Obama Plans Cosmetic Changes To NSA: Embraces 'The Spirit Of Reform' But Not The Substance

from the as-expected dept

The expectation all along was that the President's intelligence task force was likely to recommend cosmetic changes while leaving the worst abuses in place. And, in fact, many of us were quite surprised to see the panel's actual recommendations had more teeth than expected (though, certainly did not go nearly far enough). It was pretty quickly suggested that President Obama wouldn't support the most significant changes, and now that he's set to announce his plan on Friday, it's already leaked out that he's going to support very minimal reforms that leave the problematic spying programs of the NSA effectively in place as is.

Mr. Obama plans to increase limits on access to bulk telephone data, call for privacy safeguards for foreigners and propose the creation of a public advocate to represent privacy concerns at a secret intelligence court. But he will not endorse leaving bulk data in the custody of telecommunications firms, nor will he require court permission for all so-called national security letters seeking business records.

As the NY Times says, he's taking the political way out, making sure not to upset the surveillance hawks:

The emerging approach, described by current and former government officials who insisted on anonymity in advance of Mr. Obama’s widely anticipated speech, suggested a president trying to straddle a difficult line in hopes of placating foreign leaders and advocates of civil liberties without a backlash from national security agencies. The result seems to be a speech that leaves in place many current programs, but embraces the spirit of reform and keeps the door open to changes later.

Yeah, but embracing "the spirit of reform" is not actually doing any reform. It's a bullshit approach guaranteed not to win anyone's approval, which seems to be the way the president often operates. Say you're going to do something, then offer a weakly compromised version of the plan and pretend you've actually done something big. It's not leadership, it's "let's talk big, and do little."

As the NY Times says, this "largely codifies existing practices."

Basically, this whole charade simply dumps the whole thing back into Congress's hands to try to push through real reform -- meaning that rather than letting President Obama decide what to do, we need to get things like the USA Freedom Act passed as a starting point, followed by more significant surveillance freforms.

Filed Under: barack obama, national security letters, nsa, nsls, reform, section 215, surveillance

NSA Spying Includes Wireless Transmitters To Get Data Off 'Air Gapped' Computers

from the of-course-it-does dept

The latest report from the NY Times based on Snowden's revelations seems to jump all over the place, talking about a variety of efforts by the NSA to spy on people. Much of it seems to repeat earlier claims about the NSA's malware program, codenamed QUANTUM. It updates the earlier claims that there are 50,000 QUANTUM-infected computers to claim that the number is now 100,000. However, it also notes that most of the targets are exactly the kinds of things you'd expect the NSA to be spying on: the Chinese and Russian militaries, mainly.

Perhaps more interesting is that it builds on the reporting in Der Spiegel concerning the NSA's catalog of tech tools to infiltrate computers, to tie those back to the QUANTUM program, and note that many of the tools rely not on an internet connection, but on a secretly inserted radio transmitter, which can be picked up by a device in an "oversized suitcase" that can be placed miles away. By itself, none of this is all that surprising, but the documents certainly suggest the NSA is doing this on a larger scale than suspected in the past:

“What’s new here is the scale and the sophistication of the intelligence agency’s ability to get into computers and networks to which no one has ever had access before,” said James Andrew Lewis, the cybersecurity expert at the Center for Strategic and International Studies in Washington. “Some of these capabilities have been around for a while, but the combination of learning how to penetrate systems to insert software and learning how to do that using radio frequencies has given the U.S. a window it’s never had before.”

Again, these activities certainly seem more in line with what you'd expect the NSA to be doing, and raise (yet again) the question of why the NSA needs to "collect it all" when it appears that programs like these can be quite effective in doing targeted surveillance against those actually seeking to attack the US in some manner?

Separately, as the article notes, this has made the US's moral high ground concerning claims that China is doing similar surveillance on the US seem quite questionable. As the article notes, the US's attempted distinction between "national security" and "economic espionage" doesn't make much sense to many.

When the Chinese place surveillance software on American computer systems — and they have, on systems like those at the Pentagon and at The Times — the United States usually regards it as a potentially hostile act, a possible prelude to an attack. Mr. Obama laid out America’s complaints about those practices to President Xi Jinping of China in a long session at a summit meeting in California last June.

At that session, Mr. Obama tried to differentiate between conducting surveillance for national security — which the United States argues is legitimate — and conducting it to steal intellectual property.

“The argument is not working,” said Peter W. Singer of the Brookings Institution, a co-author of a new book called “Cybersecurity and Cyberwar.” “To the Chinese, gaining economic advantage is part of national security. And the Snowden revelations have taken a lot of the pressure off” the Chinese.

Of course, if the US were focused on actually increasing security on US computing systems and networks, rather than undermining them with backdoors and vulnerabilities, perhaps we'd be more protected from the Chinese. It's too bad that the NSA hasn't actually been helping on that front at all.

Filed Under: malware, nsa, quantum, spying, surveillance, wireless transmitters

Aaron Swartz Explains Why The NSA Needs To Be Stopped

from the from-beyond-the-grave dept

Last week, when we wrote about the big "day of action" against the NSA in memory of Aaron Swartz, to be held February 11th, a few folks questioned whether this was an appropriate issue, since they were unaware of Aaron being all that concerned about the NSA. Obviously, Aaron died months before the Snowden leaks, but as many folks who knew Aaron knew, the NSA was absolutely an issue he was quite concerned about even prior to the Snowden leaks. Brian Knappenberger, who has been working to put the finishing touches on his new documentary about Aaron, The Internet's Own Boy, in order to debut it at Sundance, has released an astounding trailer of the film (which looks amazing). Included in it, are multiple clips of Aaron actually speaking out about the NSA and surveillance, mainly focused on the NSA saying it can't possibly calculate how many Americans it's spying on, because to do so, would be either (a) impossible or (b) would violate their privacy (yes, at one point, they actually said figuring out how many people are being spied on would violate their privacy). So, yes, Aaron was quite concerned about the NSA, and it makes you wonder just how much we all lost in his death, because you have to expect that, as with SOPA, Aaron would have been an instrumental force in fighting back against the NSA as its overreach and abuses have been exposed. If you haven't yet, please go check out TheDayWeFightBack.org to learn more about the day of action.

Filed Under: aaron swartz, brian knappenberger, nsa, privacy, surveillance

Detailed Study Suggests NSA Rarely Useful In Stopping Terrorism

from the but-fear! dept

While we've already seen multiple detailed analyses of why the NSA's bulk collection of email data under Section 215 of the PATRIOT Act hasn't been particularly helpful in stopping any real terrorist attacks on the US, there are still other NSA programs as well. The folks over at the New America Foundation have put out a detailed new report looking at whether any of the NSA's programs have been effective. The report finds, exactly as everyone else has, that the Section 215 effort was only helpful in finding one guy who sent some money to Somalia. However, more importantly, it also looks at the other big NSA program, the one that comes under Section 702 of the FISA Amendments Act which includes (among other things) the PRISM program that got a lot of attention. Once again, the evidence of 702's usefulness is fairly minimal. The report finds that it was used in less than 5% of investigations of people charged with terrorism since 9/11.

The full report looks at all 225 individuals who were either part of Al Qaeda or an associated group and charged with terrorism since 9/11. In looking over every plot they were involved in, you see that much more traditional means of catching terrorists were involved in almost every case. There are community/family tips, informants, other non-NSA intelligence, routine law enforcement, self-disclosed by publicizing his own extremist activity, "suspicious activity" reports... and of course, plots that weren't actually prevented. There is, to be fair, a large number of plots where the discovery is from "unclear" means -- and it's entirely possible that some of those were discovered under the Section 702 programs. However, at the very least, this calls into question just how valuable either of these key NSA efforts really are.

Filed Under: 9/11, fisa amendments act, nsa, patriot act, section 215, section 702, terrorism
Companies: new america foundation

Researcher Says Simple Security Fixes From Carriers Would Have Prevented NSA Collection Of Cell Communications

from the we're-nos.-1-whatever,-why-try-harder? dept

Hanlon's Razor states: never attribute to malice that which is adequately explained by stupidity. Replace "stupidity" with "laziness" and you've got one researcher's theory as to why cell phone carriers failed to make basic efforts to provide a secure product -- one that would have prevented the NSA's collection of communications. (h/t to DSLreports)

The world's mobile phone carriers have failed to implement technology fixes available since 2008 that would have thwarted the National Security Agency's ability to eavesdrop on many mobile phone calls, a cyber security expert says.

Karsten Nohl, chief scientist with Berlin's Security Research Labs, told Reuters ahead of a highly anticipated talk at a conference in Germany that his firm discovered the issue while reviewing security measures implemented by mobile operators around the world…

None of the carriers surveyed had implemented measures for thwarting a method that allows the NSA to eavesdrop on most mobile calls by unscrambling a widely used encryption technology known as A5/1[…] Nohl said that method would have been blocked if carriers had applied two patches released in 2008.

Were carriers compelled to leave this hole open for NSA exploitation? It's a good question, but Nohl says the more likely explanation is that carriers simply didn't find the problem worth addressing.

"I couldn't imagine it is complicity. I think it is negligence," he said. "I don't want to believe in a worldwide conspiracy across all worldwide network operators. I think it is individual laziness and priority on network speed and network coverage and not security."

As has been observed everywhere, the path of least resistance is favored by many entities, even those not explicitly performing government work. Making a minimum of effort dumped customers' conversations right into the NSA's lap.

Of course, if the NSA had knocked on these carriers' doors and asked for a small favor, like leaving a security hole big enough to drive a semi full of unused privacy protections through, chances are many would have said, "Sure, why not." Verizon and AT&T have only very belatedly joined the national conversation on intelligence gathering, after spending months shuffling around the periphery while staring at the floor. For years, these providers have handed over everything the agency's asked for and shown an active interest in helping it anticipate what it might need next.

But Nohl's theory dismisses a worldwide conspiracy to dump cell phone customers' conversations into the waiting ears of the NSA -- something that's more likely to be true. While American carriers have proven to be useful NSA allies, very little has been exposed about the compliance rate of foreign carriers. Not that their resistance would matter much (or that they'd even be approached directly), as foreign intelligence agencies have been just as "helpful" as AT&T and Verizon in terms of granting access to data and communications -- much of which ultimately ends up in the NSA's sprawling lockboxes.

The moral here, if Nohl is correct, is that the industry's idle hands are the NSA's workshop. Not doing something can be just as harmful as complete complicity.

Filed Under: carriers, nsa, privacy, security, surveillance

NSA Officials Hate Ed Snowden With A Passion

from the yes,-emotional-response-is-what-we-need dept

Last week we wrote about Steven Levy's big article concerning the impact on the tech industry of the NSA's activities. This week, he's written a short piece about the two hours he got to spend at Fort Meade in the NSA's headquarters meeting with some of the NSA's top officials there. He explains how they didn't seem to want to cooperate at first, but then became much more accommodating later on. He notes that the NSA doesn't seem to recognize that "protecting" Americans and "breaking everyone's crypto" might be two goals that are at odds with one another. But, the main point he makes: NSA officials really, really, really seem to hate Ed Snowden's guts:

They really hate Snowden. The NSA is clearly, madly, deeply furious at the man whose actions triggered the biggest crisis in its history. Even while contending they welcome the debate that now engages the nation, they say that they hate the way it was triggered. The NSA has an admittedly insular culture — the officials described it as almost like a family.... NSA officials are infuriated that all this havoc was caused by some random contractor. They suggest that had Snowden been familiar with the culture and the ethos of the agency, understood the level of training undergone by its employees, seen the level of regulations and oversight, he would have been less likely to abscond with all those documents. (Snowden’s interviews indicate otherwise.) Still, they are stunned that someone “inside the fence” would do what Snowden did. Even if Snowden is eventually pardoned, he’d do well to steer clear of Fort Meade.

There's something kind of funny about the fact that they look down on him as being "some random contractor" and if only he'd really been a part of the "NSA family" that he'd "understand." That seems quite unlikely, but also suggests one of the many reasons why what the NSA is doing is so problematic. Any mission that involves people having to feel a "part of the group" to make sure that the surveillance isn't abused is a system that will be abused.

Even more troubling, is that the NSA still seems to be reacting emotionally to the whole thing. That's part of the reason they still seem unable to comprehend how much damage they've done -- not Snowden.

Filed Under: ed snowden, emotion, keith alexander, nsa, rick ledgett, steven levy, surveillance

NSA Goes From Saying Bulk Metadata Collection 'Saves Lives' To 'Prevented 54 Attacks' To 'Well, It's A Nice Insurance Policy'

from the this-is-why-no-one-trusts-them dept

Want to know why no one trusts anything NSA officials and their defenders have to say any more? When the bulk metadata collection was first revealed, those defenders went on and on about how the program "saved countless lives" and was instrumental in stopping terrorist attacks. Some skeptics then asked what terrorist attacks, and we were told "around 50" though details weren't forthcoming. Eventually, we were told that the real number was "54 terrorist events" (note: not attacks) and a review of them later revealed that basically none of them were legitimate. There was one "event" prevented via the program on US soil, and it was a taxi driver in San Diego sending some money to a terrorist group in Somalia, rather than an actual terrorist attack.

In fact, both judges and the intelligence task force seemed shocked at the lack of any actual evidence to support that these programs were useful.

And yet, the NSA and its defenders keep insisting that they're necessary. Director of National Intelligence, James Clapper, a few months ago, tried out a new spin, claiming that effectiveness wasn't the right metric, but rather "peace of mind." Of course, the obvious response to that is to point out that spying on everyone makes most of us fairly uneasy, and we'd have a lot more "peace of mind" if they dropped the program.

And, now, the NSA number 2 guy, who's about to retire, John C. "Chris" Inglis, gave a long interview with NPR, in which he is now claiming that even if the program hasn't been particularly useful in the past, that "it's a good insurance policy."

"I'm not going to give that insurance policy up, because it's a necessary component to cover a seam that I can't otherwise cover."

Basically, we want to keep this information because we want that information, even if it's not been shown to be at all useful. Of course, that's the same logic one can use to defend just about any violation of the 4th Amendment. Putting a private drone with a camera and a recording device streaming everything it sees and hears while following around NSA deputy director Chris Inglis may not discover that he's a corrupt bureaucrat willing to lie to the public, but it seems like a reasonable "insurance policy" to make sure he stays honest. After all, without that, the American public can't prove that he's not corrupt -- so it seems like a reasonable "insurance policy to cover a seam we can't otherwise cover." At least, in the logic of Chris Inglis.

Filed Under: bulk metadata, chris inglis, nsa, reforms, surveillance

In Memory Of Aaron Swartz, A Day Of Action Against The NSA

from the speak-up,-speak-out dept

A bunch of websites and organizations are teaming up today to announce a day of action against mass surveillance in honor of the passing of Aaron Swartz. It calls out to those who fought back against SOPA to now join in this effort as well -- as Aaron was deeply involved in both issues.

DEAR USERS OF THE INTERNET,

In January 2012 we defeated the SOPA and PIPA censorship legislation with the largest Internet protest in history. A year ago this month one of that movement's leaders, Aaron Swartz, tragically passed away.

Today we face a different threat, one that undermines the Internet, and the notion that any of us live in a genuinely free society: mass surveillance.

If Aaron were alive, he'd be on the front lines, fighting against a world in which governments observe, collect, and analyze our every digital action.

Now, on the eve of the anniversary of Aaron's passing, and in celebration of the win against SOPA and PIPA that he helped make possible, we are announcing a day of protest against mass surveillance, to take place this February 11th.

The idea is to use the 11th of February as a day similar to the big SOPA blackout day from two years ago. Except, rather than fighting to stop just a specific bill, this is designed to be a day to get the internet to speak out against mass surveillance. Check out the website at TheDayWeFightBack.com, and please consider supporting this and taking part.

Filed Under: aaron swartz, activism, day of action, nsa, surveillance

President Of CBS News Knew 'Reporter' John Miller Would Go Back To NYPD Before His 60 Min Propaganda Piece Aired

from the so-why-did-the-piece-still-air dept

So we've already discussed the massively conflicted John Miller, employed by CBS News while clearly being about to take a job in counterterrorism, reporting for 60 Minutes the most amazing pro-NSA propaganda infomercial you can imagine. At the time, the rumors were already swirling that Miller was about to take the job as head of counterterrorism for the NYPD, though he denied it. He also, laughably, insisted that he'd asked hard questions of the NSA, none of which made it to air (assuming he actually did ask hard questions). In response to all of this, Miller insulted his critics as not being real reporters (despite the fact many of them were), and then confirmed the big conflict that most people expected, taking the job that everyone knew he was going to take.

A NY Times piece on Miller notes that the offer to take the job was actually "informally" given to him over dinner with incoming police commissioner (and close friend of Miller) Bill Bratton on December 5th. That's a week and a half before 60 Minutes aired its piece. And, among the "everyone" who knew he was taking the job was... David Rhodes, the President of CBS News.

“As soon as the reports came out that de Blasio” -- Bill de Blasio, the city’s new mayor -- “was thinking of bringing Bratton back, I immediately assumed that John would be going too,” Mr. Rhodes said in an interview. “It was literally the first thing that I thought of.”

And yet... he still allowed Miller's highly conflicted story on the NSA to air. That raises all sorts of questions, especially for CBS News, whose editorial failings over the past few months have received a tremendous amount of attention.

Filed Under: 60 minutes, bill bratton, bill de blasio, cbs news, conflict of interest, david rhodes, john miller, nsa, nypd, propaganda
Companies: cbs

What The Intelligence Community Doesn't Get: Backdoor For 'The Good Guys' Is Always A Backdoor For The 'Bad Guys' As Well

from the get-with-the-program dept

Max Eddy, over at PC Mag, has a very interesting article about the experience of Nico Sell, of the company Wickr, talking about how an FBI agent casually approached her to ask if she'd install backdoors in her software allowing the FBI to retrieve information. As the article notes, this is how the FBI (much more so than the NSA) has acted towards many tech companies ever since attempts to mandate such backdoors by law failed (though, they're still trying). Some companies -- stupidly -- agree to this, while many do not. Those that do may think they're helping fight for "good," but the reality is different. They're opening up a huge liability on themselves, should the news of the backdoors ever get out, and at the same time, they're making their own product invariably weaker. As Sell pointed out to the FBI guy, she'd seen hackers piggyback on "lawful intercept" machines and learned:

"It was very clear that a backdoor for the good guys is always a backdoor for the bad guys."

Bruce Schneier, over at the Atlantic, recently made nearly the same point in talking about the massive costs of all of this NSA surveillance (as well as talking about the near total lack of benefits). There's the cost of running these programs that are massive. There is the fact that these programs will be abused (they always are). There are the costs of destroying trust in various tech businesses (especially from foreign users and customers). But just as important is the fact that the NSA, FBI and others in the intelligence community are flat out weakening our national security by installing backdoors that malicious users can and will find and exploit:

The more we choose to eavesdrop on the Internet and other communications technologies, the less we are secure from eavesdropping by others. Our choice isn't between a digital world where the NSA can eavesdrop and one where the NSA is prevented from eavesdropping; it's between a digital world that is vulnerable to all attackers, and one that is secure for all users.

As Schneier points out, to fix this, we need to recognize that security is more important than surveillance. The surveillance apologists always claim that their goal is security. If so, they have a funny way of showing it. The "solution" they've drummed up hasn't made us any more secure... it's made us less secure.

Filed Under: backdoors, encryption, fbi, nsa, security, vulnerabilities