Sen. Wyden Introduces Bill Aimed At Limiting FBI, US Marshals' Flying Spy Planes

from the hacking-away-at-the-surveillance-overgrowth dept

It's safe to say no domestic surveillance program will be escaping legislators' attention in the post-Snowden era -- at least not for the forseeable future. It's only been a couple of weeks since news of the FBI's secret spy plane fleet made national headlines and there's already legislation in the works aimed at setting some… um… ground rules.

In a bill announced Wednesday, Wyden joins Nevada Republican Sen. Dean Heller on the Protecting Individuals From Mass Aerial Surveillance Act, which if passed would require warrants for the government to analyze and collect data gathered en masse via domestic airplane or surveillance drone.

“Technology has made it possible to conduct round-the-clock aerial surveillance. The law needs to keep up,” Wyden said in a statement. “Clear rules for when and how the federal government can watch Americans from the sky will provide critical certainty for the government, and help the unmanned aircraft industry reach its potential as an economic powerhouse in Oregon and the United States.”

It's not just the FBI's flying spies being targeted by this bill. It's also looking to dial back the US Marshals Service's use of airborne IMSI catchers, a.k.a. "dirtboxes," as well as targeting surveillance drones, picking up where 2013's stalled Drone Privacy Act left off.

Hopefully, the bill will force a bit more transparency about use of these surveillance techniques. A warrant requirement is a nice thought, although it's hard to imagine what sort of warrant would cover a "search" that involves flying a plane in continuous circles over a small area of a city.

Considering the lowered expectation of privacy in public areas, the warrant requirement is going to be a tough sell. If it does stick, it will at least ensure deployments are targeted, rather than just exploratory. There's an opportunity here to force better and more detailed reporting of deployments, as well as significantly limiting the use of flying surveillance vehicles by eliminating exploitable loopholes.

The bill also would prevent government agencies from running footage obtained by drones or planes through facial/pattern recognition software in hopes of stumbling across untargeted suspects. It also would forbid law enforcement agencies from bypassing restrictions and reporting requirements by hiring private contractors to perform their illegal surveillance for them.

Five years ago, this sort of legislation would be dead on arrival, with deferential nods to terrorism and the War on Drugs replacing any serious consideration of the public's privacy. Thanks to the Snowden's leaks, any bill seeking to limit domestic surveillance now has a fighting chance, with even the reluctant administration forced to make more concessions to privacy than it would under other circumstances.

Filed Under: fbi, planes, ron wyden, surveillance, us marshals

The Cardinal Way: FBI Investigating STL Cardinals For Hacking Into Astros Database

from the running-redbirds dept

If you're a baseball fan, as all good Americans are, and you have never lived in St. Louis, you probably hate the Cardinals. Don't feel bad if you do, they're quite easy to hate. No other fanbase has managed to coax platitudes out of the team and local media like the common refrain that Cards fans are "the best fans in baseball." Groan. Few other teams outside of college football programs tend to go on and on about "the Cardinal way" and how they "do things the right way" like the redbirds do. The problem is that the Cardinals have been an excellent baseball team for pretty much ever, always managing success with a minimal number of lean years.

Perhaps it's partly because they're cheaters on the level of committing federal crimes in order to gain an advantage -- at least according to reports coming out today. The news broke today that the FBI has become involved in investigating whether members of the Cardinals front office illegally gained entry to a proprietary database on player files, projections, statistics and trade maps owned by the Houston Astros.

Investigators have uncovered evidence that Cardinals officials broke into a network of the Houston Astros that housed special databases the team had built, according to law enforcement officials. Internal discussions about trades, proprietary statistics and scouting reports were compromised, the officials said.

The officials did not say which employees were the focus of the investigation or whether the team’s highest-ranking officials were aware of the hacking or authorized it. The investigation is being led by the F.B.I.’s Houston field office and has progressed to the point that subpoenas have been served on the Cardinals and Major League Baseball for electronic correspondence.

Even those of you not prone to caring about professional sports will likely recognize that this is a full-on shit-hitting-fan moment for a professional organization. The "hack", as it's being called, is the kind of low-tech stuff that most of these stories involve, but that doesn't change the fact that this situation seems to be the exact kind of thing the CFAA was designed around. The background on this is that Astros General Manager used to work for the Cardinals, where he developed this database of statistics and scouting methods. When the Astros hired him away, he ported his work over to be used with his new franchise. Somehow he was allowed to use the exact same passwords from his Cardinals days, which allowed somebody from the rival team to log in and begin pulling data. Ten months ago, that data was, for some reason, released into the wild, embarrassing the Astros and yanking away any advantage the proprietary system might have yielded them. The Astros reported the hack to the league office, which involved the FBI.

Word from early on in the FBI's investigation seems to leave little doubt that someone at the Cardinals, if not many someones, is involved. Oh, and very, very stupidly involved, too.

The Cardinals front-office executives who hacked into the Astros’ database are extremely dumb. You can’t even give them credit for being l337 H4x0rs because all these dummies did was use one of the old passwords Astros GM Jeff Luhnow used when he worked for the Cardinals, and they did it from their own goddamn home, which made it very easy for FBI to track them down. Here is a tip: If you’re going to commit corporate espionage, don’t do it from your home computer. Go find, like, an internet cafe or something.

But the thing about the CFAA is that its punishment doesn't correct for technical proficiency, so a "low-level hack," as this is being called, is still a hack and still falls under the law's purview. Dumb sports team or not, this is a federal crime, and the fact that people are going to lose their jobs may be the least of those peoples' concerns. We could be talking about real jail time here.

Regardless, the Cardinals way is dead, unable to pull itself from a muck of its own making.

Filed Under: baseball, cfaa, fbi, hacking
Companies: houston astros, major league baseball, st. louis cardinals

FBI, While Hating On Encryption, Starts Encrypting All Visits To Its Website

from the funny-how-that-works dept

Last week, the Wikimedia Foundation announced that it was moving to encrypting access to all Wikipedia sites via HTTPS. This was really big news, and a long time coming. Wikipedia had been trying to move in this direction for years with fairly slow progress -- in part because some in the Wikimedia community had an irrational dislike of HTTPS. Thankfully, the Wikimedia Foundation pushed forward anyway, recognizing that the privacy of what you're browsing can be quite important.

And yet, I don't think that was the most significant website shift to HTTPS-by-default in the last week. Instead, that honor has to go to... [drumroll please]... FBI.gov. No, seriously. This may surprise you. After all, this is the very same FBI that just a couple of weeks ago had its assistant director Michael Steinbach tell Congress that companies needed to "prevent encryption above all else." Really. And it's the same FBI whose director has been deliberately scaremongering about the evils of encryption. The same director who insisted the world's foremost cybersecurity experts didn't understand when they told him that his plan to backdoor encryption was bonkers. The very same FBI who used to recommend mobile encryption to keep your data safe, but quietly deleted that page (the FBI claims it was moved to another site, but...).

But that very same FBI that has spent the past few months disparaging encryption at every opportunity apparently went over to Cloudflare and had the company help it get HTTPS set up. No joke. The FBI.gov site now automatically pushes you to an encrypted connection. Because, no matter what the FBI says, encryption is good. And the FBI's techies know that.

Remember how, just last week, the US CIO announced that all federal governments would be moving to HTTPS. Well, thankfully, the CIO's office is also tracking how well it's doing. Just yesterday, here's what it said about FBI.gov: And, here's what it says now: (If you're interested, you can see the pull request at Github that has the change as well).

Either way, kudos to the FBI for letting us encrypt our connections. Now, please don't get in the way of us encrypting our data as well.

Filed Under: encryption, fbi, fbi.gov, https

Encrypted Messaging Service Stops Answering 'Warrant Canary' Questions, Suggesting FBI, Others Are Seeking User Info

from the Golden-Key-Insertion-Team-now-onsite dept

It's beginning to look like a US-based encrypted communications platform may be headed for a Lavabit-esque future. As we're well aware, agencies like the FBI and NSA are firmly opposed to encrypted communications, which is something Surespot -- a text-messaging service -- offers.

Surespot has been in the news lately, thanks to terrorist groups utilizing encrypted services to keep their communications secret. UK's Channel Four looked into Surespot and found that 115 "ISIS-linked" people "appear" to have used the service in the "past six months." Because UK 4 wasn't able to get this information from Surespot directly (because Surespot doesn't store personally identifiable information or users' communications), it has only been able to infer this from messages on social media services that refer to Surespot.

What this means in terms of terrorists "flocking" to encrypted apps is still very vague, but there's no doubt any additional layers of secrecy are welcomed by those wishing to hide their communications. What 115 ISIS-linked users means in terms of an installed user base of at least 100,000 is also open for discussion, but it's quite obvious there are plenty of non-terrorists using the service as well.

But how long will the service stay afloat and uncompromised by national security agencies? The outlook isn't promising. George Maschke of Antipolygraph.org has been periodically sending emails to Surespot, unofficially acting as the service's warrant canary. For several months, his questions have been answered. But as of May 25th, he has still received no response to his canned questions.

In April 2015, I sent [service creator Adam] Patacchiola a similar set of questions but received no reply. I wrote again on 25 May 2015, asking:

1. Has 2fours received any governmental demand for information about any of its users?
2. Has 2fours received any governmental demand to modify the surespot client software?
3. Has 2fours received any governmental demand to modify the surespot server software?
4. Has 2fours received any other governmental demand to facilitate electronic eavesdropping of any kind?

If the answer to any of the above questions is yes, can you elaborate?

I have also attempted to contact [former co-owner Cherie] Berdovich and Patacchiola via the Surespot app itself but have received no reply. While its possible that they’ve simply tired of being pestered by me about government demands for information, I don’t think that’s the case and suspect they are under a gag order.

There's good reason to believe this is true. A recent plea agreement by a 17-year-old Virginia native charged with providing material support to ISIS (via instructions on how to use Bitcoin to provide anonymous donations) specifically mentions Surespot.

In or about late November or early December 2014, the defendant put RN [co-conspirator] in touch with an ISIL supporter located outside of the United States via Surespot in order to facilitate RN's travel to Syria to join and fight with ISIL.

I have sent the same questions to Surespot but am not expecting to receive any answers. It seems pretty clear that the government is seeking information about Surespot's users. Whether or not it will make an attempt to obtain this information en masse, as it did with Lavabit (by demanding the site's SSL key), remains to be seen. Surespot only retains usernames. [As pointed out by Antipolygraph.org's George Maschke, Surespot DOES store more than just usernames.] Surespot doesn't store much in terms of personal info, but does retain enough that frequent contacts could be outed and account holders could be identified through registration methods (email addresses, etc.) Everything else -- including encryption keys -- is stored by the users, either locally or at their chosen cloud service. Messages are end-to-end encrypted, meaning Surespot itself cannot see the contents.

What the government could do is try to force the company into creating a shared master key, which would allow agencies to decrypt messages. The FBI -- which has been most vocal about "going dark" -- may not be able to do this at present, but it is working towards being granted the legal power to do so.

FBI officials now want Congress to expand their authority to tap into messaging apps such as WhatsApp and Kik, as well as data-destroying apps such as Wickr and Surespot, that hundreds of millions of people — and apparently some militants — have embraced precisely because they guarantee security and anonymity.

At this point, Surespot has nothing to hand over to government agencies. But its silence suggests these agencies are asking all the same.

Filed Under: encrypted messages, fbi, isis, warrant canary
Companies: lavabit, surespot

FBI Successfully Stonewalls Inspector General Into Irrelevance By Withholding Timely Section 215 Documents

from the you-can't-oversee-what-you-can't-actually-see dept

The FBI doesn't just stonewall FOIA requesters. It also stonewalls its in-house investigator. Remember all those deferrals to "lawful authority" and "rigorous oversight" the agency makes when not commenting on controversial surveillance programs? Those really don't mean anything if you lock out the oversight and prevent his office from verifying whether surveillance is being carried out in accordance to laws and FBI policies.

Inspector General Michael Horowitz has been fighting a courageous, but losing, battle against FBI secrecy. As the head of the DOJ's OIG office, you'd think FBI officials would throw a small amount of deference his way. But no. They don't. It has obstructed his investigative work "for years," leading to this sort of thing:

[Horowitz] said the refusal to grant routine requests stalls investigations, including a recent one on FBI material witnesses, such that officials who are under review have sometimes retired or left the agencies before the report is complete.

The FBI won't even release an organizational chart to him. Horowitz took these complaints to Congress earlier this year in hopes of prompting FBI document production by threatening its annual budget.

Section 218 of the Appropriations Act does not permit the use of funds appropriated to the Department of Justice to deny the OIG access to records in the custody of the Department unless in accordance with an express limitation of Section 6(a) of the IG Act. The IG Act, Section 6(a), does not expressly or otherwise limit the OIG's access to the categories of information the FBI maintains it must review before providing records to the OIG. For this reason, we are reporting this matter to the Appropriations Committees in conformity with Section 218.

This, surprisingly, failed to have any effect -- not because the FBI might have deduced Horowitz was actually serious about obtaining the long-delayed documents, but because if there's anything government agencies fear more than a loss of power, it's a loss of funding.

Marcy Wheeler points out that -- during the ruckus surrounding the expiration of Section 215 -- the FBI again passed several of its self-imposed deadlines for document delivery.

The OIG has sent four letters to Congress to report that the FBI has failed to comply with Section 218 by refusing to provide the OIG, for reasons unrelated to any express limitation in Section 6(a) of the IG Act, with timely access to certain records in ongoing OIG reviews. Those reviews are:

• Two FBI whistleblower retaliation investigations, letter dated February 3, 2015, which is available here;
• The FBI documents related to review of the DEA’s use of administrative subpoenas, letter dated February 19, 2015, which is available here;
• The FBI’s use of information derived from collection of telephony metadata under Section 215 of the Patriot Act, letter dated February 25, 2015, which is available here; and
• The FBI’s security clearance adjudication process, letter dated March 4, 2015, which is available here.

As of March 31, 2015, the OIG document requests were outstanding in every one of the reviews and investigations that were the subject of the letters above.

Of particular importance is the delay of documents related to the FBI's use of Section 215 collections. Obviously, having the chance to review this before the vote on reauthorization would have been preferable. If there were any questions about the FBI's involvement, or its use of the collected data, these observations could have potentially played a key role in the provision's renewal, not to mention contributed to the debate surrounding the USA Freedom Act.

Obviously, the FBI preferred to keep legislators in the dark about its participation in Section 215. An ill-informed legislature is more prone to rely on fear-mongering and other baseless assertions. With nothing stating otherwise, the FBI is free to operate under the illusion that its use of the program is by-the-book and that the program itself is effective and useful.

Horowitz is one of the few government officials willing to stand up to the FBI. Unfortunately, it hasn't resulted in better behavior by the agency. Apparently, the FBI feels it does best with minimal oversight and isn't inclined to let anyone -- not even its in-house inspector -- in on its domestic surveillance tactics.

Filed Under: doj, fbi, inspector general, michael horowitz, patriot act, public debate, section 215

Legislators Strip Funding For Warrantless Use Of Stingrays By FBI, Take Money From The DEA To Buy Bodycams

from the CATCH-AN-IMSI-FUNDRAISER!-TIX-3/$5!! dept

The passage of appropriations bills is a seemingly casual process in which any legislator can attempt to hitch his or her hobbyhorse to it as it makes its way slowly to a vote. (And then to a government shutdown.) "Rob Peter/Pay Paul" amendments are offered for quick floor votes, adding millions to one program while siphoning the equivalent amount from another. Other amendments are simply of the "Rob Peter" variety, in which funding is stripped from programs or activities a legislator doesn't agree with.

Given the recent legislative activity surrounding US surveillance programs and the ongoing exposure of the FBI's tactics and technology, it's somewhat unsurprising that lawmakers are taking a shot at defunding some of the more questionable efforts. Darrell Issa, for example, offered an amendment stating that if the FBI wants to deploy its Stingray devices without a warrant, it will need to hold a bake sale to pay for it.

The amendment prohibits funding for federal law enforcement to conduct non-court-ordered “stingray” operations that collect bulk electronic data from individuals. The amendment was adopted on a voice vote.

This is of some import, although the FBI now claims it gets a warrant before deploying Stingrays. It will probably edge around this defunding by claiming it doesn't use Stingrays to collect data in bulk (sort of true, if used for their intended purpose and with proper minimization) or by pointing at its exemptions to its self-imposed warrant requirements, which are big enough you could fly a single-engine plane bristling with antennas and cameras through them.

In addition to other surveillance-targeting amendments, like defunding of any future NIST/NSA partnerships to backdoor encryption and the FBI/DOJ's use of backdoor surveillance via wiretapping laws, other interesting amendments were proposed and passed.

Rep. Gosar (R-AZ) – The amendment increases funding for the DOJ Office of the Inspector General by $1.7 million, offset by a reduction to the DOJ General Administration – Salaries and Expenses account.

Michael Horowitz -- the Inspector General for the DOJ -- has been battling the FBI and DEA for months now over the release of documents his office has requested. So far, the battle has been futile, but some additional funding will help ensure his office will continue to try to hold the DOJ's agencies accountable for their misconduct and failures. If nothing else, Horowitz has been both dogged and vocal while performing his oversight duties -- something that very obviously hasn't endeared him to the agencies he polices. I see no reason not to give this man, and his office, more funding.

Rep. Castro (D-TX) – The amendment increases the Community Trust Initiative, which provides grants for police body cameras, by $10 million, offset by a reduction to the DEA Salaries and Expenses account.

Body cameras are no panacea, but they're definitely better than taking no action at all. The best part about this is that it forces the DEA to fund a program many law enforcement agencies are hesitant to adopt. The ironic part is that the worst behavior in law enforcement (i.e., abuse of no-knock warrants, asset forfeiture) is tied to the Drug War. True accountability is still little more than a starry-eyed ideal, but taking $10 million from the DEA for this program is definitely a better use of that money.

Rep. Grayson (D-FL) – The amendment prohibits funding to compel a journalist or reporter to testify about information or sources that they regard to be confidential.

This is interesting, especially in light of the DOJ's efforts to compel New York Times journalist James Risen to reveal his sources. There's more to it than just the summation of this amendment, but it's far too much to cover here. (Hint: define "journalist." Once again, the government wants to be able to make that determination, probably on a case-by-case basis.)

Rep. Luetkemeyer (R-MO) – The amendment prohibits funding for DOJ’s “Operation Chokepoint.”

If this sticks, Team America: Morality Police™ will have to hold Bitcoin auctions or whatever if it wishes to keep porn performers and other blacklisted undesirables from availing themselves of bank services.

The attendant downside to these easily-passed amendments is that they can just as easily be deleted before the appropriation bill's final passage, especially if those targeted are able to apply enough pressure to block the bill's package with these intact.

Filed Under: appropriations, bodycams, congress, darrell issa, dea, fbi, stingrays

Senators Introduce Legislation Calling For Mandatory Data Collection On Police-Involved Shootings

from the because-'if-you-feel-like-it'-just-isn't-working dept

If you're looking for the number of citizens killed by police officers, don't ask the government. It just doesn't know. The DOJ is nominally in charge of compiling this information, but it has not made anything resembling an honest effort to do so.

To begin with, it has mostly ignored the federal law ordering the compilation of stats on excessive force by law enforcement officers. And it has ignored this for the last 20 years. To make things worse, it has turned over the duty of collecting data on police-involved shootings to the FBI, which has even less interest in ensuring the comprehensiveness of its "collection."

"Collection" has smart quotes nailed to it because the FBI made this a purely voluntary collection. Law enforcement agencies are invited to send in in-custody death data -- which is then verified by no one. The only thing agencies have to gain from self-reporting deaths at the hands of its officers are transparency, accountability and potentially better relationships with the people they serve. Those "gains" rarely align with law enforcement interests.

Available data is limited even further by only including citizens who were shot during the commission of a felony. Slimming it down even more is its limitation to "justifiable homicides." Everything else is simply ignored.

So, it's left to the public sector to compile this data. One of the most comprehensive databases of police-involved killings is being compiled by The Guardian with the assistance of forerunners in the (unofficial) field like Fatal Encounters and Killed By Police. Other databases are being crowd-sourced or compiled by hand by truly devoted individuals. But the government has shown no interest in compiling this information as a public service.

To that end, two senators (Cory Booker and Barbara Boxer) have introduced legislation calling for the creation and maintenance of a mandatory police-related killings database.

Senators Barbara Boxer of California and Cory Booker of New Jersey proposed legislation that would demand all states submit reports to the US Department of Justice that they said would bring “transparency and accountability to law enforcement agencies nationwide”.

“Too many members of the public and police officers are being killed, and we don’t have reliable statistics to track these tragic incidents,” Boxer said in a statement. “This bill will ensure that we know the full extent of the problem so we can save lives on all sides.”

Note the bone being thrown to law enforcement agencies, who are only too happy to compile statistics that show how "dangerous" their work is. Yes, a bill prompted by a Washington Post article on police-involved killings is preemptively calming the nerves of those who may potentially be forced to hand over information on deaths at the hands of their officers.

All well and good, but we've already put two agencies in charge of collecting this data and neither have made more than a minimal effort to do so. Making it mandatory is a huge leap forward, but pushing resistant agencies into coughing up unflattering data will take more than a well-intentioned piece of legislation. It needs to stop obliging those who have withheld this data over the years and instead provide for serious consequences if law enforcement agencies fail to meet the requirements of the law.

If previous efforts along these same lines are any indication, simply demanding agencies comply doesn't seem to have resulted in increased compliance.

In December, Congress reauthorized an act requiring that states report to the Justice Department instances where civilians are killed by police.

“Non-fatal shooting or use of force data is not captured” under the existing legislation, the release said.

So, six months after that "reauthorization" and there's been no appreciable change in reporting. At this point, anyone but the government is doing a better job capturing this data. Leading the charge from within may eventually force needed change, but a couple of decades of minimal reporting says otherwise.

Filed Under: barbara boxer, cory booker, data, doj, fbi, police shootings

Top FBI Official Says Tech Companies Need To 'Prevent Encryption Above All Else'

from the where-do-they-find-these-people? dept

Usually, when we see clueless government lackeys discussing the need to backdoor encryption, they at least admit upfront that they think encryption is important in protecting private information. Even that nutty rambling speech by Homeland Security Appropriations chair Rep. John Carter recognized that there were important reasons to use encryption to protect privacy. And FBI boss James Comey usually does some hand waving to that effect as well. But apparently he forgot to tell one of his deputies.

While testifying before Congress, Michael Steinbach, assistant director in the FBI's Counterterrorism Division, just went to the levels of pure insanity, in arguing that above all else companies should work to prevent encryption. This was during a ridiculous grandstanding hearing held by the House Homeland Security Committee entitled "Terrorism Gone Viral", and Steinbach didn't waste the opportunity to make a ridiculously viral comment of his own:

So that’s the challenge: working with those companies to build technological solutions to prevent encryption above all else.

Above all else? Is he crazy? At least his written testimony isn't quite as crazy, but still has a bunch of fear-mongering about "going dark."

Unfortunately, changing forms of internet communication are quickly outpacing laws and technology designed to allow for the lawful intercept of communication content. This real and growing gap the FBI refers to as “Going Dark” is the source of continuing focus for the FBI, it must be urgently addressed as the risks associated with “Going Dark” are grave both in traditional criminal matters as well as in national security matters.

He also seemed positively freaked out that some social networks actually recognize that protecting their users privacy is a good thing:

"There are 200-plus social media companies. Some of these companies build their business model around end-to-end encryption," said Michael Steinbach, head of the FBI's counterterrorism division. "There is no ability currently for us to see that" communication, he said.

"We're past going dark in certain instances. We are dark," he added.

While the head of the committee, Rep. Michael McCaul played along with this insanity, arguing about how these so called "dark spaces" are a "tremendous threat to the homeland" at least Rep. Ted Lieu -- the same Rep. who recently called out the push to backdoor encryption as "technologically stupid" -- has some more thoughts on the FUD and grandstanding by McCaul and Steinbach. As he told the Intercept:

“When they talk about dark places, ooooh it sounds really scary,” Lieu said. “But you have a dark place in your home you can talk, you can meet in a park –- there are a zillion dark places the FBI will never get to and they shouldn’t because we don’t want to be monitored in our home.” .....

“The notion that encryption is somehow different than other forms of destroying and hiding things is simply not true,” Lieu told The Intercept. “Forty years ago, you could make the statement that paper shredders are one of the most damaging things to national security because they destroy documents that law enforcement might want to see.”

More Lieu, less McCaul and Steinbach, please.

The thing is, as we've noted before, what's equally as disturbing as the ignorant statements from folks like Steinbach is that now, security researchers and tech companies are going to have to waste tons of time and resources explaining why all of this is not just "technically stupid" but actively makes all of us less safe. And they need to do that, rather than building stronger encryption, which is what we really need.

Filed Under: encryption, fbi, james comey, michael mccaul, michael steinbach, privacy, security, ted lieu

DOJ Blurred Lines Between Terrorism & Crime To Expand NSA & FBI Warrantless Wiretapping Of 'Hackers'

from the whatever,-it's-all-the-same dept

This week, of course, the US government passed the USA Freedom Act, a modest step towards reform. As we've noted, it doesn't even touch on two of the more concerning surveillance authorities: Executive Order 12333 and Section 702 of the FISA Amendments Act, which includes the infamous "warrantless wiretapping" programs that allow the NSA to tap "upstream" fiber optic cables from AT&T and others to sniff all data traveling across those cables.

Pro Publica and the NY Times have teamed up to report on how the DOJ expanded the warrantless wiretapping regime to go after hackers. There's a lot to unpack in the story (which is well worth reading), but the short version is that, under pressure from the White House, NSA and others, officials appear to have deliberately blurred the lines between "crime" and "international terrorism" in order to get the DOJ to sign off on secret legal orders allowing the NSA and the FBI to use its "upstream" snooping capabilities to monitor certain "cybersecurity signatures" which include basically anything the feds want, to sniff out a hacker. From the revealed documents (which, yes, come from Ed Snowden's cache): If you can't see that, the key line is:

The Certification will also for the first time spell out the authorization for targeting cyber signatures such as IP addresses, strings of computer code, and similar non-email or phone number-based selectors.

In short: the government said, "okay, you can now sniff that upstream firehose for hackers based on whatever "code snippets" or "IP addresses" we give you."

Of course, this raises some questions about the split between domestic law enforcement and international anti-terrorism/foreign intelligence work. Remember, the 702 upstream program is pretty specific in that it's only to be used for non-domestic, non-criminal work. But, according to the White House, those distinctions no longer matter:

“Reliance on legal authorities that make theoretical distinctions between armed attacks, terrorism and criminal activity may prove impractical,” the White House National Security Council wrote in a classified annex to a policy report in May 2009, which was included in the NSA’s internal files.

Yes, apparently, it's "impractical" for the surveillance state to actually follow the law.

The documents also reveal that they really wanted access to that sweet, sweet upstream firehose, because much more limited programs like PRISM (which involve court orders to certain internet companies) didn't provide enough coverage: Then, to take things a step further, the government allowed the FBI direct access to the NSA's upstream collection, even though the FBI doesn't have the same limits against surveillance on Americans that the NSA has. Why? Basically, the argument appears to be "well, the NSA already has that data... so... let's give it to the FBI as well": The documents do contain and interesting slide presentation about how and when certain capabilities can be used, including a slide dedicated to repeating the 4th Amendment, and another with a note saying that the "worst thing" the NSA can do is to use its signals intelligence capabilities "to collect against a [US Person] hacker" because doing so is "basically doing surveillance for [law enforcement] purpose without a warrant." So, at the very least, they understand the law, but it's not at all clear that they follow it: And, in fact, later in that same presentation, it notes that the NSA's Threat Operations Center (NTOC) wants more power to target "foreign hackers outside the US" without having to prove as much: "Because attribution is hard, just having to prove foreigness and an FI purpose is especially useful to NTOC."

According to the Pro Publica / NY Times report, the NSA sought more and more permission here, though it's not clear what has actually been granted:

In May and July 2012, according to an internal timeline, the Justice Department granted its secret approval for the searches of cybersignatures and Internet addresses. The Justice Department tied that authority to a pre-existing approval by the secret surveillance court permitting the government to use the program to monitor foreign governments.

That limit meant the NSA had to have some evidence for believing that the hackers were working for a specific foreign power. That rule, the NSA soon complained, left a “huge collection gap against cyberthreats to the nation” because it is often hard to know exactly who is behind an intrusion, according to an agency newsletter. Different computer intruders can use the same piece of malware, take steps to hide their location or pretend to be someone else.

So the NSA, in 2012, began pressing to go back to the surveillance court and seek permission to use the program explicitly for cybersecurity purposes. That way, it could monitor international communications for any “malicious cyberactivity,” even if it did not yet know who was behind the attack.

The newsletter described the further expansion as one of “highest priorities” of the NSA director, Gen. Keith B. Alexander.

Remember all of this when you see the government asking for new "cybersecurity" laws -- which all too frequently are ways of granting the NSA and/or FBI greater powers to do surveillance via these upstream collections. As The Intercept points out, during the big debates on cybersecurity over the last few years, the NSA has insisted that it doesn't have access to this kind of information, and almost every debate on the power of upstream collection by the NSA and others has been based on claims by the intelligence community that they only use unique identifiers like email addresses -- and not very, very broad identifiers like an IP address or "computer code."

There's a lot more in the full article and in the released documents which you can see below.

Filed Under: 702, cybersecurity, fbi, fisa, hacking, nsa, surveillance, upstream, upstream collection, warrantless wiretapping

House Overwehelmingly Passes Amendments Blocking Funding For Undermining Encryption

from the closing-the-backdoor dept

As we've been saying, the passage of the USA Freedom Act is just a small first step in the long road to real surveillance reform. On Wednesday, the House took another small step, voting overwhelmingly in favor of an amendment to an appropriations bill put forth by Rep. Thomas Massie that blocks funding to the National Institute of Science and Technology (NIST) for working with the NSA or CIA to undermine or backdoor encryption. This appears to be quite similar to part of the similar amendment last year that banned both this kind of NIST coordination, but also the NSA's use of backdoor searches under Section 702. As far as I can tell, this new amendment does not include that latter bit. Either way, this amendment passed 383 to 43.

It appears that another amendment, put forth by Rep. Ted Poe also passed by voice vote and it would block the use of funds from the DOJ/FBI from being used "to mandate or request that a person alter the product or service of the person to permit electronic surveillance of any user or service" except in cases required under existing wiretapping law.

Both of these are very big deals, and the fact that they passed so easily suggests that the House is nowhere near done on pushing for real surveillance reform. Of course, whether or not these actually go anywhere is another story. As you may recall, after passing overwhelmingly last year, under pressure to get a big omnibus bill done at the end of the year, the House leadership agreed to drop those provisions under pressure from the intelligence community.

Also, one other interesting amendment also appears to have passed easily by voice vote, which is an amendment put forth by Jared Polis, and would make it clear that the DEA cannot do bulk collection under its subpoena authority. As was detailed a few weeks ago, for many years, the DEA had been using this authority to collect tons of phone records, and the program only ended once the administration realized that the claims it was using in support of the NSA's bulk collection didn't apply to the DEA's collection, and thus they couldn't really continue it. Polis's amendment means that this particular loophole is closed for good (not that others might still be open...).

Again, all three of these may not survive all the way into law, but it does show that there's still a very strong interest in the House to continue pushing back against surveillance abuse.

Filed Under: backdooring encryption, bulk collection, cia, dea, doj, encryption, fbi, jared polis, nist, nsa, subpoenas, ted poe, thomas massie