After CIA Angrily Denied Spying On Senate, CIA Admits It Did And Apologizes

from the incredible dept

Here's a surprise. An internal investigation by the CIA has determined -- just as Senator Dianne Feinstein charged -- that the CIA illegally hacked into the network of Senate Intelligence Committee staffers in order to spy on what they were doing with regards to a report on the CIA's torture program. They did this despite an earlier instance of a similar problem after which the CIA promised it would not touch the Senate Intelligence Committee network any more.

Of course, as you may recall after Feinstein angrily denounced the CIA's actions, and explained them in detail, CIA director John Brennan angrily denied it -- though as we noted, his angry denial really confirmed nearly all of the pertinent details. Still, he specifically stated:

"When the facts come out on this, I think a lot of people who are claiming that there has been this tremendous sort of spying and monitoring and hacking will be proved wrong."

He also told reporters:

"Let me assure you the CIA was in no way spying on [the Senate Intelligence Committee] or the Senate."

Things got even more acrimonious when both sides reported each other to the Justice Department for possible criminal investigation. The CIA insisted that the Senate staffers mishandled classified information, while the Senate claimed that the CIA illegally hacked into their network. Once again, the Senate side of the story made the most sense -- because it had happened before. As you may recall from Feinstein's original explanation:

After a series of meetings, I learned that on two occasions, CIA personnel electronically removed committee access to CIA documents after providing them to the committee. This included roughly 870 documents or pages of documents that were removed in February 2010, and secondly roughly another 50 were removed in mid-May 2010.

This was done without the knowledge or approval of committee members or staff, and in violation of our written agreements. Further, this type of behavior would not have been possible had the CIA allowed the committee to conduct the review of documents here in the Senate. In short, this was the exact sort of CIA interference in our investigation that we sought to avoid at the outset.

After that, the CIA agreed that it would not touch the network in any way. But it did. As Brennan himself explained:

CIA maintains a log of all materials provided to the Committee through established protocols, and these documents do not appear in that log, nor were they found in an audit of CIA's side of the system for all materials provided to SSCI through established protocols. Because we were concerned that there may be a breach or vulnerability in the system for housing highly classified documents, CIA conducted a limited review to determine whether these files were located on the SSCI side of the CIA network and reviewed audit data to determine whether anyone had accessed the files, which would have been unauthorized.

Either way, the DOJ just recently decided to pursue neither claim, but the CIA's moves today more or less admit guilt:

Findings of the investigation by the CIA Inspector General’s Office “include a judgment that some CIA employees acted in a manner inconsistent with the common understanding reached between SSCI (Senate Select Committee on Intelligence) and the CIA in 2009,” CIA spokesman Dean Boyd said in a statement.

The statement represented an admission to charges by the panel’s chairwoman, Dianne Feinstein, D-Calif., that the CIA intruded into the computers her staff used to compile the soon-to-be released report on the agency’s use of harsh interrogation methods on suspected terrorists in secret overseas prisons during the Bush administration.

CIA Director John Brennan briefed Feinstein and the committee’s vice chairman, Saxby Chambliss, R-GA, on the CIA inspector general’s findings and apologized to them during a meeting on Capitol Hill on Tuesday, Boyd said.

“The director . . . apologized to them for such actions by CIA officers as described in the OIG (Office of Inspector General Report),” he said.

That's a pretty different tune than "When the facts come out" all those people "will be proved wrong," huh?

What's incredible about this is that it comes very soon before the redacted version of the CIA torture report that the staffers were working on is expected to be released. Brennan has been the leading voice criticizing the report, but his credibility is sliding increasingly downhill. The news today shows that he appears to have directly lied to the press and the Senate concerning this situation. The more cynical among you will claim that you just assume he's always lying, but that's unfair. For whatever it's worth, the intelligence community is very good about not technically lying, but just misleading people. Here, he was strongly making claims that were clearly just flat out not true.

Others in the Senate are calling for a thorough investigation of Brennan, and it's entirely possible this could result in Brennan being forced to resign. At this point, especially with the report coming out, it seems like the CIA could use a fresh start.

Either way, given that the CIA is now effectively admitting to the charges, it does seem noteworthy to highlight the DOJ's decision not to do anything. After all, as Chris Soghoian points out, if this same bit of hacking were done by a 19 year old hactivist, he'd be rotting in jail, and there would be all sorts of condemnations about what a horrible person he was.

Filed Under: cia, dianne feinstein, john brennan, senate, senate intelligence committee, spying, torture report

Former CIA Boss George Tenet Leading Plans To Attack Upcoming Senate Report On CIA's Torture Program

from the it-will-impact-his-legacy dept

As we continue to wait for the White House to finally release the heavily redacted version of the executive summary of the Senate Intelligence Committee's CIA torture report (the full report is over 6,300 pages and cost $40 million to produce), it appears that those who are likely to take the blame are already preparing their response. As has already leaked out over the past few months, the report will show how the program went further than people expected, that it basically uncovered no terrorist plots and that the CIA regularly lied to Congress about the nature of the program and its impact. The CIA, led by current boss John Brennan, has hit back against these conclusions, but it appears that those who were actually in power during the torture program are even more worried. Former CIA boss George Tenet, who was already considered something of a disgrace for the CIA's intelligence failures prior to invading Iraq, is apparently working hard behind the scenes to coordinate an attack on the credibility of the report -- because it pretty clearly is going to attack his credibility.

Just after the Senate Intelligence Committee voted in April to declassify hundreds of pages of a withering report on the Central Intelligence Agency’s detention and interrogation program, C.I.A. Director John O. Brennan convened a meeting of the men who had played a role overseeing the program in its seven-year history.

The spies, past and present, faced each other around the long wooden conference table on the seventh floor of the C.I.A.’s headquarters in Northern Virginia: J. Cofer Black, head of the agency’s counterterrorism center at the time of the Sept. 11 attacks; the undercover officer who now holds that job; and a number of other former officials from the C.I.A.’s clandestine service. Over the speakerphone came the distinctive, Queens-accented voice of George J. Tenet.

Over the past several months, Mr. Tenet has quietly engineered a counterattack against the Senate committee’s voluminous report, which could become public next month.

Apparently Tenet and others demanded early access to the report, and eventually Dianne Feinstein, the White House and those former CIA officials negotiated a deal letting them read the report over in James Clapper's offices. The NY Times report also details how Brennan is basically a Tenet lackey whose rise through the ranks occurred under Tenet -- making it more likely that Brennan wants to protect the reputation of his former boss.

We'll see how this eventual "response" comes out, but given the initial leaks from the report, it sounds like it's going to be fairly devastating, and make a further mockery of Tenet. As the report linked above also notes, back in 2007 Tenet got angry at a 60 Minutes interviewer and started wagging his finger at the correspondent, while insisting "We don't torture people!"

Wagging a finger at the correspondent, Scott Pelley, Mr. Tenet said over and over, “We don’t torture people.”

“No, listen to me. No, listen to me. I want you to listen to me,” he went on. “Everybody forgets one central context of what we lived through: The palpable fear that we felt on the basis of that fact that there was so much we did not know. I know that this program has saved lives. I know we’ve disrupted plots.”

It's pretty easy to say that when no one can fact-check you. But it appears that the report is going to point out that almost none of what Tenet said was true. No wonder he's so concerned about leading the attack on the report.

Filed Under: cia, dianne feinstein, george tenet, john brennan, senate intelligence committee, torture report, white house

DOJ Won't Pursue Case Against CIA For Spying On Senate Staffers Or Against Senate Staffers For Handling CIA Documents

from the because-that-would-involve-work dept

As you may recall, a few months back, a big story broke involving the CIA spying on Senate Intelligence Committee staffers who were investigating the CIA's torture program. The details revealed that in the course of their investigation, the CIA had given the staffers an internal document they didn't think they'd given them, which revealed that an internal CIA analysis more or less agreed with the Senate analysis (which has been described as "scathing"). This was a very different position than what the CIA had said publicly. After some in the Senate had asked for the "full report" rather than the draft that the staffers had been given, the CIA believed (incorrectly it appears) that the staffers had gotten access to unauthorized classified materials, and searched the special private network that had been set up just for those staffers. This happened after previous problems with the CIA doing questionable things concerning the Senate staffers network.

In the end, both sides asked the DOJ to investigate the other side. The DOJ has now said that it won't pursue either claim:

"The department carefully reviewed the matters referred to us and did not find sufficient evidence to warrant a criminal investigation," said Justice Department spokesman Peter Carr.

Perhaps this isn't too surprising. The fact that the CIA itself handed the document to the staffers made that claim a pretty clear dead end. However, the CIA searching through the staffers' computer network always seemed a lot more questionable, but perhaps not criminal. It seems likely that the DOJ realized that to pursue either side in this would create a huge political mess, and it was just easier to let the case go, and let the two sides continue to glare angrily at each other.

Filed Under: cia, dianne feinstein, doj, senate intelligence committee, spying, torture report

Senate Intelligence Committee Approves Dangerous Cybersecurity Bill

from the because-of-course dept

We've written about the Senate's dangerous CIPA bill -- which is Congress' latest (bad) attempt to help increase the NSA-led surveillance state by giving companies blanket immunity if they share private information with the government... all in the name of overhyped "cybersecurity." We, of course, have been through this fight before, with the CISPA bill, which passed in the House a few times, but couldn't get any traction in the Senate. This time around, the (really bad) Senate version passed out of the Senate Intelligence Committee by a 12-3 vote (held in secret, of course). Not surprisingly, two of the three who voted against it are Ron Wyden and Mark Udall.

By now you should know: if Ron Wyden and Mark Udall are against something related to surveillance, you should be against it too (and the opposite is true as well).

The "good" news is that despite the overwhelming support by the NSA's biggest cheerleaders on the rest of the Senate Intelligence Committee, it seems unlikely that the bill will have enough support in the overall Senate. And it will hopefully remain that way. This bill is a dangerous one, that is solely designed to give the NSA and some companies additional legal "cover" for aiding the NSA's surveillance efforts. Thanks to Snowden's revelations, companies are, in general, a lot less willing to do that these days anyway, but giving those companies blanket liability to do so is a bad, bad idea.

And while there's still little to no evidence that the "cybersecurity threat" is anywhere close to as big as what the FUDmongers insist it is, even if that is true, no one has yet explained what laws actually get in the way of having companies share critical cybersecurity information as needed. And, if such laws really do exist, any solution should to just be narrowly focused on fixing those laws, rather than granting broad immunity for sharing just about any info.

Filed Under: cisa, cispa, cybersecurity, dianne feinstein, mark udall, ron wyden, saxby chambliss, senate, senate intelligence committee

Senator Lindsey Graham Doesn't Know Details Of NSA Abuse, But Sure It's Fine Because 'WE'RE AT WAR!'

from the fud dept

So, over the weekend, the Washington Post reported on the latest bombshell from the Snowden files, showing both that the NSA is really bad at "minimizing" information on Americans that it's not supposed to hang onto and (more importantly) that, contrary to earlier claims, Snowden did in fact have access to the FISA collection database of info (suggesting that the NSA's controls over misuse of that data are not nearly as good as the agency and its defenders have claimed). Over at the Daily Beast, they figured that the various Senators in charge of oversight of the NSA would have some comments on the piece and how it shows an out of control NSA. But, that's not quite what happened. Senator after Senator insisted that they either hadn't yet read the story or were still trying to understand the details. The most ridiculous of all was kneejerk defender of the NSA, Lindsey Graham, who insisted that whatever was in the report didn't matter because we're at war:

Sen. Lindsey Graham—who sits on the Senate’s armed services, appropriations, and judiciary committees and is one of the Republican Party’s most prominent voices on defense and intelligence issues—wasn’t familiar with the Post piece.

“I don’t really know the details about what they’re saying in the paper. I know [NSA intelligence-gathering] is necessary. We’re at war with radical Islam,” Graham said.

Of course, that's interesting on two accounts. First, technically, we're not at war, because Congress hasn't declared war. You'd think a Senator would know that. Second, even if we were at war, does Graham honestly believe that there can be no limitations on NSA surveillance and nothing can go too far, so long as he can insist that "we're at war" (even if we're not)? If so, that's rather scary.

Other Senators similarly begged off responding to the piece, insisting they hadn't seen the details, including Intelligence Committee head Dianne Feinstein:

Nearly two days after the release of The Washington Post’s report, Senate Intelligence Committee Chairwoman Dianne Feinstein, who has direct oversight of the NSA, was just beginning to be fully briefed in the issue.

“I’m just in the process of looking into that,” Feinstein said.

And onto some others:

Sen. Carl Levin, the Democratic head of the Senate Armed Services Committee, was in Afghanistan and hadn’t had a chance to catch up. Sen. James Inhofe, his Republican counterpart, hadn’t seen the story. Sen. Angus King, a member of the Intelligence Committee, said he didn’t know the facts behind the newest revelations yet. He wasn’t alone.

Of course, it's safe to assume that most of them are just making an excuse to avoid answering the question, but that seems even worse. Either they don't know what's happening and have taken days to find out (bad) or they do know what's happening and simply don't want to comment about it (worse). Then, of course, there's always someone who is going to insist the whole thing is bogus -- but refuses to give any explanation as to why:

Sen. Tom Coburn, a member of Feinstein’s committee, came out of the Senate’s Monday votes challenging the veracity of the report, saying the “story is not accurate.” Pressed on where it was inaccurate, Coburn said, “I can’t tell you in what way. If I could tell you in what way, I would.”

To date, there has been no indication that there is anything amiss with the story. If it were really "not accurate," you can rest assured that the NSA or James Clapper's office would have been hitting back hard already about "inaccuracies" in the report. To date, they have not. Coburn's "trust me," is not particularly convincing since he still is the only person saying that... Though, I guess that's still better than Graham's ridiculous "we're at war!" comment.

Filed Under: abuse, dianne feinstein, ed snowden, lindsey graham, nsa, surveillance, tom coburn
Companies: washington post

Latest Cybersecurity Bill Could Actually Be A Backdoor To Destroying Net Neutrality

from the bad-definitions-make-bad-law dept

Earlier this year, we wrote about the Senate's latest attempt at a cybersecurity bill, the Cybersecurity Information Sharing Act (CISA), which tries to distinguish itself from the toxic attempts to pass CISPA over the past few years. We and many others have already detailed how CISA, like the CISPAs before it, has a tremendous problem in creating perverse incentives for companies to help the government spy on people, but as a bunch of public interest groups are noting, the definitions are so broad, that the bill could actually be a backdoor way to undermine net neutrality. That's because it has an incredibly broad definition of a "cyberthreat" such that an ISP could declare, say, Netflix to be a cyberthreat, allowing it to throttle Netflix's bandwidth. Here are two key paragraphs from a letter sent by CDT, EFF and a bunch of other groups:

Arbitrarily Harms Average Internet Users: The definition of “cybersecurity threat” is overbroad, and includes “any action” that may result in an unauthorized effort to adversely impact the security, confidentiality and availability of an information system or of information stored on such system. Countermeasures can be employed against such threats absent risk of liability. This could lead to use of countermeasures in response to mere terms of service violations. For example, logging into another individual’s social networking account – even with their permission – typically violates the website’s terms of service, and therefore qualifies as unauthorized access under the CFAA, and could be treated as a “cybersecurity threat.” A provision preventing this harm appeared in the July 2012 Cybersecurity Act and should be included in CISA.

Infringing on Net Neutrality Policy: Likewise, the July 2012 bill also contained provisions clarifying that nothing in the Act, including overbroad application of the terms “cybersecurity threat” and “countermeasure,” could be construed to modify or alter any Open Internet rules adopted by the Federal Communications Commission. Net neutrality is a complex topic and policy on this matter should not be set by cybersecurity legislation.

In other words, under the current broad definition of "cybersecurity threat," an ISP (e.g., Comcast) could argue that another service provider (e.g., Netflix) was "adversely impacting the availability" of information on its network, and thus it was going to take "any action" (e.g., throttling it down to nothing) to deal with the "threat." And, under the proposed legislation, there would be nothing anyone could do about it, as Comcast would be absolved from liability, as long as it could claim that all of that Netflix traffic was the equivalent to a cybersecurity threat according to its own definition.

The fact that there was language in previous bills that prevented this kind of thing, but is absent from this latest bill seems quite troubling. One hopes it was just an oversight in getting the bill out -- and that seems most likely. But, given how often we've seen nefarious language sneak into certain bills, it's not out of the question that others are recognizing the opportunities to backdoor in a way to get around any possible net neutrality proposal.

Filed Under: cisa, cispa, cybersecurity, cyberthreats, dianne feinstein, information sharing, net neutrality

Feinstein (Again) Says Metadata Program 'Is Not Surveillance'

from the you're-only-embarrassing-yourself,-Dianne dept

Senator Dianne Feinstein's war of words in defense of the NSA's programs continues, despite both the political tide and public favor shifting in the other direction. According to Feinstein, everyone is still suffering from some sort of mass delusion when it comes to the Section 215 program.

“It’s not a surveillance program, it’s a data-collection program,” she said while appearing on CNN’s “State of the Union” on Sunday.

Oh, but it's actually both. According to supporters of the NSA, metadata is just a bunch of anonymous numbers harvested in hopes of discovering needles. To those actually paying attention, metadata is a very efficient way to collect very personal information about someone. Just because it looks like data doesn't mean it's not surveillance. Let's not forget that metadata provides enough information to justify extrajudicial killings.

It's still surveillance. It just bears no resemblance to what spying used to mean. What the NSA has done is turn "surveillance" into something abstract, but equally invasive. It has eliminated the targeted nature of its classic definition and replaced it with servers full of data, all of it theoretically linked to another abstraction: "terrorism."

The headline says Feinstein "blasts" critics, but this sort of clueless pedantry doesn't actually "blast" anyone. Months after the defenders' assertions have been repeatedly dismantled (including two similar assertions by the senator), Feinstein's willingness to cling to a nostalgic view of surveillance could almost be termed "delightfully old school" -- if only she still didn't have at least one hand on the controls as the head of the Senate Intelligence Committee.

She also said she wasn't aware of another revelation released in conjunction with Glenn Greenwald's book on Snowden and the NSA.

In “No Place to Hide,” released last week, Greenwald said the U.S. government places surveillance tools in technology equipment to be sold abroad, an accusation the U.S. government often lobs at the Chinese government.

That program “does not sound familiar,” Feinstein said Sunday.

Well, I'm sure the NSA keeps secrets from even you, Dianne. And I'm sure the NSA is at least as surprised as you are that the information is now public. No one seems to be aware of some of the stuff that has been leaked, elements of which have escaped even the attention of those on the committees that have performed actual oversight, rather than just stood cheering on the sidelines.

Ultimately, whether it doesn't fit into Feinstein's dewy-eyed surveillance ideal or if it has escaped (read: been withheld from) her attention, she's behind it. Because without all of this, we're doomed.

“I know they will come after us if they can, I see the intelligence,” she said.

“Terror is not down in the world, it is up.”

If that's so, remind us again why all the surveillance and expansion of government powers is necessary. Because it doesn't seem to have improved anything.

Filed Under: dianne feinstein, metadata, nsa, section 215, surveillance

Feinstein And Chambliss Let James Clapper Talk Them Out Of Requiring Transparency On The Administration's Drone Strikes

from the editing-the-pre-edited-version dept

It looks like the American public won't be getting any answers on the government's extrajudicial killings any time soon. An intelligence bill that passed the Senate late last year contained a stipulation requiring the administration to provide statistics on drone strikes, including number of combatants and noncombatants killed or injured in these strikes. That requirement has now been excised, thanks to the efforts of Sens. Feinstein and Chambliss and their buddy at the Office of the Director of National Intelligence, James Clapper, as Spencer Ackerman reports.

[T]he Guardian has confirmed that Senate leaders have removed the language as they prepare to bring the bill to the floor for a vote, after the director of national intelligence, James Clapper, assured them in a recent letter that the Obama administration was looking for its own ways to disclose more about its highly controversial drone strikes.

“The executive branch is currently exploring ways in which it can provide the American people more information about the United States’ use of force outside areas of active hostilities,” Clapper wrote to the leaders of the Senate committee, Democrat Dianne Feinstein of California and Republican Saxby Chambliss of Georgia, on 18 April.

CC'ed on the letter are the heads of the House Intelligence Committee, Mike Rogers and Dutch Ruppersberger. This decision wasn't in their hands, but even if it was, it wouldn't have played out any differently. Rogers, in particular, is a huge fan of the administration's drone work and has publicly lamented the fact that the slowly-turning wheels of bureaucracy are keeping the US from killing even more people.

Feinstein's relationship with drones is, of course, somewhat hypocritical. She feels there should be stricter regulations on commercial drone usage (partially prompted by a non-commercial drone appearing outside her house during a Code Pink anti-NSA protest) and seems generally opposed to drone surveillance. However, she does stand strongly behind the nation's counterterrorism efforts and believes killing people with drones (rather than just watching them) is more acceptable.

Even more oddly, despite her very public battle against the CIA over control of the so-called "Torture Report" (a battle also marked by a bouts of Feinstein hypocrisy), she's been very supportive of the agency's weaponized aircraft.

Feinstein has long been a defender of the CIA’s drone strikes. During a February 2013 confirmation hearing for CIA Director John Brennan, Feinstein stated that the CIA’s targeting procedures kills only “single digits” of civilians annually, an assertion that cannot be independently confirmed because of the official secrecy surrounding the strikes.

Even some intelligence officials have grudgingly agreed some transparency on this issue would be a positive step for the administration to take. But that number doesn't include James Clapper, whose unintentionally humorous letter asserts that the self-proclaimed "most transparent administration" is actively seeking ways to publicize drone strike numbers. Only in recent months has the administration even acknowledged there might be a downside to its drone strike program. There's been a rollback in the number of strikes and the administration did express its hesitance to kill American citizens with drones, even if they clearly were associating with known terrorists. But this hand-wringing was mostly about public relations and less about the reality of the situation -- that the US would have to piss off yet another country by blowing past its agreement with them to not engage in military strikes on its soil.

So, there's that. And all of that is indeed very little. For years, it's been even less, as Ackerman points out.

The sharing of even basic information about drone strikes has run into a wall of official secrecy. Several independent groups attempt to track the numbers of people killed in the strikes, but no official US confirmation has been possible.

For one obfuscation artists (Clapper) to claim another (the administration) will be taking the lead when it comes to transparency borders on farcical. Now that Senate intelligence heads have complied with Clapper's request, the intelligence community's accountability has been removed. This puts the whole thing in the administration's hands, which isn't really an improvement. I'm sure the current president has no desire to publicly announce his regime has been more deadly than his predecessor's, especially given Bush's proclivity for pushing military/surveillance solutions to the world's problems.

Filed Under: dianne feinstein, drone strikes, james clapper, saxby chambliss, transparency

CISPA Take 3: Feinstein & Chambliss Draft Another Cybersecurity Bill, Designed To Wipe Out Your Privacy

from the only-massive-amounts-of-government-can-keep-you-safe dept

Washington DC: where no bad idea ever truly dies. CISPA, the infamous "cybersecurity" bill that has twice failed to cross the President's desk is back again. This is the Senate's attempt at a cybersecurity bill, so it doesn't sport the same gaudy initials (those belong to the House), but it's still the same set of terrible ideas.

The Senate's previous attempts to write its own cybersecurity bill were supposedly prompted by privacy concerns, something the House version treated as wholly irrelevant to securing our nation from cyberattacks. This new bill may decide privacy is the only thing irrelevant to national security, seeing as it's been crafted by Dianne Feinstein and Saxby Chambliss, both largely supportive of the NSA's (recently exposed) activities.

The new bill sports the following title: Cybersecurity Information Sharing Act of 2014. CISPA without the "p," apparently. Out with the "protection" (which was nominal) and in with the oversharing of cyberthreat information.

The bill, like others before it, grants broad immunity to participating companies, stripping away one of the few reasons these entities might stick up for their customers (and their data) and consider plugging the security hole before turning that info over to both the military, national security agencies and, well, any number of government agencies or competitors. The text of the bill leaves that almost completely unspecified.

The new, 39-page draft bill, written by Sen. Dianne Feinstein (D-Calif.), chairman of the intelligence committee, and Sen. Saxby Chambliss (Ga.), the ranking Republican, states that no lawsuit may be brought against a company for sharing threat data with “any other entity or the federal government” to prevent, investigate or mitigate a cyberattack.

This immunity screws up incentives and encourages questionable behavior, as it to be expected when accountability is removed.

There's a small nod to privacy in the bill, but it carries with it some potential weasel words that could completely undermine the protection.

An entity sharing cyber threat indicators pursuant to this Act shall, prior to such sharing, remove any information contained within such indicators that is known to be personal information of or identifying a United States person, not directly related to a cybersecurity threat in order to ensure that such information is protected from unauthorized disclosure to any other entity or the Federal Government.

Considering what the NSA and others have deemed "relevant" to their counterterrorism efforts, lots of personal data could easily be construed as being "directly related" to a potential cybersecurity threat.

Other protections are equally as malleable. Law enforcement agencies are allowed to avail themselves of cyberthreat information, but only if given written consent from the entity(ies) involved. But that "only" isn't actually a limitation. The paragraph immediately following the "written consent" stipulation creates the same sort of loophole that agencies like the FBI have abused to the point of surreality in the past.

If the need for immediate use prevents obtaining written consent, such consent may be provided orally with subsequent documentation of the consent.

IN CASE OF EMERGENCY, BREAK PROTECTIONS.

Giving law enforcement or indeed any agency this sort of manual override undercuts anything stipulated previously. This encourages a culture of asking forgiveness, rather than permission. Grab the data and justify it post facto. That's no protection at all, especially when granted immunity gives companies absolutely no reason to push back on these oral requests.

This may only be the draft version, and there will be several changes made before it goes up for a vote, but this groundwork is far from heartening. It appears as though no one involved has learned anything from CISPA's two troubled trips through the House, not to mention the new concerns prompted by leaked NSA documents.

Further gestures in the direction of civil liberties and privacy protections are made later in the bill (under a heading "Privacy and Civil Liberties" no less), but those protections are roughly identical to existing policies governing the NSA's (and FBI's) mass collection of American metadata -- oversight and minimization, both of which have been subverted by these agencies.

The bill also consolidates more power within the DHS, creating an "all roads lead to the DHS" method of managing cyberthreat information. If there's one entity which has proven time and time again to be both a) mostly useless and b) prone to abusive behavior, it's the DHS. And yet, the bill calls for the agency to be the central cyberthreat repository.

IN GENERAL.—Not later than 90 days after the date of the enactment of this Act, the Secretary of Homeland Security, in coordination with the heads of the appropriate Federal entities, shall develop and implement a capability and process within the Department of Homeland Security that—

(A) shall accept from any entity in real time cyber threat indicators and countermeasures in an electronic format, pursuant to this section;

(B) shall, upon submittal of the certification under paragraph (2) that such capability and process fully and effectively operates as described in such paragraph, be the process by which the Federal Government receives cyberthreat indicators and countermeasures in an electronic format that are shared by an entity with the Federal Government…

Unfortunately, as terrible as the DHS is at determining threats and sharing information, there's probably no way to route around it. The post-9/11 agency is now the government's national security clearinghouse, and everything flows to it, even if it's usually the agency least likely to make productive use of the information. While cyberthreats pile up, DHS agents will be chasing down people taking pictures of public structures.

Believe it or not, this bill putting DHS as the central authority is actually one half-step better than the likely alternative, which is making NSA the central player. For many years now, there's actually been something of a turf war between DHS and NSA over who gets to control the (increasingly massive) cybersecurity budget. And a bill that designates DHS as the "winner" of that turf battle at least gives it a slight preference over the NSA -- though, unfortunately, this bill would let DHS share info with NSA freely, which is yet another problem.

CISPA may have seemed at least half-dead, but Feinstein and Chambliss are breathing life into its lumbering carcass. You would think the last several months, combined with CISPA's earlier struggles, would have resulted in a better cybersecurity bill. Instead, it actually seems worse.

“This is definitely a step back,” said Gabe Rottman, legislative counsel and policy adviser for the American Civil Liberties Union, who was shown a copy of the draft. “The problem is the definitions of what can be shared and who it can be shared with are too broad. In this draft, companies can share data with the military and the NSA. Given the past revelations, I think it’s important to keep this information in civilian hands.”

And that's just one of several problems. Combine the bill's wording with the administration's tacit approval of the NSA's exploit stockpile and you've got something that will generate millions of dollars worth of budget line items while doing very little to make anyone -- even the government itself -- any safer.

Filed Under: cisa, cispa, cybersecurity, dhs, dianne feinstein, homeland security, immunity, information sharing, nsa, privacy, saxby chambliss

James Clapper Bans Intelligence Community From Basically Any Interaction With Nearly Anyone With A Social Media Account

from the good-luck-with-that dept

Back in 2012, we wrote about how Senator Dianne Feinstein appeared to be a lot more focused on who leaked information about the US involvement in Stuxnet, rather than the question of whether or not the US should have been involved in Stuxnet in the first place. Soon after, Feinstein pushed for astoundingly broad "anti-leak" rules that would effectively make it illegal to blow the whistle. It automatically treated any leak as bad, even if such a leak was clearly to blow the whistle on illegal behavior. Thankfully, Senator Wyden stepped in and helped kill that effort, noting the serious consequences:

"I think Congress should be extremely skeptical of any anti-leaks bills that threaten to encroach upon the freedom of the press, or that would reduce access to information that the public has a right to know," Wyden said in a floor statement publicly announcing his hold. "Without transparent and informed public debate on foreign policy and national security topics, American voters would be ill-equipped to elect the policymakers who make important decisions in these areas."

This resulted in the anti-leak provision being withdrawn. However, it appears that, in late March, Director of National Intelligence, James Clapper, more or less put in place the same rules issuing an intelligence community directive that bars all unauthorized contact with the media, no matter what the subject or the issue. You can read the directive here. While some may argue that of course no member of the intelligence community should be able to communicate with a member of the media without authorization, they are ignoring a few key points.

First, it makes no distinction at all between classified and non-classified information. That's a big deal. It's reasonable (to a certain extent) to suggest that intelligence employees should not be discussing classified information with the press, but when you get into unclassified material, it gets fairly ridiculous pretty quickly. Lots of members of the intelligence community will often help reporters out, providing explanations and details on background, and that's the sort of thing the intelligence community should support given that they frequently complain that the press gets important details wrong.

Furthermore, as Wyden himself pointed out in the debate about Feinstein's original attempt:

I am concerned that they will lead to less-informed public debate about national security issues, and also undermine the due process rights of intelligence agency employees, without actually enhancing national security.

But, of course, it gets even worse as you dig into the details. In the directive, "media" is defined incredibly broadly:

For purpose of this Directive, media is any person, organization, or entity (other than Federal, State, local, tribal and territorial governments):

a. primarily engaged in the collection production, or dissemination to the public of information in any form, which includes print, broadcast, film and Internet; or

b. otherwise engaged in the collection, production, or dissemination to the public of information in any ofrm related to topics of national security, which includes print, broadcast, film and Internet.

Perhaps I'm misreading it, but section "b" especially would appear to suggest that if you ever use your Facebook/Twitter/etc. account to share (i.e., "disseminate") any info concerning the "topic of national security," you're a part of the media. Did you share a Guardian story about Ed Snowden on Facebook? Or maybe comment about the Heartbleed bug? Congrats, you're now considered "the media" under this directive -- meaning that no one who works for the intelligence community is allowed to interact with you at all, except with authorization. For intelligence community employees, this effectively rules out their ability to do things like go to their neighbors' barbecue this summer if that neighbor has ever shared any information concerning an issue that might be under the big umbrella of national security.

And, while it's unlikely that the FBI is suddenly going to be tracking down a lowly NSA analyst for sharing small talk with his or her neighbor, if that same analyst is suddenly under investigation for other issues, you'd better believe that such interactions will be brought under scrutiny. We've seen it before. An investigation into Thomas Drake's whistleblowing turned up nothing, so the DOJ went after him because he had a classified meeting agenda on a computer (even though it was declassified anyway soon after) and threatened him with 35 years in jail. John Kiriakou blew the whistle on CIA torture, but was eventually charged with helping a reporter speak to another former CIA agent in a manner that revealed nothing that would have an impact on national security. In other words, when the DOJ wants to bring an intelligence community employee down, they'll find anything to do so. And this directive gives them another tool, while at the same time making sure to stifle the public discourse on what the intelligence community is doing.

Filed Under: dianne feinstein, intelligence community, james clapper, journalism, leaks, ron wyden, social media