Three Years On, It Appears Snowden's Leaks Have Damaged The NSA So Badly It's Healthier Than Ever

from the like-pruning-a-bush-with-a-bunch-of-microphones-hidden-inside-of-it dept

Every time the anniversary of the first Snowden leak rolls around, everyone reassesses the damage... or lack thereof. Did Snowden actually make a dent in the surveillance apparatus or did he do little more than hand out cheat sheets to terrorists?

As more time passes, even Snowden's harshest critics are warming up to the idea that his leaks did more good than harm. Former attorney general Eric Holder, to name one such critic, believes Snowden "performed a public service" by leaking surveillance documents. Of course, this is the sort of thing one can safely say when no longer in the position of having to choose between prosecuting Snowden or dropping the bogus espionage charges.

Over at Lawfare -- a site whose writers are almost universally critical of Snowden -- one contributor (a former DoD lawyer) sees Snowden's leaks as beneficial. Jack Goldsmith's take on the NSA leak fallout finds that Snowden's actions actually made the NSA a better agency -- not just in terms of transparency but in terms of capabilities.

Snowden forced the intelligence community out of its suboptimal and unsustainable obsession with secrecy... Snowden made it realize that, in the words of former NSA Director Michael Hayden, "although the public cannot be briefed on everything, there has to be enough out there so that the majority of the population believe what they are doing is acceptable."

[...]

Forced transparency meant that the intelligence community had to justify itself before the American people for the first time ever—about what it did in the domestic arena and abroad, about the legality of and accountability for its actions, and about its importance to U.S. national security.

Goldsmith points out that the transparency the NSA definitely didn't want ended up being good for it. As he sees it, the agency "had a story to tell" about its national security efforts and Snowden's leaks sort of freed it to tell its side of the story.

He also says the NSA's narrative about its "lawful" programs being practically smothered by oversight has held up. As proof of this, he offers up quotes from PCLOB (Privacy and Civil Liberties Oversight Board) members who found the NSA's Section 702 collection to have "played a key role" in disrupting terrorist activity. However, Goldsmith does gloss over the PCLOB's other key finding: that the bulk collection under Section 215 was not only unconstitutional, but worthless.

Goldsmith also says Snowden's revelations have led to better control of NSA surveillance programs. But even though he rearranges his sentences a bit to push forward with this claim, he still arrives at a contradictory conclusion.

Another criticism of the NSA was that its aggressive collection processes abroad did not consider the rights and interests of foreign individuals and firms. The main response was Presidential Policy Directive 28, which imposed restraints on collection abroad in the interests of non-U.S. citizens. PPD 28 does not have sharp teeth and, while it has reportedly been a pain to implement, will not likely have a material impact on U.S. collection practices. Like many post-Snowden reforms, it imposes process and oversight constraints and forces NSA to be more prudent in its collection practices.

Somehow, this directive is simultaneously toothless and constraining. Hmm.

But his overall point remains accurate, if somewhat unfortunate. The NSA did have to become more transparent, but considering it was starting from total darkness, it's easy to oversell its occasional translucence.

In addition, reform efforts resulting from the leaks may have given the NSA additional collection powers.

The bulk telephone metadata program was legally and on the merits the most controversial program that Snowden revealed, and the one that the NSA seemed least interested in preserving. The USA Freedom Act made some important reforms to this program—most notably, by replacing NSA collection and storage of the metadata with carrier storage of the data and by requiring more limited NSA querying of the data pursuant to court approval. And yet the NSA has ended up in a stronger position as a result. It gets access "a greater volume of call records" than before, according to the NSA general counsel, and probably at a lower cost to itself, since it no longer needs to store and organize the massive quantities of data.

On the other hand, there's no denying Snowden's leaks played a significant role in the revival of end-to-end encryption and other privacy/security efforts. This does appear to be more of a law enforcement "problem" than an intelligence one at this point, but without Snowden, it's hard to believe everyone from Apple to Facebook would be engaged in securing the world's communications.

Also undeniable is the fact that there has been no spike in terrorist activity or any meaningful disruption in the NSA's surveillance apparatus. The NSA first responded as though Snowden were a rogue magician giving away the industry's secrets. Now, it's calmed down. It's not any happier about Snowden's disappearance and his subsequent leakage, but it could be in much worse shape than it is three years down the road.

The NSA is still very much in the business of aggressive signals intelligence around the globe. Its domestic legal authorities are sounder. Its value is more apparent to the American public. It is much more adept at public diplomacy. And its central and expanding role going forward—not just for signals intelligence collection, but for cybersecurity and offensive cyber operations—are secure.

While it's unlikely the NSA is throwing parties in Snowden's honor every June 6th, it can't be displeased with the outcome. It appears to have been more embarrassed than damaged -- and it may not like the additional scrutiny and skepticism that greets it every move -- but it's still pretty much intact after three years of "damaging" leaks.

Filed Under: ed snowden, jack goldsmith, nsa, reforms, surveillance

NSA Emails Provide Little Insight Into Snowden's Pre-Leak Concerns, But Speak Volumes About Agency's Internal Controls

from the a-smoking,-tangentially-related-gun dept

Jason Leopold has secured another comprehensive set of Snowden-related documents from the NSA, dealing with the agency's search for evidence backing up his claim that he tried to take his complaints to intelligence community officials before heading to Hong Kong with a drive full of secret documents.

The long, detailed post -- written with the help of Marcy Wheeler and Ky Henderson -- covers the 800+ pages of internal emails released to Vice in response to a FOIA request. The headline suggests there's a smoking gun, but a few thousand words later, the conclusion seems to be, "There's possibly a smoking gun... and the NSA, due to malice or just incompetence, is going to be of no help in locating it."

What is undoubtedly true is that there was more to Snowden's concerns than the single email released to shore up the NSA's side of the story. There is evidence Snowden contacted other officials about his concerns, but the agency decided to present the single email as though that were the extent of Snowden's complaints.

This posed problems later as Snowden repeated his assertion to other news outlets, including NBC and Vanity Fair. These resulted in further search efforts from the agency which had already claimed to have uncovered everything that could be considered evidence of Snowden's "proper channels" claims.

The following morning, [NSA General Counsel Rajesh] De sent someone at NSA an email with the subject line "NBC/email."

"I need very senior confirmation [Kemp/Moultrie) [a reference to the NSA's director of security and Ron Moultrie, then the NSA's deputy SIGINT director] that all possible steps have been taken to ensure there are no other emails from [Snowden] to OGC," De wrote.

Those assurances apparently could not be provided — even though the agency had publicly been saying over the course of a year that no other relevant communications from Snowden existed.

What's been released by the NSA seems at odds with Snowden's claims that he made several efforts to bring his concerns to the proper authorities. Other communications were uncovered, but none of those dealt with privacy concerns or other whistleblowing attempts.

That certainly doesn't mean the NSA's first assertion that Snowden didn't raise concerns internally is correct either. The released documents show that its ability to search its own files is far less robust than the systems it uses to dig through the rest of the world's communications. For one, the agency appears to have been unable to retrieve emails related to Snowden's work with Booz Allen. Another heavily-redacted email says the NSA was able to gather and read through everything from Snowden's NSAnet and NSAgov accounts, but appends the phrase "that we've been able to obtain," suggesting the results of its search aren't as comprehensive as it would have the public believe.

What's far more disconcerting is the fact that the NSA -- the king of metadata -- isn't able to keep its own email metadata in working order.

What's remarkable about this FOIA release, however, is that the NSA has admitted that it altered emails related to its discussions about Snowden. In a letter disclosed to VICE News Friday morning, Justice Department attorney Brigham Bowen said, "Due to a technical flaw in an operating system, some timestamps in email headers were unavoidably altered. Another artifact from this technical flaw is that the organizational designators for records from that system have been unavoidably altered to show the current organizations for the individuals in the To/From/CC lines of the header for the overall email, instead of the organizational designators correct at the time the email was sent."

There's no telling where this falls on the stupid/malicious scale, but either way, it helps the NSA muddy the timeline waters and obscure the agencies/personnel involved in these email discussions. That admission is downright frightening considering what the agency does with the metadata it harvests.

Remember, this is the agency that “kills people based on metadata,” per its former Director, Michael Hayden.

But “due to a technical flaw in an operational system,” it could not preserve the integrity of either the time or the aliases on emails obtained under FOIA.

That's the scary part. Here's the hypocritical part, as pointed out by attorney and CUNY law professor Douglas Cox, in response to Marcy Wheeler's post on the NSA's metadata problem:

[Y]our point is right on, even in more mundane contexts not involving drone strikes it is remarkable the disconnect between standards agencies impose and those they practice. When you are producing docs to a govt agency in response to doc requests, eg, you often have to abide by exacting standards in format including careful capture of metadata, but with FOIA you get things like this.

Among the things this careless approach to internal metadata accomplished was obscuring the genesis of one official's recounting of a face-to-face meeting with Snowden over surveillance concerns.

As noted, the compliance woman's story had to be corrected to match the dates up to when Snowden would have been at Fort Meade. "We received a call from D4 [Office of the Director of Compliance] questioning the dates (11 or 12 Jun) that [redacted] annotated during the discussions on" the Section 702 course, one of the other people in Oversight and Compliance wrote on April 10. She "has modified her dates to reflect 5-12 April 2013."

NSA did not provide a version of the draft of the email with the incorrect date. When the chief of Oversight and Compliance provided a description of all the department's interactions with Snowden to the NSA chief of staff, Elizabeth Brooks, in June 2014, there was no mention of any other paper trail of the exchange, though earlier that same day the deputy chief had stated, generally, that that information had been provided to Ensor on June 10, 2013.

One thing that is clear, however, is that the apology laying all these details out, written after several days of fact checking at the NSA and document review in June 2014, leaves out at least one key detail — that the OGC email and the face-to-face communication could have happened the same day, making it far more likely they should be treated as parts of the same exchange. More significantly, the apology claims that "in response to the June 2013 Agency All... she provided in writing her account of these engagements." If the timestamps on documents provided to VICE News are correct (something that the NSA has admitted is a problem with this FOIA response), she actually provided her side of at least the OGC contact even before the Agency All email. But there is no record she provided her written account, to either of these exchanges, until a year after the event, a detail — if true — that Rogers should have known.

Beyond that, there's the NSA's ongoing obsession with controlling this narrative. The agency refused to answer questions from Vice pertaining to these documents but it did send it an email informing it that it had already made the FOIA documents available at the ODNI's website, presumably in an attempt to undercut Leopold/Vice's "exclusive."

The jury is still out on Snowden's claims he took his complaints to the proper officials before deciding to leak the documents he obtained. The NSA's assertions of it just being one email would be far more believable if it could provide any evidence that it can handle its own internal email systems with any sort of competence. But as far as this release goes, there's nothing in it definitively pointing to multiple attempts by Snowden to raise concerns. But it's also a stack of documents whose release was overseen by the same agency he exposed and one that still needs every "victory" it can earn… or take.

Filed Under: ed snowden, emails, foia, internal controls, jason leopold, nsa, whistleblowing

David Patraeus, Who Leaked Classified Info To His Mistress, Says Snowden Should Be Prosecuted

from the say-that-again? dept

Last week, the Intercept published Ed Snowden's powerful foreword to Jeremy Scahill's new book The Assassination Complex. The foreword is entitled: Whistleblowing Is Not Just Leaking — It’s an Act of Political Resistance. It's really worth reading. In it, among other things, he does note that there are very different kinds of leaking information. There are situations where you are alerting the public to important information. And then there are... other situations. Like what happened to former CIA Director, General David Petraeus:

Not all leaks are alike, nor are their makers. Gen. David Petraeus, for instance, provided his illicit lover and favorable biographer information so secret it defied classification, including the names of covert operatives and the president’s private thoughts on matters of strategic concern. Petraeus was not charged with a felony, as the Justice Department had initially recommended, but was instead permitted to plead guilty to a misdemeanor. Had an enlisted soldier of modest rank pulled out a stack of highly classified notebooks and handed them to his girlfriend to secure so much as a smile, he’d be looking at many decades in prison, not a pile of character references from a Who’s Who of the Deep State.

That's a pretty good summary of the "high court" situation that lets powerful people like Petraeus get away with passing on such information that could have legitimately put people at risk.

So, it was interesting, just days later, to see a long interview in the Financial Times with David Petraeus, in which he's asked about Snowden (warning: the link may be paywalled). The interview covers many subjects, and the comment on Snowden is quite brief:

Should Edward Snowden be prosecuted, I ask? “Unquestionably,” he replies. “If Snowden had wanted to help that debate he could have very easily been a whistleblower who could have gone to the appropriate organisation and offered his views. He didn’t.”

This is bullshit on so many levels. First, it's bullshit because Petreaus himself got off with barely a wrist slap for his own activity, which had nothing to do with whistleblowing and appeared to be much more dangerous than what Snowden did. Second, as Petreaus absolutely knows, the intelligence community does not treat whistleblowers well. Previous whistleblowers, including Thomas Drake, basically had their lives destroyed as punishment for using the "appropriate" channels for whistleblowing. Hell, just last week, we wrote about yet another case of an intelligence community whistleblower, who used the "appropriate" channels, suddenly having her home raided and her career in shambles.

Third, it's bullshit because even in using the "appropriate" channels, as an NSA contractor, Snowden was not protected from direct retaliation for whistleblowing. Fourth, it's bullshit because the "proper channels" would just be to run it up the line of people who thought it was hunky dory to lie to the American public to reinterpret the PATRIOT Act to enable them to spy on everyone's communications data. That wouldn't have done anything. Fifth, it's bullshit because once the information actually did get out through the press -- which never would have happened through "appropriate channels," it has set in motion a number of changes, among companies, individuals, Congress and the intelligence community. That's the point of whistleblowing, to actually change the behavior through alerting more people to what's going on.

But, really, it seems especially idiotic that someone in Petreaus' position would weigh in so hypocritically on Snowden's situation.

Filed Under: david petraeus, ed snowden, high court, leaks, low court, prosecution, whistleblowing

Trump's Incomprehensible 'Cyber' Policy: 'Make Cyber Great Again'

from the let's-try-that-again dept

Last week, we wrote about Donald Trump's fairly astounding interview transcript with the Washington Post editorial board. In that post, we focused on his bizarre and nonsensical comments on defamation law, though there was lots of other nuttiness in the interview. Over the weekend, the NY Times published its own transcript of an interview between Donald Trump and two reporters, Maggie Haberman and David Sanger, focusing on foreign policy questions. Once again, reading it presents an incredible picture of a man running for President who doesn't know the most basic things about foreign policy (he literally seemed shocked and confused when the reporters pointed out that the US has sanctions against Iran, barring it from buying Boeing airplanes).

But the issue that is relevant to folks around here is his completely confused and nonsensical responses to two things: cybersecurity and Ed Snowden. Let's start with cybersecurity. They first ask him if "cyberweapons" might present an "alternative" to nuclear weapons, which, with some background knowledge is an interesting question. Obviously, the US has used its power there using tools like Stuxnet to slowdown Iran's nuclear program, and possibly has done a lot more as well. Whether or not you agree with this approach, it's clearly a tool available to the US government these days. Trump doesn't even seem to understand the nature of the question, and just focuses on how dangerous nuclear weapons are... and his brilliant uncle at MIT telling him about how dangerous nukes are.

SANGER: You know, we have an alternative these days in a growing cyberarsenal. You’ve seen the growing cybercommand and so forth. Could you give us a vision of whether or not you think that the United States should regularly be using cyberweapons, perhaps, as an alternative to nuclear? And if so, how would you either threaten or employ those?

TRUMP: I don’t see it as an alternative to nuclear in terms of, in terms of ultimate power. Look, in the perfect world everybody would agree that nuclear would, you know, be so destructive, and this was always the theory, or was certainly the theory of many. That the power is so enormous that nobody would ever use them. But, as you know, we’re dealing with people in the world today that would use them, O.K.? Possibly numerous people that use them, and use them without hesitation if they had them. And there’s nothing, there’s nothing as, there’s nothing as meaningful or as powerful as that, and you know the problem is, and it used to be, and you would hear this, David, and I would hear it, and everybody would hear it, and — I’m not sure I believed it, ever. I talk sometimes about my uncle from M.I.T., and he would tell me many years ago when he was up at M.I.T. as a, he was a professor, he was a great guy in many respects, but a very brilliant guy, and he would tell me many years ago about the power of weapons someday, that the destructive force of these weapons would be so massive, that it’s going to be a scary world. And, you know, we have been under the impression that, well we’ve been, I think it’s misguided somewhat, I’ve always felt this but that nobody would ever use them because of the power. And the first one to use them, I think that would be a very bad thing. And I will tell you, I would very much not want to be the first one to use them, that I can say.

So, after that Sanger tries again, noting that Trump didn't actually answer the question, which was actually about cybersecurity and cyberweapons, and Trump presents us with his patented form of word salad:

SANGER: The question was about cyber, how would you envision using cyberweapons? Cyberweapons in an attack to take out a power grid in a city, so forth.

TRUMP: First off, we’re so obsolete in cyber. We’re the ones that sort of were very much involved with the creation, but we’re so obsolete, we just seem to be toyed with by so many different countries, already. And we don’t know who’s doing what. We don’t know who’s got the power, who’s got that capability, some people say it’s China, some people say it’s Russia. But certainly cyber has to be a, you know, certainly cyber has to be in our thought process, very strongly in our thought process. Inconceivable that, inconceivable the power of cyber. But as you say, you can take out, you can take out, you can make countries nonfunctioning with a strong use of cyber. I don’t think we’re there. I don’t think we’re as advanced as other countries are, and I think you probably would agree with that. I don’t think we’re advanced, I think we’re going backwards in so many different ways. I think we’re going backwards with our military. I certainly don’t think we are, we move forward with cyber, but other countries are moving forward at a much more rapid pace. We are frankly not being led very well in terms of the protection of this country.

It seems pretty clear that Trump has no clue what is being discussed and just falls back into his usual talking points about how America just isn't that good any more, and then uses the tiny bit of information he does have (China and Russia have been in the news around hackings) and argues that they're better than us. But, "we're obsolete"? Huh? As noted above (not by him, of course), the most powerful computer-based attacks do seem to be coming from the US itself, not Russia or China.

Also, what does "inconceivable that, inconceivable the power of cyber" even mean? All I can think of is the scene from The Princess Bride. Then we get to Ed Snowden. Trump, perhaps not surprisingly, is not a fan:

HABERMAN: Mr. Trump, just a quick follow-up on that question. As you know, we discovered in recent years that the U.S. spies extensively against its allies. That’s what came up with Edward Snowden and his data trove including Israel and Germany.

TRUMP: Edward Snowden has caused us tremendous problems.

HABERMAN: But would you continue the programs that are in place now, or would you halt them, in terms of spying against our allies?

SANGER: Like Israel and Germany.

TRUMP: Right. They’re spying against us. Edward Snowden has caused us tremendous problems. Edward Snowden has been, you know, you have the two views on Snowden, obviously: You have, he’s wonderful, and you have he’s horrible. I’m in the horrible category. He’s caused us tremendous problems with trust, with everything about, you know, when they’re showing, Merkel’s cellphone has been spied on, and are – Now, they’re doing it to us, and other countries certainly are doing it to us, and but what I think what he did, I think it was a tremendous, a tremendous disservice to the United States. I think and I think it’s amazing that we can’t get him back.

Wait, Ed Snowden is the one who's caused us problems with trust? Not the fact that the US was spying on people it maybe shouldn't have been spying on? Talk about blaming the messenger.

There's then a follow-up about whether or not Trump agreed with President Obama's publicly stated agreement not to spy on Angela Merkel's phone (though it's now been said that everyone else in the German government remains fair game), and Trump goes back to word salad, and concludes with another dig at Snowden where, bizarrely, he seems to argue that other countries are spying on us because of Snowden. Huh?

SANGER: President Obama ordered an end to the spying, to the listening in on Angela Merkel’s cellphone, if that’s in fact what we were doing. Was that the right decision?

TRUMP: Well you see, I don’t know that, you know, when I talk about unpredictability, I’m not sure that we should be talking about me – On the assumption that I’m doing well, which I am, and that I may be in that position, I’m not sure that I would want to be talking about that. You understand what I mean by that, David. We’re so open, we’re so, “Oh I wouldn’t do this, I wouldn’t do that, I would do this, I would do that.” And it’s not so much with Merkel, but it’s certainly with other countries. You know, that really, where there’s, where there’s a different kind of relationship, and a much worse relationship than with Germany. So, you know there’s so, there’s such predictability with our country. We go and we send 50 soldiers over to the Middle East and President Obama gets up and announces that we’re sending 50 soldiers to the Middle East. Fifty very special soldiers. And they now have a target on their back, and everything we do, we announce, instead of winning, and announcing when it’s all over. There’s such, total predictability of this country, and it’s one of the reasons we do so poorly. You know, I’d rather not say that. I would like to see what they’re doing. Because you know, many countries, I can’t say Germany, but many countries are spying on us. I think that was a great disservice done by Edward Snowden. That I can tell you.

Again, I know that all the other candidates are pretty horrible as well. But at least most of them can grasp basic concepts around the issues they're facing (even if they have terrible ideas about what to do about them). Trump doesn't even seem to understand the basics -- or even understand that he doesn't understand.

Filed Under: cybersecurity, cyberweapons, donald trump, ed snowden
Companies: ny times

Apparent Redaction Failure Leads To Government Confirming Target Of Lavabit Investigation

from the SPOILER-ALERT? dept

The US government has just undercut one of its own gag orders. It imposed one on Lavabit after demanding its source code and encryption key. It has revealed the target of its demands from the encrypted email provider -- a person everyone already knew was the target, but one that wasn't likely to be officially confirmed for years to come. Kim Zetter at Wired has the details:

Ladar Levison, owner of the now defunct email service, has been forbidden since then, under threat of contempt and possibly jail time, from identifying who the government was investigating. In court documents from the case unsealed in late 2013, all information that could identify the customer was redacted.

But federal authorities recently screwed up and revealed the secret themselves when they published a cache of case documents but failed to redact one identifying piece of information about the target: his email address, Ed_Snowden@lavabit.com. With that, the very authorities holding the threat of jail time over Levison’s head if he said anything have confirmed what everyone had long ago presumed: that the target account was Snowden’s.

The unsealed documents were posted to PACER and picked up by Cryptome, which uploaded them yesterday. The inadvertent exposure is contained in the Appeal Cover Sheet, which was apparently left unredacted when the unsealed docs were uploaded to the court's electronic filing system.


Sometimes inadvertent transparency is the best transparency. Despite this being made public (most likely accidentally), it still doesn't change the stipulations of the gag order.

When asked for comment, Levison’s lawyer Jesse Binnall told WIRED in a email that “due to the letter and spirit of the court’s January 7, 2016 order, Lavabit has no further comment on the unredacted email address.”

Yes, a gag order can still be violated even though anyone who's paying attention has known for nearly two years now that the target was Edward Snowden. Unless the government meant to release this document in unredacted form, Ladar Levinson and his lawyers could still face contempt charges for even confirming what thousands of others can see with their own two eyes.

Filed Under: ed snowden, failures, redaction
Companies: lavabit

Former FTC CTO Ashkan Soltani Denied Security Clearance, Perhaps Because He Helped In Reporting On Snowden Docs

from the bad-news dept

Ashkan Soltani is a well known privacy expert who (among other things) worked with Barton Gellman at the Washington Post to analyze the Snowden documents for story worthy information -- an effort that won that series a Pulitzer Prize. Soltani has been hugely instrumental in reporting on other privacy-related issues as well, including being a part of the team that also a Pulitzer Prize finalist for the Wall Street Journal's excellent What They Know series on digital privacy issues. Basically he has a long history of doing great journalism around privacy. For most of the last year, he was also the Chief Technology Officer at the FTC. Back in December, it was announced that he had moved over to work for the federal government CTO, Megan Smith, in the White House as a senior advisor. The CTO's office has been collecting some fairly amazing tech talent recently.

However, now, just a few weeks after Soltani took the job in the White House, he's announced that he's left the job because he's been denied the security clearance necessary to do his job:

Bittersweet end to my stint in government — I’m disappointed to announce my departure from @whitehouseostp pic.twitter.com/nYlBI1b2ur

— ashkan soltani (@ashk4n) January 29, 2016

If you can't read that statement, it says:

I am disappointed to announce my departure as Senior Advisor to the White House Chief Technology Officer, Megan Smith.

Smith hired me in December from the Federal Trade Commission, where I had served as Chief Technologist since late 2014. My mandate was to help Smith and her team work through hard questions on consumer privacy, the ethics of big data, and the recruitment of skilled technologists to government.

Those are vital issues, which have occupied me in and out of government, and I will continue to contribute what I can in other venues.

Last week the White House Office of Personnel Security notified me that I would not receive the security clearance necessary to continue to work at the White House. I'm told this is something that happens from time to time and I won't speculate on the reasons. I do want to say that I am proud of my work, I passed the mandatory drug screening some time ago, and the FBI background check was still underway. There was no allegation that it was based on my integrity or the quality of my work.

I was honored to serve at the FTC and in the White House. I wish the CTO and her amazing team success in the important work ahead.

Soltani says he won't speculate, but from the rest of his statement it's not hard to guess what the real reason is: his work with the Snowden documents in 2013. Back when Soltani first went to the FTC in late 2014, you had folks like former CIA and NSA boss Michael Hayden whine about his work on the Snowden documents and suggest it makes it inappropriate for him to hold a government job.

"I'm not trying to demonize this fella, but he's been working through criminally exposed documents and making decisions about making those documents public," said Michael Hayden, a former NSA director who also served as CIA director from 2006 to 2009. In a telephone interview with FedScoop, Hayden said he wasn't surprised by the lack of concern about Soltani's participation in the Post's Snowden stories. "I have no good answer for that."

And then you had former NSA General Counsel (and proud Techdirt hater), Stewart Baker arguing that Soltani should be barred from government work for his work on the Snowden docs:

Stewart Baker, a former NSA general counsel, said, while he's not familiar with the role Soltani would play at the FTC, there are still problems with his appointment. "I don't think anyone who justified or exploited Snowden's breach of confidentiality obligations should be trusted to serve in government," Baker said.

So it doesn't take too much reading between the lines to suggest that those in charge of handing out security clearance decided to "punish" Soltani by denying him clearance.

Of course, beyond being generally screwed up, it also is a bit ironic since Soltani's role was supposed to be about convincing techies to work in government. Want to know how not to do that? It's by pettily "punishing" Soltani for his journalism work.

Filed Under: ashkan soltani, ed snowden, ftc, megan smith, michael hayden, security clearance, stewart baker, white house

Techdirt Reading List: The God's Eye View

from the snowden-inspired-thriller dept

We're back again with another in our weekly reading list posts of books we think our community will find interesting and thought provoking. Once again, buying the book via the Amazon links in this story also helps support Techdirt.

This week's book is (I think...) our first fiction book in the series. It's also not out yet, but it's coming out on Tuesday so you can pre-order it now. It's Barry Eisler's new Ed Snowden-inspired thriller The God's Eye View. Barry was kind enough to send me a pre-publication draft of the book and it's wonderful on multiple levels. First off, it's a "can't put it down, have to keep turning the pages" thriller that you'd expect from Eisler, whose previous thrillers have ended up on the NY Times best seller list. He knows how to keep you totally gripped to the story and in a state of suspense throughout.

But it's more than just a page-turner thriller. The book is clearly inspired by the Ed Snowden revelations, and not only does it have tons of little Easter Eggs for people who have followed the surveillance debate, but it also includes at the end details of how many of the "crazy" and outlandish spy programs and tactics described in the book are actually happening today, based on the Snowden leaks and other related investigative reporting and whistleblowers. So it's an educational book as well, that helps highlight why we should be so worried about the kind of power and surveillance the NSA is capable of pulling off today. If you want to convince someone why the NSA's powers are so concerning, and want to do it in a truly entertaining way, this is the book for you.

It's also pretty cheap for a new release these days. If you're signed up for Amazon's Kindle Unlimited, it's actually included so it doesn't cost anything extra. But if you're not, the ebook is just $5.99, which is way below most ebooks these days. If you don't know Barry Eisler, he's a former CIA spook, who became a best selling novelist, and who famously turned down a huge publishing contract to self-publish. He's also written a bunch of guest posts for us and been on our podcast (twice!).

Finally, if you're in the California Bay Area, on Wednesday night, I'll be interviewing Barry at a Commonwealth Club event about the new book and probably lots of other topics as well (surveillance, publishing and who knows what else...). It'll be a fun discussion, so if you're in the area, check it out. And, either way, I highly recommend the book.

Filed Under: barry eisler, ed snowden, nsa, surveillance, techdirt reading list

As Law To Backdoor Encryption Stalls, Congress Tries Backup Stupid Plan To Backdoor Encryption

from the bad-ideas-all-around dept

Late last year, Senator Richard Burr, who is painfully wrong on encryption, announced that he and Senator Dianne Feinstein were working on new legislation that would mandate backdoors to encryption. Most people recognized that such a bill had little-to-no chance of actually passing Congress, as there are at least enough folks up on Capitol Hill who realize that such a law is incredibly stupid. Given that, it's little surprise that reporter Jenna McLaughlin from The Intercept is reporting that such legislation "has been delayed."

But, fear not, foes of strong encryption, because there's always a plan B. Late last year, we also noted that Rep. Michael McCaul, the head of the House Homeland Security Committee, was going to propose legislation that would create a "commission" bringing tech companies and law enforcement together to work on a way to undermine encryption. While, at the very least, he noted concerns about backdooring encryption (and later noted how backdoors could weaken everyone's security), it hasn't stopped him from moving forward with this commission, and making some fairly ridiculously ignorant statements about all of this.

McCaul, together with Senator Mark Warner (who should know better), has announced that they're moving forward with legislation to set up this commission, and still ridiculously claims that "going dark" is a real problem that needs to be "solved."

McCaul said the group would be given “a tight time frame” to develop “recommendations to the Congress as to what can be done to solve this urgent, and I think very challenging threat to our national security.”

But, as if to underline how little McCaul really seems to understand about the issue, during a press conference about this, he claimed that the "going dark debate" was started by Ed Snowden's use of encryption, leading to a rather sarcastic reply from Snowden himself:

Chairman McCaul on "going dark": "It’s ironic that Edward @Snowden really sort of created all this when he started using encryption."

— Kaveh Waddell (@kavehewaddell) January 19, 2016

Other things Chairman McCaul thinks I created: famine, climate change, bieber. https://t.co/eJ8JWyDy1K

— Edward Snowden (@Snowden) January 19, 2016

It's troubling that the guy who thinks Snowden started the debate on going dark is now apparently going to lead this commission to deal with the "problem" of going dark. Nor is the whole "tight timeline" particularly encouraging. Because the whole thing is based on a false premise that if we just "get smart people in the room," they'll figure out "a solution."

But how many times does it need to be said before law enforcement and politicians understand the rather basic facts: you can undermine encryption, but it makes everyone significantly less safe. There is no way to build technology that says "only the pure of heart may use this technology, while ISIS may not." The second you try to do that, all you end up doing is opening up serious vulnerabilities that will put everyone at risk.

Meanwhile, another report on this planned commission claims that it will "be tasked with developing a solution that doesn’t require a 'backdoor' into encrypted communications." That's obviously better than being tasked with backdooring encryption... but what does that even mean? The whole setup of the discussion and the debate is falsely framed around the idea that strong encryption is a "problem" that needs to be "solved." Saying "but we don't mean backdoors," feels like a semantic game, such as James Comey's ridiculous attempt a few months back, where he insisted that the FBI wants "front doors" instead of backdoors.

If Rep. McCaul and Sen Warner were serious about "Homeland Security," they'd both get on the bandwagon supporting strong encryption because that, and that alone, is the best way to protect computer security for Americans.

Filed Under: backdoors, commission, congress, dianne feinstein, ed snowden, encryption, going dark, mark warner, michael mccaul, richard burr

German Parliament Spy Oversight Board Sues German Government Over Data Sharing With NSA

from the uncharted-territory dept

After Edward Snowden's revelations about the extent of spying being carried out around the world by the NSA and its Five Eyes friends, there have been a number of attempts in other countries to find out what has been going on. One of the most thoroughgoing of these is in Germany, where there is a major parliamentary inquiry into NSA activities in that country. As Techdirt reported back in May, a surprising piece of information to emerge from this is that Germany's secret service has been carrying out spying on behalf of the NSA, which sent across various "selectors" -- search terms -- that it wanted investigated in the German spies' surveillance databases.

One group of people particularly shocked to hear this were the German parliamentarians who make up the G10 Commission that must approve spying operations in Germany. A post on Intellectual Property Watch explains why:

The German Foreign Intelligence Services, supported by the government, tapped the German Internet Exchange Point Decix, the largest internet exchange point globally. While the G10 Commission had approved the blanket tapping, they were unaware that some of the tapped data were forwarded to the NSA, the US National Security Agency, based on a list of so-called "selectors" -- names or numbers the NSA sent to their German colleagues.

Understandably annoyed, the G10 Commission demanded to see a complete list of those selectors so that it could check what information had been passed to the NSA, and whether any laws had been broken. The German government said that it would not disclose them. After misleading the oversight body about who would have access to information obtained from the Decix tapping, the German government's refusal to provide the selectors adds insult to injury. So much so, that it has apparently driven the G10 Commission to take unprecedented action: hauling the German government before the country's constitutional court, which decides weighty matters of this kind.

Since this is uncharted territory -- the G10 Commission had to find out whether taking legal action against the government in this way was even possible -- nobody really knows what might come of the move. But at the very least, it's yet another indication of the seismic shifts that are still occurring throughout the world of surveillance as a result of Snowden's unprecedented leaks.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: ed snowden, german parliament, germany, lawsuit, mass surveillance, nsa, oversight, surveillance

As Predicted: Encryption Haters Are Already Blaming Snowden (?!?) For The Paris Attacks

from the shut-up dept

It really was less than two months ago that we noted that, having lost the immediate battle for US legislation to backdoor encryption, those in the intelligence community knew they just needed to bide their time until the next big terrorist attack. Here was the quote from Robert Litt -- the top lawyer for the Office of the Director of National Intelligence from September:

Although “the legislative environment is very hostile today,” the intelligence community’s top lawyer, Robert S. Litt, said to colleagues in an August e-mail, which was obtained by The Post, “it could turn in the event of a terrorist attack or criminal event where strong encryption can be shown to have hindered law enforcement.”

Well, as you already know, on Friday there was a tragic and horrifying terrorist attack in France that killed over 100 people. And it took basically no time at all for defenders of the surveillance state to start... blaming Snowden and encryption? It started with the usual talking heads, such as former George W. Bush press secretary and current Fox News commentator, Dana Perino, who seriously seemed to blame Snowden for the attacks based on... who knows what.

Also, F Snowden. F him to you know where and back.

— Dana Perino (@DanaPerino) November 14, 2015

And then there was her Fox News colleague Greg Gutfeld, speculating that the attacks may have been planned in secret thanks to "whistleblowers."

if the attack was aided through "whistleblowers" leaking what the NSA cannot penetrate, will that be part of the movie?

— GregGutfeld (@greggutfeld) November 14, 2015

Robert Litt must have been smiling. And then, he was helped along even further by the stenographers at the NY Times, who reported over the weekend that the attackers "used encryption technology" based entirely on anonymous "European officials."

The attackers are believed to have communicated using encryption technology, according to European officials who had been briefed on the investigation but were not authorized to speak publicly. It was not clear whether the encryption was part of widely used communications tools, like WhatsApp, which the authorities have a hard time monitoring, or something more elaborate. Intelligence officials have been pressing for more leeway to counter the growing use of encryption.

Here's the link to that article, but as I type this, it now shows the following: Perhaps the NY Times realized that publishing such rampant speculation without confirmation meant that they were getting played like fiddles by the intelligence community in their game to undermine encryption. Either way, the original article is available (for now) at the Internet Archive. Update: The NY Times is now redirecting the original link to a general link about the Paris attacks, not the specific story they originally had about the evils of the attackers using encryption. As far as I can tell, there's still been no explanation.

No matter what, the argument is pure bullshit. Of course they probably used encryption, because lots of people use encryption to communicate, and there's no way in hell that they suddenly decided to use encryption "because Snowden." As Glenn Greenwald has helpfully chronicled, the press has noted that terrorists have known to use encryption to avoid having their communications spied upon since before 9/11. Here's just one example in an article stuffed with many, many more: The idea that it was suddenly because of Snowden's revelations that the attackers decided to communicate via encryption defies all common sense, and anyone making that suggestion seems to be publicly displaying a near total ignorance on history -- most likely for political gain. Meanwhile, the speculation over how the attackers communicated has led some to claim (without any evidence to support it) that they may have been communicating via the PlayStation 4. I'm pretty damn sure that the PS4 does not include end-to-end encryption, so even if that does turn out to be true, it would seem to undermine the earlier claims of encryption being the problem. Update: And, as expected, the guy who made the original "they communicated via PS4" claims is now walking back that story....

The real point, though: if you want to communicate secretly, there is always some way to do it. To blame leaks from just a couple of years ago on the fact that people planning to commit mass murder try to communicate secretly is flat out ridiculous and is nothing more than fear mongering to score political points.

Filed Under: backdoors, dana perino, ed snowden, encryption, going dark, greg gutfeld, isis, paris attack