Despite Stream Of Leaks Exposing Tremendous Gov't Surveillance Capabilities, James Comey Still Complaining About 'Going Dark'

from the really-just-working-with-a-single-talking-point-these-days dept

Following the Shadow Brokers' partial dumping of NSA exploits, a new batch of CIA exploits has hit the web via Wikileaks. Contained inside both sets of leaks was information explaining why encryption isn't much of a problem for the intelligence community. The NSA has put plenty of time and money into breaking encryption, but much of its Tailored Access Operations -- much like the contents of the CIA dump -- involve access efforts that bypass encryption completely by making themselves at home on the targeted hardware/device.

Despite these leaks, FBI Director James Comey is still insisting encryption is a problem. In his recent appearance at Boston College's cybersecurity conference, Comey had this to say:

[C]omey said that he a fan of "strong encryption" but noted that "it is making more and more of the room of what the FBI investigates dark."

Between September and November, the FBI received 2,800 devices it had lawful authority to open but could not open 1,200 of them "with any technique," he said.

Comey (again) called for "balance," a term he never bothers to define, but hints heavily at private companies being made to play by his rules, rather than offering any form of compromise from his end.

And it's partially true: devices seized after an arrest can't be forced open by exploits. The exploits need to be present on the devices first. But investigations always precede arrests. At this point, efforts can be made to target known devices to provide access during the investigation and prevent them from being locked up once they're seized. The legal framework, unfortunately, doesn't really exist at this point, but a lack of specific permission has never stopped the FBI from acting first and litigating later.

The FBI also has expanded access to the NSA's full-take surveillance programs, thanks to the recent lifting of restrictions. Nearly every phone utilizes the internet in some way, which would expose data and communications to the NSA's taps. This won't capture everything stored on devices, but it's far more info than the FBI would have otherwise. Comey's repeated complaints about "going dark" make less and less sense every time a new surveillance secret leaks.

Every new surveillance leak points to another disturbing fact: the FBI's promises of security and safety -- in reference to courtroom requests for "technical assistance" from device manufacturers -- are bullshit. If the NSA and CIA can't keep their exploits out of the public's hands, there's zero chance the FBI would somehow keep leakers and/or criminals from obtaining its cell phone-cracking secrets. The only balance that can be achieved by undermining device encryption is one where everyone loses.

Filed Under: cia, encryption, fbi, going dark, jim comey, leaks, surveillance

CIA Leaks Unsurprisingly Show The Internet Of Broken Things Is A Spy's Best Friend

from the watching-you-watching-me dept

So if you've spent any amount of time around here, you probably already know that the security and privacy standards surrounding the internet of (broken) things sit somewhere between high comedy and dogshit. Whether it's your refrigerator leaking your gmail credentials or your children's toys leaking kids' conversations, putting a microphone and camera on everything that isn't nailed down -- then connecting those devices to the internet without thinking about security and privacy -- hasn't been quite the revolution we were promised.

Obviously for the NSA and CIA, the internet of broken things is a field day, and the fact that the intelligence community would exploit this paper-mache grade security should surprise nobody. In fact, James Clapper made it abundantly clear last year that the internet of not-so-smart things was a massive target for surveillance:

"In the future, intelligence services might use the [internet of things] for identification, surveillance, monitoring, location tracking, and targeting for recruitment, or to gain access to networks or user credentials,” Clapper said."

As Mike already noted, most of what's contained in this week's Wikileaks Vault 7 CIA Document Dump isn't all that surprising. It includes stockpiled Android and iOS vulnerabilities, revelations that the US government covertly pays to keep US software unsafe and vulnerable (long suspected, now proven), and the fact that the government routinely exploits weak security in the Internet of Things to spy on targets. That includes turning Samsung "smart" televisions, long in the news for poor security and privacy violations, as an on-demand spying apparatus.

The documents highlight a CIA program named "Weeping Angel," which allows a CIA hacker to use the Samsung smart TV's microphone to listen in on a target, while the television appears to be off (aka a "fake off mode"). The documents only detail one TV model (the Samsung F8000), and seem to indicate that at least this particular exploit required someone to use an infected USB drive on the television in question:

Given the all-too-frequent lack of encryption (or hey, much security at all when it comes to collecting and transmitting data), it's still reasonable to surmise that a remote attack is perfectly possible on a laundry list of IoT devices, including televisions. Also, as the Intercept notes, given the problems we've repeatedly documented with smart televisions, it would be naive to think other sets aren't impacted:

"Security and cryptography researcher Kenneth White told The Intercept that smart TVs are “historically a pretty easy target” and “a pretty great attack platform,” given that TVs are typically located in a living room or bedroom.” White added that “there is zero chance the [CIA has] only targeted Samsung. It’s just too easy to mod other embedded OSes” found in the smart TVs sold by every other manufacturer."

Again, not particularly surprising for a tech segment repeatedly facing lawsuits for failing to disclose that TVs collect user data, or scandals involving sending this collected data unencrypted over the internet. In 2015, Samsung was forced to issue a lengthy mea culpa after users actually bothered to read the company's privacy policy, revealing that user TVs were watching them watching it. Samsung assured users the company takes "consumer privacy very seriously and our products are designed with privacy in mind," a FAQ also reassuring users that if there's no notification, your TV isn't listening:

How do I know it’s listening or not?

If the TV’s voice recognition feature is turned on for a command, an icon of a microphone will appear on the screen.

If no icon appears on the screen, the voice recognition feature is off."

Apparently not. Again, this might be less of a threat if TV vendors actually took user privacy seriously, utilized system settings that made device functionality transparent, or made it easy to disable functionality of dubious value on demand. But like the rest of the Internet of Things industry, companies were so hyped to use connectivity to hoover up private user data non-transparently, their ethical apathy left the door wide open to intruders (state sponsored or otherwise).

But hey, know that the intelligence community doesn't think you should be worried. Ex-CIA Director Gen. Michael Hayden went on The Late Show with Steven Colbert to insist that the CIA certainly doesn't use smart TVs to spy on people (something he called a "wonderful capability"), and certainly not to spy on American citizens:

Feel better?

Filed Under: cia, iot, security, smart tvs, surveillahce
Companies: samsung

CIA Leak Shows Mobile Phones Vulnerable, Not Encryption

from the and-cia-isn't-helping dept

As you've probably heard by now, this morning Wikileaks started releasing a new cache of information regarding CIA hacking tools. This is interesting on a variety of levels, but many of the reports focus on the claims that encrypted chat apps like Signal, Whatsapp and Telegram may be compromised. See the top two links in this screenshot:

Wikileaks itself may have contributed to this view with the following paragraph in its release:

These techniques permit the CIA to bypass the encryption of WhatsApp, Signal, Telegram, Wiebo, Confide and Cloackman by hacking the "smart" phones that they run on and collecting audio and message traffic before encryption is applied.

But the details don't seem to show that those apps are compromised, so much as that Android and iOS devices are compromised. It's always been true that if someone can get into your phone, the encryption scheme you use doesn't matter, because they can just pull keystrokes or grab data before you encrypt it -- in the same way that someone looking over your shoulder can read your messages as well. That's not a fault of the encryption or the app, but of the environment in which you're using the app itself.

And that should really be the bigger concern here. Over the years, nearly all of the focus on hacking mobile phones has been on the NSA and its capabilities, rather than the CIA. But it's now clear that the CIA has its own operations, akin to the NSA's hacking operations (kinda makes you wonder why we need that overlap). Except that the CIA's hacking team seems almost entirely unconcerned with following the federal government's rules on letting private companies know about vulnerabilities they've discovered.

Remember, the Obama White House put in place what it called a Vulnerabilities Equities Program in which the intelligence community is supposed to default to letting private companies know about vulnerabilities. And, yes, this was always something of a joke as there was a giant loophole involving "except for a clear national security or law enforcement need" that the NSA basically used to withhold vulnerabilities all the time. Still, at least the NSA appeared to get around to revealing some vulnerabilities eventually (probably once they were no longer useful).

Here, however, it looks like the CIA was hoarding some really serious vulnerabilities with wild abandon. In a chart released by Wikileaks you see that the CIA is getting these vulnerabilities from a variety of sources. Some it's finding itself, some it's purchasing, and some are shared via other agencies, such as the NSA or the UK's GCHQ. As Ed Snowden notes, there is now clear evidence (which many suspected, but which had not been proven) that the US government was secretly paying to keep US software unsafe and vulnerable. That's really dangerous. It's putting basically everyone in much more serious danger, just so the CIA, NSA and others can get in when they want to:

This is why the whole conversation about mandating backdoors and "going dark" was so dangerous in the first place. Those were plans to force even more of these vulnerabilities into the wild, just for the very very rare cases where they were needed by law enforcement or intelligence.

At a time when the President is suddenly acting as if he's concerned about domestic surveillance (at least of himself), perhaps now would be a good time to crack down on this kind of stuff. I'm not holding my breath -- but, for now, we're getting a lot more insight into the CIA's electronic surveillance methods, and it sounds like there's more to come.

Filed Under: cia, encryption, hacking, nsa, phones, surveillance, vep, vulnerabilities, vulnerabilities equities program
Companies: wikileaks

Trump Tops Obama, Hands Over Full Torture Report To Court Previous Administration Refused To

from the still-a-lot-of-marks-in-the-'L'-column-tho dept

Credit where credit is due: Trump has done more to preserve the full CIA Torture Report than Obama ever did. On his way out the door, the DOJ fought on his behalf in federal court, arguing against an order to deposit the full report with the court clerk for preservation in the ongoing trial of Abd al-Rahim Al-Nashiri, who has alleged he was waterboarded while detained by the CIA.

Barack Obama did stuff one copy of the full report in his presidential archives before Trump took over, perhaps in response to fears that the incoming president might make the whole thing vanish. Trump did mention his support for the use of torture on more than one occasion, and it would have been somewhat inconvenient to have an official document laying around saying torture is bad and the US shouldn't do it.

Maybe it's oneupmanship or maybe the Trump's legal counsel feels it has too much on its plate already, but as the New York Times' Charlie Savage reports, Team Trump is handing over a full copy of the Torture Report to the court as requested.

[A]s the Obama era came to an end, two Federal District Court judges for the District of Columbia ordered the executive branch to provide a copy of the report to the court’s security officer, and today, on the deadline set by one of them, the Trump administration complied rather than appeal.

A one-page notice of compliance [PDF] was issued by the White House on February 10th.

Respondents are filing this notice to advise the Court that, in accordance with the orders entered in the above captioned cases on December 28, 2016, and January 23, 2017,2 on February 6, 2017, the Government deposited for the Court Information Security Officers (CISOs) for secure storage a complete and unredacted electronic copy of the Senate Select Committee on Intelligence Committee Study of the CIA’s Detention and Interrogation Program (2014). Specifically, the Government deposited the electronic copy that had been previously delivered to the Department of Justice Office of Legislative Affairs.

The last sentence of the notice kills me. The government apparently carried the electronic copy from the DOJ's Office of Legislative Affairs to the court clerk. The clunky wording suggests this copy no longer resides at the DOJ and that the court has this particular copy of an electronic document in its hands -- one that could be copied infinitely with no discernible loss in quality or content.

Considering the full report is still classified, there are definitely plenty of dissemination control procedures in place. But without any further information to go on, the notice gives the appearance that the DOJ Office of Legislative Affairs no longer has a copy of the full report. So, that can be put on the scorecard of places the document no longer can be found, even though it could be distributed anywhere with minimal effort, cost, or replication of anything more than 1s and 0s.

Filed Under: barack obama, cia, doj, donald trump, foia, senate, torture report

Database CIA Claimed Too Difficult To Compile For FOIA Requesters Released In Full On CIA Website

from the three-years-of-fuckery dept

The CIA has millions of declassified records stashed away in Maryland -- something it claimed was accessible to the public. Actual access, however, resembles something out of Terry Gilliam's "Brazil," rather than what any reasonable person would call "accessible."

This so-called "publicly accessible" database -- known as CREST -- has been the target of MuckRock contributor Mike Best, who kickstarted an effort to liberate records from the vault through the use of manual labor. The records can be accessed by computer, but only certain computers, and only if you know exactly where to find them.

This is the CIA's "publicly available" records system front-end.

And here's how you locate it.

Accessing the information isn't easy. Researchers have to go to the back of the 3rd floor library at the National Archives building in Maryland, which is unfortunately unstaffed for half the day. Tucked away in the library are the only computers that can access the millions of pages of declassified records. If researchers ask the the main "Information" desk, they're answered with confused stares and incorrect directions. Researchers trying to look up on the National Archive's website where to access the computers, won't find it on the page about doing research at that location or on the page for electronic records at that location. That information is tucked away on the page for online databases - despite not being online.

Best's crowdfunding effort sought to free these documents from their four-computer cage. But the only way to do so was to visit in person, print out pages, and rescan them. All of this would be done under multiple forms of surveillance at the National Archive.

To expedite the process, MuckRock turned to litigation. Three years after commencing its FOIA lawsuit against the CIA, MuckRock has emerged victorious. The CIA has released the contents of the CREST vault online at its site, something it repeatedly claimed would take dozens of years and hundreds of thousands of dollars to complete.

The story behind the CIA's forced transparency is amazing. The claims made by the CIA during its opacity efforts are simply astounding. MuckRock has published a long, detailed recounting of its FOIA battle against the agency at its site and I wholeheartedly encourage you to click through and read it. But here are some of the highlights.

First off, everything in the database is in an unsearchable format by choice. The CIA only uses TIFF files, claiming that these are more resistant to alteration. But when faced with litigation, the CIA reversed course on the supposed hardiness of TIFF files.

The declaration... says that CIA cannot release these TIFF files in electronic form because they can be so easily altered by the mere act of a CIA FOIA analyst looking at them, and that the security measures they must take to remove this accidental metadata for an electronic release (involving editing each file separately by hand) would take 28 years and 1,200 CDs.

And there's where the hilarity begins. These are the DOJ's claims as to the difficulty of releasing the database it just released well ahead of its 28-year estimate. Not only is the process supposedly far too onerous to even begin to consider undertaking, but the DOJ claims the documents it just made available to the public at the CIA's website are not of public interest -- this despite being (technically) available to for public viewing at the National Archive for several years now.

In another filing, the CIA admits the 1,200 CDs that would take 28 years to compile have actually already been compiled -- and there are actually 1,450 CDs of records, but it will only consider releasing the quoted 1,200 if forced to. Unless the CIA is still porting these documents over to the CREST system at the National Archive, its claim of "28 years" looks even more ridiculous. From one of MuckRock's filings:

"Moreover, when [CIA] estimates that it would take 28 years just to create copies of the CREST database, it begs the question of how CIA loaded CREST in the first place. The system has only been operational since 2000.”

Then it claimed it would need $108,000 and six months to make copies of the CDs it already had in hand. And it doubled down on its contradictory claims about TIFF files, stating they were so easy to alter because they were so difficult to alter.

This lead to one of the best rebuttals (and lead-offs) in FOIA history:

I file a sur-reply drawing on my extensive experience as a person with a working brain, closing with the following thought:

“Last, CIA claims that ‘the act of a CIA employee opening a document on his or her terminal may cause metadata to embed itself on the image header.’ This is a frivolous statement for two reasons. First, files on PCs are not altered unless they are saved after the alteration. Simply opening a file and then closing it without changing it does not embed metadata on the file. Second, if this were a valid concern, it would apply to every file processed by the CIA FOIA office, not just CREST files. Since it clearly does not (which would paralyze the FOIA office), then the Court should view this claim very skeptically.”

Kel McClanahan -- the author of the post and MuckRock's legal rep for this case -- digs into the DOJ/CIA's repeated assertions about the "burdensomeness" of complying with this FOIA request. By the time he's done, everyone and everything is covered with government bullshit.

In 2000, using cutting edge 2000 technology, CIA populates CREST over a matter of months. For the next 15 years they insist that the only way to protect this system is to videotape people who want to access it. In 2015 they say that, using cutting edge 2015 technology, it will take them 28 years to make CD copies of CREST. Then they say that they already MADE CD copies of CREST in a matter of months if not weeks, meaning that it will only take 6 years to copy THOSE copies.

But they can copy those records to the web in 4 years. Less than a year later, they say that because of the huge public interest in CREST over the last several years (that they expressly disavowed less than 6 months before, did you remember?) they will have all of CREST online within a year because nobody needs to be videotaped any more. Then, less than 2 months later, they put all of CREST online.

The CIA and DOJ insist this stonewalling had nothing to do with the CIA's online release of CREST files. Apparently, it did all of this out of the goodness of its heart, forfeiting a shot at $100,000+ in FOIA fees and chance to do next to nothing for the next 30 years. It's obvious the effort to move these records online increased once it became apparent the government was going to come out on the losing end of these FOIA lawsuits (Jason Smathers was suing the CIA over the same database). Rather than be on the hook for legal fees, the CIA preempted any judicial judgment by releasing them to the public (the same public it said had "no interest" in these files) in bulk before final rulings could be made.

Filed Under: cia, crest, foia
Companies: muckrock

Proposed CIA Chief Seems Happy To Spy On Americans, Even If Using Info Hacked By Russians

from the that's...-a-concern dept

Last Friday, the first three of Donald Trump's appointments were up for vote -- with his DOD and DHS nominees sailing through with an easy vote. However, the Senate blocked Mike Pompeo, Trump's nominee for CIA. As we've discussed in the past, Pompeo is not concerned with violating civil liberties. In the past, we've noted that Pompeo put forth a sneaky fake amendment that pretended to defund NSA metadata collection, but which really reinforced it. He's further defended spying on Americans' metadata as the way government is supposed to operate. Oh, and did we mention that he angrily denounced SXSW for daring to have Ed Snowden speak there.

That's all quite concerning. But in opposing Pompeo for the CIA slot, Senator Ron Wyden has raised even more concerns -- including about Pompeo's willingness (or even eagerness) to use information hacked by the Russians to spy on Americans (and not just the Russians, but anyone else as well). That... should be concerning. As Marcy Wheeler explains, there were a long series of questions all leading up to the basic idea that Pompeo has no problem using whatever info is given to him to spy on people domestically, even if it comes from foreign hacking.

Wyden’s persistent concerns in his post-hearing questions pertained to whether and how Pompeo would be willing to cooperate with the Russians. Raising a Pompeo hearing comment that if a foreign partner gave the CIA information on US persons “independently,” “it may be appropriate of CIA to collect [that] information in bulk,” Wyden raised Trump’s encouragement of Russian hacking and asked what circumstances would make foreign collection so improper that CIA should not receive such information. Pompeo responded, “information obtained through such egregious conduct may be appropriate for the CIA to use or disseminate.”

Wyden then listed out a bunch of conditions, such as information coming from an adversary, to disrupt US democracy, information implicating First Amendment protected political activity, or information affecting thousands or millions of Americans. “The listed conditions could all be relevant,” Pompeo responded, remaining non-committal.

The full post-hearing questions can be found at that link, if you'd like to look them over. Meanwhile, Wyden is clearly not at all satisfied with Pompeo's answers, putting out a statement this morning saying:

Rep. Pompeo showed he's perfectly comfortable saying one thing on Monday, and the opposite on Tuesday. But his record reveals extreme positions, including enthusiasm for sweeping new surveillance programs targeting Americans and an openness to sending our country backward with regard to torture. Furthermore, his views on intelligence assessments on Russian interference in our election shifted along with the presidents', raising questions about the nominee’s objectivity.

There's been much made (especially over the weekend) about a potential rift between the CIA and Donald Trump, but no matter what, the CIA has a pretty long history of abuse of its powers in often dangerous ways. A person who has a history of supporting expanded spying on Americans (as a normal thing that government should do), and one who sees no problem using data hacked by foreign adversaries to then spy on Americans, seems like someone who should not be running the CIA right now.

Filed Under: cia, domestic surveillance, metadata, mike pompeo, ron wyden, russia, surveillance

CIA Slightly Scales Back Its Domestic Surveillance Powers In First Major Policy Update In Over 30 Years

from the we-promise-to-try-to-try dept

Ahead of Trump's inauguration, the CIA announced changes to its rules on gathering/using (inadvertently or otherwise) data and communications from American citizens. Other than this being the timeframe in which it happened, this process was likely in the works for months, rather than a panicked, last-minute attempt to keep an incoming president from redirecting the agency's foreign-based focus. (h/t Julian Sanchez)

But still, it's tempting to equate the two: Trump's swearing in and a slight scaling back of the CIA's domestic reach. The outgoing head of the agency was none too happy with Trump's tweets criticizing the intelligence community for not doing whatever it is Trump imagines it should have done about Buzzfeed publishing an opposition-funded dossier about his alleged ties to Russia. Trump compared life under this supposedly-incapable intelligence community to that of Nazi Germany, while also making statements about buddying up with Russia. Exiting CIA Director John Brennan seemed a little irked.

"I think he has to be mindful that he does not have a full appreciation and understanding of what the implications are of going down that road,” Brennan said on “Fox News Sunday,” a show Trump routinely watches.

“Now that he’s going to have an opportunity to do something for our national security as opposed to talking and tweeting, he’s going to have tremendous responsibility to make sure that U.S. and national security interests are protected,” Brennan added.

Brennan also objected to the "Nazi Germany" comment, standing up for all the fine (and probably some not-so-fine) people in the intelligence community. Given this backdrop, it might appear as though the updated CIA interpretation [PDF] of Executive Order 12333 is a response to Trump's tweets and statements, but it's more likely the agency did this in response to the Snowden leaks, which made any form of domestic surveillance by foreign intelligence agencies look a whole lot sketchier.

In a rare case of proactivity, the CIA has finally altered something it hadn't officially revamped in more than 30 years.

Earlier this month, the Director and the Attorney General approved new Attorney General Guidelines consolidating and updating the CIA’s procedures, some of which had not been significantly updated since 1982. In the intervening decades, the CIA implemented a number of additional changes in internal regulations and policies to address changes in law and technology not contemplated in the 1980s. The new, consolidated Attorney General Guidelines now incorporate many of these intervening changes, thereby providing a more unified and comprehensive set of procedures that permit the CIA to use and share intelligence information to support national security objectives in a manner that protects the privacy rights and civil liberties of all Americans.

The new guidelines add more restrictions to the CIA's use of domestic data and communications. It requires the agency purge any incidentally-collected US persons' communications within five years -- a solid improvement over its previous deadline of "never."

But with that (incrementally) good news comes some bad news:

The five-year limit on holding information applies only to the most sensitive categories of information, including email or cellphone intercepts — data that might otherwise remain in agency systems without being exploited or evaluated. Less-sensitive information is to be expunged after 25 years.

There are also additional reporting and compliance requirements meant to curtail the CIA's snooping on US persons' communications and data. Unfortunately, the specifics of these requirements are left mostly to the imagination, despite the CIA -- for the first time ever -- publishing a fully-declassified and unredacted version of its 12333 rules.

Also on the bad news side is the fact that the new restrictions rely on the interpretation of an executive order, which could be altered or replaced by the incoming president. Not only that, but the new CIA head -- Mike Pompeo -- could just as easily roll back the latest policy updates.

Also of note is the fact that, despite the incremental changes, the CIA still isn't super-concerned about Americans' civil liberties.

CIA officials acknowledged that the revisions were made without input from civil liberties groups, including the American Civil Liberties Union, which have pushed for more aggressive measures to protect Americans’ privacy than are envisioned in the updated guidelines.

As an agency with no master but the President (its "oversight" never seemed too troubled about its independent actions until it was spied on), the CIA has a lot of leeway in how it carries out its foreign intelligence operations. Whether or not we can trust the CIA to play by its own rulebook is still up in the air. It still works closely with the FBI to perform foreign intelligence collections, and recent loosening of restrictions on sharing NSA-collected, unminimized US persons' data/communications means the FBI will have even more access to information the CIA isn't supposed to touch.

And there's nothing in the new rules that suggests the CIA's practice of engaging in Section 702 backdoor fishing expeditions (often at the behest of the FBI). The summary [PDF] notes the CIA is not allowed to engage in intelligence collections targeting US persons directly, but it is still allowed to point other agencies in this direction and make use of anything collected by that agency.

With narrowly defined exceptions regarding testing and training, the CIA may not use special collection techniques in the United States. The CIA is, however, permitted to ask another federal agency to perform special collection techniques in the United States under that agency’s legal authorities. The CIA may also provide technical equipment or knowledge to another federal agency in conducting authorized special collection in the United States with the approval of the CIA’s General Counsel. The CIA may conduct special techniques outside the United States that target a United States person only with the approval of the Director of the CIA (or his designee), the CIA General Counsel, the Attorney General, and (where applicable) the Foreign Intelligence Surveillance Court.

On the bright side, the push for greater transparency from the intelligence community appears to actually be working, as both 12333 documents have been provided in a timely manner by the agency, fully-declassified and free of redactions.

Filed Under: cia, domestic surveillance, surveillance

DOJ, Obama Administration Fight Order Requiring The Full CIA Torture Report To Be Turned Over To The Court

from the don't-touch-our-stuff dept

The Obama administration has responded to calls to declassify the full CIA Torture Report with a "will this do?" promise to lock up one copy in the presidential archives. While this ensures one copy of the full report will survive the next presidency, it doesn't make it any more likely the public will ever see more than the Executive Summary released in 2014.

Other copies may still be scattered around the federal government, many of them in an unread state. The Department of Defense can't even say for sure whether its copy is intact. Meanwhile, an ongoing prosecution in which the defendant is alleging being waterboarded by the CIA has resulted in an order to turn over a copy of the full report to the court.

This order would preserve a second full copy -- with this copy being as close as we've gotten so far to seeing it become part of the public record. Of course, the DOJ is challenging this court order on behalf of the Obama administration, which certainly never intended to participate in this much transparency. Charlie Savage of the New York Times notes (on his personal blog) that a motion has been filed seeking to reverse the court's preservation/deposit order.

[T]oday the Obama Justice Department decided to fight Judge Lamberth’s order rather than comply with it. It filed a motion asking to Judge Lamberth to reconsider his order, arguing that it raised constitutional concerns (interfering with communications between Congress and the executive branch) and was unnecessary anyway given the presidential records thing. And it said that if he didn’t reconsider, the executive branch will appeal.

The judge had ordered a copy to be filed with the Court Information Security Officer (CISO). The DOJ argues [PDF] that this isn't necessary because the CIA has its copy locked up real tight-like.

Reconsideration is appropriate primarily because intervening facts have rendered these provisions unnecessary. As explained below, a copy of the SSCI Report is already being preserved in the Executive Branch under the Presidential Records Act, 44 U.S.C. §§ 2201-2209, and documents underlying the Report have been and continue to be preserved under a 2007 preservation directive issued by the Director of the CIA. Further, no copy of the SSCI Report held by the CIA has been destroyed, nor has any improper destruction of evidence by the CIA occurred since the issuance of the 2007 preservation directive.

True, one copy is being preserved in Obama's presidential archives. But the second assertion is a bit more dubious. While it's technically true the CIA hasn't destroyed any copies of the Torture Report, its oversight has. In May of last year, it was discovered that the CIA's Inspector General had destroyed the copy he'd received, thanks to a string of counterproductive "normal business" decisions.

[L]ast August, a chagrined Christopher R. Sharpley, the CIA’s acting inspector general, alerted the Senate intelligence panel that his office’s copy of the report had vanished. According to sources familiar with Sharpley’s account, he explained it this way: When it received its disk, the inspector general’s office uploaded the contents onto its internal classified computer system and destroyed the disk in what Sharpley described as “the normal course of business.” Meanwhile someone in the IG office interpreted the Justice Department’s instructions not to open the file to mean it should be deleted from the server — so that both the original and the copy were gone.

This prompted Dianne Feinstein to send a letter to someone who should have had an extra copy or three of the Torture Report lying around: CIA Director John Brennan.

As you may be aware. the office of the CIA Inspector General has misplaced and/or accidentally destroyed its electronic copy and disk of the Senate Select Committee on lntelligence's full 6,700-page classified Study of the CIA Detention and Interrogation Program. I write to request that as Director of the CIA, you provide a new copy of the Study to the office of the CIA IG immediately.

Your prompt response will allay my concern that this was more than an "accident." The CIA IG should have a copy of the full Study because the report includes extensive information directly related to the ongoing oversight of the CIA.

The accidental deletion of the IG's copy was possibly in violation of another preservation order stemming from ongoing FOIA litigation. The CIA was under orders to preserve its copy(ies), which means its oversight office should have been doing all it could to ensure its copy didn't disappear. If the CIA somehow managed to destroy its copies of the report, its oversight should have been in position to act as its backup, not to mention come down on it for any acts of impropriety. Instead, it took a copy and immediately -- if possibly inadvertently -- threw it away.

So, while the DOJ may firmly believe in all that is good and right and trustworthy about government officials holding onto damning documents, it can't rule out the possibility of human error. So, to better ensure preservation in accordance with the order, it should be less reluctant to hand over a copy to the court CISO, which would at least shift the culpability should this copy end up missing.

The obvious conclusion is that the outgoing administration (to say nothing of the incoming replacement) is still very interested in keeping the full report from ending up in the public's hands. Delivering a copy to the court makes it a part of the judicial process which, despite its tendency to seal documents and dockets far too frequently, is a much more open process than shuffling copies around from lockbox to lockbox within federal government agencies.

Filed Under: cia, cia torture report, doj, evidence, preservation, torture report

FOIA Requesters Sue Government Agencies Over Non-Responses To Requests For Election-Related Documents

from the and-this-is-how-the-public-alters-the-FOIA-response-timetable dept

Two of the nation's foremost FOIA enthusiasts -- Jason Leopold and Ryan Shapiro -- are suing a variety of federal agencies for their failure to respond to requests for documents related to the 2016 election.

The first lawsuit, filed a couple of weeks ago, concerns records pertaining to FBI director James Comey's actions in the last few weeks before Election Day. Most of the documents sought relate to the FBI's on-again, off-again investigation into Hillary Clinton's private email server. The pair also seeks a variety of communications between Comey and the rest of the FBI, as well as any internal FBI discussions about the number of leaks that accompanied Comey's last-minute dive back into the email investigation.

Shapiro and Leopold are also seeking unredacted copies of Clinton email investigation documents previously released by the FBI. They also would like to see what the FBI has on hand that references a variety of right-wing news sites, including Breitbart News and alternativeright.com.

The first lawsuit [PDF] alleges the FBI has violated FOIA law by not responding to their expedited request in a timely fashion. At the date of the lawsuit's filing, the FBI had yet to inform the requesters whether or not it would grant the request expedited status.

The second lawsuit [PDF], filed earlier this week, makes the same allegations. Expedited processing was requested, but the agencies targeted failed to rule on the processing request in a timely fashion. The list of defendants in this lawsuit is a bit longer. Shapiro and Leopold have requested election-related documents from the Office of the Director of National Intelligence, CIA, DOJ, and DHS. None of these agencies have issued a ruling on expedited processing.

The documents sought here are also a bit different. The two requesters are asking for documents held by these agencies that pertain to the Russian interference -- hacking or otherwise -- in the electoral process. There are some interesting keywords listed, including Guccifer, Elite VPN, two IP addresses, and anything related to the alleged compromise of Clinton campaign head John Podesta's devices/email accounts.

Obviously, both of the requests being sued over are time-sensitive and of considerable public interest. The longer these agencies delay their responses, the less "interesting" the information is to the public. Pulling the trigger on lawsuits two weeks after FOIA requests are filed is the new way of playing ball with federal agencies. Left to their own timetables, the agencies would likely release these documents sometime between "the distant future" and "never." This prompts the parties listed to at least adhere to the letter of the law and make a determination on expedited processing. And, given the information sought, there's no way these will be the only FOIA lawsuits related to the requested documents.

Filed Under: cia, dhs, doj, election, fbi, foia, hillary clinton, investigation, james comey, jason leopold, lawsuit, odni, russia, ryan shapiro

CIA Admits It Hasn't Touched FOIA Request In Six Years... Says It Will Close Case If Requestor Doesn't Reply

from the this-is-bad-and-you-should-feel-bad dept

Back in 2011, MuckRock user Jason Smathers filed a FOIA with the CIA for all responses they had sent to requesters containing the term "record systems." This was a reference to two earlier rejections he had received from the Agency, which cited the inability to perform a search in the system based on the terms Smathers had provided.

In response, the agency sent him partially redacted copies of those same two rejections.

Smathers immediately appealed, on grounds that it beggared belief that he had been the only requester to have ever had an exchange with the CIA that contained the words "record system."

Six years go by, and we hear nothing from the Agency regarding this request. Then, just this week, this letter arrives in the mail.

Which is worse? The casual admittance that they haven't done anything for over half a decade, or the unfathomable audacity of putting Smathers on deadline? And while two months sounds pretty generous, keep in mind that they've been sitting on this for 72 months -- a mere 36 times what they're giving him.

To give this some further context -- Smathers' request was assigned an internal MuckRock tracking number of 238. If you were to file a request today, you'd be given a number in the 31,000s.

To the CIA FOIA officer (not) reading this: There have been children born since this appeal was filed that you could have a conversation with. This is bad, and you should feel bad. Please don't be bad, be good instead.

And get rid of that damn fax machine.

Republished from Muckrock

Filed Under: cia, delay, foia, jason smathers
Companies: muckrock