House Intel Committee Says Snowden's Not A Whistleblower, 'Cause He Once Emailed His Boss's Boss

from the wait,-what? dept

As you probably heard, the ACLU and other have launched a massive campaign asking President Obama to pardon Ed Snowden. You can check it out here and sign the petition. There have also been a bunch of high profile op-eds and endorsements from a wide variety of people -- from former intelligence officials to human rights groups and more. The campaign was obviously timed to coincide with the release of Oliver Stone's new movie, Snowden.

Apparently also timed with the release of the movie, the House Intelligence Committee has released a "report" that they claim they spent two years writing, detailing why they believe Snowden is no whistleblower. They've released an unclassified three page "executive summary" that is, at best, laughable. Honestly, if this is the best that the House Intel Committee can put together to smear Snowden, they must have found nothing bad. I mean, it's the stupidest stuff: like that he once got into a dispute with his boss over some software updates at work and (*gasp*) emailed someone higher up the chain, for which he got reprimanded: If you can't read that, it says:

Third, two weeks before Snowden began mass downloads of classified documents, he was reprimanded after engaging in a workplace spat with NSA managers. Snowden was repeatedly counseled by his managers regarding his behavior at work. For example, in June 2012, Snowden became involved in a fiery e-mail argument With a Supervisor about how computer updates should be managed. Snowden added an NSA senior executive several levels above the supervisor to the e-mail thread, an action that earned him a swift reprimand from his contracting officer for failing to follow the proper protocol for raising grievances through the chain of command. Two weeks later, Snowden began his mass downloads of classified information from NSA networks. Despite Snowden's later claim that the March 2013 congressional testimony of Director of National Intelligence James Clapper was a "breaking point" for him, these mass downloads predated Director Clapper's testimony by eight months.

First of all, the inclusion of the email dispute is just... weird. I mean, people have email disputes with co-workers all the time. Is that really a sign that you're not a whistleblower, or that you're just "disgruntled?" If that's really the "dirt" that they dug up on Snowden after two years of research, they really must have nothing that actually sticks.

Oh, and also, as Snowden himself notes, this all kinda works against their point, because it shows that trying to blow the whistle up the chain is... met with reprimands. Of course, the point that they're really getting at is the second half of that paragraph -- where they claim that he began the downloads way before James Clapper's infamous lie to Senator Ron Wyden. But, again, Snowden points out that they're being totally misleading here (and it must upset the House Intelligence Committee to no end that Snowden is free and able to use Twitter to debunk their claims), because, as has been previously reported in great detail, Snowden was assigned to move a bunch of documents between systems. The "downloading" they're talking about was his job. In other words, yes, he touched 1.5 million documents. Because he was told to as a part of his job. It's been more than two years since James Clapper himself admitted that Snowden didn't actually take all of those. That's just the number he "touched" because his job was to move those documents to a different system. Snowden took a much smaller subset, and now they're claiming that him doing his job was him taking the docs.

The report also trots out the usual "harm to national security." We've been hearing this ever since the first leak... and yet no one ever has any evidence to support this. It's the bogeyman argument. And yet, here it is again: If you can't read that, it says:

First, Snowden caused tremendous damage to national security, and the vast majority of the documents he stole have nothing to do with programs impacting individual privacy interests-they instead pertain to military, defense, and intelligence programs of great interest to America's adversaries. A review of the materials Snowden compromised makes clear that he handed over secrets that protect American troops overseas and secrets that provide vital defenses against terrorists and nation-states. Some of Snowden's disclosures exacerbated and accelerated existing trends that diminished the IC's capabilities to collect against legitimate foreign intelligence targets, while others resulted in the loss of intelligence streams that had saved American lives. Snowden insists he has not shared the full cache of 1.5 million classified documents with anyone; however, in June 2016, the deputy chairman of the Russian parliament's defense and security committee publicly conceded that "Snowden did share intelligence" with his government. Additionally, although Snowden's professed objective may have been to inform the general public, the information he released is also available to Russian, Chinese, Iranian, and North Korean government intelligence services; any terrorist with Internet access; and many others who wish to do harm to the United States.

The full scope of the damage inflicted by Snowden remains unknown. Over the past three years, the IC and the Department of Defense (DOD) have carried out separate reviews--with differing methodologies--of the damage Snowden caused. Out of an abundance of caution, DOD reviewed all 1.5 million documents Snowden removed. The IC, by contrast, has carried out a damage assessment for only a small subset of the documents. The Committee is concerned that the IC does not plan to assess the damage of the vast majority of documents Snowden removed. Nevertheless, even by a conservative estimate, the U.S. Government has spent hundreds of millions of dollars, and will eventually spend billions, to attempt to mitigate the damage Snowden caused. These dollars would have been better spent on combating America's adversaries in an increasingly dangerous world.

Note that after a lot of hand-waving, the only actual damage they can even come close to quantifying is the amount of money the US government spent trying to close the barn doors -- i.e., investigate what Snowden had taken and make sure that others couldn't do the same. That's not Snowden's fault. That's very much blaming the messenger. Also, if the US government wasn't illegally spying on Americans, it wouldn't have been an issue. It seems worth noting that key point.

And, again, the report continues to point to the 1.5 million number, despite the fact that it's already been debunked. Again, the reason Snowden moved 1.5 million docs was because that was part of his job -- that wasn't the amount taken. The reason that the Intelligence Community isn't investigating all of those docs is because it has said that Snowden didn't take all of them. Why is the House Intelligence Committee bitching about that?

As for the Russian Parliament member claiming that Snowden shared secrets with Russia, Snowden himself notes that they're misquoting what was said, and that the guy had prefaced his statement by nothing that it was speculation on his part, rather than confirmed fact. You'd think that the House Intel Committee wouldn't go around trading in mere speculation.

As for the claims that "the information he released is also available to Russian, Chinese, Iranian, and North Korean government intelligence services" is also pretty ridiculous. I mean, the documents that have been released (not all of them, and the ones that have been have included redactions) have been placed on the internet, where anyone can read them. The statement about the Russians, Chinese, Iranians, North Koreans and terrorists having access to them is basically the equivalent of "these people have the internet." Yeah, so?

Next on the docket, the House Intel Committee claims that Snowden's not a whistleblower because he (1) didn't go through proper channels (2) he left the country and (3) the NSA surveillance program was all perfectly legal. If you can't read that, it says:

Second, Snowden was not a whistleblower. Under the law, publicly revealing classified information does not qualify someone as a whistleblower. However, disclosing classified information that shows fraud, waste, abuse, or other illegal activity to the appropriate law enforcement or oversight personnel--including to Congress--does make someone a whistleblower and affords them with critical protections. Contrary to his public claims that he notified numerous NSA officials about what he believed to be illegal intelligence collection, the Committee found no evidence that Snowden took any official effort to express concerns about U.S. intelligence activities--legal, moral, or otherwise--to any oversight officials within the U.S. Government, despite numerous avenues for him to do so. Snowden was aware of these avenues. His only attempt to contact an NSA attorney revolved around a question about the legal precedence of executive orders, and his only contact to the Central Intelligence Agency (CIA) Inspector General (IG) revolved around his disagreements with his managers about

Let's stop right there to respond to this load of nonsense. First of all, hiding behind the very technical, narrow legal definition of whistleblower is pretty ridiculous compared to the actual definition that most people use. Snowden revealed a program that involved mass surveillance on nearly all Americans, a program that the intelligence community had directly and officially denied existed. It was, in fact, a program that, from a plain reading of the law, should not exist, and the only way in which it did and could exist was if the government reinterpreted the law, in secret, to mean something completely different. That's pretty clearly whistleblowing. And the fact that the public has spoken out in support of him so much suggests that many people believe this as well.

And that doesn't even mention the fact that after this Congress changed the law to further clarify what the NSA could actually do. In other words, Congress seems to agree that what Snowden did was in the public interest. Even former Attorney General Eric Holder has admitted as much.

And, of course, the claims about "the proper channels" is ridiculous as well. We've written many, many times on what happens to individuals who go through the "proper channels." It often ends with them being put in jail on trumped up charges. Oh, and Snowden, as a contractor rather than gov't employee, had no whistleblower protections under the law anyway. Going through the "proper channels" gets you marked as a troublemaker, and that often leads to more scrutiny and questionable raids... and jail time. And, as if to confirm all this, the guy that Snowden could have reached out to as the "proper channel" had already mocked Snowden and attacked him, so it's not as if that would have been a useful route.

The Committee tries to brush off this concern with the "proper channels" but fails in doing so:

Despite Snowden's later public claim that he would have faced retribution for voicing concerns about intelligence activities, the Committee found that laws and regulations in effect at the time of Snowden,s actions afforded him protection. The Committee routinely receives disclosures from IC contractors pursuant to the Intelligence Community Whistleblower Protection Act of 1998 (IC WPA). If Snowden had been worried about possible retaliation for voicing concerns about NSA activities, he could have made a disclosure to the Committee. He did not. Nor did Snowden remain in the United States to face the legal consequences of his actions, contrary to the tradition of civil disobedience he professes to embrace. Instead, he fled to China and Russia, two countries whose governments place scant value on their citizens' privacy or civil liberties-and whose intelligence services aggressively collect information on both the United States and their own citizens.

Again, this is wrong. The Whistleblower Act does not actually extend its protections to contractors, and given how the Committee is reacting to Snowden to this day, does anyone actually think they would have done anything if he had approached them -- other than maybe alerting top intel community officials that they had a troublemaker in their midst? As for the claim that Snowden didn't stay in the US to face the "legal consequences," again, is it any wonder why? He knew what had happened to people like Thomas Drake, who the feds tried to put in jail for 35 years because he had a (mistakenly) classified meeting agenda at his home -- a home that was only raided because Drake had blown the whistle on another program. He'd seen what happened to Chelsea Manning, held in solitary confinement for leaking documents to Wikileaks. He'd seen what happened to countless others.

The very fact that Snowden is free today and able to tweet responses to this ridiculous smear campaign shows exactly why he didn't choose to stay in the US where they would have locked him up and thrown away the key.

To gather the files he took with him when he left the country for Hong Kong, Snowden infringed on the privacy of thousands of govemment employees and contractors. He obtained his colleagues, security credentials through misleading means, abused his access as a systems administrator to search his co-workers, personal drives, and removed the personally identifiable information of thousands of IC employees and contractors. From Hong Kong he went to Russia, where he remains a guest of the Kremlin to this day.

And yet, magically, none of that has ever become public. So, uh, it seems like maybe the major worries here were overblown.

It is also not clear Snowden understood the numerous privacy protections that govern the activities of the IC. He failed basic annual training for NSA employees on Section 702 of the Foreign Intelligence Surveillance Act (FISA) and complained the training was rigged to be overly difficult. This training included explanations of the privacy protections related to the PRISM program that Snowden would later disclose.

Now this seems to just be the Intelligence Committee scraping the bottom of the barrel again for anything to make Snowden look bad. Oooh, he failed the training program on PRISM. And, yet, that doesn't respond to the fact that there were all sorts of legitimate privacy concerns about PRISM and how it operates, and the program was kept entirely secret.

From there, the Committee goes into full scale playground taunting of Snowden, saying he's a "serial fabricator" because he may have exaggerated a few points: If you can't read that, it says:

Fourth, Snowden was, and remains, a serial exaggerator and fabricator. A close review of Snowden's official employment records and submissions reveals a pattem of intentional lying. He claimed to have left Army basic training because of broken legs when in fact he washed out because of shin splints. He claimed to have obtained a high school degree equivalent when in fact he never did. He claimed to have worked for the CIA as a "senior advisor," which was a gross exaggeration of his entry-level duties as a computer technician. He also doctored his performance evaluations and obtained new positions at NSA by exaggerating his resume and stealing the answers to an employment test. In May 2013, Snowden informed his supervisor that he would be out of the office to receive treatment for worsening epilepsy. In reality, he was on his way to Hong Kong with stolen secrets.

So, yeah. I mean, considering how much "fabricating" and "exaggerating" the House Intel Committee does in this whole report, it's a bit weak to argue that him exaggerating his leg problems is somehow proof of being a "serial fabricator." And, I'm sure that none of the members of the House Intel Committee has ever been caught "exaggerating" or "fabricating" information in their quest to get elected, right?

And, of course, Snowden claims they're mostly wrong about all of this anyway. The claim that he doctored a performance evaluation? Snowden notes that he actually reported a vulnerability. The shin splints v. broken legs? The claim that he never got his GED? Snowden hints that if that's what the Intel Committee is really saying, they should get ready to be embarrassed: The fact that he lied about why he was taking time off? I mean, come on. They must really be stretching for something to include that as a "lie." It was a deliberate move as part of his already determined plan to blow the whistle on these programs, not evidence of a pattern of lying.

In the end, the only proper way to read this report is in the context that Glenn Greenwald pointed out: if the House Intelligence Committee had done its oversight job of preventing mass surveillance on Americans, rather than acting as an enabler for the NSA, Snowden wouldn't have been a problem. The Committee's anger seems driven more by Snowden showing how complicit they were in failing to actually oversee the NSA: Of course, along with this report, the Intel Committee has also sent the White House a letter saying that it should not pardon Snowden, saying "Mr. Snowden is not a patriot. He is not a whistleblower. He is a criminal." It goes on to repeat many of the false claims from the report.

I get the feeling that history will treat Ed Snowden much more kindly than it will treat the cowardly members of the House Intel Committee who are now trying (and failing) to cover up their own failures as overseers.

Filed Under: congress, ed snowden, house intelligence committee, oversight, pardon snowden, surveillance, whistleblower

ACLU Launching Campaign To Have President Obama Pardon Snowden

from the timed-to-the-movie dept

The ACLU has been hinting at this for the past few months, but with the end of President Obama's term in office coming up and coinciding with the launch of Oliver Stone's feature film about Ed Snowden, the ACLU, along with Amnesty International, are launching an official campaign to ask the President to issue a pardon for Ed Snowden. They'll be hosting a press conference Wednesday morning, where Snowden will show up via video (perhaps using Robot Snowden?) to discuss. Not surprisingly, the ACLU says they've lined up a bunch of "legal scholars, policy experts, human rights leaders, technologists and former government officials," who will all be supporting a pardon for Snowden.

There will also apparently be a sign-on form on the site PardonSnowden.org, which is currently locked up behind a password (get busy cracking that, NSA).

Not surprisingly, I think the president absolutely should pardon Snowden. I also think there's very, very, very little chance that he actually will. I wouldn't put the chance at 0% -- because it's possible. But I'd still put the likelihood in the single digits. I hope I'm wrong -- and I hope that the President recognizes why pardoning Snowden would be such a good thing, and an important part of his legacy. And I hope that the movie (which I have not seen) properly puts Snowden's actions in context (though I'm not entirely convinced Oliver Stone will do so). So, perhaps I'm wrong. But I just find it super unlikely that President Obama would stick his neck out and take a stand like that.

Filed Under: ed snowden, pardon, president obama, whistleblowing, white house
Companies: aclu

Clinton Campaign Happily Using Strong End-To-End Encryption To Communicate; Will They Let The Rest Of Us Use It Too?

from the good-for-the-goose dept

Hillary Clinton has been somewhat hard to pin down on the encryption debate -- because she's done what she's done with plenty of issues, generally spoken in broad platitudes without ever making a statement that allows her position to actually be clear. But she's certainly said some pretty concerning stuff. Last fall she said:

Encryption of mobile communications presents a particularly tough problem. We should take the concerns of law enforcement and counterterrorism professionals seriously. They have warned that impenetrable encryption may prevent them from accessing terrorist communications and preventing a future attack.

Of course, she then did a "on the other hand" and noted the concerns of security folks. Since then, she's called for a sort of Manhattan Project on encryption, believing that if Silicon Valley people could just nerd harder, they could make encryption that could only be broken by law enforcement. That's not how it works. She's also complained that Silicon Valley treats the government "as its adversary."

So it seems rather noteworthy that, following questions about how well she secured her own emails, combined with email leaks from the DNC and reports that the campaign itself has been hacked, the Clinton campaign has now started using Signal, the popular encrypted messaging system from Open Whisper Systems (which made the protocol that is generally considered the best around for end-to-end encrypted messaging).

In the intervening weeks, staffers were told, according to a person who works with the committee, that if anyone was going to communicate about Donald Trump over e-mail or text message, especially if those missives were even remotely contentious or disparaging, it was imperative that they do so using an application called Signal....

Signal, staffers in the meeting were told, was “Snowden-approved.” A week after the meeting at the campaign headquarters, according to two people who have worked with the D.N.C. and the Clinton campaign, an e-mail was sent out instructing staffers where to download the app and how to use it.

So, you'd think that, maybe (just maybe) the Clinton campaign might come out and say that it's not planning to support bills that would outlaw Signal after they're elected, right?

Perhaps it'll take another lesson. Because, apparently, the Clinton campaign staffers didn't pay much attention to the briefing:

While the D.N.C. hack sent tremors down the spines of virtually everyone in Washington, it didn’t take long for people to take the easy route, once again e-mailing sensitive information that could easily hamper the campaign if it ever became public. Or, as one Washington insider told me: “No one really learned.”

So, there's that.

The other oddity in this story is that Hillary Clinton has called for Snowden to be put in jail, and yet now her campaign is telling everyone to use Snowden-approved encryption? The irony did not go unnoticed by one person in particular:

Filed Under: clinton campaign, ed snowden, encryption, going dark, hillary clinton, signal

Ed Snowden Explains Why Hackers Published NSA's Hacking Tools

from the you-break-many-things. dept

Yesterday, the news broke that a "mysterious" hacking group had gotten its hands on some NSA hacking tools and was releasing some of the tools as proof (it was also demanding lots of Bitcoin to reveal more). The leak came with a neat little message that feels like it was written by a Hollywood script writer trying to sound Russian.

How much you pay for enemies cyber weapons? Not malware you find in networks. Both sides, RAT + LP, full state sponsor tool set? We find cyber weapons made by creators of stuxnet, duqu, flame. Kaspersky calls Equation Group. We follow Equation Group traffic. We find Equation Group source range. We hack Equation Group. We find many many Equation Group cyber weapons. You see pictures. We give you some Equation Group files free, you see. This is good proof no? You enjoy!!! You break many things. You find many intrusions. You write many words. But not all, we are auction the best files.

You break many things indeed! (For what it's worth, it appears that GitHub and Tumblr both killed the accounts where whoever hacked this stuff first posted it).

The files that were leaked were mostly installation scripts, but also exploits designed for specific routers and firewalls. And, it's noted, that some of the tools named line up with previously leaked NSA codenames. One other interesting point from the Motherboard link above: the files are a bit dated:

The most recent file is dated June 2013, though the hackers could have tampered with the dates. Dmitri Alperovitch, the co-founder of security firm CrowdStrike, theorized that “the leakers were probably sitting on this information for years, waiting for the most opportune time to release.”

Of course, June 2013 is interesting for another reason. That's when Ed Snowden passed on his documents to a small group of reporters and the very first stories based on the Snowden leaks started. So it seems noteworthy that Snowden has put together a bit of a tweetstorm for his take on the hack and release of the hacking tools. To make it easier to read, we've put it all together here:

The hack of an NSA malware staging server is not unprecedented, but the publication of the take is. Here's what you need to know:

NSA traces and targets malware C2 servers in a practice called Counter Computer Network Exploitation, or CCNE. So do our rivals. NSA is often lurking undetected for years on the C2 and ORBs (proxy hops) of state hackers. This is how we follow their operations. This is how we steal their rivals' hacking tools and reverse-engineer them to create "fingerprints" to help us detect them in the future.

Here's where it gets interesting: the NSA is not made of magic. Our rivals do the same thing to us -- and occasionally succeed. Knowing this, NSA's hackers (TAO) are told not to leave their hack tools ("binaries") on the server after an op. But people get lazy.

What's new? NSA malware staging servers getting hacked by a rival is not new. A rival publicly demonstrating they have done so is.

Why did they do it? No one knows, but I suspect this is more diplomacy than intelligence, related to the escalation around the DNC hack. Circumstantial evidence and conventional wisdom indicates Russian responsibility. Here's why that is significant: This leak is likely a warning that someone can prove US responsibility for any attacks that originated from this malware server. That could have significant foreign policy consequences. Particularly if any of those operations targeted US allies. Particularly if any of those operations targeted elections. Accordingly, this may be an effort to influence the calculus of decision-makers wondering how sharply to respond to the DNC hacks.

TL;DR: This leak looks like a somebody sending a message that an escalation in the attribution game could get messy fast.

Bonus: When I came forward, NSA would have migrated offensive operations to new servers as a precaution - it's cheap and easy. So? So... The undetected hacker squatting on this NSA server lost access in June 2013. Rare public data point on the positive results of the leak.

You're welcome, @NSAGov. Lots of love.

Sure, it's speculation, but it's pretty informed speculation and it makes a lot of sense. There's still plenty of talk about what to do about the DNC hack, and we've talked about "cybersecurity firms" (who profit from FUD and scare stories) arguing that we should "declare cyberwar" on Russia based on loose attribution. But, as Snowden notes, this hack and partial release could very well be a warning shot that escalation won't end up looking good for the US if they go that route.

Filed Under: dnc hack, ed snowden, equation group, hacking tools, malware, nsa, surveillance

Snowden Docs Show NSA, New Zealand Spied On Pro-Democracy Activists

from the we-love-democracy,-not-so-much-those-who-advocate-for-it dept

The Intercept has published a few more documents from the Snowden stash -- these ones detailing the NSA's partnership with New Zealand's top intelligence agency to place pro-democracy activists under surveillance.

As part of the spy mission, the NSA used its powerful global surveillance apparatus to intercept the emails and Facebook chats of people associated with a Fijian “thumbs up for democracy” campaign. The agency then passed the messages to its New Zealand counterpart, Government Communications Security Bureau, or GCSB.

One of the main targets was [Tony] Fullman, a New Zealand citizen, whose communications were monitored by the NSA after New Zealand authorities, citing secret evidence, accused him of planning an “an act of terrorism” overseas.

The "act of terrorism" claims were odd, considering Fullman's activism was aligned with the New Zealand government's own views: opposition to neighboring Fiji's authoritarian ruler, Frank Bainimarama. Utilizing PRISM, the NSA intercepted Fullman's Gmail and Facebook messages, along with gathering everything it could from his public postings -- including this data on his apparently terrorism-related personal vehicle.

Both the NSA and its New Zealand partner have refused to comment on the misguided surveillance, stating only that everything done was performed lawfully.

The erroneous assumptions of terrorism seem to be linked to Fullman's lifelong friendship with a top Fijian military official. Fullman grew up in Fiji, where he met Ratu Tevita Mara in the 1960s. Fullman moved to New Zealand while in his 20s before returning to take a government position in 2009. By that point, Mara had moved up in the military to a position as the Fijian army's chief of staff. Mara, however, drew heat from the Fijian government for his opposition to the current regime.

Mara was dissatisfied with the leadership and, in May 2011, he became embroiled in a high-profile dispute with the Bainimarama regime. He was accused of plotting to overthrow the government and charged with uttering a seditious comment. He was hauled before a court, where he was threatened with imprisonment for allegedly uttering the words, “This government is fuck all.”

Mara fled Fiji, remaining in contact with Fullman, who also left Fiji after being questioned by local authorities about his relationship with Mara. A visit to New Zealand with Mara resulted in Fullman's life being turned upside down.

At 7am on July 17, 2012, about a week after Fullman had returned to Australia from the trip to New Zealand, a team of more than a dozen Australian security agents and two Australian federal police detectives arrived at his sister’s home in Sydney looking for weapons and other evidence of the suspected plot.

They seized computers, phones and documents from the premises and confiscated Fullman’s passport on behalf of the New Zealand authorities. Teams of New Zealand Security Intelligence Service officers and police simultaneously raided Fullman’s former apartment in the Wellington suburb of Karori and the homes of at least three other Fiji Freedom and Democracy movement supporters in Auckland, seizing their computers and other property.

In addition, Fullman's passport was revoked by the New Zealand government, which claimed Fullman was part of a group planning to violently overthrow the Fijian government. New Zealand's intelligence agency asked the NSA for assistance in digging up info on Fullman and keeping him under surveillance. The documents published today make Tony Fullman the first confirmed target of the NSA's PRISM surveillance.

According to the documents viewed by The Intercept, the NSA couldn't seem to decide how to classify its surveillance of Fullman, alternating between listing him as a "foreign government" target (even though Fullman no longer worked for the Fijian government) and a "counter-terrorism" target.

Months of surveillance efforts -- shared with New Zealand intelligence operatives -- produced nothing more than what could likely have been observed without all the intercepted emails/Facebook messages, harvested bank statements, and precise GPS data on Fullman's Mitsubishi station wagon.

[T]here was not a single hint of any plans for violence or other clandestine activity.

It would soon become clear that there was no evidence to support the New Zealand authorities’ suspicions. And gradually, their case would fall apart.

Ten months after placing Fullman under surveillance and stripping him of his passport, New Zealand's government returned it to him and declared him to be "no longer" of "national security concern." This determination came two months after Fullman began taking legal action against the New Zealand government for its raid of his sister's home and the cancellation of his passport.

That's not the only bit of suspicious timing: Fullman believes the raid was politically-motivated.

Four days after the raids on Fullman and his fellow campaigners, New Zealand foreign minister Murray McCully traveled to Fiji for trade talks. Fullman believes that the timing was no coincidence — and that the raids targeting the pro-democracy group were used by the New Zealand government as a bargaining chip to curry favor with the Bainimarama regime. “The minister can go to Fiji and say, ‘look we saved you, let’s be friends again, let’s start talking about how we can help each other again’,” Fullman says. “It was part of the frame up.”

The New Zealand government may have felt its efforts fell into "no harm, no foul" territory after it reinstated Fullman's passport and dropped its surveillance. But Fullman points out the high-profile raid it carried out damaged his reputation by erroneously linking him to an assassination plot. On top of that, Fullman is still subjected to additional security screening any time he travels. Fullman was never informed he was under surveillance by a foreign intelligence agency and he has never been compensated, much less apologized to, for his treatment at the hands of his own government.

The surveillance detailed here shows the NSA is willing to help foreign governments spy on their own citizens for politically-motivated reasons involving what would normally be considered protected forms of expression. It also shows that when governments do this sort of thing, they're unlikely to admit any wrongdoing, even when they tacitly admit they placed the wrong person(s) under surveillance.

Filed Under: ed snowden, gcsb, new zealand, nsa, prism, snowden docs, surveillance, tony fullman

Director Of National Intelligence 'Celebrates' National Whistleblower Day... Without Mentioning Snowden Once

from the he-who-shall-not-be-named,-who-did-the-things-that-shall-not-be-mentioned dept

In accordance with the new instructions to wrap its arms gingerly around transparency, the Office of the Director of National Intelligence is following the letter of the law in its tepid celebration of National Whistleblower Day.

The admission that this is something beyond the office's control doesn't appear until the fifth paragraph of the ODNI's "National Whistleblower Celebration Day" post -- which definitely gives it the appearance of being something it wouldn't have done if it had been given the choice.

The Senate Whistleblower Protection Caucus Introduced a resolution that designated July 30, 2016 as Whistleblower Appreciation Day. The resolution “encourages federal agencies to acknowledge employees who call attention to fraud waste and abuse and remind employees of their legal rights as whistleblowers.”

The lack of proper punctuation suggests this was copy-pasted from somewhere similarly comma- and enthusiasm-free. And while there are a few nods to the new mechanisms available to whistleblowers, the complaints will all end up in the ODNI's office sooner or later. This perhaps explains why there are so few of them, despite the program's supposedly "robust outreach" and "reprisal intake functions."

Ah. Robust. Eighteen blown whistles in two-and-a-half years, with zero landing before an outside review board.

On the other hand, there may be some sincerity in the post, seeing as Daniel Meyer -- the intelligence official quoted in the press release -- is probably in need of some whistleblower protection. Not only is he the Executive Director of IC Whistleblowing and Source Protection, he's also a customer:

The Obama administration’s top official overseeing how intelligence agencies handle whistleblower retaliation claims has lodged his own complaint, alleging he was punished for disclosing “public corruption.”

Daniel Meyer, who previously oversaw the Defense Department’s decisions on whistleblowing cases, also says he was targeted for being gay, according to records obtained by McClatchy.

Meyer made the allegations in a complaint before the Merit Systems Protection Board, an administrative panel that handles employment grievances from federal employees, after another agency rejected his claims.

There's also the matter of the elephant (who was once) in the room (but now resides somewhere in Russia). Despite there being widespread acknowledgment that Edward Snowden's leaks have been responsible for the first meaningful surveillance reforms in years, Snowden's name is nowhere to be found in the ODNI's celebratory post.

Maybe that's because the Presidential Policy Directive instituting better protections for intelligence community whistleblowers was issued in October 2012, well ahead of the initial Snowden leak. Maybe that's why the ODNI is completely restrained in its celebration of its most famous whistleblower. Then again, the PPD gave agencies 270 days to comply, which means most of them were forced to put this policy into effect just one month after Snowden's first leak, at the latest. That has to sting a little.

Whatever the case is -- whether it's a lack of actual wrongdoing or a system that still doesn't do quite enough to protect whistleblowers against reprisals -- the low number of complaints currently making their way through the system are being handled "lawfully," according to ODNI. This would put policy compliance in line with its multiple bulk interception/metadata programs, which have always been referred to as "lawful" during multiple "no comments" delivered in response to multiple leaks.

For all intents and purposes, it is Snowden Day, which now comes twice a year -- and will never be officially acknowledged once.

Filed Under: ed snowden, national whistleblower day, odni, whistleblowers

Ed Snowden And Bunnie Huang Design Phone Case To Warn You If Your Phone Is Compromised

from the busy-day dept

Bunnie Huang is having quite a day -- and it's a day the US government perhaps isn't too happy about. Huang has worked on a number of interesting projects over the years from hacking the Xbox over a dozen years ago to highlighting innovation happening without patents in China. This morning we wrote about him suing the US government over Section 1201 of the DMCA. And now he's teamed up with Ed Snowden (you've heard of him) to design a device to warn you if your phone's radios are broadcasting without your consent. Basically, they're noting that your standard software based controls (i.e., turning on "airplane mode") can be circumvented by, say, spies or hackers. But their tool is designed to actually determine if the radios are broadcasting for real:

The aim of that add-on, Huang and Snowden say, is to offer a constant check on whether your phone’s radios are transmitting. They say it’s an infinitely more trustworthy method of knowing your phone’s radios are off than “airplane mode,” which people have shown can be hacked and spoofed. Snowden and Huang are hoping to offer strong privacy guarantees to smartphone owners who need to shield their phones from government-funded adversaries with advanced hacking and surveillance capabilities—particularly reporters trying to carry their devices into hostile foreign countries without constantly revealing their locations.

They've published a paper describing the product and it's a good read.

Front-line journalists risk their lives to report from conflict regions. Casting a spotlight on atrocities, their updates can alter the tides of war and outcomes of elections. As a result, front-line journalists are high-value targets, and their enemies will spare no expense to silence them. In the past decade, hundreds of journalists have been captured, tortured and killed. These journalists have been reporting in conflict zones, such as Iraq and Syria, or in regions of political instability, such as the Philippines, Mexico, and Somalia.

Unfortunately, journalists can be betrayed by their own tools. Their smartphones, an essential tool for communicating with sources and the outside world–as well as for taking photos and authoring articles–are also the perfect tracking device. Legal barriers barring the access to unwitting phone transmissions are failing because of the precedent set by the US’s “third-party doctrine,” which holds that metadata on such signals enjoys no legal protection. As a result, governments and powerful political institutions are gaining access to comprehensive records of phone emissions unwittingly broadcast by device owners. This leaves journalists, activists, and rights workers in a position of vulnerability. Reporter Marie Colvin’s 2012 death is a tragic reminder of how real this vulnerability can be. A lawsuit against the Syrian government filed in 2016 alleges she was deliberately targeted and killed by Syrian government artillery fire. The lawsuit describes how her location was discovered in part through the use of intercept devices that monitored satellite-dish and cellphone communications.

Of course, at this point, all that exists is the paper explaining how this will work. They haven't yet built the actual system. But given Huang's history of hardware hacking and his relationships in Shenzhen, it seems likely that he could get it made pretty quickly if there was demand.

Huang, who lives in Singapore but travels monthly to meet with hardware manufacturers in Shenzhen, says that the skills to create and install their hardware add-on are commonplace in mainland China’s thriving iPhone repair and modification markets. “This is definitely something where, if you’re the New York Times and you want to have a pool of four or five of these iPhones and you have a few hundred extra dollars to spent on them, we could do that.” says Huang. “The average [DIY enthusiast] in America would think this is pretty fucking crazy. The average guy who does iPhone modifications in China would see this and think it’s not a problem.”

Again, who knows if people will actually end up using this, but it's still good to see solutions like this being explored and tested.

Filed Under: bunnie huang, ed snowden, radios, surveillance

Putin Says All Encryption Must Be Backdoored In Two Weeks

from the make-it-snappy dept

A few weeks ago, we wrote about the push by the Russian Duma to pass a massive new surveillance bill that would mandate backdoors to encryption as well as massive data retention requirements for service providers, including saying that they need to store recordings of phone calls. As you may have heard, earlier this week, Russian President Vladimir Putin signed the bill into law. And apparently to prove that he's serious about all of this, Putin has also signed an executive order telling the FSB (the modern version of the KGB) to make sure it gets encryption keys to unlock everything within the next two weeks.

After signing controversial anti-terrorist legislation earlier today, President Putin ordered the Federal Security Service (the FSB, the post-Soviet successor to the KGB) to produce encryption keys to decrypt all data on the Internet. According to the executive order, the FSB has two weeks to do it. Responsibility for carrying out Putin's instructions falls on Alexander Bortnikov, the head of the FSB.

As the article notes, there's a lot of uncertainty here, because in many cases, when things are encrypted locally or where there are private keys, there isn't any way for service providers to turn over any keys.

What happens next is a little unclear. But it seems likely that the Russian government will use this to attack certain encrypted communications services, and potentially block and/or fine them for failing to comply with the new law. There has been a lot of talk about how Ed Snowden has been speaking out against this law, as he should. Considering that he uses a number of different encryption systems to communicate with the world, this law puts him very directly in danger. But it also puts lots of other people at risk as well. As we've been pointing out for a while, encryption does much more to protect everyday citizens than it does to hide the communications of "terrorists." Undermining that puts a lot more people at risk of people hacking into their stuff than being a victim of a terrorist attack.

Filed Under: backdoors, data retention, ed snowden, encryption, fsb, mass surveillance, russia, surveillance, vladimir putin

Post Gag Order, Lavabit Founder Reveals Non-Secret That Feds Were After Ed Snowden's Emails

from the the-least-surprising-news-ever dept

Want some unsurprising news? Apparently a three year gag order has just lapsed, allowing Ladar Levison, the founder and former operator of Lavabit, the secure email service Ed Snowden famously used, to finally say that yes, the feds asked him to turn over his encryption key in order to access Ed Snowden's emails.

Lavabit founder Ladar Levison can finally confirm that Edward Snowden was the target of the 2013 investigation, which led to the shutdown of the Lavabit email service. The original case concerned law enforcement’s authority to compel the disclosure of an SSL/TLS private key, which belonged to Lavabit, and was used to protect the communications of all 410,000 customers, when only one of those customers was the subject of a criminal investigation. After three years, and five separate attempts, the federal judge overseeing the case has granted Mr. Levison permission to speak freely about investigation. The recently delivered court decision unseals the vast majority of the court filings, and releases Mr. Levison from the gag order, which has limited his ability to discuss the proceedings until now.

Mr. Levison has consistently relied on the First Amendment in his court filings, which sought to remove the gag orders entered against him. He argued that such orders are an unconstitutional restraint against speech, and an afront to the democratic process. He plans to use his newfound freedom to discuss the case during a planned presentation on Compelled Decryption at DEF CON 24 in Las Vegas, NV.

Of course, the fact that the feds were after Snowden isn't exactly news. First off, it's what everyone assumed the second the site shut itself down. But, more importantly, earlier this year, a redaction failure revealed it directly: Still, it's good that the gag order has finally been lifted, and it's great that Levison is now going to talk about these issues more widely. He also notes plans to create a legal defense foundation to help with similar cases:

In order to continue the fight, Mr. Levison is forming the Lavabit Legal Defense Foundation (or “LavaLegal”), a non-profit organization founded to, among other things, protect service providers from becoming complicit in unconstitutional activities, and fight secret attempts aimed circumventing digital privacy or impinging upon the right of those involved to speak of the experience. The foundation will be funded by donations from people and organizations all over the world that want to help protect digital privacy and bolster our collective defense against government overreach.

Filed Under: doj, ed snowden, encryption, first amendment, gag order, keys, ladar levison, service providers
Companies: lavabit

Spies In Denial: GCHQ Boss Says Snowden Didn't Kick Off Debate Over Surveillance

from the you-look-foolish dept

For all the idiotic things said about Ed Snowden, at least US bureaucrats appear to have come around to the idea that he helped kick off a necessary debate on surveillance powers and privacy. Just recently we had former Attorney General Eric Holder admit that Snowden "performed a public service by raising the debate." And regular surveillance apologist and former Defense Department lawyer Jack Goldsmith just said that "Snowden forced the intelligence community out of its suboptimal and unsustainable obsession with secrecy."

It appears that some of their counterparts in the UK are still in denial about all of this. GCHQ's boss Robert Hannigan, whose currently on a PR charm offensive (or should that be just offensive PR?) insists that Snowden has nothing to do with the ongoing debate, which he says was happening prior to Snowden leaking documents:

No, Edward Snowden had not sparked a global debate about privacy - that had been under way already - but terrorist targets GCHQ had been tracking had learned from his revelations with heavens knows what consequences, he said.

This is delusional, and calls into question whether or not the GCHQ has management that lives in reality or in a fantasy land. As someone who has followed this issue since well before the Snowden leaks, to argue that the debate was happening in any real way prior to them being splashed across the press is a flat out lie. You can disagree with what Snowden did -- as Hannigan clearly does. But to argue that the revelations did not spark the debate is clearly wrong.

As for the latter part of Hannigan's claim, that terrorists learned stuff from the Snowden documents that created "heaven knows what consequences," that's a load of bunk also. Actual studies showed basically no change in behavior by terrorists post-Snowden, as many already assumed that their basic communications were being tracked. And no one has yet to demonstrate any legitimate consequences from his revelations other than forcing people like Hannigan to have to answer questions about why the GCHQ and NSA seem to be spying on tons of people.

If this new PR campaign is about rebuilding trust in the GCHQ, Hannigan might want to recognize that spewing pure bullshit doesn't make people trust him more. It makes them trust him a lot less.

Filed Under: debate, ed snowden, gchq, robert hannigan, surveillance