As Law To Backdoor Encryption Stalls, Congress Tries Backup Stupid Plan To Backdoor Encryption

from the bad-ideas-all-around dept

Late last year, Senator Richard Burr, who is painfully wrong on encryption, announced that he and Senator Dianne Feinstein were working on new legislation that would mandate backdoors to encryption. Most people recognized that such a bill had little-to-no chance of actually passing Congress, as there are at least enough folks up on Capitol Hill who realize that such a law is incredibly stupid. Given that, it's little surprise that reporter Jenna McLaughlin from The Intercept is reporting that such legislation "has been delayed."

But, fear not, foes of strong encryption, because there's always a plan B. Late last year, we also noted that Rep. Michael McCaul, the head of the House Homeland Security Committee, was going to propose legislation that would create a "commission" bringing tech companies and law enforcement together to work on a way to undermine encryption. While, at the very least, he noted concerns about backdooring encryption (and later noted how backdoors could weaken everyone's security), it hasn't stopped him from moving forward with this commission, and making some fairly ridiculously ignorant statements about all of this.

McCaul, together with Senator Mark Warner (who should know better), has announced that they're moving forward with legislation to set up this commission, and still ridiculously claims that "going dark" is a real problem that needs to be "solved."

McCaul said the group would be given “a tight time frame” to develop “recommendations to the Congress as to what can be done to solve this urgent, and I think very challenging threat to our national security.”

But, as if to underline how little McCaul really seems to understand about the issue, during a press conference about this, he claimed that the "going dark debate" was started by Ed Snowden's use of encryption, leading to a rather sarcastic reply from Snowden himself:

Chairman McCaul on "going dark": "It’s ironic that Edward @Snowden really sort of created all this when he started using encryption."

— Kaveh Waddell (@kavehewaddell) January 19, 2016

Other things Chairman McCaul thinks I created: famine, climate change, bieber. https://t.co/eJ8JWyDy1K

— Edward Snowden (@Snowden) January 19, 2016

It's troubling that the guy who thinks Snowden started the debate on going dark is now apparently going to lead this commission to deal with the "problem" of going dark. Nor is the whole "tight timeline" particularly encouraging. Because the whole thing is based on a false premise that if we just "get smart people in the room," they'll figure out "a solution."

But how many times does it need to be said before law enforcement and politicians understand the rather basic facts: you can undermine encryption, but it makes everyone significantly less safe. There is no way to build technology that says "only the pure of heart may use this technology, while ISIS may not." The second you try to do that, all you end up doing is opening up serious vulnerabilities that will put everyone at risk.

Meanwhile, another report on this planned commission claims that it will "be tasked with developing a solution that doesn’t require a 'backdoor' into encrypted communications." That's obviously better than being tasked with backdooring encryption... but what does that even mean? The whole setup of the discussion and the debate is falsely framed around the idea that strong encryption is a "problem" that needs to be "solved." Saying "but we don't mean backdoors," feels like a semantic game, such as James Comey's ridiculous attempt a few months back, where he insisted that the FBI wants "front doors" instead of backdoors.

If Rep. McCaul and Sen Warner were serious about "Homeland Security," they'd both get on the bandwagon supporting strong encryption because that, and that alone, is the best way to protect computer security for Americans.

Filed Under: backdoors, commission, congress, dianne feinstein, ed snowden, encryption, going dark, mark warner, michael mccaul, richard burr

One Of Congress's Biggest Defenders Of NSA Surveillance Suddenly Aghast That NSA May Have Spied On Him

from the funny-how-that-works dept

Remember how Dianne Feinstein -- a huge supporter of the intelligence community -- absolutely freaked out about surveillance when it happened to her staffers (when the CIA snooped on their network)? It would almost be funny how the defenders of surveillance react when they're being surveilled... if it weren't so tragic.

As we noted earlier today, the WSJ just revealed that the NSA had no problem intercepting calls made by Congress as part of spying on foreign leaders, such as Israeli Prime Minister Benjamin Netanyahu. And, as you might expect, some folks are quite upset about this... including former US Representative Pete Hoekstra, who headed the House Intelligence Committee a decade ago. He sent out a pair of angry tweets about the news:
If you can't read those, he says:

WSJ report that NSA spied on Congress and Israel communications very disturbing. Actually outrageous. Maybe unprecedented abuse of power.

NSA and Obama officials need to be investigated and prosecuted if any truth to WSJ reports. NSA loses all credibility. Scary.

Of course, this very same Pete Hoekstra, who long defended NSA surveillance, didn't seem to have much of an issue when the NSA was spying on anyone other than himself. Just last year, in a debate with Glenn Greenwald, Hoekstra mocked the idea that anyone was upset at the NSA spying on foreign governments and said if there was anything to complain about, it was that the NSA allowed such info to leak:

If the country's intelligence techniques leak, what is to say our enemies won't also review the information, Hoekstra asked. He laughs at foreign governments who are shocked they've been spied on because they, too, gather information.

"Spying is a matter of fact," Hoekstra said. "The mistake that we made is that we had a NSA that did not put in the protections that it need to protect (it) ... they enabled someone like Edward Snowden to steal our documents and steal our national securities to the world."

Uh huh. But suddenly when it's his communications, the NSA "loses all credibility" and there needs to be an "investigation"?

And here's the very same Pete Hoekstra talking about how he was personally briefed on the "safeguards" of the NSA program and how he trusts the NSA to never violate civil liberties:

“I was briefed by the vice president and then-head of the NSA, Michael Hayden, and it was from my perspective a very thorough briefing,” recalled Hoekstra in an exclusive interview on Wednesday. “They talked about what the capabilities of the program were, how the programs functioned, and the protections that were put in place to make sure that American civil liberties were protected.”

Go on...

The Michigan Republican said he met with some of the people who administered the programs and came away convinced “they clearly understood the responsibilities that they had to No. 1, do their job, but also to protect Americans' civil liberties.”

I see...

Also, this is the very same Hoekstra, who back when he was running the House Intelligence Committee blatantly misled the public about the surveillance powers of the NSA. In that case, somewhat ironically, Hoekstra attacked a bill called the RESTORE Act, that would have granted a tiny bit more oversight over situations where (you guessed it) the NSA was collecting information on Americans. Hoekstra falsely argued that this would make it harder to track terrorists overseas (despite the fact that their communications weren't subject to the law). But now that his own communications got sucked up in surveillance efforts targeted at foreigners, it's a giant scandal?

Beginning to think that being a total hypocrite on these issues should be called "being a total Hoekstra."

Filed Under: congress, dianne feinstein, hypocrites, nsa, pete hoekstra, spying, surveillance

James Comey, Dianne Feinstein Team Up To Mislead About Encryption; Promise Legislation To Undermine National Security

from the ugh dept

This is hardly a surprise, but after Congress had more or less realized that passing a law to undermine encryption wasn't a good idea, the clueless surveillance state hawks have used the Paris and San Bernardino attacks as a chance to go for it again. In a hearing this morning, FBI Director James Comey -- who has long been leading the charge -- explained that he thought tech companies ought to change their business model to drop end-to-end encryption. Ridiculously, he argued that there's no "technical issue" in undermining encryption, just a business decision:

Now, Comey said at a Senate Judiciary Committee hearing Wednesday morning, extensive conversations with tech companies have persuaded him that “it’s not a technical issue.”

“It is a business model question,” he said. “The question we have to ask is: Should they change their business model?”

Comey is being misleading to disingenuous here. Yes, anyone can undermine encryption. And, yes, I guess you could argue that undermining encryption and weakening security for all your users is a "business model" issue in that they won't trust you any more and might look for alternative providers. But that's not the real issue. Comey's trying to shift the debate, because he knows that what he's really asked for is impossible. He's asked for backdoors that only law enforcement can use. And basically every computer security expert has explained that the only way to do that would be to expose everyone to more threats. And Comey seems to think that's okay.

Let me repeat that. The head of the FBI, who is supposed to be protecting American citizens, thinks it's okay to make everyone less safe, based on the unproven theory that it'll make his own job a little easier.

And, not surprisingly, Senator Dianne Feinstein, was right there ready to assist. She cited the Paris attacks as evidence for why "the world is really changing"

“I suspect what happened was in the aftermath of Snowden, particularly Europe got very conservative with respect to encryption. The companies back away. Now, that’s changing with Paris and God forbid what might happen in the future. So what I’m trying to say is, I think this world is really changing in terms of people wanting the protection and wanting law enforcement, if there is conspiracy going on over the Internet, that that encryption ought to be able to be pierced.”

Again, this is the same Senator who just a month ago was practically screaming about how important cybersecurity is, and now she says that the single biggest factor in protecting information online -- encryption -- should be done away with.

And, indeed, while others have held back, Feinstein has said she's working with Senator Burr on legislation to effectively break encryption:

Sen. Dianne Feinstein (D-Calif.) told the Senate Judiciary Committee on Wednesday that she would seek a bill that would give police armed with a warrant based on probable cause the ability “to look into an encrypted Web."

"I have concern about a PlayStation that my grandchildren might use," she said, "and a predator getting on the other end, and talking to them, and it's all encrypted. I think there really is reason to have the ability, with a court order, to be able to get into that."

A spokesman for Feinstein's office told the Daily Dot in an email that the senator has been working with Judiciary Committee Chairman Richard Burr (R-N.C.) the issue of encryption and that Burr's office is taking the lead on potential legislation.

None of that makes any sense. First of all, the Playstation is not encrypted end-to-end, and if she's concerned about who her grandchildren are talking to on the Playstation maybe she should look into that, rather than having the government undermine the very foundations of basic computer security on the internet?

Hopefully cooler heads prevail in Congress, but we've seen Feinstein and Burr team up to do tremendous damage through fearmongering before, and apparently it's not going to stop any time soon.

Filed Under: backdoors, business mod, congress, dianne feinstein, encryption, going dark, james comey, legislation, richard burr

Senator Feinstein Brings Back Horrible Bill Forcing Internet Companies To Report On Your 'Suspicious' Behavior

from the it-was-a-bad-idea,-drop-it dept

Earlier this year, Senator Dianne Feinstein, who seems to be an endless well of bad ideas around surveillance, started pushing a bill that would require internet companies to report to the government any content they suspected was posted by terrorists. This bill has all sorts of problems, not the least of which is that most of the major internet companies already alert the government to any terrorist-related content that they come across. But, by mandating such reporting, it will only lead to these companies filing a bunch more reports -- much of which will be bogus, flooding the government with useless information, just to avoid running afoul of the law.

Back in September, Senator Wyden successfully forced Feinstein to drop the bill...

But, of course, in the wake of the Paris and San Bernardino attacks all bad ideas are back on the table, and Feinstein is bringing this one back as well. She's teaming up with the intelligence committee's other biggest cheerleader, Intelligence Committee boss Senator Richard Burr, to reintroduce the idea, and they put out a completely bogus statement that plays up the fearmongering angle as much as possible, about those darn ISIS people using social media.

“We’re in a new age where terrorist groups like ISIL are using social media to reinvent how they recruit and plot attacks,” Senator Feinstein said. “That information can be the key to identifying and stopping terrorist recruitment or a terrorist attack, but we need help from technology companies. This bill doesn’t require companies to take any additional actions to discover terrorist activity, it merely requires them to report such activity to law enforcement when they come across it. Congress needs to do everything we can to help intelligence and law enforcement agencies identify and prevent terrorist attacks, and this bill is a step in the right direction.”

“Terror groups have become adept at taking advantage of social media platforms to spread their message,” Senator Burr said. “Social media is one part of a large puzzle that law enforcement and intelligence officials must piece together to prevent future attacks. It’s critical that Congress works together to ensure that law enforcement and intelligence officials have the tools available to keep Americans safe. The stakes have never been higher and having cooperation with these outlets will help save lives here and abroad.”

Neither of those quotes makes any sense. Again, most companies already report stuff, and mandating it will only lead to more bogus reports to avoid liability for the companies, while potentially leading to less active monitoring since they only have to report stuff if they come across it. As for Burr's assertion that this is necessary to give law enforcement "the tools" to find this information -- that's a totally different issue. Doesn't law enforcement have computers? Can't they go to Twitter and Facebook and YouTube themselves and do searches?

Senator Wyden has already spoken out on what a bad idea this is, and how it would do the exact opposite of what Feinstein and Burr are claiming:

Let’s make sure the record is clear: The Director of the FBI testified a few months ago that social media companies are ‘pretty good about telling us what they see.’ Social media companies must continue to do everything they can to quickly remove terrorist content and report it to law enforcement.

I’m opposed to this proposal because I believe it will undermine that collaboration and lead to less reporting of terrorist activity, not more. It would create a perverse incentive for companies to avoid looking for terrorist content on their own networks, because if they saw something and failed to report it they would be breaking the law, but if they stuck their heads in the sand and avoided looking for terrorist content they would be absolved of responsibility.

I’m for smart security policies. If law enforcement agencies decide that terrorist content is not being identified quickly enough, then the solution should be to give those agencies more resources and personnel so they know where to look for terrorist content online and who to watch, and can ensure terrorist activity is quickly reported and acted upon.

Meanwhile, CDT has gone much further in explaining why this is such an astoundingly dumb idea:

Why is this proposal such a bad idea? As we described in July, it would create a requirement for all electronic communication services – social media companies, as well as Internet service providers, web hosts, cloud services, and public libraries or coffee shops that offer WiFi access – to make reports about their users’ activity based on a completely opaque set of criteria. Creating such an obligation, with its vague parameters, would drive Internet companies to one of several likely responses. Some would decide to significantly over-report their customers’ information and private communications to the US government to ensure that the company stays on the right side of the law. Others would refuse to review any content that was flagged to them, for fear that doing so would mean they obtain the “actual knowledge of any terrorist activity” that triggers the reporting obligation.

Either of these outcomes pose major problems for the free expression and privacy of Internet users. It’s also far from clear that this would generate actionable information for law enforcement or intelligence agencies. Further, this type of reporting obligation would undermine any sense of trust between Internet users and the companies that provide the service providers that enable them to access information, conduct transactions, and share their perspectives online. The proposal would essentially deputize US-based Internet companies to act as agents of the government, including potentially requiring entities such as email services to turn over the contents of private communications if they are part of the “facts and circumstances” of alleged terrorist activities – for their users both in the US and abroad.

It's a bad idea and Feinstein knows it's a bad idea, because all of this has been explained to her multiple times in the past. So why is she still proposing it?

Filed Under: dianne feinstein, freakout, informant, richard burr, ron wyden, terrorism
Companies: facebook, google, twitter, youtube

A Month Ago, Dianne Feinstein Said Cybersecurity Was Super Important... Now She Says We Should Undermine Encryption

from the which-side-is-she-on? dept

Look, everyone has known for quite some time that Senator Dianne Feinstein's big push for so-called "cybersecurity" legislation in the form of CISA had absolutely nothing to do with cybersecurity. It was always about giving another surveillance tool to her friends at the NSA. However, given that she was one of the most vocal in selling it as a "cybersecurity" bill (despite the fact that no cybersecurity experts actually thought the bill would help) it seems worth comparing her statements from just a month ago, with her new attacks on actual cybersecurity in the form of encryption.

Here is Feinstein just a month ago, claiming to worry about "cyberattacks" on Americans:

"Millions of personal records and hundreds of billions of dollars fall victim to cyber-attacks every year, and we’ve done little to stem the tide."

Of course, CISA does nothing to protect any of that. You know what does protect against that -- better use of encryption to keep that information from getting hacked in any useful manner.

Okay, fast forward. Following the Paris attacks, Feinstein has been among the most vocal in claiming that we need to undermine encryption, which is pretty amazing given that she represents California (and is from San Francisco), home to tons of tech companies that actually get this and think she's completely crazy for undermining actual cybersecurity.

Never mind that, though. Here she is this past weekend, on CBS's Face the Nation totally attacking encryption itself and mocking the tech companies that just a month ago she was insisting needed special government help to protect against cyberattacks. She was asked if the intelligence community has the tools it needs, and she decides to attack encryption -- even choosing to cite as a source CIA director John Brennan -- the same John Brennan who illegally spied on her staffers and then lied about it repeatedly.

"I can say this. [FBI] Director [James Comey] and, I think John Brennan, would agree, that the Achilles Heel in the internet is encryption. Because there are now... it's a black web! And there's no way of piercing it. And this is even in commercial products! PlayStation, John! Which our kids use. If the two ends communicate, that's encrypted. So terrorists can use PlayStation to be able to communication and there's nothing that can be done about it."

The host, John Dickerson, then points out that the tech industry (again, mostly based in or near Feinstein's hometown, and that she's supposed to be representing) says that backdooring encryption makes us less safe and opens us up to more attack, and Feinstein brushes it off, relying on her apparent years of computer security training...

No. I don't think so. I think with a court order, with good justification, all of that can be prevented. It can be prevented in Europe, because Europe has been a major driver for more encryption. And I think that they are now seeing the results. I have visited with all of the General Counsels of the tech companies, just to try to get them to take bomb building recipes off the internet. Recipes that have been tested and we know can explode a plane. Directions. Where to sit on the plane to blow it up. We know that there are bombs that can go through magnetometers. And to put that information out on the internet, is terrible. And I sorta got 'well, pass a law.' So, we may just have to do that. But I am hopeful that the companies, most of whom are my constituents -- not most, but many -- will understand what we're facing. And we're not crying wolf. There's good reason for this. And people are dying all over the world. And I think the Sinai-Russian airliner is a classic example of a bomb that got on a plane, that blew up that plane.

Where to start with this nonsense? First, note that she doesn't actually respond to the question concerning how undermining encryption will make us all less safe and make all that information Feinstein herself claimed was under attack just a month ago more vulnerable, other than to say that she, personally, doesn't think that what every computer security expert has been saying is true. Yikes.

Second, rather than focus on encryption, she pivots to her other pet projects, claiming that the government should force internet companies to censor The Anarchist's Cookbook. She keeps on this despite the fact that all the way back in 1997, the DOJ directly told Feinstein that this would violate the First Amendment. From the DOJ to Feinstein:

The First Amendment would impose substantial constraints on any attempt to proscribe indiscriminately the dissemination of bombmaking information. The government generally may not, except in rare circumstances, punish persons either for advocating lawless action or for disseminating truthful information -- including information that would be dangerous if used -- that such persons have obtained lawfully.

Third, this weird infatuation with The Anarchist's Cookbook, despite the fact that it's generally recognized as a joke for fools, where the likelihood of being able to build an actual bomb from it are minimal at best. And, while she pretends that the GCs of tech companies just sort of shrugged their shoulders about this, it's much more likely that it's because they thought she was being ridiculous trying to censor the internet in violation of the First Amendment. Whoever told her "well, pass a law" was almost certainly trying to get rid of her, knowing that any such law would be unconstitutional.

Fourth, this tangent about "bomb making instructions" online still has absolutely nothing to do with encryption or the question about how encryption makes us all much more vulnerable to attack and actually makes us all less safe.

Fifth, the comment about Europe is insane. Again, while the attackers may have used some encryption, it's been revealed (since long before Feinstein did this interview) that they did an awful lot of communicating in the clear, including unencrypted SMS and Facebook messenger. On top of that, what the hell does "Europe has been a major driver for more encryption" even mean? Perhaps it's true that they've been adopting more encryption to hide from the NSA's spying that Feinstein herself helped hide from everyone.

Sixth: the whole PlayStation thing has been debunked as a way that the Paris attackers communicated. They did not. Furthermore, she's just wrong that the PlayStation has end-to-end encryption. It does not.

Seventh, does she honestly believe that whoever blew up that Russian airplane downloaded bomb-making instructions from the internet? Also, if it were really so easy to get such instructions and get them through security, don't you think we'd have seen a lot more airplanes blown up by now?

In summary, Feinstein (a month ago) said we should all be deathly afraid of cyberattacks, and the only way to solve it was to give the government much greater access to companies' computer systems, via CISA. And, now, she insists that encryption is an "Achilles's heel" and that actual cybersecurity experts are lying when they say undermining encryption will put everyone at risk. Why? Because The Anarchist's Cookbook is online and Google won't take it down.

Is it really so much to ask for politicians to actually understand technology before they go off on ridiculous, ignorant, uninformed rants about it -- often leading to even more ridiculous and dangerous legislation?

Filed Under: cisa, cybersecurity, dianne feinstein, encryption, going dark, surveillance, terrorists

Insanity Rules: Disgusting Politicians Push For More Surveillance And Less Encryption... Based On Nothing

from the make-it-stop dept

Yesterday we noted that the surveillance state supporters were quick to rush in and blame Ed Snowden and call for undermining encryption in response to the attacks in Paris last week -- and they did so based on no factual information whatsoever. There was, briefly, a NY Times article quoting anonymous "officials" claiming that the attackers had communicated via encrypted channels. That article eventually disappeared entirely (with no explanation from the NY Times). If that's true, it would not be surprising, because terrorist groups have long used encryption -- as have tons and tons and tons of law abiding folks. Blaming encryption seems particularly dumb.

And, indeed, on Monday it was made clear that no one actually has any idea how the planning was done and there isn't yet known evidence of encryption:

A U.S. security official said there is no evidence yet demonstrating that the Paris attackers used a particular method for communicating, or whether any technology they used was encrypted in a particular way.

Of course, that statement is as meaningless as the one from the anonymous official claiming they did use encryption, because it's just a random namely "official." And, of course, it wouldn't be surprising at all if they did use encryption, because that's how people communicate safely. And it's not because of Snowden. As we noted yesterday, terrorists have known to use encrypted communications for well over a decade.

Still, none of this has stopped the insane grandstanding on the issue. CIA Director John Brennan kicked it off by taking a potshot at Snowden along with privacy advocates and tech companies -- again, based on nothing:

"In the past several years, because of a number of unauthorized disclosures and a lot of handwringing over the government’s role in the effort to try to uncover these terrorists, there have been some policy and legal and other actions that are taken that make our ability collectively, internationally to find these terrorists much more challenging," he said. "I do hope that this is going to be a wake-up call particularly in areas of Europe where I think there has been a misrepresentation of what the intelligence security services are doing by some quarters that are designed to undercut those capabilities."

Brennan also ridiculously claimed that the terrorists had "gone to school" based on the Snowden disclosures, which again, defies all logic and historical reporting of how widely encrypted communications were used prior to this.

And then all the usual fear mongerers started to pile on. Let's start with the surveillance state's number one defender, Senator Dianne Feinstein:

Senator Dianne Feinstein, the California Democrat, said she’s asked Silicon Valley companies to help law enforcement and intelligence agencies access communications that have been encrypted -- or scrambled to evade surveillance -- if terrorists are using the tools to plan attacks.

“I have asked for help. And I haven’t gotten any help,” Feinstein said Monday in an interview with MSNBC. “If you create a product that allows evil monsters to communicate in this way, to behead children, to strike innocents, whether it’s at a game in a stadium, in a small restaurant in Paris, take down an airliner, that’s a big problem.”

But that's idiotic. Does she feel the same way about the telephone? Or paper? Or cars? These are all tools that terrorists use as well, but she's not calling for them to be broken. Blaming the tools is a ridiculous move -- especially for a politician who should know better.

But, of course, she wasn't the only one. Senator John McCain -- who once was a strong defender of encryption in the late 90's, has apparently gone to the other side as he's been taken by unrealistic fears:

Senator John McCain, an Arizona Republican and chairman of the Senate Armed Services Committee, said on MSNBC Monday that "it’s time we had another key that would be kept safe and only revealed by means of a court order."

Except, of course, that doesn't work. And McCain has been told that won't work and will make everyone less safe... and yet he's still pushing for it.

Rep. Michael McCaul, chair of the House Homeland Security Committee got in on the stupid game as well:

“The dark space of the Internet is becoming a breeding ground for terrorist communications, recruitment and plotting,” said McCaul, a Texas Republican. “Our inability to monitor encrypted messages on social media apps, and the terrorists’ awareness of that, compounds the danger America and the West face.”

You know what would put us in even greater danger? Undermining encryption and giving up our keys.

NYPD Commissioner Bill Bratton also repeated the nonsensical claim that tech companies, in better protecting users from hackers, were somehow helping the terrorists:

Technology has been "purposefully designed by our manufactures so that even they claim they cannot get into their own devices after they’ve built them," Bratton said on MSNBC’s Morning Joe.

"They need to work with us right now," Bratton said. "In many respects, they’re working against us."

All of this is based on a weird kind of idiocy. It's wrong on so many levels: (1) strong encryption helps protect citizens, not harm them; (2) terrorists already know how to use strong encryption and they have for years; (3) backdooring encryption won't stop people from using non-backdoored encryption; (4) there's still little to no evidence that snooping on everyone's communications actually stops any terrorist plots. But a big tragedy happened and thus, politicians feel like they need to "do something" and that "doing something" seems to be to attack the technology that actually makes us safer. It's insanity on a massive level.

And the press is playing right into it. The NY Times may have dropped that original story, but came back with one claiming that the attacks had "reopened the debate on encryption." No, they did not. The debate is over. Undermining encryption is dangerous and bad news for everyone. As we noted, the intelligence community's top lawyer, Robert Litt, flat out said just a few weeks ago that he and his friends were waiting for the next terrorist attack in order to push for backdoors in encryption. This is the playbook that was planned all along and most of the press is falling for it.

Thankfully, there are a few exceptions. Kim Zetter at Wired pointed out how the whole narrative is wrong and that backdooring encryption won't help at all. And Alex Howard at the Huffington Post put up a similar story. But for much of the mainstream press, they're playing right into the surveillance state's game plan, repeating the stupid talking points on encryption, based on zero actual facts, and then insisting that the debate is somehow open again.

There is no debate. Yes, the surveillance state supporters want to undermine our security and undermine encryption, but there's no actual debate here. Actual experts know that this is a bad move and a dangerous one that will put many more people at risk. Exploiting an attack in Paris (right after France expanded its own surveillance efforts) is hardly a good excuse for undermining the safety of basically everyone.

Filed Under: bill bratton, dianne feinstein, encryption, going dark, john brennan, john mccain, michael mccaul

DOJ Has Blocked Everyone In The Executive Branch From Reading The Senate's Torture Report

from the this-is-ridiculous dept

A year ago, we were writing a ton on the famed Senate Intelligence Committee's torture report. This report, which Committee staffers spent years on, cost $40 million, and clocked in at nearly 7,000 pages of detailed analysis of the US's hugely questionable (both morally and legally) torture program in the wake of 9/11. After much fighting, the Senate finally released a heavily redacted executive summary, but since then there have been some questions about what happens with the full report. Senator Dianne Feinstein, who was (believe it or not!) the driving force behind the report, had copies of the full report delivered to the Defense Department, the CIA, the State Department and the Justice Department. However, there has been a lot of confusion over whether or not anyone actually read it. The DOJ clearly announced that officials had read the whole thing... but later claimed that no one had even opened the report. Obviously, the DOJ lied with one of those statements.

There had been some hope that ex-Senator Mark Udall might choose to release some of it from the Senate floor before leaving office, but that didn't happen.

And, with the changing of the guard, the new head of the Senate Intelligence Committee, Richard Burr, demanded that all the federal government agencies that received the report should return it to him so he can destroy it and make sure that no one ever sees what's in the report. As we noted, however, this whole thing seemed to be an effort to state publicly that the document was a Congressional record. That matters because Congressional records are not subject to FOIA requests. Executive branch records are subject to FOIA requests -- and the ACLU has made a FOIA request to the exec branch for a copy of the report.

The DOJ has taken Burr's lead and claimed that the report is a Congressional record, and that's also why they insist that no one at the DOJ has opened it -- to maintain that it has not become an executive branch record subject to FOIA. Not surprisingly, Senator Feinstein is pissed off about this -- because her staffers spent years putting together this report, detailing massive abuses by the CIA and others in torturing people, and the whole point of it was to help the government learn how badly it messed up and to stop it from doing it again. But if no one reads it, then that won't happen. And, the DOJ now says that not only has it not read it, it has instructed everyone in the exec branch not to read it for fear that reading it would make it subject to FOIA:

Nearly a year after the Senate released a declassified 500-page summary of the report, the fate of the entire document remains in limbo, the subject of battles in the courts and in Congress. Until those disputes are resolved, the Justice Department has prohibited officials from the government agencies that possess it from even opening the report, effectively keeping the people in charge of America’s counterterrorism future from reading about its past. There is also the possibility that the documents could remain locked in a Senate vault for good.

Senator Feinstein (along with Senator Pat Leahy) has sent a rather angry letter (reasonably so!) to Attorney General Loretta Lynch, expressing her strong displeasure over this state of affairs:

Dear Attorney General Lynch and Director Comey:

We firmly believe that appropriate DOJ and FBI officials must read the full 6,700-page Senate Intelligence Committee Study of the CIA's Detention and Interrogation Program in order to understand what happened and draw appropriate lessons. This is exactly what Director Comey promised during his testimony before the Senate Appropriations Committee on March 12, 2015, when he said he would designate FBI officials to read the full, final version of the Committee's Study and consider the lessons that can be learned from it. Director Comey also acknowledged that former FBI Director Bob Mueller ordered FBI agents not to participate in the CIA program. Unfortunately, as the executive summary of the Study makes clear, the Department of Justice was among those parts of the Executive Branch that were misled about the program, and DOJ officials' understanding of this history is critical to its institutional role going forward.

We are gravely disappointed that, according to Assistant Attorney General Peter Kadzik's letter dated August 5, 2015, the Department of Justice is citing a Freedom of Information Act (FOIA) case, ACLU v. CIA as an excuse to refuse to allow Executive Branch officials to review the full and final Study. This DOJ decision prevents the FBI and other parts of the Executive Branch from reading the full 6,700-page Study and learning from the mistakes of the past to ensure that they are not repeated. Further, personnel at the National Archives and Records Administration have stated that, based on guidance from the Department of Justice, they will not respond to questions about whether the Study constitutes a federal record under the Federal Records Act because the FOIA case is pending.

The record in the FOIA case does not support DOJ's decision. According to the court filings in the FOIA case, DOJ represented that it would "preserve the status quo" pending appeal, but the context in which that commitment arose makes clear that DOJ was agreeing not to return the Study to the Senate Intelligence Committee. DOJ's commitment not to return the Study while the FOIA litigation is pending in no way precludes appropriately cleared individuals in the Executive Branch from reading the Study. We urge that you reconsider your position and disseminate the full and final Committee Study to appropriately cleared senior individuals in the Department of Justice and FBI, and instruct other appropriate federal departments to take the same position. For the same reason, we urge you to explicitly commit to retaining copies of the full 6,700-page Study.

We hope you agree that the legacy of this historic report cannot be buried in the back of a handful of Executive Branch safes, never to be reviewed by those who most need to learn from it. We look forward to hearing from you on this important issue.

The DOJ's argument that it has to block anyone from reading the document, lest it magically switch from a Congressional document to an executive branch one is apparently puzzling to experts.

“It’s quite bizarre, and I cannot think of a precedent,” said Steven Aftergood, the director of the Project on Government Secrecy at the Federation of American Scientists. He said there are any number of classified Senate documents that are shared with intelligence agencies and remain as Congressional records, even if they are read by members of the executive branch.

But it's not at all bizarre when put into the simple context of recognizing that this administration has bent over backwards refusing to look back on the nature of what the CIA did and whether or not it violated the law or international agreements on torture (or basic morality). This is just another way to avoid facing up to the mistakes of the past, and conveniently using a FOIA lawsuit as a method for making sure this information remains in the dark.

Filed Under: dianne feinstein, doj, foia, loretta lynch, richard burr, senate intelligence committee, torture report

Senate Rejects All CISA Amendments Designed To Protect Privacy, Reiterating That It's A Surveillance Bill

from the the-exclamation-point dept

In case you weren't already convinced that CISA is a surveillance bill masquerading as a cybersecurity bill, today the Senate rejected four separate amendments to the bill that attempted to better protect the privacy of Americans. Senator Wyden had an amendment to require the removal of personal information before information could be shared, which was voted down 55 to 41. Senator Heller had an amendment that was basically a backstop against the Wyden amendment, saying that if the Wyden amendment didn't pass, Homeland Security would be responsible for removing such personal information. That amendment also failed by a 49 to 47 vote. Senator Leahy had an amendment that would have removed FOIA exemptions in the bill (making it much less transparent how CISA was used). That amendment was voted down 59 to 37. Senator Franken then had an amendment that would have "tightened" the definition of cybersecurity threats, so that the shared information needed to be "reasonably likely" to cause damage, as opposed to the current "may" cause damage. And (you guess it, because you're good at this), it was also voted down by a 60 to 35 vote.

Meanwhile, Marcy Wheeler notes that the revised version of the bill by Senators Burr and Feinstein, which claimed to incorporate greater transparency requirements proposed by Senator Tester, actually takes away a lot of transparency and actually makes it more difficult for Congress to learn whether or not CISA is being used for domestic surveillance:

That Burr and DiFi watered down Tester’s measures so much makes two things clear. First, they don’t want to count some of the things that will be most important to count to see whether corporations and agencies are abusing this bill. They don’t want to count measures that will reveal if this bill does harm.

Most importantly, though, they want to keep this information from Congress. This information would almost certainly not show up to us in unclassified form, it would just be shared with some members of Congress (and on the House side, just be shared with the Intelligence Committee unless someone asks nicely for it).

But Richard Burr and Dianne Feinstein want to ensure that Congress doesn’t get that information. Which would suggest they know the information would reveal things Congress might not approve of.

Once again, these kinds of actions really only make sense if CISA is being used to justify warrantless domestic surveillance. Which once again raises the question of why Congress is willing to move forward with such a surveillance bill. We just went through a whole process showing that the public is not comfortable with secret laws and secret interpretations that lead to surveillance. Why would they immediately push for a new secret law that expands surveillance and reject any and all attempts at protecting the privacy of the American public or any sort of transparency and accountability in how the bill is used?

The bill is positioned as a cybersecurity bill, but good luck finding a single computer security expert who actually thinks the bill is either useful or necessary. I've been trying and so far I can't find any.

Filed Under: al franken, cisa, dean heller, dianne feinstein, pat leahy, privacy, richard burr, ron wyden, senate, surveillance, transparency

Senate Pushes Forward With CISA As Internet Industry Pulls Its Support

from the what-are-they-thinking? dept

Despite the fact that most of the internet industry has recently come out against the ridiculous faux-cybersecurity bill CISA, the Senate today began the process of moving the bill forward with a debate. The arguments were pretty much what you'd expect. The supporters of the bill, such as Senators Dianne Feinstein and Richard Burr, went on and on about how the bill is "voluntary" and about various online hacks (none of which would have been stopped by CISA -- but apparently those details don't matter). Senator Ron Wyden responded by pointing to all the internet companies coming out against the bill, and saying (accurately) that they're doing so because they know the public no longer trusts many of those companies, and they don't want a bill that will almost certainly be used for further surveillance efforts.

Amazingly, Burr shot back with a really dishonest and misleading claim that companies that don't agree to "share" information with the government are the ones harming their users by somehow not protecting their info. That's fairly incredible. The reason that companies don't want to share info is because no one -- the companies or the public -- trust the government to not abuse the information. To turn that around and pretend that sharing the info with the government is likely to better protect user information is laughable.

The fact that the internet companies have finally come out against CISA is a really big deal. For the past few years, they've remained pretty quiet on it and related bills, because it would have granted them immunity from liability for participating in the program. So, for the tech companies, it was tough to argue against the bill, since it just protected them from legal liability. Yet, in the last few weeks, many internet companies and industry associations have (finally) spoken out against the bill, noting that it actually puts their users' privacy at risk. This also helps highlight how the claim that this is all "voluntary" is a myth, and the companies recognize that they will likely be pressured into sharing information.

Meanwhile, a bunch of amendments have been introduced along with CISA... including an absolutely terrible amendment introduced by Senator Sheldon Whitehouse that would revamp an unrelated bill, the infamous CFAA, which needs to be reformed. Except that the Whitehouse amendment makes the CFAA worse, not better.

There's still plenty of process to occur, but the ball is now rolling. There will likely be some fights and votes in the next few days, but if you don't think CISA (or this horrible CFAA amendment) should pass, now would be a good time to call your two Senators and let them know to oppose this.

Filed Under: cfaa, cisa, cybersecurity, dianne feinstein, information sharing, richard burr, ron wyden, sheldon whitehouse

Why Do Senators Keep Lying About What CISA Would Be Used For?

from the liar-liar dept

We keep asking if the politicians supporting CISA -- the "Cybersecurity Information Sharing Act" can explain just what security breaches it would have stopped -- and they can't. Because the answer is that it wouldn't have stopped any of them. And yet, the politicians pushing CISA never seem to waste an opportunity to pretend that each new big computer hack would have been stopped if only CISA had been in place. A few months ago it was the OPM hack and, now, apparently it's the T-Mobile/Experian hack.

Both Senators Richard Burr and Dianne Feinstein (the two leading members of the Senate Intelligence Committee from each party) have been taking swings at anyone who won't support the bill, and have cited the T-Mobile customer breach as a reason to support it:

“If these special interest groups are successful in mischaracterizing this bill, which authorizes purely voluntary sharing, they will only succeed in allowing more personal information to be compromised to criminals and foreign countries.”

The Intelligence panel leaders urged action on the bill following a breach that might have exposed private data for 15 million current and prospective T-Mobile customers.

Of course, the reason that the customer data was exposed has nothing to do with CISA, which would not have stopped that breach. It had to do with Experian screwing up their encryption. If Feinstein and Burr really wanted to encourage better cybersecurity, they'd be encouraging greater encryption.

And they're not being truthful in the rest of their statement. As far as I've seen, most of the people opposing CISA are happy to admit that it's about "voluntary" sharing of information -- but they note that by taking away all liability from companies for sharing info, companies have greatly decreased incentives to protect user privacy.

And, also, all of this totally leaves out the real reason behind CISA. As was revealed this past summer, the NSA uses "cybersignatures" as selectors in searching through all of the upstream (backbone) traffic that it sniffs. Given that, what the NSA is really looking for are more "cybersignatures" in order to be able to sniff out many more things.

And guess what CISA would do? That's right, create incentives for companies to give "cybersignatures" to the NSA.

This is almost certainly why Senator Ron Wyden made it clear that CISA is a surveillance bill in disguise, because it would play right into the hands of the NSA, by giving it a way to snoop on even more communications after convincing companies to hand over "cybersignatures" that it can then use to sniff through everyone's internet traffic.

Yes, CISA is "voluntary." But it's totally about surveillance, not cybersecurity, and nothing in CISA would have prevented the T-Mobile hack or the OPM hack or any other hack. For Feinstein and Burr to suggest otherwise is totally disingenuous fluff, designed to mislead the American public and to support the NSA.

Filed Under: cisa, cybersecurity, cybersignatures, dianne feinstein, nsa, richard burr, ron wyden, surveillance, t-mobile hack
Companies: experian, t-mobile