Analyst Who Accidentally Leaked NSA Software Given Five More Years In Prison Than General Who Handed Classified Info To His Mistress

from the 'somebodies'-score-another-win-over-the-'nobodies' dept

An NSA employee will be headed to prison for inadvertently exposing the agency's malware stash.

Nghia Hoang Pho, 68, of Ellicott City, Maryland, and a naturalized U.S. citizen originally of Vietnam, was sentenced today to 66 months in prison, to be followed by three years of supervised release, for willful retention of classified national defense information. According to court documents, Pho removed massive troves of highly classified national defense information without authorization and kept it at his home.

Pho's leaks were different than other NSA leaks. First reported last year by a couple of press outlets, the NSA TAO (Tailored Access Operations) tools were exposed to the outside world by anti-virus software , which correctly labeled it as malware. These malware samples drew the attention of hackers who then targeted Pho's laptop to exfiltrate NSA hacking tools. The NSA exploits and malware made their way into the public domain, kicking off a crippling wave of ransomware that has since been repurposed to mine for cryptocurrency on infected computers.

The DOJ's press release has a lot to say about the seriousness of the offense and the seriousness of the FBI in tracking down government employees who carelessly handle classified code. In particular, it offers up this self-serving garbage to justify locking someone up for taking their work home with them.

“Pho’s intentional, reckless and illegal retention of highly classified information over the course of almost five years placed at risk our intelligence community’s capabilities and methods, rendering some of them unusable,” said Assistant Attorney General Demers. “Today’s sentence reaffirms the expectations that the government places on those who have sworn to safeguard our nation’s secrets. I would like to thank the agents, analysts and prosecutors whose hard work brought this result.

This sentence does nothing of the sort. To those not closely watching these things (i.e., people who'd never read this press release in the first place), it may seem like the DOJ is serving up justice. But for those of us who've seen certain people -- like General Petraeus -- mishandle classified info in a much more egregious fashion (giving his mistress, and biographer, access to top secret info) and walk away from it pretty much unscathed, this statement from the DOJ is not just hollow. It's hypocritical.

Even the judge handling the case saw through the DOJ's double standard. Josh Gerstein of Politico reports the judge had plenty to say about the DOJ's prosecutorial efforts, especially in light of the fact Pho never directly gave anyone else access to the NSA's classified hacking stash.

[O]ne of the most striking aspects of Tuesday's sentencing was [Judge George] Russell's lament that top government officials seem to have escaped with little more than a slap on the wrist for engaging in similar behavior.

Russell seemed particularly perturbed that former CIA Director David Petraeus managed to get probation after admitting he kept highly classified information in his home without permission, shared it with his girlfriend and lied to investigators.

"Did he do one day in prison?" the clearly frustrated judge asked. "Not one day. ... What happened there? I don't know. The powerful win over the powerless? ... The people at the top can, like, do whatever they want to do and walk away."

It's nice to hear this from a judge, even if there's nothing the judge can actually do about it. Russell could only sentence Pho, not clawback Petraeus' unearned freedom and post-conviction cakewalk. Judge Russell might be less willing to help the government apply its sentencing double standard in the future, but his statements to the DOJ have probably only assured the agency will try to steer clear of his court in the future.

Filed Under: classified info, david petraeus, double standards, high court, leaks, low court, nghia hoang pho, nsa, nsa tao, sentencing

EU Explores Making GDPR Apply To EU Government Bodies... But With Much Lower Fines

from the good-for-the-goose,-not-so-good-for-the-gander dept

We recently wrote how various parts of the EU governing bodies were in violation of the GDPR, to which they noted that the GDPR doesn't actually apply to them for "legal reasons." In most of the articles about this, however, EU officials were quick to explain that there would be new similar regulations that did apply to EU governing bodies. Jason Smith at the site Indivigital, who kicked off much of this discussion by discovering loads of personal info on people hosted on EU servers, has a new post up looking at the proposals to apply GDPR-like regulations on the EU governing bodies itself.

There are two interesting points here. First, when this was initially proposed last year, the plan was to have it come into effect on the very same day as the GDPR went into effect: May 25, 2018, and that it was "essential" that the public understand that the EU itself was complying with the same rules as everyone else.

Essential however, from the perspective of the individual, is that the common principles throughout the EU data protection framework be applied consistently irrespective of who happens to be the data controller. It is also essential that the whole framework applies at the same time, that is, in May 2018, deadline for GDPR to be fully applicable.

Guess what didn't happen? Everything in the paragraph above. The EU forced everyone else to comply by May of this year. But gave itself extra time -- time in which it is not complying with the rules and brushing it off as no big deal, while simultaneously telling everyone else that it's easy to comply.

Also, while the GDPR puts incredible fines on those who fail to comply... the fines for if the EU doesn't comply (if this rule ever actually goes into effect) are much more limited. Under the GDPR, companies can be fined 20 million euros or 4% of revenue, whichever is higher, meaning that any smaller company can be put out of business, but the plan for the EU itself is for fines to top out at €50,000 per mistake, with a cap of €500,000 per year.

Must be nice when you're the government and can make different rules for yourself, while mocking anyone who thinks that the rules for everyone else are a bit too aggressive and onerous.

Filed Under: double standards, eu, eu commission, eu parliament, gdpr, high court, low court

The Pirate Bay's 'Lawsuit' Against Anti-Piracy Group More About Exposing Double Standards In Enforcement

from the looks-like-it dept

We stayed away from the story that made the rounds last week, concerning the claims that The Pirate Bay was going to file a lawsuit against Finnish anti-piracy agency CIAPC for setting up a site that parodies The Pirate Bay, using a copy of TPB's stylesheet. Knowing how TPB operates, we assumed that this was not an ordinary situation, even as eager reporters mocked the site for its apparent hypocrisy. Having seen how TPB has acted in the past, we figured there was more to this, and this week the details are starting to come out.

TPB has now said that it has reported the parody CIAPC site to the Economic Crime Unit. Why? Well, it appears the whole thing is really about exposing the double standard by Finnish law enforcement. You see, recently, Finnish prosecutors went after a parody site by Finnish "software developer, researcher and internet activist" Matti Nikki. So, TPB, is noting that it just wants to see the law applied equally (by which it means, showing how farcical the law is, knowing that law enforcement will never prosecute this):

“In a similar case, the prosecution and the Helsinki Court of Appeals have found that a parody site can violate the moral rights of the original author. Changing the logo or making slight edits to the text are not enough to remove this liability,” they informed the police.

The Finnish EFF supported this claim, explaining to TorrentFreak (in the link above) that seeing how prosecutors reacted would be quite telling:

“It’s interesting to see, how the police reacts to Pirate Bay’s demands. On facts the case is indeed very similar to Matti Nikki’s case, in which the prosecutor decided to bring the charges on behalf of Save the Children.

“The law should be the same for everyone so now the objectivity of the Finnish police is going to be tested. Anyway as others have already pointed out, even if Pirate Bay loses the case, it’s a victory for their cause.”

So, while others were mocking, it appears there was a much more serious thought process going on here. One of the following possibilities are likely to occur:

• Finnish prosecutors do absolutely nothing, thus exposing their complete double standard in enforcing the law.
• A lawsuit happens, and TPB "loses" the case, as it's an obvious parody situation which should be allowed -- and thus, TPB reinforces the protections for parody.
• A lawsuit happens TPB actually wins the case, which most people would equally recognize as preposterous after seeing the initial press coverage of the story.

It's looking like this was, yet again, a more clever move than many gave them credit for initially.

Filed Under: copyright, double standards, finland, law enforcement, lawsuit, moral rights, parody
Companies: ciapc, the pirate bay