Spending Bill Would Give Administration Direct Control Of Surveillance Spending

from the Congress-votes-to-cut-itself-out-as-spending-middleman dept

We've been given six more years of Section 702 collections, thanks to many, many Congressional representatives who just couldn't find it in their hearts to tell the dear old NSA "No." An extension was granted to push the "debate" into 2018, but there was no debate to be had. Instead, oversight committees on both sides of the Congressional aisle used this time to push out zero-reform renewal packages that actually made Section 702 worse.

After a brief, two-week consideration of opposing views, things moved ahead as though the program had never been abused by the NSA and had never "inadvertently" swept up US persons' communications without a warrant. The same politicians who complained about the NSA's power being in the hands of Donald Trump were the ones who voted for the passage of "reform" bills increasing the agency's reach and grasp.

Now, Congressional reps are granting the Trump Administration even greater control of US spy powers. The House spending bill contains an alteration to the language covering the Intelligence Community's use of federal funds. The funding of surveillance programs is already secret. The NSA's infamous "black budget" makes it impossible for citizens to see how -- and how much -- money is being spent spying on the world.

But the book isn't closed to everybody. If the agency or the administration wants to shift funding around, it must first inform Congress. This theoretically gives Congress veto power on spending changes Congress hasn't pre-approved. The disclosures are, of course, done in secret and there's no way to know how often Congress blocks spending changes, but at least it's some form of oversight. That will no longer be the case if the spending bill is approved, as Ryan Grim reports for The Intercept.

The House spending bill released Wednesday would allow President Donald Trump, or people under him, to secretly shift money to fund intelligence programs, a break with 70 years of governing tradition.

Since 1947, section 504 of the National Security Act has mandated that the administration inform Congress if it intends to shift money from one intelligence project to another, if the new project has not been authorized by Congress. That notification can be — and almost always is — done in secret, but it is at least a minimal check on executive power.

The spending bill currently under consideration, known as a continuing resolution, or CR, breaks with that tradition, allowing funds to “be obligated and expended notwithstanding section 504(a)(1) of the National Security Act of 1947.”

This would make the entire "black budget" discretionary, overseen only by the people moving the money around. Congressional control of agency budgets would become a historical artifact, something long-term reps could gaze back at nostalgically as what's left of Intelligence Community oversight crumbles into nonexistence.

Filed Under: black budget, budget, house, oversight, privacy, surveillance

Feds Waged Hundreds Of Cyberattacks On Other Countries; Spent $25 Million Buying Vulnerabilities

from the we-are-the-cybersecurity-threat dept

It's pretty typical for companies and governments hoping to "bury" important bad news to release it late on a Friday evening, hoping to miss the news cycle. If you're extra lucky, that Friday happens to come right before a long weekend, such as Labor Day. But, for the life of me, I can't figure out why a major news publication, like the Washington Post would break a big story on a Friday night before Labor Day weekend, pretty much guaranteeing that it doesn't get very much attention at all. Very bizarre -- but we figured we'd try to bring this story to you guys on Tuesday, back after the week is underway so the story doesn't get lost. The details: as suspected, the US is actually one of the leading proponents of offensive cyberattacks. This isn't a huge surprise, since they've more or less admitted to having "broad powers" but there have been questions both about the rules of engagement and just how often the US uses these capabilities.

Wonder no more. The Washington Post's Barton Gellman has the story from the black budget, showing 231 offensive cyber-operations in 2011, a number that likely went up quite a bit in 2012 (and again in 2013). For all the hype about "cybersecurity" threats from abroad, it still looks like the biggest cybersecurity threat out there is our own government. And, yes, everyone already knows about Stuxnet, and it sounds like most of these offensive efforts aren't nearly as ambitious, but there's still a lot going on.

Separately, the story confirms earlier reports that the US government is a huge purchaser of exploits from various hackers, choosing to exploit them, rather than use them to help protect our systems. For 2013, the feds budgeted $25.1 million for the "additional covert purchases of software vulnerabilities." But, that's really on a fraction of the number of exploits. The report notes that most vulnerabilities the NSA uses actually are designed at home.

Also those few hundred attacks appear to downplay the capabilities of the NSA (and the CIA) should they want to do more, because it sounds like they've hacked into a variety of networks and have zombie machines at the ready:

By the end of this year, GENIE is projected to control at least 85,000 implants in strategically chosen machines around the world. That is quadruple the number — 21,252 — available in 2008, according to the U.S. intelligence budget.

The NSA appears to be planning a rapid expansion of those numbers, which were limited until recently by the need for human operators to take remote control of compromised machines. Even with a staff of 1,870 people, GENIE made full use of only 8,448 of the 68,975 machines with active implants in 2011.

For GENIE’s next phase, according to an authoritative reference document, the NSA has brought online an automated system, code-named TURBINE, that is capable of managing “potentially millions of implants” for intelligence gathering “and active attack.”

While the fact that the NSA is doing all of this isn't a huge surprise and merely confirms earlier reports, the actual scale of the operations is certainly quite eye-opening.

Filed Under: black budget, cyberattacks, ed snowden, genie, nsa, nsa surveillance, offensive attacks, stuxnet, surveillance

Intelligence Black Budget Reveals Major Focus By NSA On Cracking Encryption

from the how-safe-is-your-encryption dept

There are lots of people digging through the latest Ed Snowden leaks concerning the black budget for intelligence activities in the US trying to pick out various nuggets. Over at Wired, Kevin Poulsen has found one of the most interesting tidbits, highlighting how James Clapper cheers on the "groundbreaking cryptanalytic capabilities to defeat adversarial cryptofgraphy and exploit internet traffic." In short, the NSA has gotten pretty good at breaking encrypted communications. Encryption is a strong protector, but can be broken -- and that's always been a part of the NSA's mission: code-breaking. But, there have long been questions about to what level the NSA can break today's popular encryption standards. What today's leaks show is that they're apparently pretty successful and are spending more and more money on it: The pie chart above? That's $11 billion and it employes 35,000 people. Breaking your encryption. As Poulsen notes, James Bamford (who has followed the NSA closely for years) revealed last year that the NSA had recently made an "enormous breakthrough" in cryptanalysis, and this should raise some questions about just how secure various forms of encryption really are today.

Filed Under: black budget, encryption, nsa, nsa surveillance, spying, surveillance

Latest Snowden Leaks Detail The 'Black Budget' And How Much The Gov't Wastes On Useless Surveillance

from the i-could-use-me-a-black-budget-too dept

Barton Gellman and Greg Miller over at the Washington Post have the latest scoops from the Ed Snowden leaks, in which it appears they've been able to go through the details of the infamous "black budget," detailing the money that is spent on intelligence operations. Apparently, the total budget is around $52.6 billion this year (which actually is a bit lower than I would have expected, but is apparently twice what the budget was back in 2001). There's also another $23 billion spent on "intelligence programs that more directly support the U.S. military."

Not surprisingly, the Post agreed to leave most of the document unpublished and is careful not to reveal anything really damaging (i.e., sources and methods), but the results are still quite revealing. Of course, Director of National Intelligence James Clapper is still angry, arguing that any info from the budget "could provide insight for foreign intelligence services to discern our top national priorities, capabilities and sources and methods." Blah, blah, blah. Someone doesn't like being held accountable. Others point out that discussing the budget seems quite reasonable. The post quotes Lee Hamilton, the former chair of the 9/11 commission (and former chair of the House Intelligence Committee), who argues that having this info public is important to having an informed public debate on the surveillance state. That's the only way that the intelligence community can be held accountable.

And, actually, what the budget reveals is a rather stunning lack of accountability for the budget -- much of it going to the CIA. While many people had assumed that the CIA had been diminishing in power and authority within the intelligence community (especially in relation to the NSA), it turns out that its budget has been growing and growing, and is much more than the NSA's. Furthermore, the CIA has basically been transformed from an "intelligence" agency into a "paramilitary force."

And for all this funding, with so little accountability, it should come as no surprise to find out that much of this money appears to be wasted, and not particularly effective.

Throughout the document, U.S. spy agencies attempt to rate their efforts in tables akin to report cards, generally citing progress but often acknowledging that only a fraction of their questions could be answered — even on the community’s foremost priority, counter-terrorism.

In 2011, the budget assessment says intelligence agencies made at least “moderate progress” on 38 of their 50 top counterterrorism gaps, the term used to describe blind spots. Several concern Lebanon’s Hezbollah movement, an enemy of Israel that has not attacked U.S. interests directly since the 1990s.

Other blank spots include questions about the security of Pakistan’s nuclear components when they are being transported, the capabilities of China’s next generation fighter aircraft, and how Russia’s government leaders are likely to respond “to potentially destabilizing events in Moscow, such as large protests and terrorist attacks.”

A chart outlining efforts to address key questions on biological and chemical weapons is particularly bleak. U.S. agencies set themselves annual goals of making progress in at least five categories of intelligence collection related to these weapons. In 2011, the agencies made headway on just two gaps; a year earlier the mark was zero.

So, we're spending all of this money (our money) on top secret operations, including spying on pretty much every American... and so far it's been almost entirely useless against the actual threats we face. Well, that's comforting. Oh, and if you wondered about the failure to connect the dots on the Boston Marathon bombings? It's because the intelligence community and all that money have no idea how to figure out those kinds of attacks.

The intelligence community seems particularly daunted by the emergence of “home grown” terrorists who plan attacks in the United States without direct support or instruction from abroad, a threat realized this year, after the budget was submitted, in twin bombings at the Boston Marathon.

The National Counterterrorism Center has convened dozens of analysts from other agencies in attempts to identify “indicators” that could help law enforcement understand the path from religious extremism to violence. The FBI was in line for funding to increase the number of agents surreptitiously tracking activity on jihadist Web sites.

But a year before the bombings in Boston the search for meaningful insight into the stages of radicalization was described as one of “the more challenging intelligence gaps.”

Also, the NSA is swimming in so much information that it asked for nearly $50 million to cope with the problem of having too much information. We've pointed out for years that the trick to finding the needles in haystacks isn't to build bigger haystacks, but that's long been the NSA's approach. However, those haystacks have become so big that the NSA asked for $48.6 million designated for "coping with information overload." Here's a simple, and cheaper, plan: don't collect so much irrelevant data. You can ship me half of the $48.6 million and keep the rest for something that's actually useful.

Also, there's this:

The agencies had budgeted for a major counterintelligence initiative in fiscal 2012, but most of those resources were diverted to an all-hands, emergency response to successive floods of classified data released by the anti-secrecy group WikiLeaks.

For this year, the budget promised a renewed “focus . . . on safeguarding classified networks” and a strict “review of high-risk, high-gain applicants and contractors” — the young, nontraditional computer coders with the skills the NSA needed

The budget, obviously, was submitted before Snowden absconded with it and gave it to the Post, so I would imagine that there have been some revisions to create yet another "all-hands, emergency response" to Snowden-like situations.

Filed Under: black budget, budget, cia, intelligence community, nsa, surveillance