It's Finally Dawning On Tech Companies That All This NSA Stuff Is Bad For Them

from the more-of-that-please dept

We've been arguing since the beginning of the Snowden leaks, that the tech industry should be much angrier than it is about all of this, because the fallout and blowback from this is going to impact these companies quite a bit. To date, the big tech companies have been fighting back, but it's mostly focused on the transparency issue, arguing in court that the gag orders barring them from talking about what the government has legally compelled them to do, is a violation of their First Amendment rights. And that's correct and an important fight, but we've been disappointed that the tech companies haven't supported even greater reforms and changes, including greater privacy protections. But that might be changing.

Obviously, the news of the NSA infiltrating private network links between data centers should make these companies even angrier. It appears that Google is getting there, though Yahoo still doesn't seem to realize what just happened.

However, in an interesting move that at least hints at potential further realization from the tech industry that they need to support user privacy rights, the big guys -- Google, Facebook, Apple, Microsoft, Yahoo and AOL -- have all sent a letter to Congress in support of the USA Freedom Act. In it, they once again talk up the importance of greater transparency. But, also, for the first time that I can remember, they appear to be arguing for even more:

Transparency is a critical first step to an informed public debate, but it is clear that more needs to be done. Our companies believe that government surveillance practices should also be reformed to include substantial enhancements to privacy protections and appropriate oversight and accountability mechanisms for those programs.

And, even with the letter being sent today, it was almost certainly written and approved before yesterday's revelations -- meaning that this was before they realized the NSA was trying (and succeeding) to backdoor into their networks without their knowledge. Hopefully they'll start pushing for even more significant reforms as well. Some have argued that the tech industry has been complicit in the NSA surveillance efforts, while others have suggested they were compelled, or even tricked/hacked into it. The evidence suggests a combination of all of those factors (in varying degrees across the different companies). But if they want to actually regain the trust of their users, they should stand up for the rights of their users and support the efforts to create real change and to stop illegal surveillance, rather than just increasing transparency.

Filed Under: civil liberties, nsa, nsa surveillance, reform, tech companies, usa freedom act
Companies: aol, apple, facebook, google, microsoft, yahoo

Feinstein Releases Fake NSA Reform Bill, Actually Tries To Legalize Illegal NSA Bulk Data Collection

from the don't-buy-the-lies dept

Despite Dianne Feinstein's supposed "conversion" earlier this week about the NSA being out of control with its spying, and the associated performance of NSA folks claiming that they were screwed, it's quickly become apparent that this was all pure theater to make people think that real reform might be coming. Feinstein claimed she was shocked about this and called for a full investigation... and yet, just two days later, she held a markup of her planned "reform" bill for the collection of intelligence by the NSA (and held the markup in secret -- because nothing says "let's increase transparency of the NSA" like keeping the debates and votes secret). That bill was moved out of committee today by a vote of 11 to 4, leading Feinstein to release the bill with a bunch of misleading claptrap designed to make people think it's real reform. It even confused some folks who know this stuff into thinking, after a quick first pass, that it "banned" the bulk data collection. And you might think that's the case because her description says:

• Prohibits the collection of bulk communication records under Section 215 of the USA PATRIOT Act except under specific procedures and restrictions set forth in the bill;
• Establishes criminal penalties of up to 10 years in prison for intentional unauthorized access to data acquired under the Foreign Intelligence Surveillance Act (FISA) by the United States;
• Prohibits the bulk collection of the content of communications under Section 215 of the USA PATRIOT Act;

Reading that, you might think it actually banned the bulk data collection that's been reported on, but it does not. That "except under specific procedures and restrictions set forth in the bill" just takes the highly questionable reasoning of the FISA Court in approving the bulk data collection and makes that the "exception." In other words, it does exactly the opposite of what Feinstein claims. Rather than banning bulk data collection, it legalizes it. That third point on the "content" is just a red herring -- the same red herring that Feinstein and others have been waving about wildly for months, pretending people are upset about the collection of actual recordings, rather than the collection of metadata. She's wrong. People are upset about the collection of metadata, which this legalizes.

Even more ridiculous, the focus (both in the marketing and the bill itself) on collection of content "under Section 215" is another red herring, since it appears that much of that collection actually happens under other programs anyway. So this doesn't change a damn thing.

Other supposed "changes" in the bill -- including limiting who can perform queries on the data, how many "hops" they can analyze and how long they can retain the data, all match with current practice and don't change a thing. Even though James Clapper and Keith Alexander more or less seemed to concede at yesterday's House hearing that they'd be okay with cutting back on the data retention from five to three years, this bill keeps it at five. There are a few other minor changes, but this bill is almost entirely as expected, simply codifying the status quo, even though Feinstein has insisted that it was legal all along. The one minor "concession" which many had expected -- having a third party at the FISA Court who could fight for civil liberties -- is watered down. Rather than an actual adversarial setup, with this person representing civil liberties, it's set up as an appointed "amicus cureia" or "friend of the court," where they basically just advise the court on the issue.

This bill is a farce, and made even more farcical by the misleading way in which Feinstein has presented it, pretending it bans bulk data collection when it actually legalizes it.

Filed Under: bulk data collection, dianne feinstein, fisa, fisa court, fisa improvements act, fisc, lies, nsa, nsa surveillance, section 215

Greenwald On The Reporting Of The NSA's Recent Denials: So, Now We Trust The Liars?

from the maybe-it's-the-uniforms... dept

The NSA has taken a different approach to addressing the recent leaks involving the surveillance of foreign officials (and foreign citizens). Rather than limit itself to bland statements about oversight and legal framework, the NSA has chosen to claim the reporting is "misleading," if not flat out wrong. (The NSA and the administration are also taking turns throwing each other under the bus. While this is very amusing, it does very little to address the veracity of the leaks…)

Glenn Greenwald notes on his blog that these recent tactics have a hint of desperation about them, considering they were only deployed after news broke of the NSA's surveillance of high-level foreign officials.

[T]hese exact same Boundless Informant documents have been used by newspapers around the world in exactly the same way for months. The NSA never claimed they were inaccurate until yesterday: when it is engulfed by major turmoil over spying on European allies.

The same documents the agency now claims are wrong or misleading have been public for months now, but it's only now, after the administration and Sen. Feinstein turned on the NSA, that Gen. Alexander and James Clapper are pushing the narrative that the documents themselves are being misinterpreted. Greenwald points out that both have been very careful not to deny the gist of the story itself (large scale collection of foreign phone metadata) but rather that the slides deployed by reporters in Spain and France are being misread.

The agency also made the dubious decision to implicate the foreign intelligence agencies that feed them information in hopes of undermining the reporting (as well as spreading the blame.

[T]he fact some of this data is collected by virtue of cooperation with a country's own intelligence service does not contradict our reporting. To the contrary: the secret cooperation between some European intelligence agencies and the NSA has been a featured part of our reporting from the start…

The NSA spies extensively with (but rarely on) its four closest, English-speaking surveillance allies in the "Five Eyes" group: the UK, Canada, Australia and New Zealand. But for many European nations, the NSA cooperates with those nations' intelligence services but also spies on their populations and their governments without any such cooperation. That negates none of our reporting: it is simply a restatement of it.

The NSA seems to be running short on credible counter-arguments. Many representatives in DC simply aren't buying the lines about "oversight" and "legality" any more. Even its defenders have begun distancing themselves. So, it's decided to start casting doubt on those reporting on the leaks. Fair enough, I suppose. There are many rhetorical tactics it could deploy and seeding doubt by questioning the reporting is just one of them. The problem is that the press in general has been more than happy to give the NSA's responses a credibility they haven't earned.

NSA Director Gen. Keith Alexander asserted yesterday that two "Boundless Informant" slides we published - one in Le Monde and the other in El Mundo - were misunderstood and misinterpreted. The NSA then dispatched various officials to the Wall Street Journal and the Washington Post to make the same claim, and were (needless to say) given anonymity by those papers to spout off without accountability. Several US journalists (also needless to say) instantly treated the NSA's claims as gospel even though they (a) are accompanied by no evidence, (b) come in the middle of a major scandal for the agency at home and abroad and (c) are from officials with a history of lying to Congress and the media.

Sadly, despite a very long history (that spans several administrations) of general untrustworthiness in both intelligence agencies and administrations themselves, government officials (even those speaking from under the cover of anonymity) are instantly given more credibility than any journalist, even when those officials have the most to gain by lying.

Journalists who consistently lie or are repeatedly inaccurate tend to be speedily expelled from the system. Government and intelligence officials who lie tend to remain employed, or at worst, exit via the revolving door, landing well-paying gigs in the private sector. Journalists have the most to lose, while government officials (especially when granted anonymity) have nearly nothing to lose, not if the misstatements and disinformation help shore up the narrative.

Knowing this, why would journalists take these statements at face value? Even worse, why would they help the government PR machine by publishing a narrative handed to them by a faceless, nameless "official" who has everything to gain from spinning the story? That's not journalism. That's "reporting."

Greenwald quotes the EFF's Trevor Timm on this baffling attitude.

"Oh, NSA says a story about them is wrong? Well, that settles that! Thankfully, they never lie, obfuscate, mislead, misdirect, or misinform!"

Greenwald has taken a lot of heat for his lack of objectivity, but judging from this, more journalists need to be questioning statements coming from "officials" looking desperately for a place to plant their unreliable narratives. Four months of the NSA having to eat the words of each previous denial after each new leak should be more than enough proof that if its collective lips are moving, it's lying. At best, it's offering its least egregious "untruths."

Filed Under: glenn greenwald, nsa, nsa surveillance

Was Level 3 The Weak Link That Gave The Feds A Way To Hack Into Google's Network?

from the no-comment dept

The NY Times has an interesting and informative story building on yesterday's bombshell about the NSA and GCHQ infiltrating Google and Yahoo's network links between datacenters. Much of the NYT report covers the same ground as the original Washington Post article, but adds a few key details. The key part? That the network cables that connect the various Google datacenters are apparently provided by telco infrastructure giant Level 3 -- and when asked about it, Level 3 seemed to hint strongly that the government may have gotten access via it, but that it was legally gagged from talking about it:

In a statement, Level 3 said: “We comply with the laws in each country where we operate. In general, governments that seek assistance in law enforcement or security investigations prohibit disclosure of the assistance provided.”

That's not a definite confirmation, but you can see how it would raise eyebrows. As the NYT report notes, in an earlier story, concerning claims that Level 3 had helped the intelligence community spy on Germans, the company had denied the report. The fact that it's not denying it here, but rather pointing out that if it had helped there would be a gag order, certainly suggests the potential way in for the NSA. If so, Google might want to look rather closely at its agreement with Level 3.

Filed Under: datacenters, infiltration, networks, nsa, nsa surveillance
Companies: google, level 3, yahoo

Further Details On The Foreign Spying The NSA Is/Isn't/Is Doing And How Much The Administration Knows/Doesn't Know/Knows

from the rhetoric-fight! dept

In only a handful of days, the usual leak-and-denial progression of the Snowden leaks has completely disintegrated. The pattern was comforting in its own way, but the battle lines are now in a state of flux.

More allegations about overseas spying surfaced. James Clapper issued a non-denial denial about the harvesting of phone data in France that attacked a claim no one was making ("recorded phone data?"). This was swiftly followed by identical claims involving phone data from Spain and Italy. More phone data, more NSA surveillance.

The bombshell, however, was the news that German Chancellor Merkel's phone had been tapped by the NSA for over a decade. This news inspired the NSA's unpaid PR flack, Dianne Feinstein, to express her outrage that powerful people might be on the receiving end of the NSA's unblinking eye. She threatened a "complete review" of the NSA's tactics. Or did she?

This news failed to derail Feinstein's push to codify the NSA's current practices, something that doesn't really go hand-in-hand with a "complete review." But even this vague promise from one of the NSA's staunchest defenders was enough to bring a few angry tears to the agency's eyes.

The tapping of Merkel's phone was first presented as, "This is the first I've heard of this!" by the president. He claimed to be unaware of this activity and Jay Carney sent out a detail-free apology to Merkel stating that the NSA was not currently surveilling her, nor would it be in the future. Of course, it had enjoyed an 11-year run without interruption, so the loss of this single intercept isn't much of a problem. It still has 35 other foreign officials on (literal) tap.

But the sting of Feinstein's sudden disapproval, combined with Obama's claims of ignorance prompted agency heads to fire back. First, they claimed Obama had known about the surveillance since 2010. Then the claim was walked back, with the NSA stating this information hadn't been forwarded to the President.

Then the administration, now engaged in multiple diplomatic battles, did something unexpected: it joined Feinstein in selling the agency out. Its defense of the agency had definitely been cooling over the past several weeks, but the NSA couldn't have expected to hear the President ask for "additional constraints" on its surveillance programs.

Slapped twice, the NSA retracted its retraction and swung back at the administration it felt had cut the agency adrift.

The White House and State Department signed off on surveillance targeting phone conversations of friendly foreign leaders, current and former U.S. intelligence officials said Monday, pushing back against assertions that President Obama and his aides were unaware of the high-level eavesdropping.

Now, everyone's culpable. There are no "good guys" in this scenario. The administration attempted to slip out the back door unnoticed while the NSA defended the foreign surveillance it swore it wasn't doing, but the spooks had someone waiting in the alley. Having dragged the President and his staff down to its level, the NSA set about doing the same to its many accusers. All those collections of foreign phone data? "Not us."

U.S. officials said the Snowden-provided documents had been misinterpreted and actually show phone records that were collected by French and Spanish intelligence agencies, and then shared with the NSA, according to officials briefed on those discussions.

As was suspected, these nations' own intelligence agencies and telcos were gathering data and passing it on to the NSA. The intelligence agency was technically correct (the best kind of "correct"). It wasn't directly harvesting data. But it acquired the data nonetheless. It went even further in its denials, claiming that what was gathered wasn't even all that intrusive.

Based on an analysis of the document, the U.S. concluded that the phone records the French had collected were actually from outside of France, and then were shared with the U.S. The data don't show that the French spied on their own people inside France.

U.S. intelligence officials haven't seen the documents cited by El Mundo but the data appear to come from similar information the NSA obtained from Spanish intelligence agencies documenting their collection efforts abroad, officials said.

By stating the information dealt with non-domestic calls, the called-out intelligence agencies likely breathed a (short-lived) sigh of relief at not having been accused of anything approaching the NSA's level of domestic surveillance.

But even this illusion may not hold for long. During Mike Rogers' half-tantrum, half-circle jerk "intelligence hearing," Gen. Alexander coughed up some interesting answers in response to Rogers' lobbed softballs and smug "hmmms". If you can weave your way through Alexander's semantic smokescreen, the NSA head admits that not only is the NSA gathering European phone records directly but it (along with local intelligence agencies) is targeting wholly domestic communications. Marcy Wheeler at emptywheel breaks it down.

Rogers starts by asking Alexander to elaborate, specifically with regards to the US and NSA (he may be invoking the WSJ story, but he doesn't say so).

Rogers: And to that end, if I can, Mr. Alexander, there was some reporting that the story about French citizens being spied on by a particular slide that was leaked on a slide deck concluded that French citizens were being spied on. Can you expound on that a little bit? By the United States, by the way, specifically the National Security Agency.

Reading from a document of some sort, Alexander repeats the gimmick Clapper used last week, suggesting that the reports said the NSA had collected phone calls (content), then "corrects" their report to say Boundless Informant actually tracks metadata (which is actually what the reports had said).

Alexander: Chairman, the assertions by reporters in France, Le Monde, Spain, El Mundo, and Italy, L'Espresso, that NSA collected tens of millions of phone calls are completely false. They cite as evidence screen shots of the results of a web tool used for data management purposes but both they and the person who stole the classified data did not understand what they were looking at. The web tool counts metadata records from around the world and displays the totals in several different formats. [my emphasis]

Alexander then adds to last week's gimmick of claiming the Europeans reported these as calls, not metadata, by denying we, alone, collected this data.

The sources of the metadata include data legally collected by NSA under its various authorities as well as data provided to NSA by foreign partners. To be perfectly clear, this is not information that we collected on European citizens. It represents information that we and our NATO allies have collected in defense of our countries and in support of military operations.

This is not information "we" collected (on European citizens, but I'll come back to that), it's data "collected by NSA … as well as data provided … by foreign partners." It's data "we and our NATO allies have collected."

Those conjunctions — "as well as" … "and" — which in Alexander's written statement make it clear that both the Europeans and US collect this intelligence, disappeared from much of the reporting on this.

Wheeler goes on to explain how Rogers conversationally leads Alexander to assert a defense against any future accusations about spying on foreign individuals, or any nation's attempts to spy on their own citizens. Rogers makes the point that anyone could use undersea cables, etc. -- not just citizens of Country X. He also says that Country X could have citizens from Country Y living within its borders. While all of this is undoubtedly true, Rogers is basically giving Alexander all the rationale he needs to justify the NSA directly collecting data from foreign countries as well as giving local intelligence agencies the justification for domestic spying.

Rogers: Hmm. And so, let me just ask you this. If, as you study the networks of the world, let's just talk about the European Union for a second if I may. Is it possible for Chinese intelligence services, military or otherwise, to use networks that you would find in any nation-states of the European Union?

Alexander: Absolutely, Chairman.

Rogers: How about Russian intelligence services? Is it possible that they could use networks–communication networks, computer networks–inside the European Union for what they're up to?

Alexander: Absolutely, Chairman.

Rogers: How about al Qaeda? Would they use, could they use, is it possible for them to use the networks found in the European Union to conduct planning, operations, or execution of operations?

Alexander: They could, absolutely, Chairman. [my emphasis]

As it stands right now, the NSA has come out of the last batch of leaks related to foreign surveillance relatively unscathed. But the key is "relatively." At best, it comes out looking no better than the administration or its counterparts in foreign countries. Details have emerged indicating both Spain and France have gathered data and turned it over to the NSA, but French intelligence maintains it never gathered or turned over 70 million phone records in one month, perhaps suggesting there are parallel operations running here.

So, without touching the very latest leak, here's what we know/don't know.

The NSA did/did not/sort of did/still does/will-with-varying-amounts-of-cooperation collect millions of phone records overseas, phone records which did/did not involve wholly domestic communications and were/were not gathered solely by foreign intelligence agencies.

The NSA DID intercept world officials' communications, something the administration was/wasn't/was aware of. This has been condemned by the administration and intelligence leaders, which shows exactly what an intelligence agency has to do to lose top level support: anger the wrong people and, more importantly, get caught.

The NSA is now fully engaged in its own defense. Losing support it assumed was guaranteed has forced it to start playing dirty. With the administration swiftly extracting itself from this codependent relationship and an angered (but for all the wrong reasons) Sen. Feinstein targeting any number of surveillance programs, the NSA can no longer rely on rehashing talking points and staying above the fray. This will get nastier as it goes on, and that's wonderful. Any opponent of the NSA's programs has to be thrilled to see the agency left to fend for itself. Anyone who enjoys watching government entities forced to confront their own bad decisions has to be thrilled as well. It looks like the NSA is beginning to feel that if it can't have any secrets, neither can anyone else it "answers" to.

Filed Under: blame, james clapper, nsa, nsa surveillance

NSA Issues Non-Denial Denial Of Infiltrating Google & Yahoo's Networks

from the here-we-go dept

While NSA boss Keith Alexander issued a misleading denial of this morning's report of how the NSA has infiltrated Yahoo and Google's networks by hacking into their private network connections between datacenters, the NSA has now come out with its official statement which is yet another typical non-denial denial. They deny things that weren't quite said while refusing to address the actual point:

NSA has multiple authorities that it uses to accomplish its mission, which is centered on defending the nation. The Washington Post's assertion that we use Executive Order 12333 collection to get around the limitations imposed by the Foreign Intelligence Surveillance Act and FAA 702 is not true.

The assertion that we collect vast quantities of US persons' data from this type of collection is also not true. NSA applies attorney general-approved processes to protect the privacy of US persons – minimizing the likelihood of their information in our targeting, collection, processing, exploitation, retention, and dissemination.

NSA is a foreign intelligence agency. And we're focused on discovering and developing intelligence about valid foreign intelligence targets only.

Note what is missing from all of this. They do not deny hacking into the data center connection lines outside of the US. They do not deny getting access to all that data, especially on non-US persons. As for the claim that they're protecting the privacy of US persons, previous statements from Robert Litt, the general counsel for the Office of the Director of National Intelligence, have already made it clear that if they collect info on Americans, they're going to use this loophole to search them:

"If we're validly targeting foreigners and we happen to collect communications of Americans, we don't have to close our eyes to that," Litt said. "I'm not aware of other situations where once we have lawfully collected information, we have to go back and get a warrant to look at the information we've already collected."

So, for all the claims that this kind of information will be "minimized," it certainly looks like they've already admitted they don't do that.

Meanwhile, that Guardian article that has the NSA's response also has responses from the 3 other players in this drama. There's the UK's GCHQ, who apparently has partnered with the NSA in breaking into Google and Yahoo. It didn't want to say a damn thing:

"We are aware of the story but we don't have any comment."

Google, however, was reasonably furious about this story.

In a statement, Google's chief legal officer, David Drummond, said the company was "outraged" by the latest revelations.

"We have long been concerned about the possibility of this kind of snooping, which is why we have continued to extend encryption across more and more Google services and links, especially the links in the slide," he said.

"We do not provide any government, including the US government, with access to our systems. We are outraged at the lengths to which the government seems to have gone to intercept data from our private fiber networks, and it underscores the need for urgent reform."

Yahoo's response, unfortunately, was a lot more restrained and not particularly on point.

"We have strict controls in place to protect the security of our data centers, and we have not given access to our data centers to the NSA or to any other government agency."

Yeah, but the story is how the NSA got around your security. Yahoo should be a lot angrier about this. One hopes that once the technical people talk to management, the company will realize just how bad this situation is.

Hopefully, this means that Google and Yahoo will stop just focusing on getting more "transparency" out of the government concerning NSA surveillance, and will start taking a much more active role. This includes: (1) pushing back hard against government surveillance, including going to court to stop it and (2) building much more secure systems that cannot be easily compromised by the NSA.

Filed Under: executive order 12333, gchq, infiltrate, keith alexander, networks, nsa, nsa surveillance, section 702
Companies: google, yahoo

Keith Alexander, On Stage While Story Of NSA Infiltrations Breaks, Tries To Mislead With Response

from the servers-or-datacenter dept

In an interesting bit of timing, just as the Washington Post was breaking the news that the NSA had infiltrated Google and Yahoo's cloud data by hacking into the (stupidly) unencrypted data links between data centers, it turned out that NSA boss Keith Alexander was on stage at a Bloomberg Government Cybersecurity conference. He was asked about the report, and he tried to tap dance around it by claiming the NSA doesn't have access to Yahoo and Google's servers. The Guardian has a brief summary:

Alexander, asked about the Post report, denied it. “Not to my knowledge, that’s never happened,” the NSA director said, before reiterating an earlier denial Prism gave the NSA direct access to the servers of its internet service provider partners.

“Everything we do with those companies that work with us, they are compelled to work with us,” Alexander said. “These are specific requirements that come from a court order. This is not the NSA breaking into any databases. It would be illegal for us to do that. So I don’t know what the report is, but I can tell you factually: we do not have access to Google servers, Yahoo servers, dot-dot-dot. We go through a court order.”

But, of course, in typical Alexander fashion, he's choosing his words carefully -- and thankfully people can more easily see through it at this point, since they're getting so used to it. The report didn't say they were accessing those companies' servers or databases, but rather hacking into the network connection between their data centers. That's like a report breaking of the NSA hijacking armored cars with cash, and Alexander claiming "we didn't break into the bank." Nice try.

Filed Under: datacenters, infiltration, keith alexander, network, nsa, nsa surveillance
Companies: google, yahoo

Lavabit To Release Code As Open Source, As It Creates Dark Mail Alliance To Create Even More Secure Email

from the it's-needed dept

This whole morning, while all these stories of the NSA hacking directly into Google and Yahoo's network have been popping up, I've been at the Inbox Love conference, all about the future of email. The "keynote" that just concluded, was Ladar Levison from Lavabit (with an assist from Mike Janke from Silent Circle), talking about the just announced Dark Mail Alliance, between Lavabit and Silent Circle -- the other "security" focused communications company who shut down its email offering after Lavabit was forced to shut down. Levison joked that they went with "Dark Mail" because "Black Mail" might have negative connotations. Perhaps just as interesting, Levison is going to be releasing the Lavabit source code (and doing a Kickstarter project to support this), with the hope that many others can set up their own secure email using Lavabit's code, combined with the new Dark Mail Alliance secure technology which will be available next year.

As noted, the Alliance is working on trying to create truly secure and surveillance-proof email. Of course, nothing is ever 100% surveillance proof -- and both members of the alliance have previously claimed that it was almost impossible to do surveillance-proof email. However, they're claiming they've had a "breakthrough" that will help.

The newly developed technology has been designed to look just like ordinary email, with an interface that includes all the usual folders—inbox, sent mail, and drafts. But where it differs is that it will automatically deploy peer-to-peer encryption, so that users of the Dark Mail technology will be able to communicate securely. The encryption, based on a Silent Circle instant messaging protocol called SCIMP, will apply to both content and metadata of the message and attachments. And the secret keys generated to encrypt the communications will be ephemeral, meaning they are deleted after each exchange of messages.

For the NSA and similar surveillance agencies across the world, it will sound like a nightmare. The technology will thwart attempts to sift emails directly from Internet cables as part of so-called “upstream” collection programs and limit the ability to collect messages directly from Internet companies through court orders. Covertly monitoring encrypted Dark Mail emails would likely have to be done by deploying Trojan spyware on a targeted user. If every email provider in the world adopted this technology for all their users, it would render dragnet interception of email messages and email metadata virtually impossible.

Importantly, they're not asking everyone to just trust them to be secure -- even though both companies have the right pedigree to deserve some level of trust. Instead, they're going to release the source code for public scrutiny and audits, and they're hoping that other email providers will join the alliance.

At the conference, Levison recounted much of what's happened over the last few months (with quite a bit of humor), joking about how he tried to be "nice" in giving the feds Lavabit's private keys printed out, by noting that he included line numbers to help (leaving unsaid that this would make OCR'ing the keys even more difficult). He also admitted that giving them the paper version was really just a way to buy time to shut down Lavabit.

Janke came up on stage to talk about the importance of changing the 40-year-old architecture of email, because it's just not designed for secure communications. The hope is that as many other email providers as possible will join the Alliance and that this new setup becomes the de facto standard for end-to-end secure email, which is where Levison's open sourcing of his code gets more interesting. In theory, if it all works out, it could be a lot easier for lots of companies to set up their own "dark mail" email providers.

Either way, I would imagine that this development can't make the NSA all that happy.

Filed Under: dark mail, dark mail alliance, email, ladar levison, mark janke, nsa, nsa surveillance, open source, security, surveillance
Companies: dark mail alliance, lavabit, silent circle

NSA's Talking Points On Snowden Leaks Say To Emphasize 9/11

from the these-sound-very-familiar dept

If you've been following all the NSA stuff, you're used the regular claims from the NSA's defenders. The folks over at Al Jazeera were able to get the talking points that the NSA has been using in response to the Snowden leaks, and they're exactly everything we've been hearing -- with extra emphasis on playing up 9/11. My favorite talking point, described as a "sound bite that resonates" is:

I much prefer to be here today explaining these programs, than explaining another 9/11 event that we were not able to prevent.

You'll also note an awful lot of "we need to connect the dots," though they leave out the part about how having more data actually makes it harder to connect the dots. They also play up the "over 50 cases" of dealing with "terrorist events" -- a number that has since been totally debunked.

The documents are the basic talking points that Keith Alexander, James Clapper and others have been using in their various Congressional hearings. If you watched the hearing yesterday, for example, you'd notice that Clapper especially was almost always reading off the talking points even when asked questions (Alexander appears to feel more comfortable "winging it"). Given that, there's not much that's totally surprising -- we've heard all of this. But it's still fascinating to see it in black and white.

Filed Under: ed snowden, james clapper, keith alexander, nsa, nsa surveillance, talking points

Watch The Video Of Rep. Mike Rogers Attacking Fellow Reps For Saying They Had No Idea NSA Spied On Foreign Leaders

from the could-he-be-any-more-condescending? dept

Yesterday, we wrote about the incredible exchange between Reps. Mike Rogers and Adam Schiff, after Rogers made a big production out of claiming that of course the House Intelligence Committee knew all about the NSA spying on foreign leaders. Schiff (and some others on the committee) made it clear that, contrary to Rogers' condescending claims earlier, they had no idea, despite being on the committee. However, to understand the level of dripping condescension from Rogers towards his colleagues who contradict him on the Committee, you really have to watch the video. If C-SPAN's video clipping service is working correctly (and it's crazy buggy), you should see the whole thing below (or at this link, starting with Schiff's questions to the panel, in which he makes it clear that he was not informed, and that he's not at all happy with James Clapper trying to tap dance around this by spewing a bunch of words that don't mean anything about how he tries to follow "the spirit" of the law.

The fun starts a little over five and a half minutes in when Rogers starts lecturing Schiff about not saying what Schiff knows is true, and making not-particularly-veiled claims that if only Schiff had done his homework, he'd know about it. Schiff shoots back to point out that dumping a ton of documents and insisting that he must know everything in them is quite different than directly informing him of this very serious activity, leading to a long and ridiculous lecture from Rogers that has to be watched to see the scolding father tone he adopts, all the while knowing he's full of crap, because Schiff clearly has him dead to rights. The information may have been buried somewhere, but the Committee clearly was not informed directly about these activities. If they had been, when Schiff asked his question of Clapper, Clapper wouldn't have tap danced like he did around the question. He would have just said, "We did inform you." Here's a bit of the transcript, though you have to see the tone to believe it.

Rogers: I would argue that to say that we're in the dark is mystifying to me. Some members spend a lot more time based on their schedules, which are significant, in this Congress. But, it is disingenuous to imply that this Committee did not have a full and complete understanding of activities of the intelligence community, as was directed under the national intelligence priority framework, to include sources and methods.

Schiff: Will the Chairman yield?

Rogers: I would yield.

Schiff: Chairman, are you suggesting you and the Committee were informed of the wiretapping of foreign leaders if that report is correct?

Rogers: Well, I wouldn't confirm any specific activity by intelligence community. As the gentleman knows -- as I have highlighted -- that we have access to all sources and methods and there is lots of product to be reviewed by the Intelligence Committee, through the Intelligence Committee and through the members of the Committee. Any implication that through the reviews that this Committee would not be informed to the status that has been in question is not correct.

Schiff I'd be interested to know, Mr. Chairman --

Rogers: We would be happy to take you to the committee and spend a couple of hours going through mounds of product that would allow member to be as informed as a member wishes to be on sources and methods and all activities of the intelligence community under the national intelligence framework.

Schiff: I would just say --

Rogers: I think we need to be careful about what we talk about but I think it would be disingenuous to use the classification...

Schiff: ... I think it would be disingenuous, Mr. Chairman, to suggest we have information if we don't have it. I would like to find out just what we were informed by the intelligence community. I would also like to find out if this is in the posture that you sometimes see in litigation, where you're given a warehouse full of documents...

Rogers: Again, reclaiming my time. Reclaiming my time. This is a very unique Committee on Capitol Hill. It's the only committee on both sides of the chamber that has both military and civilian intelligence activities. That is an enormous responsibility for every member of this committee, enormous. We don't get to take personal staff from the office to assist in processing of information we may have to do as members of this committee. I think it is to the semantics of exactly who, what, when or why, if you're asking if intelligence community submits a selector to every engagement in their business to the intelligence committee, that would be ridiculous. And no one would receive information in that way, not even the Director of National Intelligence would receive it in that particular way. To know what the framework is and know what the guidelines are and know what the reporting is and go through the very significant oversight of this Committee and the review of the product, which is incredibly important to the end, and to say this Committee is somehow in the dark on intelligence activities simply is not accurate.

I think we need to be incredibly careful about making any assertions that somehow we're in the dark because that information is available in robust amounts of material in our particular Committee. It is time consuming. I get it. It's a very time consuming committee. Again, this feeds into this flame of misreporting about lack of oversight or our intelligence community is running around doing what they want to do outside of the law or any oversight is wrong. Again, I just caution members before you might make any statement to the contrary, I would argue that a significant portion of your time should be spent in the committee reviewing the materials available and made available by the Intelligence Committee accordance with the law we are charged to do. With that, Miss Bachmann.

Schiff: Mr. Chairman, can I --

Rogers: Nope.

Schiff: -- will you yield?

Rogers: No. Reclaiming my time. I will not. Miss Bachmann.

And, just for fun, I've left Bachmann's questions in the video if you'd like to see what was so important that Rogers had to "reclaim his time" and not allow Schiff to speak. It's a bunch of questions about just how evil Ed Snowden is, complete with making the entire panel state that Snowden is a traitor, despite not actually fitting the classification under the law. The only one who refused to play that game was James Cole who says considering the legal proceedings, he really can't comment, which Bachmann refuses to accept as an answer.

So, rather than actually get to the heart of the matter on an important question of whether or not the intelligence community actually provided this important information to the Committee, we're treated to a game of bogus name calling. Ladies and gentleman, this is "Congressional oversight" under the leadership of Mike Rogers.

Filed Under: adam schiff, michele bachmann, mike rogers, nsa, nsa surveillance