for any improper access that was done, despite the fact that we didn’t have a memorandum of understanding.”

Again, that directly contradicts reality. We'll see if Feinstein decides to respond to all of this, but Senator Wyden already has with a bit of internet slang in this hilarious tweet: If you can't see it, that's Wyden's press office linking to one of these stories, saying "smh" which is internet shorthand for "shaking my head."

Filed Under: cia, dianne feinstein, james clapper, john brennan, lies, nsa, odni, ron wyden, senate, spying, surveillance, torture report

New Study Says There's No Evidence That Terrorists Changed How They Communicate Post-Snowden

from the because-they-already-knew dept

One of the standard talking points right after the Ed Snowden revelations first started coming out was that the leaks were causing terrorists to change how they communicated, meaning that US intelligence was somehow "losing track" of important information on the whereabouts and plans of terrorists. The most obvious example of this was from CNN "reporter" Barbara Starr (who has a long track record of repeating Defense Department talking points) who directly claimed: "terrorists are trying to change the way they communicate because of what they learned from Edward Snowden's admitted leaks of classified information about government surveillance programs." We questioned this claim on a number of points -- in part because there was plenty of evidence that most terrorists already suspected such surveillance and acted accordingly. Meanwhile, in private, James Clapper (who publicly was claiming massive damage from terrorists changing how they communicate) admitted that he really wasn't that worried.

Clapper has said repeatedly in public that the leaks did great damage, but in private he has taken a more nuanced stance. A review of early damage assessments in previous espionage cases, he said in one closed-door briefing this fall, found that dire forecasts of harm were seldom borne out.

So it should come as no surprise at all that a new research report more or less confirms that there is no evidence of terrorists changing how they communicate post-Snowden. You can read the full report from Flashpoint Partners yourself, but it's pretty clear:

• The underlying public encryption methods employed by online jihadists do not appear to have significantly changed since the emergence of Edward Snowden. Major recent technological advancements have focused primarily on expanding the use of encryption to instant messenger and mobile communications mediums.
• Aside from warning of tampered copies of “Asrar al-Mujahideen” that were deliberately infected with spyware, none of the prominent jihadi logistical units have expressed any public doubt as to the continued effectiveness of encryption methods employed in their software packages that were released prior to the Snowden leaks.
• The actual release of new jihadi-themed encryption software packages, like “Asrar al-Dardashah,” seems to have had a far more noticeable impact in terms of driving waves of interest in the subject of encryption among users of jihadi web forums than the publication of the Snowden NSA revelations in June 2013.
• Well prior to Edward Snowden, online jihadists were already aware that law enforcement and intelligence agencies were attempting to monitor them. As a result, the Snowden revelations likely merely confirmed the suspicions of many of these actors, the more advanced of which were already making use of – and developing –secure communications software.

In other words, as we said, most terrorists already assumed their electronic communications were at risk and acted accordingly. There is little to no evidence that Snowden's leaks had any significant impact at all. The report shows that encryption packages were popular well before the Snowden leaks, and little seems to have changed after the Snowden leaks.

The report also looked at forum discussions on various encryption techniques on forums frequented by terrorist groups. As you can see from the following two charts, there doesn't appear to be any bump in discussions about encryption or related software post Snowden (the leaks began in June of 2013). If anything there was much more discussion before the Snowden revelations started:

The full report is quite interesting, though I doubt we'll see any NSA defenders/Snowden haters admitting that their doom and gloom claims turned out to be false.

Filed Under: communication, ed snowden, encryption, fud, james clapper, jihad, terrorists
Companies: flashpoint partners

New Intercept Leak Shows That Intelligence Agencies Are Ready And Willing To Perform Economic Espionage If US Tech Edge 'Slips'

from the altitude-of-high-road-rapidly-approaching-sea-level dept

The NSA has repeatedly assured the public that it definitely does not perform economic espionage. It may collect metadata and communications from around the world (including that of US citizens) and intercept shipments of computer hardware in order to install its own spying devices, but it doesn't perform espionage in service of American corporate interests.

This was the small thing that set our intelligence agencies slightly above similar agencies in China. Last August, the ODNI (Jame Clapper's office) sent this categorical denial to the Washington Post in response to leaked documents. (Emphasis in original.)

“The department does ***not*** engage in economic espionage in any domain, including cyber.”

And then the truth came rolling in, thanks to Snowden's leaks.

After that categorical statement to the Post, the NSA was caught spying on plainly financial targets such as the Brazilian oil giant Petrobras; economic summits; international credit card and banking systems; the EU antitrust commissioner investigating Google, Microsoft, and Intel; and the International Monetary Fund and World Bank. In response, the U.S. modified its denial to acknowledge that it does engage in economic spying, but unlike China, the spying is never done to benefit American corporations.

A slight change in wording and the denial still holds. Or does it? The Intercept's latest set of documents -- issued by Clapper's office -- show the US government definitely has plans to do the one thing Clapper says we don't: spy for the benefit of US corporations.

The document, the 2009 Quadrennial Intelligence Community Review—provided by NSA whistleblower Edward Snowden—is a fascinating window into the mindset of America’s spies as they identify future threats to the U.S. and lay out the actions the U.S. intelligence community should take in response…

According to this document, one of the threats that the government might call in the services of its intelligence agencies to handle is a slip in America's "technological and innovative edge." The appropriate response in the free world -- especially a country that always tells its citizens they can achieve anything through hard work and determination -- would be to allow the struggling corporations to solve their own problems. If it really needed to get involved, the government could take a close look to see if it was creating bottlenecks with iffy IP laws or its random blend of regulation and deregulation. Anything but take the easiest way out.

But if the American way of life (such as it were) is threatened in the future, Clapper's office recommends letting the spies fix it.

The report recommends “a multi-pronged, systematic effort to gather open source and proprietary information through overt means, clandestine penetration (through physical and cyber means), and counterintelligence” (emphasis added). In particular, the DNI’s report envisions “cyber operations” to penetrate “covert centers of innovation” such as R&D facilities.

Cheat to win. And saying everyone else is doing it (even if they are) doesn't do anything more than drag the US down to their level. One scenario included in the document posits Russia and India working together to outpace the US. At this point, the NSA and others would step in to perform cyber-espionage, hacking into the foreign research facilities and making off with proprietary data. The data collected would be (this is a direct quote)

...assesse[d] whether and how its findings would be useful to U.S. industry.

As is noted by Glenn Greenwald, there's no indication the US has actually done this in the past. But it is a long-term document, meant to envision the intelligence agencies' roles over the next 20 years. And one of those roles being discussed is stealing secrets to put US companies ahead.

Some may defend this as being a purely speculative document that details numerous what-if scenarios that will never be played out. But that defense is inadequate. The speculations aren't tied to scenarios in which the US government shifts towards a more China-like role and gives up its ambitions of being the leader of the free world. In these scenarios, the United States is presumed to be doing business as a democratic republic -- one that has often sought to rise above this sort of behavior.

The NSA has the capabilities to do many things, some of which remain unexplored (or at least unrevealed). This is one of them. The agency's defenders have argued that it doesn't abuse these powers, but its internal documents (along with statements from former NSA head Keith Alexander) that it will always "play to edges" of its confinements. This document shows it's willing to step into this role if asked to. Or if it thinks it was asked to. Or it may perform this role proactively and ask forgiveness later.

The fact is that this scenario never should have been presented. It's not that much different than using the threat of domestic terrorism as a what-if projection for unencumbered harvesting of US citizens' communications. There are lines you don't cross -- not in this nation -- even hypothetically. Corporate espionage is one of them. Especially when the US Attorney General is handing out indictments for corporate espionage by the Chinese.

Nothing may ever come of this. But it's important for the world to know that offer is on the table.

Filed Under: economic espionage, intelligence community, james clapper, lies, nsa, odni, surveillance

James Clapper's Office Declassifies Another Set Of Fully-Redacted Pages

from the also-jabs-public-in-eyes-with-godawful-scans dept

The ODNI continues to comply with court orders from FOIA lawsuits but its compliance is in letter only. Declassifying documents the way the ODNI does isn't helping further the debate on privacy vs. security or making the government's arguments for surveillance dragnets any more clear.

Two more documents were released late Friday, with one of them being more about what it doesn't include than what it does and the other potentially leading to irreversible eye damage.

First up, the FBI's report on the maintenance and use of [REDACTED] databases. About the only thing surviving the redaction knife is a few footnotes which indicate this document has something to do with the pen register/trap and trace bastardization that turned a targeted surveillance technique with a low legal barrier to entry into a broad, untargeted dragnet with a low legal barrier to entry. (PDF link.)

But this is how most of the "declassified" report looks.

Right-margin barely large enough to contain the exemptions.


The unexpected use of black in a sea of white redactions.


All of the above is in addition to several pages that were withheld in their entirety, without even being given the chance to be redacted into uselessness.

What remains is mainly footnotes. One supplies a description of PR/TT surveillance pulled directly from the US code. One references CALEA (Communications Assistance for Law Enforcement Act). One footnote points out that the FBI is not allowed to "affirmatively search" content gathered incidentally by this program, unless, of course, (truck-sized loophole ahead) it needs to "prevent harm to national security."

In total, the document is of zero value to anyone anywhere. No information was freed, nor will it be -- not if intelligence officials have the final say for redactions. The redactions can be challenged, but that's in EPIC's hands.

The second document, a declaration in support of the PR/TT program by CIA director George Tenet, contains more readable info… but just barely. There's a lot of redactions in here as well but the main struggle is reading the remaining text which looks like it was rolled off a myopic, 75-year-old mimeograph. (PDF link.)

Most of Tenet's declaration revolves around threats the CIA was tracking, none of which are allowed past the censor, despite it being a decade later. The name Al-Qaeda appears every so often, and there's hints of a discussion revolving around surveillance tactics and government actions related to the 9/11 attacks, but most of this information is withheld as well.

Interestingly, Tenet notes that the CIA (and other agencies) have picked up signals that signal a "US strike" in the "next four months," possibly in conjunction with the 2004 elections. It also cautions that being too effective may be accelerating terrorists' attack plans, with detainments and other factors possibly causing terrorism leaders to believe their operations are compromised.

Tenet declares all the redacted surveillance programs to have been essential in disrupting terrorists' plans and/or possibly pushing attack timetables forward, noting that the PR/TT has been invaluable in lots of things that are completely redacted. In conclusion, please give the NSA/FBI PR/TT dragnet privileges.

So much for transparency. Even a discontinued surveillance program is subject to page after page of complete redaction, including documents discussing threats over a decade old whose attacks and plans were either thwarted or never came to fruition. The word "declassify" generally is taken to mean a release of information previously withheld, but in the ODNI's hands, all it means is the release of as little as possible.

Filed Under: declassify, foia, james clapper, nsa, odni, surveillance

Government's Response To Snowden? Strip 100,000 Potential Whistleblowers Of Their Security Clearances

from the surface-issues-neutralized.-underlying-causes-unaddressed. dept

Snowden just re-upped for three years in picturesque Russia, a land best known for not being a US military prison. Not exactly ideal, but under the circumstances, not entirely terrible. The government knows where Snowden is (more or less) and many officials have a pretty good idea what they'd like to do to him if he returns, but the NSA is still largely operating on speculation when it comes to what documents Snowden took.

But they do have someone looking into this. The government has tried to assess the damage posed by Snowden's leaks, but so far all it has come up with is vague proclamations that the released have caused grave and exceptional damage to US security and an even vaguer CIA report claiming that a bunch of documents Snowden theoretically has in his possession might severely harm the US if a) they are released and b) they exist.

Charlie Clark at Defense One has a fascinating article on the man tasked with handling the intelligence community's post-Snowden world.

The man filling that role, or the “NCIX,” as acronym-inclined national security feds call the National Counterintelligence Executive, is Bill Evanina, 47, a former FBI special agent with a counter-terrorism specialty.

Tapped in May 2014 by James Clapper, director of the Office of National Intelligence, Evanina is now immersed in coordinating multi-agency efforts to mitigate the risk of foreign infiltration, assess damage from intelligence leaks and tighten the security clearance process.

This means teaming up with the "'most transparent administration" to help sniff out and stamp out so-called "insider threats." This has always been a priority during Obama's term and its efforts are now being redoubled. On one hand, the ODNI (James Clapper's office) is dipping its toes in the transparency waters. (But mainly it's trying to keep from being pushed into the transparency pool by a variety of litigants.) Evanina is working towards the "discussion" of security vs. privacy, but most of his efforts are focused on locking everything down.

The appearance of new leakers has the government even more concerned.

[W]hen queried about an Aug. 6 New York Times report of leaked internal documents showing “secret terror lists” that include 28,000 Americans kept by the National Counterterrorism Center, Evanina was firmer. “No unauthorized leak is routine,” he said. “It’s a criminal act that has us very concerned. In the intelligence community’s view, every disclosure is a problem because it betrays the people who collected that data. There’s a rationale on why it was classified,” he added, citing a need to protect “both the collection methods and lives.” The FBI is moving forward,” he said, with a probe into how the lists were leaked to an online magazine called The Intercept.

The government swears it protects whistleblowers but the efforts it makes undermines its assertions. Telling people the government is targeting them for reasons it doesn't seem to be able to put into words is called a "criminal act." But here's the most surprising fact from Evanina's profile.

One crisp action taken following agency auditing after Snowden’s exposure: 100,000 fewer people have security clearances than did a year ago, Evanina said. “That’s a lot.”

This looks like the proper response to someone like Snowden. Handing out too many security clearances undermines security. But it's more than that: it's a consolidation of power. By stripping 100,000 people of their clearances, the government eliminates 100,000 potential whistleblowers. With fewer eyes watching surveillance programs, odds of abuse multiply. Someone has to watch the watchers and sometimes that someone is nothing more than a government contractor.

This response doesn't fix the underlying problems -- the government's broad surveillance programs that sweep up Americans' data and communications. All it does is make it that much harder to expose wrongdoing.

If the government wants to solve its problems, it needs to listen to its whistleblowers rather than simply writing them off as security risks or criminals. The internal channels are a joke and no serious effort is being made to improve them. Instead, the NSA and others have reined in access, ensuring that whistleblowers are both fewer in number and limited in options.

Filed Under: bill evanina, ed snowden, james clapper, ncix, security clearance