CIA Still Arguing Its Official Leaks To Journalists Shouldn't Be Subject To FOIA Requests

from the redefining-the-term-'made-public' dept

Last week, a federal judge pointed out the obvious to the CIA: release-to-one is release-to-all, no matter how the agency's lawyers spin it. The CIA had emailed classified information to certain journalists. When another journalist sought copies of those emails, the CIA handed him fully-redacted versions. Obviously, they weren't redacted when they were sent to select members of the public. Why would the CIA feel the need to redact the information now when another member of the public asked for it?

The CIA argued it had every right to hand out classified info to whoever it saw fit and then turn around and refuse to hand it over when an FOIA requester requested it. It said the classified info it gave to journalists was never published by those journalists, so it was technically not a public release. The judge shot back, stating that the CIA had effectively waived its right to withhold this information by handing it out to journalists in the first place.

CIA voluntarily disclosed to outsiders information that it had a perfect right to keep private. There is absolutely no statutory provision that authorizes limited disclosure of otherwise classified information to anyone, including "trusted reporters," for any purpose, including the protection of CIA sources and methods that might otherwise be outed. The fact that the reporters might not have printed what was disclosed to them has no logical or legal impact on the waiver analysis, because the only fact relevant to waiver analysis is: Did the CIA do something that worked a waiver of a right it otherwise had? The answer: CIA voluntarily disclosed what it had no obligation to disclose (and, indeed, had a statutory obligation not to disclose). In the real world, disclosure to some who are unauthorized operates as a waiver of the right to keep information private as to anyone else.

The FAS Secrecy News blog brings us the news that the CIA has already issued a response [PDF] containing new arguments about why it should be able to engage in selective disclosure of classified info to members of the public.

CIA argued that the court is wrong to think that limited, selective disclosures of classified information are prohibited or unauthorized by law. The National Security Act only requires protection of intelligence sources and methods from "unauthorized" disclosure, not from authorized disclosure. And because the disclosures at issue were actually intended to protect intelligence sources and methods, they were fully authorized, CIA said. "The CIA properly exercised its broad discretion to provide certain limited information to the three reporters."

"The Court's supposition that a limited disclosure of information to three journalists necessarily equates to a disclosure to the public at large is legally and factually mistaken," the CIA response stated. "The record demonstrates beyond dispute that the classified and statutorily protected information withheld from the emails has not entered the public domain. For these reasons, the limited disclosures here did not effect any waiver of FOIA's exemptions."

So, technically, it's not a new argument, just a reiteration of the CIA's stance on classification waivers it would rather believe aren't waivers of classification. In essence, the CIA would like to be able to selectively leak classified information while retaining the privilege of denying every other member of the public access to these leaks. If the selected journalists choose to publish classified info handed to them by the CIA, only then does it enter the public domain, according to the the CIA. Otherwise, the CIA will decide what's classified and withholdable, not judges or logic or common sense.

Apparently, this is standard operating procedure for the agency. MuckRock's stash of CIA documents contains official instructions for CIA leaks to the press, including a checklist for post-leak damage control.

The form for reporting the leaks... was fairly comprehensive. In addition to any supplemental materials, which were be attached to the leak reports, the form was two pages long. In addition to requesting the time, date, publication author and how the sourcing was attributed, the form requested notes about the subject matter, the geography associated with it and the dissemination of the information. After asking what, if anything, the information had compromised, the form asked about the accuracy of the information.

The form also requested information about whether the leak was authorized or not, and who had authorized it. Tellingly, it requested information about which government organizations were criticized in the leak, but didn’t feel the need to ask who or what had been praised.

The tradition -- started during the Nixon administration in response to his call to root out leakers -- continues to this day. The CIA will make snap decisions on declassification, hand out info to reporters it feels it can trust, and possibly report the leaks to intelligence oversight. It happened often enough a computerized system was built to track the agency's official leaks. Nearly fifty years later, the CIA's official leak program is being challenged in court, and the CIA wants everything to be the way it was during the glory days of the Nixon presidency.

The CIA's hypocritical arguments are symptomatic of a hypocritical system. The intelligence community hates leakers, unless it's the agencies themselves doing the leaking. And it definitely doesn't trust journalists… unless it needs them to help control the narrative. The judge in this case is punching holes in government tradition. Hopefully, this will end with the CIA handing over the info it already handed over to other people, free and clear of redactions.

Filed Under: cia, foia, leaks, transparency

NSA Exploit Now Powering Cryptocurrency Mining Malware

from the ETERNALDAMAGE dept

You may have been asked if you'd like to try your hand at mining cryptocurrency. You may have demurred, citing the shortage in graphics cards or perhaps wary you were being coaxed into an elaborate Ponzi scheme. So much for opting out. Thanks to the NSA, you may be involved in mining cryptocurrency, but you're likely not seeing any of the benefits.

A computer security exploit developed by the US National Security Agency and leaked by hackers last year is now being used to mine cryptocurrency, and according to cybersecurity experts the number of infections is rising.

The good news is you won't have to cough up ransom to retake control of your computer. The bad news is this doesn't guarantee you'll have a functioning computer.

This new attack—called WannaMine—may seem like less of a threat than WannaCry because it doesn’t lock users out of their computer. But CrowdStrike noted in a blog post laying out its findings on WannaMine that the company has observed the malware “rendering some companies unable to operate for days and weeks at a time.” WannaMine infections are also hard to detect because it doesn’t download any applications to an infected device.

This is the path the NSA's malware has taken: from worldwide ransomware to drive-by installations of mining software. The route to infection is still the normal route: malicious links. Once inside, the malware co-opts your processor for cryptocurrency mining. If your computer happens to be part of a network, the infection will spread to connected computers, turning entire businesses into someone else's side hustle.

The "fun" part is even patched systems can be infected. The NSA's EternalBlue exploit may no longer work, but an attached tool called Mimikatz can still root around for login passwords to continue spreading the malware. The damage isn't theoretical.

For companies hit by WannaMine at scale though, the cumulative effects can be disastrous, [Bryan] York [director of CrowdStrike] told me. He cited a client that recently came to CrowdStrike for help after their network was infected by WannaMine, which York said was using so much CPU power that it totally shut down their service.

“The implications of cryptocurrency mining aren't just, ‘Oh darn, I lost some of my CPU,’” York said. “It's actually getting in the way of how businesses conduct their operations and causing down time.”

While this isn't the first cryptominer based on NSA exploits to hijack users' computers, it's the hardest to track down and kill. It contains no application files, relying on Windows tools to perform the dirty work. No files written to disk make it all but invisible. And, unlike ransomware, there's no way to pay someone to stop using your CPU to mine Monero. You can't even buy your way out of the problem.

This won't be the last we'll see of malicious software built on NSA hacking tools. It will serve as a continual reminder of the government's untrustworthiness when it comes to secure computing, mass harvesting of data, and security tradeoffs performed without input of the majority of stakeholders.

(Counterpoint via @dril: maybe NSA-enabled cryptomining hijacking is the most patriotic thing there is.)

Filed Under: cryptocurrency, exploits, leaks, malware, miners, nsa, weapons

Judge Tells CIA It Can't Hand Classified Info To Journalists And Pretend The Info Hasn't Been Made Public

from the release-to-one-is-still-release-to-all,-legally-speaking dept

The CIA is spectacularly terrible at responding to FOIA requests. It's so bad it's highly possible the perceived ineptness is deliberate. The CIA simply does not want to release documents. If it can't find enough FOIA exemptions to throw at the requester, it gets creative.

A FOIA request for emails pertaining to the repeated and extended downtime suffered by the (irony!) CIA's FOIA request portal was met with demands for more specifics from the requester. The CIA wanted things the requester would only know after receiving the emails he requested, like senders, recipients, and email subject lines.

The CIA sat on another records request for six years before sending a letter to the requester telling him the request would be closed if he did not respond. To be fair, the agency had provided him a response of sorts five years earlier: a copy of his own FOIA request, claiming it was the only document the agency could locate containing the phrase "records system."

In yet another example of CIA deviousness, the agency told a requester the documents requested would take 28 years and over $100,000 to compile. Then it went even further. During the resulting FOIA lawsuit, the DOJ claimed the job was simply too impossible to undertake. Less than 2 months after MuckRock's successful lawsuit, the entire database went live at the CIA's website -- more than 27 years ahead of schedule.

This is the CIA's antipathy towards the FOIA process on display. It takes a lawsuit to get it to produce documents. And what we have here is more CIA recalcitrance being undercut by an FOIA lawsuit.

Journalist Adam Johnson sued the agency early last year for its refusal to produce correspondence between the CIA's Office of Public Affairs and prominent journalists. Johnson did receive copies of these emails, but the CIA redacted the emails they had sent to journalists. (The journalists' response were left unredacted.) Since the emails obviously weren't redacted when they were sent to journalists, Johnson challenged the redactions in court.

The government argued it had a right to disclose classified information to journalists. And it certainly can. The CIA can waive classification if it so desires. But what it can't do is claim it has never released this classified info to the public -- not if it's handing it out to journalists.

Daniel Novak is representing the journalist in his FOIA lawsuit. And he reports the judge is no more impressed by the CIA's arguments than his client is. The decision [PDF] is redacted but some very nice bench slaps have been left untouched... like this one, which sums up the ridiculousness of the CIA's arguments.

CIA voluntarily disclosed to outsiders information that it had a perfect right to keep private. There is absolutely no statutory provision that authorizes limited disclosure of otherwise classified information to anyone, including "trusted reporters," for any purpose, including the protection of CIA sources and methods that might otherwise be outed. The fact that the reporters might not have printed what was disclosed to them has no logical or legal impact on the waiver analysis, because the only fact relevant to waiver analysis is: Did the CIA do something that worked a waiver of a right it otherwise had? The answer: CIA voluntarily disclosed what it had no obligation to disclose (and, indeed, had a statutory obligation not to disclose). In the real world, disclosure to some who are unauthorized operates as a waiver of the right to keep information private as to anyone else.

The government cited 1981's Phillippi case -- the one that saddled us with the infamous "Glomar response" -- in support of its assertions that it did not waive classification when it disclosed classified info to certain journalists. The court says that case doesn't discuss the CIA's apparently voluntary decision to feed classified info to the press, which is explicitly a waiver. Unlike the Glomar/Phillippi case, the CIA's own press office divulged classified info to members of the public. The court says the government can't have it both ways: it can't hand classified info to one journalist then tell another it can't disclose info it already made public (even if in a very limited fashion).

Contrary to the Government's suggestion, Phillippi does not announce that limited disclosure of information that the CIA is not supposed to disclose can never operate as a waiver. It does not authorize the Government to distinguish between "trusted journalists" and other journalists. It simply does not address either the facts facing this court or the legal implication of those facts at all.

If harm comes from further public disclosure following the relinquishment of the documents to Johnson, well, that's the CIA's fault.

The Government's effort to focus the Court's attention on the very real danger to [redacted] only underscores the lack of wisdom of CIA's risky (and apparently discontinued) selective disclosure program.

The opinion also contains this pointed footnote, appended to discussion of the CIA's assertion it can hand over classified info to journalists and still pretend the info hasn't been made public.

I suppose it is possible that the Government does not consider members of the press to be part of "the public." I do.

The few remaining redactions the CIA handed to Johnson haven't been unredacted yet. The bulk of emails have been uncensored as a result of this lawsuit. There are a few the court is still holding back on, but it's a very small percentage of the total. Those may see the unredacted light of day, though. While the court is giving the CIA one more attempt to submit a credible argument in favor of continued redaction, the presiding judge clearly isn't impressed with the efforts the agency has made so far.

Filed Under: cia, foia, glomar, leaks, transparency

Classified Cabinet Docs Leak Down Under Via An Actual Cabinet Sale... Just As Aussies Try To Outlaw Leaking

from the what-a-world dept

Back in December, we reported on an effort underway in Australia to criminalize both whistleblowers and journalists who publish classified documents with up to 20 years in prison. 20 years, by the way, is also the amount of time that Cabinet documents are supposed to be kept classified in Australia. But just recently Australia's ABC news suddenly started breaking a bunch of news that appeared to come from access to Cabinet documents that were still supposed to be classified. This included stories around ending welfare benefits for anyone under 30 years old as well as delaying background checks on refugees. Some explosive stuff.

On Wednsday, ABC finally revealed where all this stuff came from. It wasn't an Australian Ed Snowden. It was... government incompetence. Apparently, someone bought an old filing cabinet from a store that sells second-hand government office furniture. The cabinet had no key, so he drilled the lock and... found a ton of Cabinet documents in an actual cabinet.

So... if that law were to go through in Australia... would that mean the government employee who didn't check the filing cabinet would get 20 years in jail? Or the store that sold out? Or the guy that drilled it? Or do all of them get 20 years? Why don't we just support whistleblowers and the press for reporting on important news that the public should know about?

Filed Under: australia, cabinet, classified information, leaks, reporting, security, whistleblowing

Seeking To Root Out Leakers, The Intelligence Community Is Destroying Official Routes For Whistleblowers

from the ensuring-there's-only-one-way-out dept

The Trump Administration is continuing its war on leakers. It's probably meant to keep whistleblowers at bay as well. This isn't necessarily a trait unique to Trump's White House. There really hasn't been a whistleblower-friendly administration in pretty much ever, but this particular administration has been awash in leaked documents, each one prompting more severe crackdowns.

But it's going to come to a head at the national security level. The "Intelligence Community" -- sixteen agencies participating and partaking in intelligence analysis and collection under the Office of the Director of National Intelligence -- is basically ousting its internal oversight. Jenna McLaughlin, writing for Foreign Policy, has the details.

[Dan] Meyer, whose job is to talk to intelligence community whistleblowers, can no longer talk to whistleblowers. He has been barred from communicating with whistleblowers, the main responsibility of his job as the executive director for intelligence community whistleblowing and source protection. He is currently working on an instructional pamphlet for whistleblowers, and he will have no duties to perform after he’s completed that work.

He can also no longer brief the agencies or the congressional committees on his work as he’s done in the past, send out his whistleblower newsletter, or conduct outreach. And he has no deputy or staff.

This is the end result of internal struggles and the continual sidelining of the so-called "proper channels." They weren't worth much when Snowden decided to leak. They were relatively worthless when others leaked documents years before Snowden began changing the intelligence community from the far outside. And if they were ever going to be worth anything, that effort has been derailed in favor of hunting down leakers.

This is incredibly stupid. If the administration wants to stop leaks, one of the better tools is proper channels that actually work -- ones that get results and shield whistleblowers from retaliation. Instead, intelligence officials have decided leaking and whistleblowing are pretty much the same thing and have headed off attempts to build an official whistleblowing outfit worth a damn

What's being ousted, bit by bit, is the IC's Inspector General's office. Elimination of whistleblower outlets may only be part of the plan. Once rendered toothless, it may be prevented from performing other oversight duties. But the war of leakers starts where it always starts: with whistleblowers. If the Inspector General's office is completely neutralized, the only option will be leaking, not exactly the best news for this particularly sieve-like administration.

Filed Under: inspector general, intelligence community, leaks, whistleblowers

Hackers Grab More NSA Exploits, Possibly With Assistance Of Russian Antivirus Developer

from the three-strikes-program-in-effect dept

Yet another NSA breach is being reported -- this one linked to Russian antivirus developer, Kaspersky Lab. The Wall Street Journal broke the news, detailing the apparent exfiltration of NSA exploits via Kaspersky antivirus software by Russian hackers (likely paywall).

Given the US government's recent decision to ban the use of Kaspersky AV software, one might assume Kaspersky itself acted maliciously. But the details in the story -- along with analysis from other journalists and researchers -- suggests the AV software may have done nothing more than its job.

The hackers appear to have targeted the contractor after identifying the files through the contractor’s use of a popular antivirus software made by Russia-based Kaspersky Lab, these people said.

The theft, which hasn’t been disclosed, is considered by experts to be one of the most significant security breaches in recent years. It offers a rare glimpse into how the intelligence community thinks Russian intelligence exploits a widely available commercial software product to spy on the U.S.

The incident occurred in 2015 but wasn’t discovered until spring of last year, said the people familiar with the matter.

The stolen material included details about how the NSA penetrates foreign computer networks, the computer code it uses for such spying and how it defends networks inside the U.S., these people said.

A few interesting details stand out:

First, the discovery of files via antivirus software was made easier by the way Kaspersky AV operates.

It’s basically the equivalent of digital dumpster diving,” said Blake Darché, a former NSA employee who worked in the agency’s elite hacking group that targets foreign computer systems.

Kaspersky is “aggressive” in its methods of hunting for malware, Mr. Darché said, “in that they will make copies of files on a computer, anything that they think is interesting.” He said the product’s user license agreement, which few customers probably read, allows this.

The combined guesswork of the Wall Street Journal's sources suggest snippets of NSA malware code were discovered on a contractor's personal computer. Kaspersky AV has been banned from use inside the NSA for years, but nothing prevents NSA contractors from installing it on their home computers. In this case, a contractor had files on their personal computer that never should have left the NSA. (Well… at least not in this fashion. Taking sensitive files off grounds can be a criminal offense. Deploying these files to compromise computers and devices around the world, however, is just the daily work of the NSA's Tailored Access Operations.)

The unanswered question appears to be how state-sponsored Russian hackers determined which computer to target. Some suspect Kaspersky employees informed the Russian government of their discovery, but the Journal article offers no clarifying statements.

As Marcy Wheeler points out, the NSA could have made this bad situation worse by "hacking back."

[N]one of the rest of the report explains how Kaspersky could have learned so much about NSA’s tools.

We now may have our answer: initial discovery of NSA tools led to further discovery using its AV tools to do precisely what they’re supposed to. If some NSA contractor delivered all that up to Kaspersky, it would explain the breadth of Kaspersky’s knowledge.

It would also explain why NSA would counter-hack Kaspersky using Duqu 2.0, which led to Kaspersky learning more about NSA’s tools.

The Wall Street Journal says the identity of the contractor whose laptop was compromised is still unknown. Not so fast, says Washington Post's Ellen Nakashima, who's been following these developments for a few years now.

The employee involved was a Vietnamese national who had worked at Tailored Access Operations, the elite hacking division of the NSA that develops tools to penetrate computers overseas to gather foreign intelligence, said the individuals, who spoke on condition of anonymity to discuss an ongoing case. He was removed from the job in 2015, but was not thought to have taken the materials for malicious purposes such as handing them to a foreign spy agency, they said.

One NSA figure who may not survive this third major breech is its boss, Mike Rogers. His head was on the chopping block for breaches under his command back when Obama was still in office. A third major breach of NSA security may be a breach too far.

In a few short years, the NSA has gone from "No Such Agency" to the world's best unofficial source of malware. It's something to keep in mind every time the agency pitches an expansion of surveillance powers. It can't keep an eye on its own backyard because it's too busy staring into everyone else's.

Filed Under: exploits, leaks, malware, nsa, russia
Companies: kaspersky lab

Desperate To Stop Leaks, The Trump Administration Considers Moving From Bad Ideas To Worse Ones

from the do-you-consent-to-the-use-of-sodium-pentothal? dept

The Trump Administration is so frustrated by constant leaks, it's willing to try anything to stop them. Apparently, this may one day involve questionable tech with an extremely-spotty track record. Attorney General Jeff Sessions has an idea -- a bad one -- to address the ongoing White House leakstravaganza.

Sessions' idea is to do a one-time, one-issue, polygraph test of everyone on the NSC staff. Interrogators would sit down with every single NSC staffer (there's more than 100 of them), and ask them, individually, what they know about the leaks of transcripts of the president's phone calls with foreign leaders. Sessions suspects those leaks came from within the NSC, and thinks that a polygraph test — at the very least — would scare them out of leaking again.

Sessions' spitball may never come to fruition but it does indicate the White House is still no closer to uncovering the source(s) of these leaks. This also indicates the AG is willing to alienate NSC staffers with mandatory tests predicated on nothing more than Sessions' belief the leaks came from within the NSC.

On top of that, there's the dubious deterrent effect of deploying machinery whose results should be taken with a shaker of salt. The machines can be beat. Research and "How To" literature bear this out, although the federal government does what it can to prevent the spread of the latter. False positives are a problem as well. Ringing up staffers for leaking just because a machine said yes isn't going to stop the leaks or put investigators any closer to catching the real culprit(s).

But this is the way things go when the federal government is in charge. It relies heavily on polygraph tests when vetting applicants for agencies like the Customs and Border Protection. And it continues to deploy these tests even when applicants have admitted to activities or relationships that would disqualify them from federal employment.

Chances are Sessions' polygraph idea will likely remain just an idea. It could be the multiple discussions Sessions is engaging in are all part of his leak deterrence plan -- to have the threat of mandatory lie detector tests hovering in midair for the rest of tenure. Even so, it's a desperation move that shows the White House can't contain the leaks, much less hope to stop them. Suggestions like the one made by Sessions are just going to turn more staffers against the administration, which means more leaks, rather than less, over the course of this administration's lifetime.

Filed Under: jeff sessions, leaks, lie detector, national security, polygraph

CIA Helps National Archive Out By Offering To Trash Its Stash Of Leak-Related Documents

from the I'M-HELPING dept

The National Archives obviously can't be expected to store every piece of paper generated by the federal government. But it does have an obligation to preserve copies of historically-significant documents. Unfortunately, it's allowing agencies to make these decisions. While it's true some agencies may have a better grasp on a document's significance, other agencies aren't as interested in archiving historically significant documents -- especially ones that might make them look bad.

Enter the CIA, which already has a significant history of burying documents it would rather not reveal.

The CIA is scheduled to begin destroying old records related to leaks of classified information in August unless critics convince the National Archives to scuttle the plan.

The National Archives and Records Administration tentatively approved a CIA proposal to get rid of several types of records after 30 years. Along with leak-tied files, the record types include medical records, behavioral conduct files, security clearance information, personality files with counterintelligence interests, workers-compensation reports for employees posted overseas, and declassification and referral files.

Leak-related files currently have to be saved permanently, but under this proposal they can be destroyed 30 years after a case is closed.

This is the CIA's response to the Archives' question: what documents should we not worry about keeping? This is the CIA stating none of the documents listed above have historical value. Nate Jones of the nonprofit National Security Archive points out why the CIA shouldn't be allowed to make this determination.

Jones warns that NARA and the CIA should err on the side of preservation, even if they believe the files at issue are backed up elsewhere. “History has shown that they are too eager to destroy their records,” he said of CIA officials. “The CIA does not have a lot of good will for preserving historically relevant documents.”

There's history the CIA likes -- the sort of thing that's enshrined in its public areas and featured prominently on its website. Then there's everything else. The CIA tends to move forward with document destruction without bothering to confirm backups still exist just in case.

[J]ust last month, it came to light that the spy agency chucked records about this country's secret role in the 1953 Iran coup during an office move, when it believed copies existed someplace else.

An avoidable accident, but nothing about it suggests it was an accident or that the CIA had any interest in avoiding it. History may be written by the winners, but history can be erased by even the clumsiest losers. Not only are those files gone but any record of their destruction is missing as well.

“There is no written record confirming the destruction of the 1953 microfilmed cables” because “records of such routine destruction were themselves temporary and scheduled to be destroyed.”

The CIA, meanwhile, is complaining its ample budget simply can't cover the cost of digitizing everything related to leaks or personnel issues. If this is even remotely true, it exposes a serious flaw in agency priorities. The government apparently has plenty of money available for watching others, but very little set aside for being watched by the public.

Matthew Aid, an ex-intelligence officer and historian, puzzled over the rationale behind the National Security Agency storing "several hundred times the volume of the Library of Congress every single day as part of its global eavesdropping operations," while "the CIA can't afford to scan its records."

Regrettably, the NARA is pretty much powerless. It can make recommendations and ask for proposals, but it's all held together by toothless laws which have zero deterrent effect on agencies hoping to carve holes in their sketchy history with scheduled document destruction.

Filed Under: cia, deleting, leaks, national archives, records, records retention

As A New Wave Of Cyberattacks Rolls Out, Rep. Ted Lieu Asks What The NSA's Going To Do About It

from the ETERNALPWNAGE dept

Leaked NSA exploits have now been the basis for two massive cyberattacks. The first -- Wannacry -- caught hospitals and other critical infrastructure across several nations in the crossfire, using a tool built on the NSA's ETERNALBLUE exploit backbone. The second seems to be targeting Ukraine, causing the same sort of havoc but with a couple of particularly nasty twists.

This one, called Petya, demanded ransom from victims. Things went from bad to worse when email provider Posteo shut down the attacker's account. Doing so prevented affected users from receiving decryption keys, even if they paid the ransom.

It soon became apparent it didn't matter what Posteo did, no matter how clueless or ill-advised. There was no retrieving files even if ransoms were paid. Two separate sets of security researchers examined the so-called ransomware and discovered Petya is actually a wiper. Once infected, victims' files are as good as gone. No amount of bitcoin is going to reverse the inevitable. The ransomware notices were only there to draw attention to the infection and away from the malware's true purpose.

Both cases are considered to be attacks by nation states. Inconsistently-applied patches -- most of them released with zero information by Microsoft -- have led to an insane amount of damage.

Through it all, the NSA -- whose tools were leaked -- has remained consistently silent. There's been no indication if the agency is working to mitigate the ongoing threat or whether it's far more concerned with discovering who left behind the malware toolkit first exposed by the ShadowBrokers.

It's unlikely we'll hear much being said publicly by the agency, but Rep. Ted Lieu has sent a letter to NSA chief Mike Rogers demanding answers. The letter [PDF] points out both attacks have been based on NSA exploits (ETERNALBLUE and ETERNALROMANCE). Lieu also states he fears the attacks seen in the past few weeks are only the "tip of the iceberg." The agency's refusal to discuss the attacks apparently isn't going to fly anymore.

Lieu makes two requests: the first is for the agency to see if it has some sort of magic "OFF" switch just laying around.

My first and urgent request is that if the NSA knows how to stop this global malware attack, or has information that can help step the attack, NSA should immediately disclose it. If the NSA has a kill switch for this new malware attack, the NSA should deploy it now.

It's far more likely the NSA has information it would rather not share than it is the agency has a way to shut down this attack, much less prevent future variations on its ETERNAL theme. But that's directly related to the second part of Lieu's request: work with companies whose software is being exploited to prevent further attacks. If the NSA still has security holes it's hoping won't be patched anytime soon, the current situation would seem to call for a rethink of its exploit-hoarding M.O.

What may be in order is the NSA stepping up and playing defense. It has stated a desire to be a larger cog in the US cyberwar machinery, but often seems more interested in playing offense than pitching in to help on the defensive end. That may need to change quickly if the NSA isn't going to be seen as more of a problem than a solution.

Filed Under: attacks, cyberattacks, exploits, leaks, nsa, ransomware, russia, ted lieu, ukraine, vulnerabilities, warfare

Secret Defense Dept. Report Shows Manning Leaks Did No Serious Damage

from the confirming-unofficial-statements-from-US-officials dept

Prosecutors seeking to justify a lengthy sentence (and the abuses that had already occurred) in the Chelsea Manning case insisted the documents she leaked had caused serious damage to those exposed by them. They said this even as multiple government officials admitted the most the United States had suffered was some embarrassment.

Jason Leopold has obtained an official assessment of the Manning leaks which shows the same thing: no real damage was done.

Regarding the hundreds of thousands of Iraq-related military documents and State Department cables provided by the Army private Chelsea Manning, the report assessed “with high confidence that disclosure of the Iraq data set will have no direct personal impact on current and former U.S. leadership in Iraq.”

This doesn't necessarily mean no damage was done. But the report confirms the United States didn't suffer from the Manning leaks.

The report also determined that a different set of documents that was published the same year, relating to the U.S. war in Afghanistan, would not result in “significant impact” to U.S. operations. It did, however, have the potential to cause “serious damage” to “intelligence sources, informants and the Afghan population” and U.S and NATO intelligence collection efforts.

The report [PDF] also notes investigators located the encrypted Wikileaks "insurance" file -- one Julian Assange says he'll release the key to if he feels his ability to disseminate information is threatened. (Stay tuned!) The assessment concludes it's unlikely this file contains anything damaging either.

Based on public statements by Assange, the IRTF assesses with moderate confidence that the "Insurance File" does not contain any USG data beyond what the IRTF has already reviewed.

The document dates back to 2011. It may have been some use in Manning's defense during the trial (a defense severely limited by the nature of espionage proceedings). As Leopold notes, Manning was not allowed to view this report. Instead, she was forced to fight the charges blind while prosecutors cherry-picked portions of the report to bolster their arguments.

Not that any of this matters at this point. The damage has already been done to Manning's life. And Manning's prosecution likely serves as a low-key chilling effect to dissuade potential leakers and whistleblowers from publicly humiliating the US government. But it does show the government is willing to use evidence that doesn't actually exist to secure a conviction.

Filed Under: chelsea manning, damage, defense department, dod, leaks, state department
Companies: wikileaks