Why The EU Needs To Get Audits For Tech Companies Right

from the it's-too-easy-to-get-it-wrong dept

Discussions over the right – or at least a good – way to regulate big tech companies are heating up in the European Union (EU). Several legislative proposals are set to be negotiated, with public and behind-the-scenes lobbying in full swing already. As with any regulation, a key question is how to hold corporate decisionmakers accountable for their actions and how to create transparency. Some of the ways this has typically been done in other industries include legally mandated corporate compliance regimes, rules for financial or supply chain transparency and mandatory risk assessments and audits. These ideas are coming to the tech sector now, too, especially with the draft “Digital Services Act” (DSA). The DSA suggests new due diligence rules for platforms such as Facebook and YouTube, for example, regarding what processes are in place for content moderation and how they deal with potential infringements on users’ fundamental rights. Audits are introduced to check whether companies comply with the DSA’s due diligence rules.

If done right, audits can be a valuable mechanism helping independent researchers, oversight bodies and the public hold tech companies accountable. If done poorly, audits will be mere check-the-box exercises with little value that might even hurt people and entrench platform power. That is why it will be crucial for the EU get the audit provisions in the DSA right. Four major issues, drawn from past experiences with audits and general risks associated with them, need to be taken into account.

First, there is the risk of a weak auditor or an auditor with only limited powers. Facebook’s and Google’s “privacy audits” in the US can be taken as an example. Each company was subjected to legally mandated scrutiny by the US Federal Trade Commission over data protection issues. Yet, what were at times billed as “privacy audits” turned out to be mere assessments that were later criticized as almost meaningless due to vague language and powers for the regulator.

Second, auditors can, conversely, be too powerful. If their mandate is ill-fitting or too broad, the auditing company or governmental agency that oversees global corporate giants like Facebook and Google might have quite a sway in what billions of people access, read and watch on the web. This could be abused for financial or political interests. Especially authoritarian leaders might try to tip the scale in their favors by controlling big tech companies, which has some lawmakers in the EU worried as well.

Third, the auditing process itself can lack clear guidance and oversight. Without quality control, what is meant to be a safety measure and to incentivize corporate compliance can turn into a check-the-box exercise. Unfortunately, there are grave examples for this danger: “Social audits”, aiming to certify suitable workplace conditions, especially in the clothing industry, have come under intense scrutiny, after audited companies’ factories burned or crumbled, killing hundreds of workers. A for-profit auditing system with little checks can be partly to blame. In the financial industry, bad and sometimes illegal business practices could not be stopped despite auditing regimes being in place, as the WireCard case in Germany illustrates. Similarly, the international “Dieselgate” scandal showed the limitations of overseeing car manufacturers.

Relatedly, fourth, audits need to have consequences if they reveal corporate malfeasance. An audit that shows how a company failed to follow the rules cannot only result in recommendations or a blow to the company’s reputation. Fines and, more importantly, changes in business practices and compliance processes are necessary.

In all four areas, the DSA needs improvement. To address the first two points on the strength or weakness of the auditor, it is crucial that the auditor’s tasks and powers are clearly delineated. For tech companies offering people news and information spaces, a top priority should be that auditors check corporate processes, not individual pieces of content. This means that the auditor should, for instance, monitor whether companies have suitable notice-and-action mechanisms, meaningful reporting standards about their online advertising practices and recommender systems as well as consumer protection measures in place. Determining the legality of content should be left neither to corporations nor governmental regulators, but to independent courts. This would ensure that platforms are held accountable, without establishing an all-powerful auditor. The DSA draft goes in this direction, but the tasks of the auditor need to be spelled out in greater detail.

In practical terms, it is not yet clear who could and should do the auditing. Looking towards established audits in other industries can be helpful but copying existing methods risks perpetuating its flaws (like with the social audits) and not accounting for the peculiarities of tech companies. It is presumptuous to assume that big accounting firms might just take on auditing tech companies. Auditing a company like Facebook, TikTok or Snapchat is not the same as auditing a bank or an insurer. Auditors need different skills and specific technical knowledge in this field, which many existing auditing outfits might not have yet. However, it is also ill-advised to blindly rely on young companies now claiming to audit tech companies or even “algorithms”, as there is no common definition of what such “algorithmic auditing” entails. For example, the Ada Lovelace Institute, a UK-based NGO, has identified four different ways to assess algorithmic systems and those can, in turn, contain different approaches. An industry has sprung up offering to audit algorithmic systems for biases and legal compliance but there are no standards for such audits or auditors. To ensure high-quality auditors and a system of checks and balances, the EU should define what audits are supposed to achieve and what is expected of auditors. A vetting process regarding the financial independence of platforms and auditors could be discussed, as well as guidelines for oversight and quality control. Otherwise, audits risk being a fig leaf for tech companies or, worse, a cover-up for systemic failures like with some “social audits”.

Lastly, the DSA’s remedies for failed audits and non-compliance need to be beefed up. An independent oversight entity should be enabled to stop abusive business practices and sanction companies. Promisingly, this idea on enforcement as well as some potential improvements to the auditing regime have been put forth by the European Parliament. With the DSA, the EU has the chance to build an auditing regime for digital platforms from scratch. It should strive to make it as structurally sound as possible to limit terrible outcomes like those described above. This is not far-fetched, because some platforms’ business practices have been linked to genocide, election interference and invasions of privacy, just to name a few risks.

Establishing clear rules for the content of audits, standards for the auditors themselves and consequences for tech companies would be a true EU innovation. It would ensure a watch-the-watchers approach for auditors and thus alleviate legitimate concerns that governmental or private auditors (especially if paid for by the platforms) undermine democratic oversight. Taken together, this would go a long way in improving accountability for tech companies.

Julian Jaursch is a project director working on platform regulation topics at Stiftung Neue Verantwortung (SNV), a Berlin-based not-for-profit, non-partisan tech policy think tank.

Filed Under: audits, content moderation, digital services act, dsa, eu, tech policy

Navy Officer Working For The NSA Caught Trying To Search Her Boyfriend's Son's Phone

from the self-starter-goes-for-illegal-snooping-right-out-of-the-gate dept

The NSA often makes statements following document leaks about its undying interest in protecting the rights of Americans, no matter how much might be swept up intentionally/incidentally by its surveillance programs. Undoubtedly, there is some sincerity in this statement. But the following story, based on information liberated by a Jason Leopold FOIA request, shows the NSA can be sincere about its desire to protect Americans' privacy while still doing very little to uphold that ideal.

A Navy officer stationed in Iraq “deliberately and without authorization” used an NSA database to try to pry into the mobile phone of her boyfriend’s son, according to a top secret NSA inspector general report obtained by BuzzFeed News.

The NSA discovered the violation about a month after it happened. The officer was undergoing training and had already taken two courses pertaining to the search and use NSA collections. But when this violation occurred, she had been given full access to NSA data stores to complete her final course.

During a training exercise, she entered her boyfriend’s son’s telephone number into a search field and tried to access data covering the span of a month on the prepaid telephone number. That phone was also used by other members of her boyfriend’s family, the report said.

But the officer had an excuse: according to the report [PDF], she said it was the "only telephone number she could think of at the time." The Inspector General found this excuse to be dubious at best.

"She could not explain why this telephone number came to mind instead of her own telephone number or any other number."

Now, here's where we get to the NSA's professed respect for Americans' Fourth Amendment rights. The level of respect will vary from person to person. Obviously, the Navy officer had zero respect for her boyfriend's son's rights. More troubling, her instructor apparently felt this violation wasn't a big deal.

When she entered the phone number, the system displayed a "bright red warning sign." This scared the officer but her instructor's response showed little concern about the violation the officer was attempting to engage in.

[H]er trainer, an Army officer, told her “not to worry” and to just clear out the various search fields on the database.

Neither the Navy officer nor her trainer reported the incident.

The NSA discovered the violation during an audit and reported it. This is good, but it's also limited to what the NSA chooses to report.

The Inspector General has noted in the past it is limited in its oversight abilities by the NSA and its reporting systems. The IG often has trouble compiling the information needed to make a determination about potential violations and there have been times where the NSA has actually destroyed information the IG has needed for investigations.

Much of what we know about the NSA's violations is self-reported. But this relies on the agency being forthcoming -- something it's not particularly known for. The gap between what's discovered and what's handed over by the agency has been noticed by its Congressional oversight and the FISA court. The latter, in particular, has noted the agency often delivers notification of violations months or years after the violations occur and has been routinely unwilling to clarify technical issues when discussing violations with the court.

In this case, the Navy officer claimed the violation was an "accident" that occurred during training. The Inspector General's office, however, viewed it as a deliberate misuse of highly-sensitive data. It appears the NSA sided with the officer. The only "punishment" handed out was another round of training. So, when the NSA claims it's doing everything it can to protect Americans from unlawful surveillance, it's a half-truth at best. If it was doing everything it could, it would have pushed this officer out of the rotation and replaced her with someone more likely to uphold the ideals the NSA claims it holds.

Filed Under: audits, nsa, spying, surveillance

Alex Halderman Clarifies: Not Sure If Election Was Hacked, But, Uh, Shouldn't Someone Be Checking To Make Sure?

from the that's-a-good-point dept

So lots of people have been discussing the story claiming that some e-voting experts believe the Clinton campaign should be asking for a recount in certain battleground states, where it's possible there were some e-voting irregularities. As we noted in our post, the story would barely be worth mentioning if one of the people involved wasn't Alex Halderman, a computer science professor we've been talking about for nearly a decade and a half, going back to when he was a student. Halderman is basically the expert on e-voting security -- so when he says something, it's worth paying attention.

Halderman has now posted something of a follow-up to the NY Magazine article clarifying his views and what he's suggesting. He's not saying there's evidence of a hack, but basically saying that no one knows if there was a hack or not, and because of that, there should be a recount as a way to audit the results to see if there were any irregularities.

After the election, human beings can examine the paper to make sure the results from the voting machines accurately determined who won. Just as you want the brakes in your car to keep working even if the car’s computer goes haywire, accurate vote counts must remain available even if the machines are malfunctioning or attacked. In both cases, common sense tells us we need some kind of physical backup system. I and other election security experts have been advocating for paper ballots for years, and today, about 70% of American voters live in jurisdictions that keep a paper record of every vote.

There’s just one problem, and it might come as a surprise even to many security experts: no state is planning to actually check the paper in a way that would reliably detect that the computer-based outcome was wrong. About half the states have no laws that require a manual examination of paper ballots, and most other states perform only superficial spot checks. If nobody looks at the paper, it might as well not be there. A clever attacker would exploit this.

There’s still one way that some of this year’s paper ballots could be examined. In many states, candidates can petition for a recount.

So, in effect, Halderman isn't saying that he's got evidence of e-voting fraud, but is simply arguing that if no one checks, no one will ever know. So we should check in order to be sure that there wasn't hacking. That's... pretty sensible.

Examining the physical evidence in these states — even if it finds nothing amiss — will help allay doubt and give voters justified confidence that the results are accurate. It will also set a precedent for routinely examining paper ballots, which will provide an important deterrent against cyberattacks on future elections. Recounting the ballots now can only lead to strengthened electoral integrity, but the window for candidates to act is closing fast.

Basically, the only way we can actually get an effective audit to see if there were any voting irregularities is to ask for a recount. The problem, of course, is a political one. If the Clinton campaign does call for a recount, it will immediately be seen as a political play, and lead to a ton of negative publicity. My guess is that the campaign won't want to go there. If we lived in a time where people were intellectually honest, the campaign could present it exactly the way Halderman has framed it -- not as a claim that they believe fraud happened, but rather as a way to ensure that the e-voting machines were accurate and not manipulated -- but does anyone think that the press (either those that supported or those that opposed Clinton) would treat it that way? It would become a complete mess in about two-and-a-half seconds.

And, that's unfortunate. Because as Halderman points out (and, like us, has been pointing out for over a decade), it absolutely is possible to hack most e-voting machines. Especially if the attacker is determined enough to do so:

Here’s one possible scenario. First, the attackers would probe election offices well in advance in order to find ways to break into their computers. Closer to the election, when it was clear from polling data which states would have close electoral margins, the attackers might spread malware into voting machines in some of these states, rigging the machines to shift a few percent of the vote to favor their desired candidate. This malware would likely be designed to remain inactive during pre-election tests, do its dirty business during the election, then erase itself when the polls close. A skilled attacker’s work might leave no visible signs — though the country might be surprised when results in several close states were off from pre-election polls.

Could anyone be brazen enough to try such an attack? A few years ago, I might have said that sounds like science fiction, but 2016 has seen unprecedented cyberattacks aimed at interfering with the election. This summer, attackers broke into the email system of the Democratic National Committee and, separately, into the email account of John Podesta, Hillary Clinton’s campaign chairman, and leaked private messages. Attackers infiltrated the voter registration systems of two states, Illinois and Arizona, and stole voter data. And there’s evidence that hackers attempted to breach election offices in several other states.

In all these cases, Federal agencies publicly asserted that senior officials in the Russian government commissioned these attacks. Russia has sophisticated cyber-offensive capabilities, and has shown a willingness to use them to hack elections. In 2014, during the presidential election in Ukraine, attackers linked to Russia sabotaged the country’s vote-counting infrastructure and, according to published reports, Ukrainian officials succeeded only at the last minute in defusing vote-stealing malware that was primed to cause the wrong winner to be announced. Russia is not the only country with the ability to pull off such an attack on American systems — most of the world’s military powers now have sophisticated cyberwarfare capabilities.

So, yes, it would be good if the votes here were reviewed, if only as an opportunity to explore the potential problems of e-voting machines, rather than as a political ploy. The only problem is that everyone would see it as a political ploy and with political ploys comes general dumpster fires of idiocy.

Filed Under: alex halderman, audits, democracy, donald trump, e-voting, hillary clinton, voting

NSA On Snowden's Claims Of Passing Around Nudie Pics: We Totally Wouldn't Allow That... If We Knew About It

from the but-they-don't,-so dept

Following on the news that Ed Snowden told the Guardian how NSA employees routinely passed around pictures they had intercepted of "extremely attractive" people who were naked, the NSA has issued one of its typical non-denial denials. In an email to Forbes' Kashmir Hill, NSA spokesperson Vanee Vines basically said, "If we knew about it, that wouldn't be allowed":

“NSA is a professional foreign-intelligence organization with a highly trained workforce, including brave and dedicated men and women from our armed forces,” said spokesperson Vanee Vines by email. “As we have said before, the agency has zero tolerance for willful violations of the agency’s authorities or professional standards, and would respond as appropriate to any credible allegations of misconduct.”

Except, of course, what nearly every story talking about this has left out is that this is hardly the first such revelation. The NSA has a history and pattern of this kind of thing. Back in 2008, it was revealed that NSA analysts had been listening in on and passing around tapes of Americans having phone sex:

Not only were calls between Americans listened to and recorded on a regular basis, the "good parts" (i.e., phone sex) were sent around to other operators to listen to as well. One of the operators said that on a regular basis messages would be sent around with messages like: "Hey, check this out. There's good phone sex or there's some pillow talk, pull up this call, it's really funny, go check it out."

Even if we take the NSA at its word that it has a "zero tolerance" policy for this kind of thing, that actually makes the story even worse. Because it just shows how weak (to non-existent) the NSA's "100% auditability" really is. Keith Alexander insisted that everything done by people with access to these databases was tracked and audited. But it's becoming increasingly clear that that's not true at all. And it makes you wonder just how much abuse is going on that the NSA has no idea about -- potentially for things even worse than listening in on phone sex or passing nudie pics around the office.

Filed Under: abuse, auditability, audits, ed snowden, nsa, nudie pics, surveillance, zero tolerance

Snowden Says NSA Employees 'Routinely' Passed Around Naked Photos That Had Been Intercepted

from the because-of-course-they-would dept

One of the repeated talking points by the NSA for years has been about how there are all these "strict controls" on who has access to data and how it's used. We've seen pretty clear evidence that the NSA's definition of "strict controls" (like so many NSA definitions of plain English words and phrases) is different than what most people consider "strict controls." After all, it insisted for months that Snowden didn't have any access to actual surveillance data... until it was revealed that he did. There were also all those cases of flagrant abuses of the NSA's system that were revealed last fall. The NSA pretended this showed how good they were at catching anyone who abused the system, but the details suggested otherwise. Many of the "caught" abuses only came out years later when the people who abused the systems to spy on lovers and friends admitted to it during interviews.

Keith Alexander insisted that the NSA had "100% audibility" of the actions of their employees and they made sure that no one abused their powers:

"The assumption is our people are just out there wheeling and dealing. Nothing could be further from the truth. We have tremendous oversight over these programs. We can audit the actions of our people 100%, and we do that," he said.

Addressing the Black Hat convention in Las Vegas, an annual gathering for the information security industry, he gave a personal example: "I have four daughters. Can I go and intercept their emails? No. The technical limitations are in there." Should anyone in the NSA try to circumvent that, in defiance of policy, they would be held accountable, he said: "There is 100% audibility."

Of course, that doesn't explain why so many of the "LOVINT" cases only came out after people self-confessed many years later, rather than through any audits.

Meanwhile, in the latest Ed Snowden interview (done with the Guardian's Alan Rusbridger), Snowden reveals that NSA employees routinely would share naked photos that had been intercepted:

“You've got young enlisted guys, 18 to 22 years old,” Snowden said. “They've suddenly been thrust into a position of extraordinary responsibility where they now have access to all of your private records. In the course of their daily work they stumble across something that is completely unrelated to their work in any sort of necessary sense. For example, an intimate nude photo of someone in a sexually compromising position. But they're extremely attractive.

“So what do they do? They turn around in their chair and show their co-worker. The co-worker says: ‘Hey that's great. Send that to Bill down the way.’ And then Bill sends it to George and George sends it to Tom. And sooner or later this person's whole life has been seen by all of these other people. It's never reported. Nobody ever knows about it because the auditing of these systems is incredibly weak. The fact that your private images, records of your private lives, records of your intimate moments have been taken from your private communications stream from the intended recipient and given to the government without any specific authorization without any specific need is itself a violation of your rights. Why is that in a government database?”

Then Alan Rusbridger, The Guardian’s editor-in-chief, asked: “You saw instances of that happening?”

“Yeah,” Snowden responded.

“Numerous?”

“It's routine enough, depending on the company that you keep, it could be more or less frequent. These are seen as the fringe benefits of surveillance positions."

Of course, none of this is really that new. Way back in 2008, you may recall, that it was revealed that NSA analysts were listening in on pillow talk phone calls between Americans overseas and loved ones back home... and sharing those recordings around the office:

Not only were calls between Americans listened to and recorded on a regular basis, the "good parts" (i.e., phone sex) were sent around to other operators to listen to as well. One of the operators said that on a regular basis messages would be sent around with messages like: "Hey, check this out. There's good phone sex or there's some pillow talk, pull up this call, it's really funny, go check it out."

That was revealed years before Snowden even worked for the NSA. It would appear that little has changed.

Filed Under: audits, controls, ed snowden, naked pictures, nsa, surveillance

NSA Still Has No Idea How Many Documents Snowden Took... But Insists We Can Trust Them Because They Audit Everything

from the there's-a-disconnect-there dept

In the ongoing saga over the NSA's snooping on just about everyone, the one message the NSA and its defenders keep going back to is this idea that we need to "trust" them. And they insist that the trust is fine because everything they do is carefully monitored and audited. In John Oliver's recent interview with former NSA boss, General Keith Alexander, Alexander insisted that this kind of tracking and auditing was fool-proof, claiming that it had caught the twelve people who had abused their authority to spy on specific individuals. Except that Alexander was flat out lying there. First of all, internal investigations have shown thousands of abuses, not just twelve. As for the twelve that Alexander is talking about, when we looked through the details, it became clear that only three of the twelve were caught because of audits. And many were only caught because the guilty party later confessed -- sometimes many years later.

In other words, all this talk of how we should "trust" the NSA because its audits are so good... don't pass the basic laugh test. Yes, twelve people were caught, but nine of them were caught because they confessed themselves or others turned them in. Your guess is as good as mine about how many others abused the system without getting caught at all. Alexander insists that number is zero, but he has no way to know that.

Meanwhile, every time the NSA talks about how wonderful its auditing system is, it seems worthwhile to remind them that Edward Snowden walked out the door with a bunch of documents and no one noticed. At all. As we've been pointing out for months, that should call into question just how good those "audits" are.

And, to make this point even clearer: nearly a year after Snowden walked out the door with all of those documents, the NSA still has no idea what he took. As Glenn Greenwald points out, Alexander is still saying the NSA has no idea how much Snowden took:

AFR: Can you now quantify the number of documents [Snowden] stole?

Gen. Alexander: Well, I don’t think anybody really knows what he actually took with him, because the way he did it, we don’t have an accurate way of counting. What we do have an accurate way of counting is what he touched, what he may have downloaded, and that was more than a million documents.

In fact, the NSA keeps changing its story on how many documents. Early on, Greenwald had suggested it was in the 60,000 to 70,000 range. Just a few days ago, Ewan MacAskill, the often-overlooked Guardian reporter who was with Greenwald and Laura Poitras when they first met Snowden, told a conference that Snowden had 60,000 documents. Yet, by November, the NSA was claiming it was over 200,000 documents. And in December it suddenly jumped to 1.5 million, and then days later, 1.7 million -- based on the assumption, as Alexander admits above, that Snowden took everything he "touched."

But just that very admission highlights that the auditing system the NSA keeps insisting we should trust is completely broken. As we've noted, if the NSA can't tell how its own systems are being used, then it has no idea how they're being abused. Even worse, the NSA has no idea if other people with powers similar to Snowden may have taken other documents and given them to those who actually mean to do us harm, rather than reporters looking to serve the public interest.

In admitting that the NSA has no way of knowing what Snowden did, Alexander is admitting that all this talk of the infallible audit system is all smoke and mirrors. And, because of that, the claims that we can trust the NSA not to abuse its systems are equally untrustworthy.

Filed Under: audits, ed snowden, keith alexander, nsa, surveillance

NSA Still Not Sure What Snowden Took, But May Try To Pre-empt Future Leaks

from the getting-ahead-of-the-story dept

We've been among those who have suggested that the best way for the NSA to deal with the upcoming NSA leaks is to just stop lying and come clean about what they're doing. It's such a crazy suggestion that even former NSA boss Bobby Ray Inman has suggested it as well. It looks like the NSA is considering revealing something, but it's likely to be pretty limited:

With respect to other information held by Snowden and his allies but not yet publicized, the NSA is now considering a proactive release of some of the less sensitive material, to better manage the debate over its surveillance program.

"We're working on how do we do that," says Richard Ledgett, the NSA official in charge of the agency's response to the Snowden disclosures.

This came following a story about Keith Alexander claiming that Snowden may have taken "up to 200,000" documents with him -- a number that has generated some headlines. Of course, when you read the details, you realize that while Alexander quoted a range that had 200,000 as the ceiling, it also notes that officials at the NSA "remain unsure which documents he downloaded for leaking to the media." Yes, nearly six months in, they still don't know what he took. And this is the agency saying that they have such great audits that no one can abuse their systems? Really?

Glenn Greenwald has already mocked the claim of 200,000 documents (and, I was pretty sure in the past he had put the number in the tens of thousands -- closer to 60,000). But, once again, we're left wondering how the NSA can claim it has controls in place when it still has no idea what happened. Either way, open on up, NSA. Let's see what you've got. I'm sure that each attempt to spin things will be quickly debunked by actual documents from Snowden.

Filed Under: audits, eric holder, keith alexander, leaks, nsa, nsa surveillance, pre-emptive leaks, surveillance

NSA Has Spurred Renewed Interest In Thorough Security Audits Of Popular 'Secure' Software

from the skepticism-is-a-good-thing dept

In yet another bit of fallout from the NSA surveillance efforts -- and, specifically, the NSA's covert takeover of security standards to insert vulnerabilities -- it appears that there's suddenly much more skepticism towards well-known security offerings. This is a good thing. There have already been some revelations concerning attempts to compromise Tor, and security researcher Matthew Green has now called for a thorough security audit of TrueCrypt, the (very) popular disk encryption tool. Green and some others have kicked off the project on the aptly named website IsTrueCryptAuditedYet.com.

As Green notes, he is not suggesting that TrueCrypt is not secure, or that it's been compromised, but that in this day and age, security software needs to be properly audited -- and, if anything, hopefully the results of such an audit will be either more secure software or more confidence that TrueCrypt really is secure.

Maybe nothing at all. Rest assured if I knew of a specific problem with Truecrypt, this post would have a very different title -- something with exclamation points and curse words and much wry humor. Let me be clear: I am not implying anything like this. Not even a little.

The 'problem' with Truecrypt is the same problem we have with any popular security software in the post-September-5 era: we don't know what to trust anymore. We have hard evidence that the NSA is tampering with encryption software and hardware, and common sense tells us that NSA is probably not alone. Truecrypt, as popular and widely trusted as it is, makes a fantastic target for subversion.

But quite frankly there are other things that worry me about Truecrypt. The biggest one is that nobody knows who wrote it. This skeeves me out. As Dan Kaminsky puts it, 'authorship is a better predictor of quality than openness'. I would feel better if I knew who the TrueCrypt authors were.

Now please don't take this the wrong way: anonymity is not a crime. It's possible the Truecrypt developers are magical security elves who are simply trying to protect their vital essence. More prosaically, perhaps they live in a country where privacy advocates aren't as revered as they are in the US. (I kid.)

Hopefully, the end result of this new found skepticism towards popular security products will lead to a world in which we really are more secure, rather than one in which the NSA just has people thinking they're more secure.

Filed Under: audits, matthew green, nsa, nsa surveillance, security, truecrypt

Details Reveal NSA Track Record Of Flagrant Abuse, Failed Audits And Minimal Accountability

from the self-reported? dept

For months, the NSA and its defenders insisted that for all of the details that Ed Snowden's leaks revealed, at least there weren't any signs of intentional abuses. Even President Obama insisted that the lack of intentional abuses proved that the systems were working. And, then, of course, it came out that there actually have been a series of intentional abuses (which were apparently just revealed to the Senate Intelligence Committee, which is supposed to be in charge of oversight, right before the public found out about it). We were told of approximately one willful violation per year, with many being classified as "LOVINT" for someone spying on a "love interest."

Senator Grassley asked the Inspector General of the NSA to reveal the details of those abuses, and the Inspector General has done so, revealing the details, circumstances, investigations and punishments regarding the twelve known intentional violations (without revealing names). I say "known" intentional violations because reading through these, it quickly becomes clear that there are likely many, many more intentional violations, but it's just that the NSA doesn't know about them. For all the claims of the NSA's audit abilities, it appears that many of these intentional violations were caught via self-reporting or other suspicions, rather than an audit. And, many of them were caught quite a while after the violation happened. Let's go through the revealed abuses:

In 2011, before an upcoming reinvestigation polygraph, the subject reported that in 2004, "out of curiosity," he performed a SIGINT query of his home telephone number and the telephone number of his girlfriend, a foreign national. The SIGINT system prevented the query on the home number because it was made on a US person. The subject viewed the metadata returned by the query on his girlfriend's telephone.

Note: this only came about because the guy admitted to it before undergoing a polygraph. But, also important, this came out seven years later. Yes, the system stopped the query on his home phone number, but apparently that didn't raise any alarm bells at all to look at his other queries done around the same time. If this only came out because the guy admitted it, how many NSA analysts have done the same and just never admitted it?

Oh, and while the investigation found that the person broke the law, the DOJ declined to prosecute (protect your own!), and the guy retired in 2012 without any disciplinary action.

In 2005, during a pre-retirement reinvestigation polygraph and interview, the subject reported that, in 2003, he tasked SIGINT collection of the telephone number of his foreign-national girlfriend without an authorized purpose for approximately one month to determine whether she was "involved with any [local] government officials or other activities that might get [him] in trouble."

Once again, this wasn't discovered via an audit, but rather the person admitting it years later. Not only that, but he was able to view a month's worth of data. It also appears that this person wasn't punished, and the NSA doesn't even have a record of whether or not the issue was referred to the DOJ.

In 2004, upon her return from a foreign site, the subject reported to NSA Security that, in 2004, she tasked a foreign telephone number she had discovered in her husband's cellular telephone because she suspected that her husband had been unfaithful. The tasking resulted in voice collection of her husband.

Once again, this is self-reported (though, at least it happened in the same year!). Also, it's important to note that this does not appear to be metadata, but voice collection. Remember how the NSA's defenders keep talking about not collecting contents of phone calls? Yes, well that's "under this program." The NSA has many programs. Sometimes they can collect the content of phone calls for important things like checking to see if your husband is spying on you. Also: no punishment because the woman resigned.

In 2003, the appropriate OIG was notified that an employee had possibly violated USSID 18. A female foreign national employed by the U.S. government, with whom the subject was having sexual relations, told another government employee that she suspected that the subject was listening to her telephone calls. The other employee reported the incident.

The investigation determined that, from approximately 1998 to 2003, the employee tasked nine telephone numbers of female foreign nationals, without a valid foreign intelligence purpose, and listened to collected phone conversations while assigned to foreign locations. The subject conducted call chaining on one of the numbers and tasked the resultant numbers. He also incidentally collected the communications of a U.S. person on two occasions.

Once again, this wasn't any audit that caught it. It was the woman, who was savvy enough to suspect her lover was spying on her, telling someone which resulted in the investigation. And, then it was discovered that this had gone on for five years without being caught, and it wasn't just over this one woman. Oh, and, again he was listening in on actual phone calls. Not just "metadata." At least in this case, he was "suspended without pay," but he then resigned before any other discipline could be handed out.

The employee's agency discovered that an employee had misused the SIGINT collection system between 2001 and 2003 by targeting three female foreign nationals.

Not much detail here, but again, it went on for years before someone noticed, and it doesn't sound like a regular audit found it, though I guess it's possible. Yet again, the guy just resigned with no punishment.

As the result of a polygraph examination, it was discovered that an employee had accessed the collection of communications on two foreign nationals.

It's not clear when this happened and how long it took to discover it, because they don't say. But, again, it wasn't an audit that discovered the problem, but a polygraph -- and polygraphs are notoriously ineffective, and can be beaten. Does anyone actually believe that every NSA analyst who's taken a polygraph test was forced to admit the times they abused the system? At least this guy was very slightly punished: 10 days suspension without pay, and a recommendation for a promotion was withdrawn (and a "one-year letter of reprimand" was appended to his file).

In 2011, the NSA OIG was notified that, in 2011, the subject had tasked the telephone number of her foreign-national boyfriend and other foreign nationals and that she reviewed the resultant collection. The subject reported this activity during an investigation into another matter.

The subject asserted that it was her practice to enter foreign national phone numbers she obtained in social settings into the SIGINT system to ensure that she was not talking to "shady characters" and to help mission.

Oh right. Forget the "reasonable and articulable suspicions" standard. Apparently this analyst thought it was the "shady character" standard that she was being held to. And, yes, once again, this was self-reported. Furthermore, just the fact that she seemed to think that this was a perfectly reasonable use of the system highlights how all the claims from the NSA and its defenders that its analysts are so well-trained to not abuse the system is a load of bunk. And, once again, the woman resigned before any punishment.

In 2005, the NSA OIG was notified that, on the subject's first day of access to the SIGINT collection system, he queried six e-mail addresses belonging to a former girlfriend, a U.S. person, without authorization. A site review of SIGINT audit discovered the queries four days after they had occurred.

The subject testified that he wanted to practice on the system and had decided to use this former girlfriend's e-mail addresses. He also testified that he received no information as a result of his queries and had not read any U.S. person's e-mail.

Hey, look, finally on case number eight we have one that was caught by an audit. It turns out that there actually are some audits somewhere, even if they missed all those other cases. Still, I do love this story. On the guy's first day of access he went immediately to search his girlfriend's emails. Also, this raises some other questions, since while it's known that the NSA has built a database of phone records, there's been a lot less discussion on email records, so it makes you wonder which database he was querying. This guy also got a bit of punishment: reduction in grade, 45 days restriction, 45 days of extra duty (he was in the military obviously) and half pay for two months. It was also recommended that he not be given a security clearance (now there's an idea...).

In 2006, the Office of Oversight and Compliance within NSA's Signals Intelligence Directorate informed NSA OIG that, between 2005 and 2006, the subject had without authorization queried in two SIGINT systems the telephone numbers of two foreign nationals, one of whom was his girlfriend. On one occasion, the subject performed a text query of his own name in a SIGINT system.

The OIG investigation found that the subject queried his girlfriend's telephone number on many occasions and her name on two. He testified that he received only one "hit" from the queries on the girlfriend. Another number he queried, that of a foreign national language instructor, returned "insignificant information."

The subject claimed that he queried his name to see if anyone was discussing his travel and the telephone numbers to ensure that there were no security problems.

I really do love the excuses these guys come up with. Either way, we've got yet another case of this practice going on for a while before being discovered, and it not being discovered via any audit.

In 2008, the NSA OIG was notified that a SIGINT audit had discovered a possible violation of USSID 18. A investigation revealed that, while reviewing the communications of a valid intelligence target, the subject determined that the intelligence target had a relative in the U.S. The subject queried the SIGINT system for the e-mail address of the intelligence target in 2008 and used other search terms to obtain information about the target's relative.

Hey, once again the audit finally shows up. The guy got a "written reprimand."

In 2009, the NSA OIG was notified that, in 2009, a military member assigned to a military tactical intelligence unit queried the communications of his wife, who was also a military member stationed in a foreign location. The misuse was discovered by a review of SIGINT audit logs. The investigation by his military unit substantiated the misuse.

Hurray for another one caught by an audit. This guy received similar punishment as the other military member above (reduction in rank, 45 extra days of duty, half pay for two months) and had the issue referred to the DOJ, though it doesn't sound like the DOJ did anything about it.

i> In 2009, a military unit at a foreign location notified the NSA OIG that, in 2009, a military member had queried a country's telephone numbers to aid in learning that country's language. The misuse was discovered by a review of SIGINT audit logs.

And there we are. One more victory for the audit, but what an abuse, huh? Apparently purchasing a copy of Rosetta Stone was too pricey, so why not just sift through an entire country's phone system to get some "real folks" to help him learn the language.

Either way, the pattern is clear. While audits did catch a few extreme cases, many of the other intentional misuses of SIGINT were only discovered (often years later) thanks to the person themselves admitting it. I don't see how anyone can read those and not realize that it's likely that there are many, many, many more similar abuses, that were just never self-reported, meaning people got away with them. I don't see how the NSA and its defenders can possibly argue that these are a full accounting of all of the intentional abuses.

Filed Under: audits, lovint, nsa, nsa surveillance

DOJ Still Can't Do Math: Terrorist Statistics Inflated, Double Counted And Badly Organized

from the $5-billion-can't-buy-you-a-usable-database-these-days dept

Of all the unsurprising news of inflated numbers and double-counting contained in the Office of Inspector General's (OIG) audit of the DOJ's reported terrorism statistics, this sentence from the introduction of the report is the least surprising -- and by extension, the most damning.

Department resources devoted to preventing terrorism and promoting the nation’s security have increased from approximately $737 million in fiscal year (FY) 2001 to approximately $5.26 billion in FY 2012, an increase of 614 percent.

Despite the exponentially-increased budget and the fact that the EOUSA (which provides terrorism numbers to the DOJ) has had more than six years to get its case tracking system under control, the audit finds there has been little to no improvement. In fact, there's evidence the EOUSA (Executive Office for United States Attorneys) may be getting worse.

We found that although EOUSA revised its procedures for gathering, classifying, and reporting terrorism-related statistics based on the recommendations from our 2007 audit, EOUSA's implementation of the revised procedures was not effective to ensure that terrorism-related statistics were reported accurately. Specifically, we found that EOUSA inaccurately reported all 11 statistics we reviewed during this follow-up audit. Most of these 11 statistics were inaccurately reported by significant margins…

The continued inaccurate reporting by significant margins indicates that EOUSA needs to strengthen its implementation of controls for gathering, verifying, and reporting terrorism-related statistics.

Great, except that it's had since 2007 to improve and simply hasn't. The OIG's report shows that the EOUSA has trouble performing even the most basic of tasks, like updating numbers annually or attaching supporting documentation for the numbers in its reporting.

Because the log and corresponding support were not previously maintained as required, EOUSA had difficulty providing us accurate lists for 5 of the 11 statistics selected for testing. An official of the Data Analysis Staff told us that, as the result of an oversight, the FY 2010 U.S. Attorneys' Annual Statistical Report was not recorded in the FY 2011 log. The official subsequently showed us that this oversight was corrected by updating the FY 2011 log to reflect the FY 2010 U.S. Attorneys' Annual Statistical Report.

The official believed that the schedules listed in the annual report were the support for the reported statistics. However, the schedules in the annual reports only show the numbers reported for each statistic, but do not show necessary supporting details such as case numbers, defendant names, and disposition dates.

Further complicating the matter is the fact that the EOUSA entered case info into the NLIONS (National Legal Information Office Network System) in a completely arbitrary manner, which resulted in inaccurate case counts.

[A]n EOUSA official told us that while the defendant filed an appeal on June 23, 2007, the appeal was not entered into LIONS by the applicable USAO until January 22, 2009, and therefore the appeal was counted as filed in FY 2009. For the other eight cases, the official explained that these were the first appeals filed in FY 2009 for these cases.

When asked how this explanation was consistent with the NLIONS business rules, which state that an appeal should only be counted if it is the first appeal filed in the case, the official told us that a new methodology was used to count the appeals by which EOUSA had selected the defendant with the best disposition, first filing date, latest close date, and the highest participant identification or defendant number.

However, we noted that in a case with multiple defendants there is no guarantee that these criteria will be sufficient for EOUSA to identify a single defendant - for example, the defendant with the "best disposition" may not have the "first filing date." Therefore, this methodology appears likely to produce arbitrary results and therefore does not appear sufficient to us. Moreover, the official had no documented procedures to show the methodology had been changed from that described in the NLIONS business rules.

This isn't the only way the EOUSA screwed with/screwed up the NLIONS database. It also decided that the "smartest" way to track closed cases was by the date it was entered in the system.

We discussed these discrepancies with an EOUSA official who said that EOUSA's terminated statistics are based on the date that USAO personnel enter the disposition into LIONS instead of the date when the case was actually terminated. The official told us that the system disposition date is used for reporting purposes because this date cannot be changed, whereas the actual termination date can be changed in the system, and therefore using the system disposition date improves the accuracy of the reported statistic.

While relying on a static, unchangeable date might protect the integrity of the data, the delays between case closure and entry in the system completely undermines the data's accuracy, especially in terms of determining annual budget outlays.

[W]e found that the time lag between the date the 13 cases were actually terminated and the date the terminations were entered into the system by the USAOs ranged from 10 to 483 days, and averaged 266 days with a median of 314 days...

Because of this discrepancy (which is putting it nicely), the OIG expanded its spot check to cover all 258 cases listed as terminated in 2010.

As a result, we concluded that EOUSA overstated by 32, or 14 percent, the reported number of cases actually terminated during FY 2010. We consider this amount of deviation to be significant. The time lag between the date these 32 cases were actually terminated and the date the cases were entered into the system by the USAOs ranged from 1 to 706 days, and averaged 201 days with a median of 176 days.

That's just this one instance dealing with these specific cases. More examples are scattered throughout the report. Looking at pending cases, the OIG cross-referenced NLIONS with PACER and uncovered some truly lengthy delays.

PACER showed that one case was disposed of on June 25, 2008, but the USAO did not enter the disposition into LIONS until May 2, 2011, which was 1,041 days after the district court terminated the case.

PACER showed that one case was disposed of on December 19, 2007, but the USAO did not enter the disposition into LIONS until February 11, 2011, which was 1,150 days after the district court terminated the case.

PACER showed one case involving six defendants was disposed of on August 6, 2007, but as of February 1, 2013, the USAO had not entered a disposition for any of the six defendants into LIONS, and therefore the case was still shown as pending in LIONS.

When auditing the numbers provided for suspects charged under the National Security Infrastructure statute, the system lag ran right off the charts.

Three defendants' cases were filed in FY 2008, 1 case was filed in FY 2001, and 2 cases were filed in FY 2000. For each of these cases, USAO personnel entered case data into LIONS during FY 2009. Data entry delays ranged from 323 to 3,391 days and averaged 1,848 days with a median of 1,743 days.

This lack of timely data entry not only skewed annual numbers but has also resulted in double counting. In addition, a dozen or so cases were found to have been miscoded as "terrorist-related," including those covering such non-terrorist activities like animal fighting, narcotics possession and bank robbery.

As the OIG states early in the report, the accuracy of these numbers is crucial to making "informed operational and budgetary decisions." Unfortunately, it appears a truly informed decision hasn't been made for nearly the entire lifetime of the DOJ's War on Terror. If a report in 2007 found similar problems and nothing's changed over the past six years, it's safe to assume the problem runs all the back to the initial post-9/11 response.

Thirteen straight years of running a crooked game using ever-increasing amounts of taxpayer funds. In the private sector, this sort of thing would put someone out of business, if not at the receiving end of a class action suit or fraud charges. But here in our government, it's just one of those things -- the endless cycle of audits and corrective actions, neither of which have propelled the EOUSA to anything approaching excellence, much less mediocrity.

Filed Under: abuses, audits, doj, oig, terrorism