FOIA'ed Documents Show NSA Abuse Of Pen Register Statutes To Collect Content

from the subpoena-an-inch,-take-a-mile dept

New FISA court documents have been handed over to the EFF as the result of its long-running FOIA lawsuit. The new pile of documents is, unfortunately, very heavily-redacted, forcing readers to extrapolate a lot from the missing data.

One of the few released FISA court docs leaving anything legible concerns the NSA's use of pen register/trap-and-trace orders to collect content, rather than just dialed phone numbers. The NSA (along with the FBI) has been admonished for its abuse of these orders before, thanks to its insistence any numbers dialed are fair game, even if they could be construed as partial contents of calls -- i.e., communications.

What the NSA liked to scoop up were "post cut through dialing digits" -- any numbers dialed after the phone number itself. These numbers could contain such things as credit card numbers, menu selections for automated services, and other information that could not be considered a dialed phone number.

The FISA court put an end to this, noting (all the way back in 2006) the government's complaints it couldn't segregate phone numbers from post cut through digits were laughable. It cites a magistrate judge's denial of the government's PR/TT order for these very reasons and asks the government to explain what actions it had taken in response to this denial.

On July 19, 2006, the Honorable Stephen WM Smith denied a government application to acquire post-cut-through digits in a criminal investigation, expressly rejecting the government's argument that 18 U.S.C.3121(c) implicitly authorizes the acquisition of contents using a pen register/trap and trace device, given the current state of filtering technology In re Application of the United States for an Order Authorizing (1) Installation and Use of a Pen Register and Trap and Trace Device or Process. (2) Access to Customer Records, and Cell Phone Tracking, F.Supp.2d 2006 WL 2033877, at 6, 9 (SD. Texas, 2006).

Accordingly, the government is ordered to submit a written brief to the Court, no later than [redacted] discussing how, if at all, Magistrate Judge Smith's opinion affects the government's analysis of this issue as set forth in its Memorandum.

It also should be noted -- as the EFF's Aaron Mackey points out -- the NSA spent nearly eight years collecting internet metadata with pen register/trap-and-trace orders before being forced to give up this bastardization of this zero oversight collection method, which was written specifically to target dialed phone numbers only.

Ultimately, the EFF is disappointed with this document dump and will likely challenge the NSA's withholding of 12 requested documents in full. The NSA is supposed to deliver another set of documents from this lawsuit before the end of the year. But it's falling behind on its other obligations. The USA Freedom Act mandated timely declassification of FISA court opinions, but the ODNI (Office of the Director of National Intelligence) appears to be moving forward with as little transparency as possible. Twelve documents withheld, eleven documents delivered composed mainly of blacked-out text. Hopefully, we'll have more to work with when the NSA delivers its next batch sometime in the next couple of months.

Filed Under: fisa, foia, nsa, pen register, surveillance

NSA Warned Trump Staffers Against Personal Email/Device Use; Were Ignored

from the biggest-phish dept

Blatant hypocrisy aside, the Trump Administration's use of personal email accounts isn't just a low-flying middle finger to public records laws. It's also a stupidly insecure method for handling sensitive communications.

Senior adviser Jared Kushner continued to use his personal email account -- albeit in a limited fashion -- after taking his official position. He did this despite being warned by the nation's professional spooks that doing so was a really bad idea. Josh Meyer reports for Politico:

The National Security Agency warned senior White House officials in classified briefings that improper use of personal cellphones and email could make them vulnerable to espionage by Russia, China, Iran and other adversaries, according to officials familiar with the briefings.

The briefings came soon after President Donald Trump was sworn into office on Jan. 20, and before some top aides, including senior adviser Jared Kushner, used their personal email and phones to conduct official White House business, as disclosed by POLITICO this week.

As noted, the NSA also cautioned against the continued use of personal devices -- something that makes every admin official who still insists on using their own laptops and phones attack vectors for cybercriminals and state-sponsored attacks from unfriendly governments.

But whatever, it's just the nation's top intelligence experts talking. Use of personal devices and email accounts continued, despite admin staff being told to assume these were already compromised. At this point -- more than six months after that cautionary meeting -- it's likely bad guys are standing in line to access cycles on admin accounts and devices.

As Meyer notes, this isn't necessarily just a Trump administration issue. It's something that happens with every incoming president and their crew. No one wants to give up devices and email accounts and not many of them can be immediately convinced about the level of risk.

But the point remains: when the NSA explains what could possibly happen to insecure devices and accounts, its information is coming from a place of deep personal experience (as it were):

A second former U.S. intelligence official said that the NSA briefers understand how insidious the cyberespionage campaigns can be because they conduct similar operations against others.

So, it's not the only administration to play it fast and loose for the first several post-inauguration months. But it's the one that will (and should) take the most heat for it. For one, evidence is being amassed showing Russian interference and influence on the election run, if not on the administration itself. For another, it's an administration that found its way into office using Hillary Clinton's personal email server use as a springboard. The other problem is the Trump Team has decided to throw its energy into shutting down internal leaks rather than addressing its own security holes, which means info is probably being exfiltrated to state actors with something far more nefarious in mind than leaking docs to journalists.

Filed Under: jared kushner, nsa, security

NSA-Developed Crypto Technology No Longer Trusted For Use In Global Standards

from the I-just-can't-think-why dept

One of the most shocking pieces of information to emerge from the Snowden documents was that the NSA had paid RSA $10 million to push a weakened form of crypto in its products. The big advantage for the NSA was that it made it much easier to decrypt messages sent using that flawed technology. A few months after this news, the National Institute of Standards and Technology announced that it would remove the "Dual Elliptic Curve" (Dual EC) algorithm from its recommendations. But of course, that's not the end of the story. Betraying trust is always a bad idea, but in the security field it's an incredibly stupid idea, since trust is a key aspect of the way things work in that shadowy world. So it should come as no surprise that following the Dual EC revelations, the world's security experts no longer trust the NSA:

An international group of cryptography experts has forced the U.S. National Security Agency to back down over two data encryption techniques it wanted set as global industry standards, reflecting deep mistrust among close U.S. allies.

In interviews and emails seen by Reuters, academic and industry experts from countries including Germany, Japan and Israel worried that the U.S. electronic spy agency was pushing the new techniques not because they were good encryption tools, but because it knew how to break them.

The NSA has now agreed to drop all but the most powerful versions of the techniques -- those least likely to be vulnerable to hacks -- to address the concerns.

The Reuters report has interesting comments from security experts explaining why they opposed the new standards. Concerns included the lack of peer-reviewed publication by the creators, the absence of industry adoption or a clear need for the new approaches. There's also the intriguing fact that the UK was happy for the NSA algorithms to be adopted. Given the extremely close working relationship GCHQ has with the NSA, you can't help wondering whether the UK's support was because it too knew how to break the proposed encryption techniques, and therefore was keen for them to be rolled out widely. Certainly, the reason its representative gave for backing the two NSA data encryption methods, known as Simon and Speck, was feeble in the extreme:

Chris Mitchell, a member of the British delegation, said he supported Simon and Speck, noting that "no one has succeeded in breaking the algorithms.”

Moreover, it was only half-true: the Reuters story says that academics have already had "partial success" in finding weaknesses, which surely calls for a cautious approach and more research, rather than simply accepting the proposal and hoping for the best. And even the British representative had to admit that his NSA mates had totally blown it:

He acknowledged, though, that after the Dual EC revelations, "trust, particularly for U.S. government participants in standardization, is now non-existent."

As the NSA -- and also the W3C, thanks to its blessing of DRM in HTML -- will now find, regaining that lost trust will be a long and difficult process. Maybe others can learn from their (bad) examples.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: encryption, nsa, standards, trust

Report Details The NSA's Decade-Long Abuse Of Its Surveillance Powers

from the good-old-fashioned-American-sticktoitiveness! dept

As more documents are released -- whether due to FOIA lawsuits or the Intelligence Community's begrudging attempts at transparency -- more evidence continues to pile up indicating the NSA has always abused/misused its collection programs.

A report written for Demand Progress by foremost NSA wonk Marcy Wheeler compiles a 12-year run of NSA overcollection and underreporting. These findings are summarized (lol) in a couple-thousand-word piece Wheeler wrote for Motherboard. Either route you take, you'll see the NSA has been given a long leash by its overseers. The end result of this mostly hands-off approach speaks for itself. From the Demand Progress white paper [PDF]:

For almost 12 years, both under Section 702 and other programs before it, NSA was always engaging in or retaining some kind of electronic surveillance the FISC would go on to deem unauthorized, and NSA would only fix the problem when threatened with criminal sanctions.

The FISA Court may often appear to be a rubber stamp, but it's often constrained by a lack of information. The NSA goes to court facing no adversaries, so the assertions it makes about lawful collection and careful use of surveillance powers are rarely challenged. When they are, it's only because the problem has become too big for the NSA to ignore and, generally, too big to hide from the court.

When the FISA Court finally has enough info to take on improper surveillance, years of unconstitutional collection have already occurred. Section 702 powers have never not been abused by the NSA, as the court belatedly noticed in 2011.

After reviewing the government's plan for MCTs [multiple communication transactions], Judge John Bates explained that “[u]nder the totality of the circumstances, then, the Court is unable to find that the government’s proposed application of NSA’s targeting and minimization procedures to MCTs is consistent with the requirements of the Fourth Amendment.”

That came three years after these powers had been granted with the 2008 FISA Amendments Act. Judge Bates' decision did almost nothing to push the NSA towards more constitutional collection efforts.

The government failed to keep those promises, and for over five more years, the government conducted queries on upstream collection in violation of procedures Judge Bates approved in response to the 2011 disclosures. After the new violations were revealed in late 2016, FISC Judge Rosemary Collyer called those queries “a very serious Fourth Amendment issue,” and she later scolded the government for “the extent of non-compliance with ‘important safeguards for interests protected by the Fourth Amendment.

The FISA Court's rulings made it clear the NSA had been overcollecting in one form or another since 2004. Despite this, the NSA took its time purging the unlawful collections from its databases. In addition to these violations, the FISA Court has found five years of repeated violations in the NSA's bulk internet metadata program, along with unconstitutional phone record collection efforts that swept up domestic records it was never supposed to have, thanks to flaws in the NSA's de-tasking procedures. That overcollection apparently spanned five years, from 2008-2013.

The recently retired "about" collection was another problematic collection, almost guaranteed to net purely domestic communications with its keyword searches and lack of targeting. The shutdown was likely spurred by the FISA Court's refusal to approve the NSA's 2015 Section 702 requests. It may also have been a mercy killing meant to prevent oversight members like Ron Wyden from ever obtaining an answer on domestic communications swept up by the program.

But that shutdown doesn't prevent "upstream" collection of communications travelling along internet backbones in foreign countries, far beyond the reach of Section 702's limitations. Upstream collections will continue to snag domestic communications and the NSA seemingly has no way (or little interest) in preventing analysts from accessing these.

The report is a harrowing read that makes it explicitly clear the NSA's oversight is mostly nonexistent. It relies heavily on self-reporting by the NSA, which tends to guarantee surveillance violations will only be brought to the court's attention after years of misuse by the agency. The same goes for its Congressional oversight, which has zero power to compel more timely -- and complete -- reporting.

Beyond its surveillance issues, the NSA is also involved in other Constitutional violations.

When Congress passed the FISA Amendments Act in 2008, it required the government to follow the same notice provisions as used under traditional FISA. If prosecutors want to use “any information obtained or derived from” Section 702 in a trial, they must tell the defendant. Yet when the government pointed to attacks prevented using Section 702 in the wake of the Edward Snowden leaks, defendants in those cases had not received the required notice. For example, the defendant in the most celebrated case involving an attack thwarted using Section 702, Najibullah Zazi, did not receive notice until July 2015, over five years after he pled guilty.

The government only started giving such notices after it emerged that Solicitor General Don Verrilli falsely informed the Supreme Court that such defendants get notice, when in fact DOJ had a policy that ensured no defendant received notice of Section 702 surveillance for nearly five years.

Going hand-in-hand with these violations are the FBI's access to privileged communications -- harvested by the NSA -- despite having policies in place meant to prevent this very behavior.

Another persistent violation involves FBI’s failure to abide by its own minimization procedures requiring that the communications for targets who have been federally indicted be reviewed and, if pertaining to the charged matter, sequestered. This means that agents may have access to attorney-client communications collected using Section 702 at the same time the government is criminally prosecuting the target of the surveillance.

To think things are better now is to ignore how the NSA has acted over the past decade-plus. The National Intelligence Director is playing nice with (limited) transparency, but underlying flaws in the NSA's collection and minimization procedures are likely still causing multiple violations. Thanks to the secretive nature of its work and its rather lax oversight, violations happening today likely won't be revealed for years to come. And this report only covers what's known about the NSA's Section 702 collections. There are other authorities we know almost nothing about, like Executive Order 12333, which may allow the NSA to continue its Fourth Amendment violations but without having to fear after-the-fact reprisal from the FISA court.

Filed Under: fisa court, fisc, mass surveillance, nsa, section 702, surveillance

Released Snowden Doc Shows NSA Thwarting Electronic Dead Drops By Using Email Metadata

from the 'just-metadata'-strikes-again dept

The latest batch of Snowden docs published at The Intercept cover a lot of ground. The internal informational sheets from the Signals Intelligence Directorate include info on a host of surveillance programs that haven't been revealed by previous document dumps. Nor do they discuss the programs in full. As such, some of the information is limited.

One of those published last week mentions the NSA's targeting of internet cafes in Iraq and other Middle Eastern countries using a program called MASTERSHAKE. Using MASTERSHAKE, analysts were apparently able to drill down location info to which target was sitting in which chair at the cafes under surveillance.

Further down the page [PDF], past this brief mention of a program discussed more fully elsewhere, there's another interesting tidbit. Apparently, the NSA can suss out electronic dead drops using harvested metadata. (h/t Electrospaces)

[REDACTED] will be briefing on THERAPYCHEATER. This is a system that uses metadata analysis to detect and exploit the communication patterns of targets about whom the SIGINT system has no specific a priori knowledge. By identifying suspicious patterns in the access to draft folders of webmail accounts, THERAPYCHEATER will identify email addresses potentially being used in a form of covert communication known as a cyber dead drop. There are numerous examples in both SIGINT and collateral of terrorists using cyber dead drops to communicate operational information and plans.

Apparently, the tried-and-true surveillance workaround is no longer a secure option. One way to avoid surveillance of communications was to simply not communicate. Composing drafts in a shared email account was one to talk to others without risking interception.

As the paragraph states, this draft folder metadata is used to acquire new surveillance targets, based almost solely on the analyst's impression of account activity. Presumably from here, the NSA can move on to seeking access to the actual account to see what's hiding inside that's never been sent. Or, at the very least, keep an eye on traffic to and from the email account.

This was written in 2005 so access to email account metadata may be more limited, thanks to routine encryption. However, the metadata here refers to activity taking place within an account, suggesting the NSA does (or at least did) have access to certain types of account activity, rather than simply gathering metadata related to web-traversing communications.

Filed Under: dead drops, email, mastershake, metadata, nsa, surveillance

NSA Employees Routinely Undermined 'Non-Attributable' Web Access With Personal Web Use

from the ONE-OF-US dept

Another large batch of Snowden docs have been released by The Intercept. The new documents are part of the site's "SID (Signals Intelligence Directorate) Today" collection, a sort of interoffice newsletter featuring discussions of intelligence-gathering efforts the agency has engaged in, as well as more mundane office business.

The one discussed in this Intercept post details some careless opsec by Intelligence Community (IC) employees. Like anyone in any office anywhere, IC employees use their office computers to send personal email, shop online, and fritter away the downtime with some web surfing.

That's where they're running into problems. This SID Today document [PDF] deals with the IC's personal use of company computers -- namely, the "attribution" problem that develops when outside websites are accessed using IP addresses that can be traced back to the NSA and other IC components.

The IC uses a system called AIRGAP to provide internet access for IC employees while supposedly still preventing outsiders from tracing IP addresses back to sensitive locations. Set up in 1998 by "one of the world's largest internet providers," the system was supposed to provide non-attributable access to the outside internet world.

Unfortunately, as is detailed by the SID Today doc, the execution of AIRGAP was lacking.

One early concern about the firewall was that it funneled all internet traffic through a single IP address, meaning that if any activity on the address was revealed to be associated with U.S. spies, a broad swath of other activity could then be attributed to other U.S. spies. More IP addresses were subsequently added, but “occasionally we find that the ISP reverts to one address, or does not effectively rotate those assigned,” Speight wrote.

Speight added that the “greater security concern” was the very intelligence agents the system was designed to protect. “Despite rules and warnings to the contrary, all too frequently users will use AIRGAP for registering on web sites or for services, logging into other sites and services and even ordering personal items from on-line vendors,” Speight wrote in a classified passage. “By doing so, these users reveal information about themselves and, potentially, other users on the network. So much for ‘non-attribution.'”

It's the sort of simple carelessness that's almost unavoidable in large organizations. The NSA's effort to distance itself from its employees' internet use was thwarted by the ISP's funnel and IC employee sloppiness. As The Intercept points out, this mirrors some of the brainlessness exhibited by Russian hackers, who used a system designed to obscure their origin, but constantly undermined that protection by using the same system to log in to personal social media accounts.

The difference between the two is AIRGAP was just there to open a portal out of the IC's closed system. The Russian's system was designed to obscure the source of attacks. But the personal use of the IC's firewall/AIRGAP is still a violation of internal policy, as the document points out.

Rather than work towards preventing the unpreventable (personal web use), the IC set up another system -- OUTPARKS -- which provided more than 200 random IP addresses, all of which would be registered to an ISP, rather than the IC itself. Confusingly, the new system -- put in place in 2005 -- is also referred to as AIRGAP, primarily because IC employees are creatures of habit and referred to OUTPARKS as AIRGAP despite it being an entirely new, NSA-owned operation.

Ultimately, the document shows NSA employees are just like the rest of us: periodically bored and prone to using work computers for personal reasons.

Filed Under: covering tracks, mistakes, nsa, security

The NSA's Weird Interest In File Sharing Programs

from the National-Sharing-Agency dept

Another large Snowden document dump from The Intercept uncovers many more off-brand uses of NSA surveillance tools. The pile of documents come from the NSA's "SID (Signals Intelligence Directorate) Today" files, of which there are apparently thousands of available pages. The documents released late last week show that if it happened online, the NSA was looking at it.

According to documents provided by NSA whistleblower Edward Snowden, the spy agency formed a research group dedicated to studying peer-to-peer, or P2P, internet traffic. NSA didn’t care about violations of copyright law, according to a 2005 article on one of the agency’s internal news sites, SIDtoday. It was trying to determine if it could find valuable intelligence by monitoring such activity.

But it appears the NSA found very little worth observing.

“By searching our collection databases, it is clear that many targets are using popular file sharing applications,” a researcher from NSA’s File-Sharing Analysis and Vulnerability Assessment Pod wrote in a SIDtoday article. “But if they are merely sharing the latest release of their favorite pop star, this traffic is of dubious value (no offense to Britney Spears intended).”

The info in the SID Today publication [PDF] is a bit dated, as it shows BitTorrent trailing applications like eDonkey and KaZaa. Even though it was mostly popular albums traversing the internet pipes, the NSA still formed a File-sharing Analysis and Vulnerability Assessment (FAVA) "pod" to poke away at the infrastructure and search the shared files for data of national security interest. To do this, it had to strip away the layers of protection lying between the NSA and the contents of the files.

As many of these applications, such as KaZaA for example, encrypt their traffic, we first had to decrypt the traffic before we could begin to parse the messages. We have developed the capability to decrypt and decode both KaZaA and eDonkey traffic to determine which files are being shared, and what queries are being performed.

Breaking the encryption allowed the NSA to peer into users' computers via their shared folders, as well as harvest email addresses, country codes, user names, and lists of recent searches.

Even so, there was little actual intelligence to be gathered from the most popular file sharing applications of a decade ago. But that laid the groundwork for further examination of file sharing for national security reasons. A program called GRIMPLATE tracked BitTorrent use by Defense Dept. employees, checking to see if any of the swarms travelling in and out of the DoD's safe spaces was "malicious" -- a definition that presumably covers DoD employee exfiltration of sensitive files as well as possibly-harmful programs being downloaded to DoD computers.

Over in the UK, GCHQ was taking much more proactive steps toward turning torrent traffic into both a weapon and a source of intel.

The page describes DIRTY RAT, a GCHQ web application used by analysts that at the time had “the capability to identify users sharing/downloading files of interest on the eMule (Kademlia) and BitTorrent networks. … For example, we can report on who (IP address and user ID) is sharing files with ‘jihad’ in the filename on eMule. If there is a new publication of an extremist magazine then we can report who is sharing that unique file on the eMule and BitTorrent networks.”

The RAT was also tasked with gathering info to be shared with law enforcement. Child porn is name-checked in the document, as are the London Metro Police and FBI. But GCHQ wasn't interested in merely collecting info on users sharing illicit content. It also wanted to use the sharing platforms for malware delivery.

A tool called PLAGUE RAT “has the capability to alter the search results of eMule and deliver tailored content to a target,” the wiki article states. “This capability has been tested successfully on the Internet against ourselves and testing against a real target is being pursued.”

File sharing hasn't gone away, so it's indisputable both agencies are still eyeballing BitTorrent traffic. Considering a number of exfiltrated docs/software have been shared via the service, there are probably files of national security interest circulating along with movies, music, and games.

Filed Under: copyright, encryption, file sharing, nsa, surveillance

AG Sessions, DOJ Ask Congressional Leaders For A Clean, Forever Re-Authorization Of Section 702

from the also:-mandate-that-people-like-us dept

The DOJ and Attorney General Jeff Sessions have offered up their official plea for a clean reauthorization of Section 702 surveillance powers. These are due to expire at the end of the year, but so far there's been no concerted effort to subject it to greater restrictions -- at least nothing as cohesive as the opposition to Section 215 renewal that began shortly after the Snowden leaks started.

Unlike Section 215 phone records collections, the Section 702 collections at least appear to be somewhat useful in harvesting communications relevant to national security efforts. But these collections should be subjected to even greater scrutiny because of what they contain: communications. While the NSA may have ended its supremely vague "about" email collection program (which harvested emails talking about targets/keywords, along with those to and from actual targets), it appears to only have done so because it couldn't make it stop harvesting US persons' communications.

But none of that is mentioned in the Attorney General's letter to Congressional leaders. Instead, the request asks not only for a "clean" reauthorization, but a "forever" one as well.

We are writing to urge that the Congress promptly reauthorize, in clean and permanent form, Title VII of the Foreign Intelligence Surveillance Act (FISA), enacted by the FISA Amendments Act of 2008 (FAA), which is set to sunset at the end of this year.

Title VII of FISA allows the Intelligence Community, under a robust regime of oversight by all three branches of Government, to collect vital information about international terrorists, cyber actors, individuals and entities engaged in the proliferation of weapons of mass destruction and other important foreign intelligence targets located outside the United States. Reauthorizing this critical authority is the top legislative priority of the Department of Justice and the Intelligence Community. As publicly reported by the Privacy and Civil Liberties Oversight Board, information collected under one particular section of FAA, Section 702, produces significant foreign intelligence that is vital to protect the nation against international terrorism and other threats.

Whether or not the collections produce useful intel is beside the point. Congress very definitely should not remove the periodic renewal period for surveillance powers. Doing so would subject the powers to even less oversight. A periodic review period allows Congress to take recent events into account when determining how much surveillance power the government should have going forward. It also permits examination by fresh sets of eyes, some of which won't have been fully assimilated into the "national security above all else" way of thinking.

The reasons Congress shouldn't grant a clean, in-perpetuity re-auth are the very reasons Sessions wants Congress to never examine Section 702 collections again. The DOJ refers to a "comprehensive regime of oversight" in its letter, but that phrase greatly overstates the quality of surveillance oversight that's been provided over the past 15 years.

Given the administration's view -- along with the views of most of the party in power -- Sessions may get what he wants. If nothing else, he's relatively assured of walking away with a clean reauthorization -- barring the leak of any damning NATSEC documents between now and the end of the year. It may turn out the only reform effort put in place will be the NSA's voluntary ditching of the "about" collection.

Filed Under: jeff sessions, nsa, section 702, surveillance

North Carolina Election Agencies First Learned They'd Been Hacked From Leaked Documents Published By The Intercept

from the accelerated-disclosure dept

At the time, the documents leaked by NSA contractor Reality Winner -- showing Russian interference in the recent election -- didn't seem to be of much importance. They showed something that had long been suspected, but also showed the NSA performing the sort of surveillance no one really disapproves of. The documents were in the public's interest, but weren't necessarily of the "whistleblower" variety.

That aspect of the documents hasn't changed, but public interest in the unauthorized disclosure certainly has. In a post for Emptywheel, Marcy Wheeler takes on an NPR story about actions taken by electoral agencies as a result of the leak.

The company that provided the software for the poll books is VR Systems — the company that the document Reality Winner leaked showed had been probed by Russian hackers.

[S]usan Greenhalgh, who’s part of an election security group called Verified Voting, worried that authorities underreacted. She was monitoring developments in Durham County when she saw a news report that the problem pollbooks were supplied by a Florida company named VR Systems.

“My stomach just dropped,” says Greenhalgh.

She knew that in September, the FBI had warned Florida election officials that Russians had tried to hack one of their vendor’s computers. VR Systems was rumored to be that company.

Now, there's an investigation underway in North Carolina, linked directly to the documents leaked by Reality Winner. Josh Lawson, general counsel for the state's board of elections, said it first learned about the hacking from the Intercept's article.

Which makes you wonder when the federal government was going to get around to notifying affected state agencies. When local agencies are learning about Russian hacking from leaked documents rather than straight from the source, the downward flow of pertinent information seems to be more than a little broken.

Not that this news will do Winner any good as she heads to court. As noted by Ed Snowden earlier, and reaffirmed here by Marcy Wheeler, any positive outcomes resulting from leaked documents can't be raised by the defendant.

Last week, Magistrate Judge Brian Epps imposed a protection order in her case that prohibits her or her team from raising any information from a document the government deems to be classified, even if that document has been in the public record. That includes the document she leaked.

The protective order is typical for leak cases. Except in this case, it covers information akin to information that appeared in other outlets without eliciting a criminal prosecution. And more importantly, Winner could now point to an important benefit of her leak, if only she could point to the tie between her leak and this investigation in North Carolina.

With the protection order, she can’t.

This is generally how things go in espionage cases. This is what Snowden detractors ignore when they argue he should just return home and face a "fair trial." There are no fair trials in espionage cases. In Winner's case, the order is so broad it forbids her legal reps from discussing any classified document or any document they believe might be classified (or derived from classified documents), even if those documents have been leaked and published by journalistic entities.

The info in the leaked documents led to an investigation. This may excuse the leak in the minds of those whose first encounter with evidence of Russian hacking came from a site known for publishing leaks, rather than the federal government performing the surveillance that uncovered it. But this is of no use to Reality Winner, or any leaker in her position. No matter how much good may result from unauthorized disclosures, the government only cares about the authorization.

Filed Under: hacking, leak, north carolina, nsa, reality winner

Former NSA Official Argues The Real Problem With Undisclosed Exploits Is Careless End Users

from the sorry-about-all-the-ransomware dept

As leaked NSA software exploits have been redeployed to cause computer-based misery all over the world, the discussion about vulnerability disclosures has become louder. The argument for secrecy is based on the assumption that fighting an existential threat (terrorism, but likely also a variety of normal criminal behavior) outweighs concerns the general public might have about the security of their software/data/personal information. Plenty of recent real-world examples (hospital systems ransomed! etc.) do the arguing for those seeking expanded disclosure of vulnerabilities and exploits.

Former Deputy Director of the NSA Rick Ledgett appears on the pages of Lawfare to argue against disclosure, just as one would have gathered by reading his brief author bio. Ledgett's arguments, however, feel more like dodges. First off, Ledgett says the NSA shouldn't have to disclose every vulnerability/exploit it has in its arsenal, an argument very few on the other side of the issue are actually making. Then he says arguments against exploit hoarding "oversimplify" the issue.

The WannaCry and Petya malware, both of which are partially based on hacking tools allegedly developed by the National Security Agency, have revived calls for the U.S. government to release all vulnerabilities that it holds. Proponents argue that this would allow patches to be developed, which in turn would help ensure that networks are secure. On its face, this argument might seem to make sense—but it is a gross oversimplification of the problem, one that not only would not have the desired effect but that also would be dangerous.

At this point, you'd expect Ledgett to perform some de-simplification. Instead, the post detours for a bit to do some victim-blaming. It's not the NSA's fault if undisclosed exploits wreak worldwide havoc. It's the end users who are the problem -- the ones who (for various reasons) use outdated system software or don't keep current with patches. This isn't a good argument to make for the very reasons outlined in Ledgett's opening paragraph: software vendors can't patch flaws they're unaware of. This is where disclosure would help protect more users, even if it meant the loss of some surveillance intercepts.

Then Ledgett argues the NSA's leaked exploits weren't really the problem. If they hadn't been available, the malware purveyors just would have used something else.

The actors behind WannaCry and Petya, believed by some to be from North Korea and Russia, respectively, had specific goals when they unleashed their attacks. WannaCry seemed to be straightforward but poorly executed ransomware, while Petya appeared to have a more sinister, destructive purpose, especially in the early Ukraine-based infection vector. Those actors probably would have used whatever tools were available to achieve their goals; had those specific vulnerabilities not been known, they would have used others. The primary damage caused by Petya resulted from credential theft, not an exploit.

This is undoubtedly true. Bad actors use whatever tools help them achieve their ends. It's just that these specific cases -- the cases used by Ledgett to argue against increased disclosure -- were based on NSA exploits vendors hadn't been informed of yet. The patches that addressed more current vulnerabilities weren't issued until after the NSA told Microsoft about them, and it only did that because its toolset was no longer under its control.

Ledgett also points out that the NSA does better than most state entities in terms of disclosure:

Most of the vulnerabilities discovered by the U.S. government are disclosed, and at the National Security Agency the percentage of vulnerabilities disclosed to relevant companies has historically been over 90 percent. This is atypical, as most world governments do not disclose the vulnerabilities they find.

Maybe so, but there's not much honor than just being better than the worst governments. Ledgett only says the NSA is better than "most." This doesn't turn the NSA into a beacon of surveillance state forthrightness. All it does is place it above governments less concerned about the security and wellbeing of their citizens.

Ledgett then goes back to the well, claiming a) the two recent attacks had nothing to do with the NSA, and b) disclosing vulnerabilities would make the NSA less effective.

WannaCry and Petya exploited flaws in software that had either been corrected or superseded, on networks that had not been patched or updated, by actors operating illegally. The idea that these problems would be solved by the U.S. government disclosing any vulnerabilities in its possession is at best naive and at worst dangerous. Such disclosure would be tantamount to unilateral disarmament in an area where the U.S. cannot afford to be unarmed… Neither our allies nor our adversaries would give away the vulnerabilities in their possession, and our doing so would probably cause those allies to seriously question our ability to be trusted with sensitive sources and methods.

The problem here is that Ledgett ignores the obvious: leaked NSA tools helped create the problem. The NSA never disclosed these vulnerabilities to affected software vendors -- at least not until it became obvious it could no longer keep these tools secret.

I'm guessing the NSA is already living through the last part of Ledgett's paragraph. A set of effective, still-undisclosed vulnerabilities being digitally spirited away and dumped into the public's lap probably makes it less likely foreign surveillance partners will be sharing their malware toolkits with the NSA.

This leads right into another argument against vulnerability hoarding: it has been shown with complete clarity that the NSA can't guarantee its exploits will never be used by criminals and malicious governments. The leak of its toolkit shows any suggestion that only the "good guys" will have access to undisclosed vulnerabilities is both ignorant and arrogant. The NSA isn't untouchable. Neither are all the surveillance partners the NSA has shared its tools with.

In the end, it's the private sector's fault, according to Ledgett. The solution is for vendors to write better software and end users to patch more frequently. This is good advice, but not an absolution of the NSA's vulnerability secrecy.

The NSA needs to do better balancing its needs and the security of the general public. Very few people are arguing the NSA should have zero undisclosed exploits. But the exploits dumped by the Shadow Brokers affected older versions of Microsoft system software dating back to Windows XP and they still weren't patched until the exploits had already been made public. These were exploits some in the NSA thought were too powerful, and yet, the NSA did nothing until the malware offspring of its secret exploit stash were taking down systems all over the world.

Filed Under: disclosure, exploits, malware, nsa, rick ledgett, vep, vulnerabilities