No Matter Who's Elected, Surveillance Powers And Programs Unlikely To Be Scaled Back

from the sorry-constituents,-but-your-concerns-aren't-a-priority dept

The New York Times editorial board speculates on where we're going from here following President Obama's not-doing-much-until-forced-to approach to surveillance and surveillance reform. Two candidates -- neither of them improvements -- are roughly a month away from one of them taking the nation's top office. As the Times' board points out, there's not much in it for anyone hoping the incoming White House will push forward with more reform efforts or better oversight.

The Republican nominee, Donald Trump, has not substantively addressed any of these issues. But he has proposed draconian, unconstitutional measures to keep the nation safe, including carrying out surveillance of mosques and creating a database of Muslims. This is offensive and outrageous. “We’re going to have to do certain things that were frankly unthinkable a year ago,” he said last November.

Hillary Clinton has been more measured in discussing surveillance and encryption. Her campaign has suggested creating a national commission to explore legal and practical questions surrounding encryption. Mrs. Clinton has also said she would like to foster a more constructive relationship with Silicon Valley leaders, who have often been reluctant to collaborate with intelligence agencies. But she has been troublingly vague on specifics.

The Times is far too kind to Clinton. (No one really needs to rehash Trump's inability to form coherent sentences when discussing policy…) Clinton may be more measured, but what she has discussed suggests a return to form when Obama exits office. A return to GEORGE W. BUSH form, really -- basically another 4-8 years of post-2001 fear-based legislating, like her predecessor engaged in.

After the attack in Orlando, Clinton joined Trump in calling for expanded watchlists and denial of Constitutional rights to those placed on them. She has occasionally hinted at vague surveillance reform, but has also made it clear Snowden should hop on the next plane home and spend some time in prison. She has also suggested tech companies partner with the government to create backdoors in encryption -- but in an imaginary "safe" way that won't threaten their customers' security. And she's made it clear that deploying the military is a perfectly acceptable response to state-led cyberattacks.

Either way the election goes, the surveillance business will remain as usual. This is troubling, due to the fact that Section 702 -- which authorizes the NSA's internet backbone-based surveillance dragnet PRISM -- is up for renewal at the end of next year. With recent revelations about Yahoo's very proactive surveillance assistance generating some interesting questions about what the NSA can or can't do under this authority, it would be nice to have someone in the White House that would amplify these concerns, rather than help drown them out.

Filed Under: donald trump, election, hillary clinton, mass surveillance, nsa, section 702, surveillance

Continued Disagreement And Confusion Over Yahoo Email Scanning

from the someone-needs-to-come-clean-for-real dept

The story behind Yahoo's apparently scanning over every email for the NSA continues to be... confusing. Earlier this week we noted some conflicting reports in the media on what was actually happening. The NY Times report said that it was via a FISA Court Order, which would be interesting, and would almost certainly require a declassification of the FISA opinion. However, Reuters insisted that it was actually under Section 702 of the FISA Amendments Act (which doesn't involve a FISA Court Order). So, confusion abounded.

And now it's getting worse. That same NY Times report said that the system was just a modification of Yahoo's malware scanners for a particular snippet of text or code:

To comply, Yahoo customized an existing scanning system for all incoming email traffic, which also looks for malware, according to one of the officials and to a third person familiar with Yahoo’s response, who also spoke on the condition of anonymity

Except, according to a new report from Motherboard, that's not actually true, and instead the NSA was asking Yahoo to install its own malware which was super buggy:

Anonymous sources told The Times that the tool was nothing more than a modified version of Yahoo’s existing scanning system, which searches all email for malware, spam and images of child pornography.

But two sources familiar with the matter told Motherboard that this description is wrong, and that the tool was actually more like a “rootkit,” a powerful type of malware that lives deep inside an infected system and gives hackers essentially unfettered access.

The rootkit-like tool was found by Yahoo’s internal security testing team during one of their checkups, according to a source.

That's more consistent with the original report in Reuters, which talked about the security team finding the code and believing it was malware. And, apparently the rootkit/malware code that the NSA gave Yahoo was super buggy and put everyone at risk:

“It definitely contained something that did not look like anything Yahoo mail would have installed,” the source added. “This backdoor was installed in a way that endangered all of Yahoo users.”

Another source, who also requested anonymity and was familiar with what happened, confirmed that describing the tool as a “buggy” “rootkit” is accurate.

A different article over at the Intercept has similar claims as well. It's possible that this is the same source going to multiple publications, or it could actually be different sources. Seeing as the language in the two articles is similar, it very likely is the same source though:

According to the Yahoo alum, a mere “modification to [existing] mail filters wouldn’t have raised a red flag … [the security team] wouldn’t have been able to detect it in the first place.” Rather, Yahoo’s security team had detected “something novel, like something a hacker would have installed.” The team believed it “was or looked like a root kit,” a piece of software installed on a computer system to give a third party complete, invisible control. In this case, according to the ex-Yahoo source, it was “a program that runs on your servers that has access to incoming data.”

And the buggy nature is also discussed as well:

“The program that was installed for interception was very carelessly implemented, in a way that if someone like an outside hacker got control of it, they could have basically read everyone’s Yahoo mail,” something the source attributed to “the fact that it was installed without any security review.”

I'm guessing this is the same source who went to both publications, but it continues to raise more questions about this. Forcing Yahoo to actually install code is a big, big deal and gets back to the questions raised by the DOJ trying to force Apple to do the same thing. And, once again, this is the kind of thing the government isn't supposed to be able to do in secret. Yes, individual orders and details about who or what is being searched can and should be kept secret, but requiring a company to install code that sniffs through every email... that's not how these things are supposed to work.

Filed Under: email, malware, mass surveillance, nsa, rootkit, scanning
Companies: yahoo

Senator Ron Wyden Says White House Is Required By Law To Reveal Details Behind Yahoo Scanning

from the where's-my-popcorn? dept

So, one of the things in the USA Freedom Act is a provision requiring that the White House declassify any "novel interpretations" of the law in ordering surveillance. This was to avoid the situations, such as under the Section 215 program, where the intelligence community reads words to mean things differently than anyone else would read them. Now, given what we've learned so far about the Yahoo email scanning case and the fact that it clearly goes beyond what people thought the law enabled, it seems clear that there's some interpretation somewhere that's "novel."

And that means that the White House should declassify the reasoning. Now Senator Ron Wyden is asking them to do exactly that:

“Recent reports of a mass-email scanning program have alleged that federal law is being interpreted in ways that many Americans would find surprising and troubling,” Wyden said. “The USA Freedom Act requires the executive branch to declassify Foreign Intelligence Surveillance Court opinions that involve novel interpretations of laws or the Constitution and I certainly expect the Executive Branch to follow this law.”

This is, obviously, something of a warning shot to the administration. Chances are they'll ignore this, but that could turn into a pretty serious strategic mistake. As we've been saying since it first came out, James Clapper should explain what's happening, because the longer they stay silent, the worse this looks.

Filed Under: fisa court, mass surveillance, nsa, odni, ron wyden, surveillance, usa freedom act
Companies: yahoo

Inspector General's Report Notes Section 215 Requests Down Sharply Since 2013

from the but-that's-because-the-government-has-so-many-other-options dept

The Snowden Effect continues. In addition to actual oversight finally being applied to surveillance programs, the breadth and scope of some programs continues to be narrowed. Some of this narrowing has been forced on the NSA by legislation. But some of it also appears to be shame-related. It's no longer as acceptable to harvest vast amounts of data domestically, apparently.

Shane Harris at The Daily Beast notes that the latest Inspector General's report [PDF] details a sharp decline in Section 215 requests since Snowden's debut leak in June 2013.

Between 2012 and 2014, that court approved 561 so-called “business records orders,” but that number dropped from a nine-year high of 212 in 2012 to 170 in 2014, a nearly 20 percent decrease, according to a review by the Justice Department’s inspector general.

The number fell again in 2015 to 142 orders.

If Snowden hadn't dumped the documents, the program would have remained unaltered and, most likely, requests would have continued to rise. Thanks to a forced "conversation" about domestic surveillance, the resulting USA Freedom Act, along with the appointment of an amicus to make FISA court proceedings a tiny bit more adversarial, the government has scaled back its requests for phone metadata and other "third party" records. Having to target first and request second kind of has that effect.

The other effect leading to this decline is also related to the document leaks. The NSA -- and the FBI, which actually makes the requests for data -- found itself an outcast in its own country. Fewer requests are apparently being made because it's no longer socially acceptable to do so.

A Justice Department official attributed the diminishing use of the program to the “stigma attached” to it after Snowden’s leaks.

Then again, this might just be a nice thing to say. The FBI and NSA have several other surveillance programs operating with less oversight and restrictions than the Section 215 program. Although officials claimed the program was essential when defending it against legislative efforts, there was hardly any evidence presented to back this assertion up. Even the OIG report notes as much, stating that FBI agents "could not identify any major case developments" from its business records collections. Even so, the FBI continues to believe the bulk collection of metadata still serves as a valuable "building block" of its investigations, even if it's ultimately an extraneous one.

The report also points out that the FBI routinely uses other processes to obtain these same records -- ones that are faster and don't require a trip to the FISA court. In between redactions, the OIG notes that the FBI opens "parallel investigations" and utilizes things like grand jury subpoenas to compel the production of business records, rather than routing this through the FISA court. Then there's the FBI's use of National Security Letters, which has showed no sign of slowing even when faced with additional public scrutiny.

Shane Harris points out that the Section 702 program, which harvests vast amounts of internet/email communications and data, is far more useful and far more powerful. That's up for renewal next year and it will be interesting to see how James Clapper's office -- and the FBI -- handle any obstacles standing in the way of a no-questions-asked reapproval. The intelligence community seemed willing to let Section 215 take center stage during the push to pass the USA Freedom Act -- a surveillance state scapegoat released to draw attention away from the NSA's more intrusive bulk collections. But the intel community isn't going to be as easily persuaded to dial back a program that targets platforms that facilitate communications on a much wider scale.

Filed Under: bulk collection, ed snowden, mass surveillance, nsa, section 215, surveillance

Yahoo Email Scanning May Sink EU Privacy Shield Agreement

from the nsa-fucking-things-up-again dept

After the US/EU "safe harbor" on data protection was tossed out thanks to NSA spying being incompatible with EU rights, everyone had tried to patch things up with the so-called "Privacy Shield." As we noted at the time, as long as the NSA's mass surveillance remained in place, the Privacy Shield agreement would fail as well. This wasn't that difficult to predict.

And there are already some challenges to the Privacy Shield underway, including by Max Schrems, who brought the original challenge that invalidated the old safe harbor. But things may have accelerated a bit this week with the story of Yahoo scanning all emails. This news has woken up a bunch of EU politicians and data protection officials, leading to some serious questions about whether it violates the Privacy Shield agreement.

Johannes Kleis, a spokesman with BEUC, an umbrella group for European consumer organisations, called on other EU data protection authorities to investigate Yahoo.

Fabio de Masi, a German member of the European parliament with the leftist Die Linke party called on the EU high representative for external affairs Federica Mogherini to seek clarification from US authorities about the treatment of EU data.

And elsewhere as well:

"It goes far beyond what is acceptable," said Johannes Caspar, Commissioner for Data Protection and Freedom of Information in Hamburg, Germany.

Over in the European Parliament, Dutch MEP Sophie in 't Veld has asked the EU Commission to investigate: While some keep arguing that the whole idea of a safe harbor or privacy shield is a problem, that's not really true. Enabling more easy data flows between countries on a borderless internet is really important for keeping the internet really global. This is a serious issue. The problem is the NSA's surveillance activities undermining all of this, and continually (rightfully) freaking out people in other countries about what happens to data that flows into the US. The answer is not to dump agreements that enable the free flow of data, but to stop mass surveillance activities.

Once again, it appears that overly aggressive mass surveillance by the US intelligence community is creating massive headaches for American internet companies.

Filed Under: data flows, data protection, eu, mass surveillance, nsa, privacy shield, us
Companies: yahoo

NY Times And Reuters Claim Totally Different Explanations For Yahoo's Email Scanning

from the so-um-well,-this-is-awkward dept

On Wednesday afternoon the NY Times released a report that appeared to clarify some of the questions around Tuesday's Reuters report about Yahoo scanning all emails. According to the NY Times, unlike the original Reuters report that talked about a "directive" (which would imply an NSA surveillance program such as the one under Section 702 of the FISA Amendments Act), the scanning was actually the result of a more traditional FISA Court order.

Yahoo was ordered last year to search incoming emails for the digital “signature” of a communications method used by a state-sponsored, foreign terrorist organization, according to a government official familiar with the matter.

The Justice Department obtained the order from a judge of the Foreign Intelligence Surveillance Court.

To comply, Yahoo used a modified version of its existing systems that were scanning all incoming email traffic for spam, malware and images of child pornography. The system stored and made available to the Federal Bureau of Investigation a copy of any messages it found that contained the digital signature.

Some had speculated that this was what happened, but there was still some confusion over Reuters' original use of "directive." However, before the digital ink had even dried on the NY Times report, Reuters came out with a new report of its own that claimed the scanning was done under a Section 702 program:

Yahoo's request came under the Foreign Intelligence Surveillance Act, the sources said. The two sources said the request was issued under a provision of the law known as Section 702, which will expire on Dec. 31, 2017, unless lawmakers act to renew it.

But, the Reuters report also notes that there was a "FISA Court warrant" associated with the request:

The FISA Court warrant related specifically to Yahoo, but it is possible similar such orders have been issued to other telecom and internet companies, the sources said.

So it sounds like there may have been some sort of weird hybrid FISA Court order, which used Section 702 as the basis for the demand -- even though the coverage of it included items that previously had been considered off limits under the 702 PRISM program (i.e., "about" communications, rather than just to and from metadata).

Either way, this is putting renewed emphasis on the problems with Section 702 -- and the fact that it expires at the end of next year. If the NSA had been hoping that the PCLOB report, and other factors, would lead Congress to rubber stamp the renewal, the exposure of the Yahoo program may have just undermined that in a big way. The EFF is already pointing out how scanning all emails for a selector like this is a 4th Amendment violation. Of course, actually getting standing to prove that in court is going to be a challenge.

Filed Under: 702, email scanning, fisa court, fisc, mass surveillance, nsa
Companies: ny times, reuters, yahoo

Yahoo Issues Tone Deaf Non-Denial Denial Of Email Scanning Report

from the blink-twice-if-you're-being-forced-to-say-this dept

After basically all the big tech companies have come out with strong and clear denials, Yahoo this morning released a silly mealy mouthed non-denial denial, written by a PR firm, that took almost 24 hours to craft:

Good morning –

We are reaching out on behalf of Yahoo regarding yesterday’s Reuters article. Yahoo said in a statement:

“The article is misleading. We narrowly interpret every government request for user data to minimize disclosure. The mail scanning described in the article does not exist on our systems.”

Best,

The Joele Frank Team

Of course, people are parsing every word of that and noting some... remaining questions. The article is misleading? Okay, how? Which parts? What did it get wrong? You narrowly interpret every government request? Great. So explain what was found here, or explain the specifics of what Yahoo is doing. "Does not exist on our systems"? Did it ever? Does it exist on someone else's system? Does a different mail scanning system exist? Lots of people would like to know.

More importantly, note that they say they want to minimize disclosures. But that's not the key issue here, as Chris Soghoian points out. The Reuters report was on the searching of all emails, not the disclosure bit. Yes, sure, it seems clear that after searching everyone's email, Yahoo likely only "disclosed" a small number to the NSA, but that's not really the point, is it?

I mean, I guess this statement is better than Yahoo's original: "Yahoo is a law abiding company, and complies with the laws of the United States" statement. But, it's not very reassuring. Much more important is what Yahoo could have said, but didn't. But that's not happening. Yahoo has said that it "can't comment further" which either means it doesn't want to comment further or, potentially, that it feels it is legally barred from commenting any further -- which is certainly a possibility (though a disturbing one).

The NSA or the Director of National Intelligence could help clear this up, but so far they're going all Glomar on any questions: And that alone should be a giant warning sign to any tech company that decides not to fight these kinds of demands: when it inevitably leaks to the public (and it will), the intelligence community will let you hang out to dry all by yourself.

Filed Under: email, mass surveillance, non-denial denial, nsa, scanning, section 702
Companies: yahoo

Basically All Big Tech Companies Deny Scanning Communications For NSA Like Yahoo Is Doing

from the getting-more-interesting dept

So, the big story yesterday was clearly the report that Yahoo had secretly agreed to scan all email accounts for a certain character string as sent to them by the NSA (or possibly the FBI). There has been lots of parsing of the Reuters report (and every little word can make a difference), but there are still lots of really big questions about what is actually going on. One big one, of course, is whether or not other tech companies received and/or complied with similar demands. So it seems worth nothing that they've basically all issued pretty direct and strenuous denials to doing anything like what Yahoo has been accused of doing.

Twitter initially gave a "federal law prohibits us from answering your question" answer -- and a reference to Twitter's well documented lawsuit against the US government over its desire to reveal more details about government requests for info. However, it later clarified that it too was not doing what Yahoo was doing and had never received such a request. Microsoft's response was interesting in that it says it's not doing what Yahoo is, but refused to say if it had ever received a demand to do so. Google said it had never received such a request and would refuse to comply if it had. Facebook has also denied receiving such a request, and, like Google, says it would fight against complying. This still leaves lots of unanswered questions about why Yahoo gave in. Again, historically, Yahoo had been known to fight against these kinds of requests, which makes you wonder what exactly was going on here.

Former GCHQ infosecurity guy Matt Tait has one of the more more interesting threads about this news, arguing (in some ways) that it's both less and more than everyone is making it out to be. His basic argument is that this is an expansion of the PRISM program to include "about" targets. This has been discussed in the past, but under PRISM, the NSA could give tech companies "selectors" in the form of specific addresses and the companies were compelled to hand over emails "to" or "from" them -- but according to the PCLOB's report on the Section 702 program it did not include anyone emailing "about" the selector. Upstream collections (i.e., tapping the backbones from folks like AT&T) did include "about" selectors (and this information also flowed into other areas, enabling so called backdoor searches. And, as I speculated yesterday, Tait says that this latest news appears to be Yahoo now agreeing to use "about" selectors on its emails, which means that it's still part of PRISM, with a massive expansion.

Tait then notes that if James Clapper wants to clear this up, he should state publicly whether or not "about" collection is a part of PRISM. And if that's the case, he should also explain when and why PRISM was expanded to include this. But, of course, Clapper and the Intelligence Community tend not to want to explain very much of anything, leaving lots of people in the dark.

And, frankly, that's stupid. The Intelligence Community thinks that this keeps "bad guys" on edge, not knowing what's safe and what's not. But that's dumb. They mostly know to use more encrypted/secret means of communication when they need to. Instead, what you end up with is keeping the public on edge and not trusting services. I can almost guarantee that one of the early comments on this post will be some of you insisting that all the companies denying doing this are flat out lying. I don't agree with that, because the companies don't have a history of outright lying on things like this, but the way the NSA and other parts of the US government have repeatedly tried to pressure them and gag them, it's much tougher to take anything at face value any more. And that's not good for anyone.

Filed Under: about collection, about selectors, mass surveillance, nsa, prism, section 702, upstream
Companies: facebook, google, microsoft, twitter, yahoo

Yahoo Secretly Built Software To Scan All Emails Under Pressure From NSA Or FBI

from the uh-wait-a-second dept

So Reuters had a big exclusive report this morning about Yahoo creating "custom software to search all of its customers' incoming emails for specific information" at the behest of the NSA or FBI. This was built last year -- which came well after the Snowden disclosures, and after Yahoo had been revealed to have legally challenged earlier NSA dragnet attempts -- and after it had rolled out end-to-end encryption on email.

Apparently, this was a decision made at the top by Marissa Mayer, and pissed off the company's top security guy, Alex Stamos (who is awesome and a big supporter of end-to-end encryption) leading him to leave the company (and move to Facebook, where he is currently).

According to the two former employees, Yahoo Chief Executive Marissa Mayer's decision to obey the directive roiled some senior executives and led to the June 2015 departure of Chief Information Security Officer Alex Stamos, who now holds the top security job at Facebook Inc."Yahoo is a law abiding company, and complies with the laws of the United States," the company said in a brief statement in response to Reuters questions about the demand. Yahoo declined any further comment.

Of course, this comes out less than a week after the NY Times had a big report on how Mayer de-prioritized security, despite having built up a great team of computer security experts called "The Paranoids." But, Mayer apparently downplayed or blocked their efforts, leading many to go elsewhere. And now we find out that Yahoo agreed to create this special software for scanning all emails for certain phrases or keywords. Bizarrely, this new report notes that Mayer gave the task of writing this software not to the security team, but to email engineers, leaving the security team in the dark, until they discovered it, thinking it was malware:

They were also upset that Mayer and Yahoo General Counsel Ron Bell did not involve the company's security team in the process, instead asking Yahoo's email engineers to write a program to siphon off messages containing the character string the spies sought and store them for remote retrieval, according to the sources.

The sources said the program was discovered by Yahoo's security team in May 2015, within weeks of its installation. The security team initially thought hackers had broken in.

When Stamos found out that Mayer had authorized the program, he resigned as chief information security officer and told his subordinates that he had been left out of a decision that hurt users' security, the sources said. Due to a programming flaw, he told them hackers could have accessed the stored emails.

Now, there are still a number of open questions about this: chief among them if others, such as Google, Microsoft, Facebook, and Twitter were similarly compelled to create similar software. This may not be that meaningful, but the article does not say that it was a FISA Court "order" but rather a "directive" that compelled this:

The company complied with a classified U.S. government directive, scanning hundreds of millions of Yahoo Mail accounts at the behest of the National Security Agency or FBI, said two former employees and a third person apprised of the events.

The question then is what secret "directive" does the government have that allows such broad scanning? The most likely (but certainly not the only) possibility is a stretched interpretation of Section 702 of the FISA Amendments Act. That Section is responsible for two known programs for the NSA to collect info: PRISM, which had big tech companies sharing specific information with the NSA, and "upstream" collection in which broadband providers like AT&T would scan all traffic for certain information. Without more detail, it's a little difficult to know what happened here, but it sounds like something in between PRISM and upstream -- in which online service providers were similarly asked to scan all content for certain information.

It seems clear that Yahoo either didn't think it could win a legal fight over this (certainly a possibility), or that it just didn't want to. At the very least, this seems like yet another example of totally secretive rulemaking by the US government on what surveillance capabilities are legal, without any public review or adversarial process designed to make sure that civil liberties are protected. I know that many of the more paranoid folks out there think that the NSA already had deals with the big companies to scan all content, but they weren't supposed to, and as far as we knew they did not as of a few years ago. But if that changed last year, that's a big, big deal, and much more information needs to become public on this.

Filed Under: alex stamos, bulk collection, email, marissa mayer, mass surveillance, nsa, privacy, scanning, section 702
Companies: yahoo

Will The Washington Post Give Back Its Pulitzer And Stand Trial With Snowden?

from the senseless dept

We already know that the Washington Post editorial board has some cognitive dissonance when it comes to Ed Snowden. Three years ago, right after the Washington Post itself, via reporter Barton Gellman, broke a bunch of the initial stories around the Ed Snowden documents -- including the first public report on the Section 702 PRISM program -- the editorial board wrote a piece condemning Snowden's leaks. Now, it's true (as many point out) that the editorial board is separate from the reporters who work at the paper, but it still is really quite amazing that the editorial board would not only burn a source like that but basically complain about its own journalism.

It appears that three years later, the Post's editorial board has not changed its perspective. In response to the campaign to pardon Snowden, the Washington Post has come out with a tone deaf editorial against pardoning Snowden, calling for him to be prosecuted, and insisting that Snowden caused real harm with the revelations. Here's the really incredible part. The Post focuses its complaint on the revelation of the PRISM program -- and that is the story that the Post broke. Glenn Greenwald and the Guardian had the first story, about the Section 215 mass phone records surveillance program. But it was the Post that had the first story about PRISM. And yet, the Washington Post now says that while revealing the 215 program may have been a public service, revealing PRISM was a crime.

The complication is that Mr. Snowden did more than that. He also pilfered, and leaked, information about a separate overseas NSA Internet-monitoring program, PRISM, that was both clearly legal and not clearly threatening to privacy. (It was also not permanent; the law authorizing it expires next year.) Worse — far worse — he also leaked details of basically defensible international intelligence operations: cooperation with Scandinavian services against Russia; spying on the wife of an Osama bin Laden associate; and certain offensive cyber operations in China. No specific harm, actual or attempted, to any individual American was ever shown to have resulted from the NSA telephone metadata program Mr. Snowden brought to light. In contrast, his revelations about the agency’s international operations disrupted lawful intelligence-gathering, causing possibly “tremendous damage” to national security, according to a unanimous, bipartisan report by the House Permanent Select Committee on Intelligence. What higher cause did that serve?

Except it wasn't Ed Snowden who publicly revealed information about PRISM. It was the Washington Post. And it won a freaking Pulitzer Prize for that reporting as well. And now it says that the revelation of that program should never have happened?

Really?

Remember that, while many people falsely think that Snowden is the one who revealed these programs to the public, that's not the case. He gave the documents to certain journalists, saying that he trusted them to sort through them and determine what was newsworthy, what was not, and what should be kept secret. It was the Washington Post that determined the PRISM program -- which is still subject to legal challenges (though so far has been found to be legal) -- was serious enough for news coverage. Not Ed Snowden. And yet now the Post says Snowden should be prosecuted for the journalistic decision it made, which earned it a Pulitzer.

Yes, the Post editorial board is free to make such a stupid decision, but it's only going to harm its journalistic staff. What source is going to go to the Washington Post now, when it's the very paper that took all the glory from publishing stories from a source -- and then called for him to be thrown in jail?

Here's what the Washington Post's Executive Editor Marty Baron said about the Pulitzer Prize when it was announced:

Post Executive Editor Martin Baron said Monday that the reporting exposed a national policy “with profound implications for American citizens’ constitutional rights” and the rights of individuals around the world.

“Disclosing the massive expansion of the NSA’s surveillance network absolutely was a public service,” Baron said. “In constructing a surveillance system of breathtaking scope and intrusiveness, our government also sharply eroded individual privacy. All of this was done in secret, without public debate, and with clear weaknesses in oversight.”

Baron added that without Snowden’s disclosures, “we never would have known how far this country had shifted away from the rights of the individual in favor of state power. There would have been no public debate about the proper balance between privacy and national security. As even the president has acknowledged, this is a conversation we need to have.”

Hmm. That doesn't seem to fit with what his own editorial board is now saying about Snowden's revelations. When asked about this now, in response to the editorial, Baron suddenly came down with a case of the "no comments."

In an email response to Fortune, Post editor-in-chief Marty Baron said: “I don’t comment on editorials. As you know, that department is entirely separate from the newsroom. You should contact Bart Gellman.”

Gellman, of course, is the reporter who wrote those stories for the Post and who has said he "profoundly" disagrees with the Post's editorial.

As he should, because the editorial is not just tone deaf and ridiculous, it's cowardly bullshit that massively harms the reputation of the Post itself, and certainly undermines its credibility with sources.

Filed Under: 702, barton gellman, ed snowden, editorial board, journalism, mass surveillance, pardon snowden, sources
Companies: washington post