The Nunes Memo Has Effectively Destroyed Intelligence Oversight

from the WTG dept

The Nunes Memo, capitalized to give it far more gravitas that it actually possesses, was released late last week to mixed reviews. Nunes had built it up to be a mind-blowing damnation of a politically corrupt Federal Bureau of Investigation, more interested in destroying Trump than performing its appointed duties. The memo showed the FBI had relied on questionable evidence from the Steele dossier while securing FISA warrants to surveill former Trump adviser Carter Page. This memo was composed by the House intelligence oversight head -- one who had rarely expressed concern about domestic surveillance prior to investigations of Trump officials.

The memo showed the basis for the warrants may have been thin, but it didn't show it was nonexistent. In fact, the underlying warrants actually did inform the FISA court about the political background of Christopher Steele and his dossier. Nunes didn't know this because Nunes hadn't actually read the warrants. When he was finally apprised of this contradiction, he claimed the FBI disclosure didn't count because the disclosure was contained in a footnote.

The memo's release has had some serious side effects, however. But it will be Congressional oversight taking the damage, rather than the FBI. The memo's release showed the dumping of sensitive, classified info could be motivated by political whims, rather than as the result of a thoughtful, deliberative process. It showed oversight committee members were willing to jeopardize law enforcement sources and methods to score political points -- ironically the same claim Nunes was making about the FBI's motivations.

The damage will also be felt -- indirectly -- by the American public. Intelligence oversight is supposed to protect Americans from surveillance abuses. With this move, Nunes has destroyed its credibility, as Julian Sanchez points out.

It will be hard for anyone who has read the Nunes memo to regard the committee’s output as nonpartisan now. And by crying wolf about intelligence abuses with no serious evidence, Nunes and his enablers have made it far easier for America’s spy agencies to dismiss any future allegations, however meritorious, as yet another self-serving partisan distraction: at best, baseless conspiracy theorizing; at worst, an effort to obstruct legitimate investigations.

And that may not even be the worst of it. As Sanchez notes, the effectiveness of intelligence oversight will be blunted further. It's already mostly ineffective. Now, it may be completely broken.

[T]he committees are ultimately dependent on the intelligence community itself to direct their attention to areas that demand further scrutiny—whether in the form of official briefers, or whistleblowers who approach members with their concerns. Neither type is likely to repose much confidence in a committee that seems so enthusiastic to make a partisan circus of its grave task.

If the end game was to stop whistleblowing and give the nation's surveillance apparatus even more autonomy, well… mission accomplished. What was merely "dysfunctional" (according to the 9/11 Commission) will now be utterly useless.

And in the end, it won't matter to those who went along with Nunes' plan to own the libs (FBI Edition). For most committee members, intelligence oversight is a do-nearly-nothing job with zero political payoff. When things are fixed or further broken, the public is rarely informed. The few times the public is apprised of changes, it's handled obliquely with as many redactions as possible. Home state constituents waiting for their bridge to nowhere / vanity airport aren't going to be pouring funds into the re-election hoppers based on some shadowy, poorly-explained intelligence reforms. Everyone involved -- the overseers and the overseen -- would prefer as little interaction with each other as possible. By showing the House Oversight Committee is not above playing political football with FISA warrants, Nunes has virtually guaranteed the committee will be left alone.

Filed Under: house intelligence committee, infighting, intelligence community, nunes memo, oversight, politics

US Telcos Threatened With Loss Of Government Contracts If They Do Business With Huawei

from the evidence-schmevidence dept

Last week we noted how AT&T was forced to scrap a partnership with Huawei to sell the company's smartphones here in the States, just hours before it was set to be announced at CES. The reason? Apparently a few members of the Senate and House Intelligence Committees fired off a letter to the FCC demanding that they pressure US telcos into avoiding Huawei. The letter, which nobody has published, allegedly accuses the company of being little more than an intelligence proxy for the Chinese government.

There are several problems with this. While it's certainly possible that Huawei helps the Chinese government spy, there's been no hard evidence of this. In fact, numerous investigations (including one eighteen months long) found no evidence of any spying whatsoever. What inquiries did find is that these allegations pretty consistently originate with U.S. hardware vendors like Cisco, who routinely enjoy playing up the threat simply because they don't want to compete with Chinese hardware vendors. You know, the very same thing we routinely (often quite accurately) complain about China doing.

Despite no real evidence, a new Reuters report indicates this new pressure is much greater than just AT&T's smartphone partnership. In fact, the report suggests that the government is now urging all US telcos and ISPs to avoid using any Huawei gear whatsoever if they want to continue winning government contracts (and as an NSA BFF, AT&T has plenty of contracts to protect). From the report:

"The lawmakers are also advising U.S. firms that if they have ties to Huawei or China Mobile, it could hamper their ability to do business with the U.S. government, one aide said, requesting anonymity because they were not authorized to speak publicly.

One of the commercial ties senators and House members want AT&T to cut is its collaboration with Huawei over standards for the high-speed next generation 5G network, the aides said. Another is the use of Huawei handsets by AT&T’s discount subsidiary Cricket, the aides said.

And while Reuters mentioned that there have been investigations, it oddly forgets to mention what the outcome of those investigations were (again, zero evidence of spying). Also ignored is the fact that Chinese networking hardware is absolutely everywhere in the States, including being embedded in many of the products sold by U.S. manufacturers. If China wants to spy on America, it only need turn to the ocean of poorly secured IOT devices, the lion's share of which are now made in China by companies with a complete and total disinterest in anything even vaguely resembling security standards.

Similarly and comedically ignored is the fact the United States government engages in this kind of behavior all of the time. You might recal the NSA was caught intercepting Cisco hardware to install surveillance technology a few years ago. The Snowden documents also revealed how the NSA hacked into Huawei and stole company source code as early as 2007, all in the hopes of planting backdoors in network hardware used by countries who avoid buying American gear. Everyone but the most ardently myopic patriots realize that the United States' credibility on this subject was dismantled decades ago.

This latest wave of hysteria comes simultaneously and not-coincidentally as Representatives Michael Conaway and Liz Cheney introduced a bill banning US carriers from doing any business whatsoever with Huawei or ZTE Corp (two guesses on which companies are pushing for that law). Again, it's perfectly possible that Huawei helps the Chinese government spy. But if that's the case, it shouldn't be too difficult to provide some hard evidence supporting this position. Unless, of course, this is all little more than an adorable little stage play concocted simply to protect US hardware vendors from having to actually compete.

Filed Under: china, fcc, fud, house intelligence committee, surveillance, threats
Companies: at&t, huawei

Intelligence Oversight Tries Again With Zero-Reform Section 702 Bill, Criticizes Reform Efforts As Threats To Security

from the tireless-in-their-unquestioning-defense-of-the-agencies-they-'oversee' dept

The Congressional showdown on Section 702 reforms/renewal continues to generate little actual debate or reform -- but plenty of bad proposals. Both the House and Senate Intelligence Committees have decided there should be a renewal -- preferably an extended one -- with zero actual reform.

Members of the House offered up some tepid reforms in the USA Liberty Act, only to find this offering blocked by the House Permanent Select Committee on Intelligence (HPSCI), which offered a zero-reform package at the last minute. Fortunately, no one was able to tack a lousy non-reform bill to the tailend of the annual budget bill, thereby dodging reform discussions and giving the NSA a surveillance blank check for the next 5-10 years.

Having been stiff-armed for a few weeks, the HPSCI has put together another Section 702 "reform" bill that does nothing to change the status quo and actually has the possibility of making things worse.

Sharon Franklin discusses the many, many problems with the House Committee bill at Just Security. What the committee offers up as reforms is language that can (and will) be read as allowing the NSA (and other agencies) to conduct themselves as they have for years -- this time with the explicit statutory authority granted to them by their supposed oversight.

Proponents of the Intelligence Committee’s bill contend that it presents a compromise approach to addressing both of these privacy risks, and that recent modifications to the bill address the concerns of privacy advocates. In reality, the bill includes no meaningful reform on either issue – or any other real reforms to Section 702. Instead, the Intelligence Committee’s bill would codify these two practices and risk expanding the government’s surveillance authority.

Codification would include the NSA's abandoned "about" email collection. The NSA voluntarily ditched this program because it couldn't stop collecting US persons' communications with this untargeted collection. This bill would allow the NSA to turn the collection back on, provided no introduced legislation specifically demanding the permanent shutdown of this collection method within 30 days of the NSA's notice. Worse, it would possibly allow the NSA to expand the scope of an already vaguely-targeted collection.

First, it could be interpreted by the government to permit unintentional “about” collection, such as where the Intelligence Community knows a certain technique results in “about” collection, but since that technique is not specifically intended to collect “about” communications, it engages in that collection nonetheless. Second, because the bill defines an “abouts communication” as “a communication that contains a reference to, but is not to or from, a target,” there is a risk that the bill could be interpreted to allow the government to collect communications that merely reference a target, such as mentioning a target’s name. Currently, the government may only collect communications that include a target’s “selector,” such as a target’s email or phone number.

The bill would also leave the backdoor search loophole wide open. The FBI (and other agencies) query NSA collections for information not necessarily related to national security investigations through this backdoor search, allowing them to use ostensibly foreign-facing collections for domestic policework. The bill does add a warrant requirement for these sorts of non-national-security-related searches, but this would only apply to "predicated investigations." This would allow the FBI to make use of NSA databases in other forms of investigations, including preliminary investigations -- all of which are based on less probable cause than "predicated" investigations. In other words, the FBI would be required to get a warrant during the final stages of a criminal investigation but need nothing to engage in fishing expeditions using NSA collections.

The HPSCI is also on the attack, trying to prevent other reform legislation from gaining supporters. It has gone so far as to portray support for competing bills containing actual reforms as threats to national security. Ron Wyden's office has issued a debunking of the HPSCI's outlandish claims.

HPSCI Majority allegation: USA RIGHTS will recreate a pre-9/11 “wall” preventing the Intelligence Community and law enforcement from sharing terrorism information.

Fact: Nothing in the USA RIGHTS Act prevents sharing of terrorism information.

HPSCI Majority allegation: USA RIGHTS prevents the IC from “uncovering plots against the United States and saving potential hostages via limitations on the ability to conduct U.S. person queries…”

Fact: USA RIGHTS, which requires a warrant for U.S. person searches of 702 data, includes an exception to rescue hostages, as well as an emergency provision that allows the government to search first and seek a warrant later. In addition, the government has other FISA tools, such as Section 215, that would allow it to swiftly “connect the dots” between suspects and terrorists without a probable cause warrant.

HPSCI Majority allegation: USA RIGHTS limits the government’s ability to obtain terrorism information by “unnecessarily restricting when the Government may ask for technical assistance from electronic communication service providers.”

Fact: Recent statements from the government indicate that it interprets Section 702 to allow it to direct electronic communication service providers to alter encryption. Even supporters of government-mandated weakening of strong encryption have argued for court orders. USA RIGHTS merely requires that the FISA Court oversee any such directives and ensures that those directives are tailored to the surveillance at issue.

HPSCI Majority allegation: USA RIGHTS would prevent NSA from “understanding foreign threat networks by permanently ending NSA’s ‘abouts’ collection.”

Fact: The “abouts” collection, which could include communications to and from innocent Americans on whom there is no suspicion, was suspended by the government due to significant compliance problems. If the government wishes to resume the “abouts” collection, it can always seek those authorities from Congress.

HPSCI Majority allegation: USA RIGHTS allows terrorists and spies to sue the U.S. government.

Fact: It is a basic tenet of the rule of law that surveillance authorities can be challenged in court. USA RIGHTS merely ensures that the government cannot abuse the secrecy of Section 702 to keep it from ever being challenged by anyone.

This is only a small part of the many claims the HPSCI has made in hopes of heading off any real challenge to its zero-reform Section 702 legislation. It's pretty sickening this is coming from legislators charged with subjecting surveillance efforts to intense scrutiny. The HPSCI has never held up any of the NSA's dubious claims as examples of untrustworthy behavior or as a threat to Americans' privacy. Instead, it focuses its attention on those who won't grant the NSA a pass it hasn't earned.

Either way, this issue is coming to a head today. House leadership tried to "appease" those who actually support the 4th Amendment by allowing just one amendment to be voted on -- good amendment by Reps. Justin Amash and Zoe Lofgren. House leadership apparently expects the amendment to fail, and then their awful bill to squeak across the finish line. In response, there's been a pretty frantic effort on both sides to garner support -- leading to the HSPCI's misleading attacks on the amendment.

If enough Reps in the House actually grasp what's at stake, and vote for the Amash/Lofgren amendment, it would be a pretty big game changer, and perhaps push the Senate away from its own bad proposals. If not, it will mean that a majority of our elected officials think that the 4th Amendment and the privacy of Americans is not particularly important. So right about now might be a good time to contact your representative to see where they stand on this.

Filed Under: 4th amendment, devin nunes, house intelligence committee, justin amash, nsa, section 702, surveillance, zoe lofgren

Intelligence Oversight Committees Are Being Stocked With Former Intelligence Agency Employees

from the circle-of-life dept

RESOLVED: this nation's intelligence oversight is indisputably useless. It's about 99% joke and 1% Ron Wyden dog-whistle questions that go unanswered for months or years. Committees on both sides of the legislature are composed mostly of surveillance cheerleaders and flak catchers profoundly uninterested in performing actual oversight. Reform efforts tend to take place despite the intelligence committees, rather than because of them. Every so often, positive changes are made for purely partisan reasons.

Super-friendly "oversight" committees aren't helping hold our nation's multiple intelligence agencies accountable. But it goes deeper than lawmaking fanboys/girls holding prominent positions in intelligence committees. The desire to limit accountability traces back further than the front-mouths lobbing softballs to IC leaders at Congressional hearings. As Tim Johnson and Ben Wieder report for McClatchy News, the intelligence community has been stocking committees with home teamers for years.

Lawmakers assigned to oversee the sprawling U.S. intelligence apparatus rely strongly on a staff that in recent years has included scores of onetime spooks, analysts and lawyers who previously worked at the spy agencies under scrutiny.

According to a comprehensive analysis by McClatchy, at least one-third, and perhaps far more, of the professional staff members who carry out the work of the House and Senate intelligence committees are themselves veterans of the agencies that the two panels oversee.

Really not a problem, I suppose, if the other two-thirds are staunch civil rights defenders and privacy advocates. But of course they're not. They're just more government employees, many of whom find defending the status quo to be a more sensible career path, one that starts with idealism (sometimes) and ends with a pension, with very little forward momentum during the intervening years.

The "intelligence community" term attempts to humanize a hulking behemoth bristling with surveillance apparati, currently hoovering up $80 billion every year. And that estimate is likely on the low end, as these agencies have another, entirely-opaque budget to utilize on top of this.

The other low estimate at work here is McClatchy's guess at the number of former agency employees currently working for the intelligence oversight committees. It's not always easy to sniff out the origins of staffers, especially if they've possibly spent some time engaged in clandestine activities.

McClatchy’s analysis determined the staffers’ backgrounds based on searches of LinkedIn profiles, congressional records, executive profiles and in a handful of cases, press reports, obituaries or personal interviews in which the former or current committee staff members publicly acknowledged their own intelligence background.

In dozens of cases, McClatchy could not determine whether a given staff member had worked in intelligence. Some have left almost no trace on the internet, itself perhaps a telling sign of a sensitive prior professional life.

According to staffers who spoke to McClatchy, the one-third estimate is way, way off. One said "all but a couple" of staffers he worked with came from intelligence agencies. Others estimated IC oversight market saturation to be 50-75%.

Obviously, a dearth of intelligence experience would be less than useful for oversight committees. Experience is extremely useful but in cases where oversight is already severely lacking, stuffing the roster with IC picks is guaranteed to result in the sort of non-oversight we've become accustomed to. Not only are staffers likely to advise against additional accountability and lobby against reform efforts, they're also likely to know how to ensure any reform efforts are shot full of exploitable holes by the time they hit the president's desk.

And there's no good way of fixing this that won't leave other government committees tied up in policies that prevent them from hiring anyone with subject matter expertise. Pretty much the only thing that can be done is sitting back and marveling at the breadth of the intelligence community's regulatory capture.

Filed Under: house intelligence committee, intelligence committees, oversight, senate intelligence committee, surveillance state

Oh, Sure, Suddenly Now The House Intelligence Boss Is Concerned About Surveillance... Of Mike Flynn

from the high-court,-low-court dept

We've written a few times about Rep. Devin Nunes, who heads the House Intelligence Committee. He's been a long-time vocal supporter of NSA surveillance. He insisted that there was no need for reform after the Snowden leaks and he actively misled the public and other members of Congress to shoot down an amendment that would have stopped so-called backdoor searches of "incidentally collected" information on Americans. Nunes falsely claimed that by blocking backdoor searches of the 702 database, it would have blocked things such as tracking whether or not the Orlando nightclub shooter had overseas contacts (it would not have done that at all).

So it's fairly hilarious to see that Nunes' first reaction to the news of National Security Advisor Mike Flynn's resignation was to demand answers on why Flynn's calls with Russian officials were recorded.

“I expect for the FBI to tell me what is going on, and they better have a good answer,” said Rep. Devin Nunes (R-Calif.), chairman of the House Permanent Select Committee on Intelligence, which is conducting a review of Russian activities to influence the election. “The big problem I see here is that you have an American citizen who had his phone calls recorded.”

Uh, dude, you approved this kind of thing (loudly and proudly), and not only that, but you actively blocked suggested amendments that would have blocked the using of this information to dig into information on US persons. Maybe it's time to rethink that one, huh? Of course, (former assistant Attorney General) David Kris (who knows this stuff probably better than anyone else) has made it clear that Flynn's calls with a Russian official wouldn't need to be "minimized" (i.e., have his identity excluded) because "a U.S. person’s name can be used when it is necessary to understand the foreign intelligence information in the report."

Of course, there's lots of irony to go around here. Timothy Edgar -- who was the director of privacy and civil liberties for the White House National Security staff under Obama (and also did privacy/civil liberties work in the Bush administration) has noted that the leaking of the contents of his phone calls actually means that Flynn's own civil rights have been violated and even suggests he gives the ACLU a call (oh, and another layer of irony: Edgar has been warning about how Flynn and others in the Trump administration might trample on civil liberties... and yet here, he's arguing that Flynn's civil liberties have been violated.)

Along those lines, Glenn Greenwald notes that the leaking of actual content from intercepted communications is a really serious crime, but one that should be seen as totally justified here, as it was clearly a form of whistleblowing (even as he admits that the motives of the leakers likely weren't pure, but were possibly for revenge against Flynn, who many in the intelligence world disliked).

It is a big deal to actually leak the contents of an intercepted communication (most leaks and whistleblowing tend to be about programs, not the actual intercepted communications). Of course, this should raise other questions about why the NSA and FBI are surveilling so many people -- and will the content of those other calls be used for political vendettas rather than true whistleblowing? Unfortunately, it seems unlikely that someone like Devin Nunes is going to care about all that. In typical "high court/low court" fashion, he's only concerned that someone on his team was hurt by such surveillance, not that such surveillance regularly occurs.

Filed Under: devin nunes, fisa, house intelligence committee, michael flynn, minimization, surveillance

House Intelligence Committee's List Of 'Snowden's Lies' Almost Entirely False

from the and-it-took-'em-two-years dept

So, last week, I wrote up a long analysis of the House Intelligence Committee's ridiculous smear campaign against Ed Snowden, highlighting a bunch of misleading to false statements that the report made in trying to undermine Snowden's credibility as he seeks a pardon from President Obama. The Committee insisted that it had spent two years working on the report, but it seems like maybe they just needed all that time because they couldn't find any actual dirt on Snowden.

In my analysis, I pointed to some of Snowden's public responses, highlighting how the House Intel Committee was either completely misinformed or lying about Snowden. But Barton Gellman, one of the four reporters who Snowden originally gave his documents to, and who has done some amazing reporting on the Snowden leaks (not to mention, who is writing a book about Snowden) has responded to the report as well, and highlights just how incredibly dishonest the report is.

Gellman focuses on just one section -- the weird section that tries to make out Snowden as a "serial exaggerator and fabricator." Here's that paragraph again:

Fourth, Snowden was, and remains, a serial exaggerator and fabricator. A close review of Snowden's official employment records and submissions reveals a pattern of intentional lying. He claimed to have left Army basic training because of broken legs when in fact he washed out because of shin splints. He claimed to have obtained a high school degree equivalent when in fact he never did. He claimed to have worked for the CIA as a "senior advisor," which was a gross exaggeration of his entry-level duties as a computer technician. He also doctored his performance evaluations and obtained new positions at NSA by exaggerating his resume and stealing the answers to an employment test. In May 2013, Snowden informed his supervisor that he would be out of the office to receive treatment for worsening epilepsy. In reality, he was on his way to Hong Kong with stolen secrets.

As we noted on Friday, Snowden disputed almost everything in this paragraph, saying that it would be "extremely unwise" for them to say he didn't have a GED, and (more importantly) pointed out that it wasn't shin splints that kept him out of the Army, and that the "doctored performance evaluation" was actually him showing (as requested by his managers) a "proof of concept" of a vulnerability in the CIA's computer system.

Gellman takes all of these points even deeper and debunks the House Intelligence Committee's findings with checkable facts. The "shin splints" claim? Gellman has reviewed Snowden's Army paperwork. It wasn't shin splints.

This is verifiably false for anyone who, as the committee asserts it did, performs a “close review of Snowden’s official employment records.” Snowden’s Army paperwork, some of which I have examined, says he met the demanding standards of an 18X Special Forces recruit and mustered into the Army on June 3, 2004. The diagnosis that led to his discharge, on crutches, was bilateral tibial stress fractures.

A shin splint comes from the muscles and bone tissue around the tibia being overworked, often by repetitive injury. It's true that tibia stress fractures are sometimes confused with shin splints, but an actual fracture is much more serious (and doctors will sometimes check to see if shin splints are really a stress fracture if they're not going away). If Snowden was in the hospital and on crutches with bilateral tibial stress fractures, that's way past shin splints. The House Intel Committee was either lied to or is lying here to the public -- ironically in the section they claim is about Snowden's fabrications and exaggerations.

How about the claim that he never got his GED? It turns out that Gellman actually has the evidence:

I do not know how the committee could get this one wrong in good faith. According to the official Maryland State Department of Education test report, which I have reviewed, Snowden sat for the high school equivalency test on May 4, 2004. He needed a score of 2250 to pass. He scored 3550. His Diploma No. 269403 was dated June 2, 2004, the same month he would have graduated had he returned to Arundel High School after losing his sophomore year to mononucleosis. In the interim, he took courses at Anne Arundel Community College.

So, again, in the section on fabrications and exaggerations, the House Intel Committee appears to be the one fabricating stuff. It again raises the question of whether or not they were lied to or just failed to do basic due diligence into the truth of the claim.

What about the claim about his level in the CIA? Again, Gellman to the rescue with evidence:

Judge for yourself. Here are the three main roles Snowden played at the Central Intelligence Agency (CIA). (1) His entry level position, as a contractor, was system administrator (one among several) of the agency’s Washington metropolitan area network. (2) After that he was selected for and spent six months in training as a telecommunications information security officer, responsible for all classified technology in U.S. embassies overseas. The CIA deployed him to Geneva under diplomatic cover, complete with an alias identity and a badge describing him as a State Department attache. (3) In his third CIA job, the title on his Dell business card was “solutions consultant / cyber referent” for the intelligence community writ large—the company’s principal point of contact for cyber contracts and proposals. In that role, Snowden met regularly with the chiefs and deputy chiefs of the CIA’s technical branches to talk through their cutting edge computer needs.

Gellman also has more detail on that whole "doctoring his performance evaluation" claim, noting how the House Intel Committee was clearly exaggerating the truth:

Truly deceptive, this. I will tell the story in my book. Suffice to say that Snowden discovered and reported a security hole in the CIA’s human resources intranet page. With his supervisor’s permission, he made a benign demonstration of how a hostile actor could take control. He did not change the content of his performance evaluation. He changed the way it displayed on screen.

Gellman has a few more in his post as well, but the short version is that "four of the six claims are egregiously false, and a fifth is hard to credit." Oh, and the one "true" claim? That he lied to his bosses saying he was going for epilepsy treatment when he was really heading off to hand over the files to reporters.

And so we're left with the question: how the hell did the House Intelligence Committee spend two years... to get everything so incredibly wrong? And will anyone actually call them on this?

Filed Under: barton gellman, ed snowden, house intelligence committee, pardon snowden, smear campaign

House Intel Committee Says Snowden's Not A Whistleblower, 'Cause He Once Emailed His Boss's Boss

from the wait,-what? dept

As you probably heard, the ACLU and other have launched a massive campaign asking President Obama to pardon Ed Snowden. You can check it out here and sign the petition. There have also been a bunch of high profile op-eds and endorsements from a wide variety of people -- from former intelligence officials to human rights groups and more. The campaign was obviously timed to coincide with the release of Oliver Stone's new movie, Snowden.

Apparently also timed with the release of the movie, the House Intelligence Committee has released a "report" that they claim they spent two years writing, detailing why they believe Snowden is no whistleblower. They've released an unclassified three page "executive summary" that is, at best, laughable. Honestly, if this is the best that the House Intel Committee can put together to smear Snowden, they must have found nothing bad. I mean, it's the stupidest stuff: like that he once got into a dispute with his boss over some software updates at work and (*gasp*) emailed someone higher up the chain, for which he got reprimanded: If you can't read that, it says:

Third, two weeks before Snowden began mass downloads of classified documents, he was reprimanded after engaging in a workplace spat with NSA managers. Snowden was repeatedly counseled by his managers regarding his behavior at work. For example, in June 2012, Snowden became involved in a fiery e-mail argument With a Supervisor about how computer updates should be managed. Snowden added an NSA senior executive several levels above the supervisor to the e-mail thread, an action that earned him a swift reprimand from his contracting officer for failing to follow the proper protocol for raising grievances through the chain of command. Two weeks later, Snowden began his mass downloads of classified information from NSA networks. Despite Snowden's later claim that the March 2013 congressional testimony of Director of National Intelligence James Clapper was a "breaking point" for him, these mass downloads predated Director Clapper's testimony by eight months.

First of all, the inclusion of the email dispute is just... weird. I mean, people have email disputes with co-workers all the time. Is that really a sign that you're not a whistleblower, or that you're just "disgruntled?" If that's really the "dirt" that they dug up on Snowden after two years of research, they really must have nothing that actually sticks.

Oh, and also, as Snowden himself notes, this all kinda works against their point, because it shows that trying to blow the whistle up the chain is... met with reprimands. Of course, the point that they're really getting at is the second half of that paragraph -- where they claim that he began the downloads way before James Clapper's infamous lie to Senator Ron Wyden. But, again, Snowden points out that they're being totally misleading here (and it must upset the House Intelligence Committee to no end that Snowden is free and able to use Twitter to debunk their claims), because, as has been previously reported in great detail, Snowden was assigned to move a bunch of documents between systems. The "downloading" they're talking about was his job. In other words, yes, he touched 1.5 million documents. Because he was told to as a part of his job. It's been more than two years since James Clapper himself admitted that Snowden didn't actually take all of those. That's just the number he "touched" because his job was to move those documents to a different system. Snowden took a much smaller subset, and now they're claiming that him doing his job was him taking the docs.

The report also trots out the usual "harm to national security." We've been hearing this ever since the first leak... and yet no one ever has any evidence to support this. It's the bogeyman argument. And yet, here it is again: If you can't read that, it says:

First, Snowden caused tremendous damage to national security, and the vast majority of the documents he stole have nothing to do with programs impacting individual privacy interests-they instead pertain to military, defense, and intelligence programs of great interest to America's adversaries. A review of the materials Snowden compromised makes clear that he handed over secrets that protect American troops overseas and secrets that provide vital defenses against terrorists and nation-states. Some of Snowden's disclosures exacerbated and accelerated existing trends that diminished the IC's capabilities to collect against legitimate foreign intelligence targets, while others resulted in the loss of intelligence streams that had saved American lives. Snowden insists he has not shared the full cache of 1.5 million classified documents with anyone; however, in June 2016, the deputy chairman of the Russian parliament's defense and security committee publicly conceded that "Snowden did share intelligence" with his government. Additionally, although Snowden's professed objective may have been to inform the general public, the information he released is also available to Russian, Chinese, Iranian, and North Korean government intelligence services; any terrorist with Internet access; and many others who wish to do harm to the United States.

The full scope of the damage inflicted by Snowden remains unknown. Over the past three years, the IC and the Department of Defense (DOD) have carried out separate reviews--with differing methodologies--of the damage Snowden caused. Out of an abundance of caution, DOD reviewed all 1.5 million documents Snowden removed. The IC, by contrast, has carried out a damage assessment for only a small subset of the documents. The Committee is concerned that the IC does not plan to assess the damage of the vast majority of documents Snowden removed. Nevertheless, even by a conservative estimate, the U.S. Government has spent hundreds of millions of dollars, and will eventually spend billions, to attempt to mitigate the damage Snowden caused. These dollars would have been better spent on combating America's adversaries in an increasingly dangerous world.

Note that after a lot of hand-waving, the only actual damage they can even come close to quantifying is the amount of money the US government spent trying to close the barn doors -- i.e., investigate what Snowden had taken and make sure that others couldn't do the same. That's not Snowden's fault. That's very much blaming the messenger. Also, if the US government wasn't illegally spying on Americans, it wouldn't have been an issue. It seems worth noting that key point.

And, again, the report continues to point to the 1.5 million number, despite the fact that it's already been debunked. Again, the reason Snowden moved 1.5 million docs was because that was part of his job -- that wasn't the amount taken. The reason that the Intelligence Community isn't investigating all of those docs is because it has said that Snowden didn't take all of them. Why is the House Intelligence Committee bitching about that?

As for the Russian Parliament member claiming that Snowden shared secrets with Russia, Snowden himself notes that they're misquoting what was said, and that the guy had prefaced his statement by nothing that it was speculation on his part, rather than confirmed fact. You'd think that the House Intel Committee wouldn't go around trading in mere speculation.

As for the claims that "the information he released is also available to Russian, Chinese, Iranian, and North Korean government intelligence services" is also pretty ridiculous. I mean, the documents that have been released (not all of them, and the ones that have been have included redactions) have been placed on the internet, where anyone can read them. The statement about the Russians, Chinese, Iranians, North Koreans and terrorists having access to them is basically the equivalent of "these people have the internet." Yeah, so?

Next on the docket, the House Intel Committee claims that Snowden's not a whistleblower because he (1) didn't go through proper channels (2) he left the country and (3) the NSA surveillance program was all perfectly legal. If you can't read that, it says:

Second, Snowden was not a whistleblower. Under the law, publicly revealing classified information does not qualify someone as a whistleblower. However, disclosing classified information that shows fraud, waste, abuse, or other illegal activity to the appropriate law enforcement or oversight personnel--including to Congress--does make someone a whistleblower and affords them with critical protections. Contrary to his public claims that he notified numerous NSA officials about what he believed to be illegal intelligence collection, the Committee found no evidence that Snowden took any official effort to express concerns about U.S. intelligence activities--legal, moral, or otherwise--to any oversight officials within the U.S. Government, despite numerous avenues for him to do so. Snowden was aware of these avenues. His only attempt to contact an NSA attorney revolved around a question about the legal precedence of executive orders, and his only contact to the Central Intelligence Agency (CIA) Inspector General (IG) revolved around his disagreements with his managers about

Let's stop right there to respond to this load of nonsense. First of all, hiding behind the very technical, narrow legal definition of whistleblower is pretty ridiculous compared to the actual definition that most people use. Snowden revealed a program that involved mass surveillance on nearly all Americans, a program that the intelligence community had directly and officially denied existed. It was, in fact, a program that, from a plain reading of the law, should not exist, and the only way in which it did and could exist was if the government reinterpreted the law, in secret, to mean something completely different. That's pretty clearly whistleblowing. And the fact that the public has spoken out in support of him so much suggests that many people believe this as well.

And that doesn't even mention the fact that after this Congress changed the law to further clarify what the NSA could actually do. In other words, Congress seems to agree that what Snowden did was in the public interest. Even former Attorney General Eric Holder has admitted as much.

And, of course, the claims about "the proper channels" is ridiculous as well. We've written many, many times on what happens to individuals who go through the "proper channels." It often ends with them being put in jail on trumped up charges. Oh, and Snowden, as a contractor rather than gov't employee, had no whistleblower protections under the law anyway. Going through the "proper channels" gets you marked as a troublemaker, and that often leads to more scrutiny and questionable raids... and jail time. And, as if to confirm all this, the guy that Snowden could have reached out to as the "proper channel" had already mocked Snowden and attacked him, so it's not as if that would have been a useful route.

The Committee tries to brush off this concern with the "proper channels" but fails in doing so:

Despite Snowden's later public claim that he would have faced retribution for voicing concerns about intelligence activities, the Committee found that laws and regulations in effect at the time of Snowden,s actions afforded him protection. The Committee routinely receives disclosures from IC contractors pursuant to the Intelligence Community Whistleblower Protection Act of 1998 (IC WPA). If Snowden had been worried about possible retaliation for voicing concerns about NSA activities, he could have made a disclosure to the Committee. He did not. Nor did Snowden remain in the United States to face the legal consequences of his actions, contrary to the tradition of civil disobedience he professes to embrace. Instead, he fled to China and Russia, two countries whose governments place scant value on their citizens' privacy or civil liberties-and whose intelligence services aggressively collect information on both the United States and their own citizens.

Again, this is wrong. The Whistleblower Act does not actually extend its protections to contractors, and given how the Committee is reacting to Snowden to this day, does anyone actually think they would have done anything if he had approached them -- other than maybe alerting top intel community officials that they had a troublemaker in their midst? As for the claim that Snowden didn't stay in the US to face the "legal consequences," again, is it any wonder why? He knew what had happened to people like Thomas Drake, who the feds tried to put in jail for 35 years because he had a (mistakenly) classified meeting agenda at his home -- a home that was only raided because Drake had blown the whistle on another program. He'd seen what happened to Chelsea Manning, held in solitary confinement for leaking documents to Wikileaks. He'd seen what happened to countless others.

The very fact that Snowden is free today and able to tweet responses to this ridiculous smear campaign shows exactly why he didn't choose to stay in the US where they would have locked him up and thrown away the key.

To gather the files he took with him when he left the country for Hong Kong, Snowden infringed on the privacy of thousands of govemment employees and contractors. He obtained his colleagues, security credentials through misleading means, abused his access as a systems administrator to search his co-workers, personal drives, and removed the personally identifiable information of thousands of IC employees and contractors. From Hong Kong he went to Russia, where he remains a guest of the Kremlin to this day.

And yet, magically, none of that has ever become public. So, uh, it seems like maybe the major worries here were overblown.

It is also not clear Snowden understood the numerous privacy protections that govern the activities of the IC. He failed basic annual training for NSA employees on Section 702 of the Foreign Intelligence Surveillance Act (FISA) and complained the training was rigged to be overly difficult. This training included explanations of the privacy protections related to the PRISM program that Snowden would later disclose.

Now this seems to just be the Intelligence Committee scraping the bottom of the barrel again for anything to make Snowden look bad. Oooh, he failed the training program on PRISM. And, yet, that doesn't respond to the fact that there were all sorts of legitimate privacy concerns about PRISM and how it operates, and the program was kept entirely secret.

From there, the Committee goes into full scale playground taunting of Snowden, saying he's a "serial fabricator" because he may have exaggerated a few points: If you can't read that, it says:

Fourth, Snowden was, and remains, a serial exaggerator and fabricator. A close review of Snowden's official employment records and submissions reveals a pattem of intentional lying. He claimed to have left Army basic training because of broken legs when in fact he washed out because of shin splints. He claimed to have obtained a high school degree equivalent when in fact he never did. He claimed to have worked for the CIA as a "senior advisor," which was a gross exaggeration of his entry-level duties as a computer technician. He also doctored his performance evaluations and obtained new positions at NSA by exaggerating his resume and stealing the answers to an employment test. In May 2013, Snowden informed his supervisor that he would be out of the office to receive treatment for worsening epilepsy. In reality, he was on his way to Hong Kong with stolen secrets.

So, yeah. I mean, considering how much "fabricating" and "exaggerating" the House Intel Committee does in this whole report, it's a bit weak to argue that him exaggerating his leg problems is somehow proof of being a "serial fabricator." And, I'm sure that none of the members of the House Intel Committee has ever been caught "exaggerating" or "fabricating" information in their quest to get elected, right?

And, of course, Snowden claims they're mostly wrong about all of this anyway. The claim that he doctored a performance evaluation? Snowden notes that he actually reported a vulnerability. The shin splints v. broken legs? The claim that he never got his GED? Snowden hints that if that's what the Intel Committee is really saying, they should get ready to be embarrassed: The fact that he lied about why he was taking time off? I mean, come on. They must really be stretching for something to include that as a "lie." It was a deliberate move as part of his already determined plan to blow the whistle on these programs, not evidence of a pattern of lying.

In the end, the only proper way to read this report is in the context that Glenn Greenwald pointed out: if the House Intelligence Committee had done its oversight job of preventing mass surveillance on Americans, rather than acting as an enabler for the NSA, Snowden wouldn't have been a problem. The Committee's anger seems driven more by Snowden showing how complicit they were in failing to actually oversee the NSA: Of course, along with this report, the Intel Committee has also sent the White House a letter saying that it should not pardon Snowden, saying "Mr. Snowden is not a patriot. He is not a whistleblower. He is a criminal." It goes on to repeat many of the false claims from the report.

I get the feeling that history will treat Ed Snowden much more kindly than it will treat the cowardly members of the House Intel Committee who are now trying (and failing) to cover up their own failures as overseers.

Filed Under: congress, ed snowden, house intelligence committee, oversight, pardon snowden, surveillance, whistleblower

Why Are The Congressional Intelligence Committees So Quiet On The NSA Malware Leaks?

from the speak-up,-feinstein,-we-can't-hear-you dept

Last week, we wrote about the leak of various NSA hacking tools, that showed it had zero-day exploits for a bunch of hardware, including some from Cisco. This has raised some concerns about how long the NSA sat on these vulnerabilities without telling companies -- along with reaffirming what many people already suspected: that the supposed "Vulnerabilities Equities Program" (VEP), in which the NSA is supposed to disclose the vulnerabilities it finds to the companies to patch, is a complete joke.

But Marcy Wheeler has another important point about all of this. When the Snowden documents originally leaked three plus years ago, the various top members of the House and Senate Intelligence Committees -- the so-called Gang of Four -- were quick to speak out (and condemn) the leak. But, oddly, this time they're staying pretty quiet.

Within hours of the first Snowden leak, Dianne Feinstein and Mike Rogers had issued statements about the phone dragnet. As far as I’ve seen, Adam Schiff is the only Gang of Four member who has weighed in on this

U.S. Rep. Adam Schiff, the ranking Democrat on the House Intelligence Committee, also spoke with Mary Louise. He said he couldn’t comment on the accuracy of any reports about the leak.

But he said, “If these allegations were true, I’d be very concerned about the impact on the intelligence community. I’d also obviously want to know who the responsible parties were. … If this were a Russian actor — and again, this is multiple ‘ifs’ here — we’d have to ask what is causing this escalation.”

Say, Congressman Schiff. Aren’t you the ranking member of the House Intelligence Committee and couldn’t you hold some hearings to get to the bottom of this?

Meanwhile, both Feinstein (who is the only Gang of Four member not campaigning for reelection right now) and Richard Burr have been weighing in on recent events, but not the Shadow Brokers release.

If the House and Senate Intelligence Committees were really about "oversight" of the NSA, then shouldn't they have jumped on this immediately? Shouldn't they be looking into how the NSA manages the VEP? Shouldn't they be looking into how these tools got out? Why are they just staying silent or giving meaningless statements like Schiff's?

Filed Under: 0days, adam schiff, devin nunes, dianne feinstein, house intelligence committee, leak, malware, nsa, richard burr, senate intelligence committee, vep, vulnerabilities

House Intel Boss, Rep. Devin Nunes, Lying To Congress About Attempt To Stop Encryption Backdoors

from the liar-liar dept

There are some in Congress who apparently have no problem deceiving both their colleagues and the American public in the pursuit of making Americans less safe and putting our country, economy and infrastructure at risk. This time, it's House Intelligence Committee chair Rep. Devin Nunes, along with Rep. Lynn Westmoreland, who chairs the NSA subcommittee. They've been sending around a letter that blatantly misrepresents a proposal designed to better protect Americans' privacy and security.

For the past two years, around this time, we've talked about the importance of an attempt by Reps. Thomas Massie and Zoe Lofgren to prevent two different kinds of "backdoor" surveillance -- the use of backdoor searches to the NSA's 702 collection and (perhaps more importantly) attempts to backdoor encryption. The Massie/Lofgren amendment has been overwhelmingly supported in the House the past couple of years, but the Senate (with help from surveillance state supporters in the House) keeps conspiring to strip it out of the final agreement.

The Massie/Lofgren amendment is back again this year, and it's pretty straightforward. First, it defunds gov't employees from doing "backdoor" searches (i.e., searching through massive databases of material on Americans that was collected "incidentally" but still kept anyway):

... none of the funds made available by this Act may be used by an officer or employee of the United States to query a collection of foreign intelligence information acquired under section 702 of the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1881a) using a United States person identifier.

But, more importantly, it blocks any funding for attempts to force anyone to backdoor encryption:

none of the funds made available by this Act may be used by the National Security Agency or the Central Intelligence Agency to mandate or request that a person (as defined in section 101(m) of the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1801(m))) alter its product or service to permit the electronic surveillance (as defined in section 101(f) of such Act (50 U.S.C. 1801(f))) of any user of such product or service for such agencies.

While that's a bit of a word jumble, in short, it says that the NSA and CIA cannot force companies to backdoor encryption to enable government surveillance. This point is especially important this year, following on the DOJ/FBI's flubbed attempt to force Apple to decrypt some iPhones earlier this year, combined with the dangerous Burr/Feinstein anti-encryption bill (thankfully dead for now), to offer Congress a clear attempt to say that it will not accept attempts to backdoor encryption.

In the past, those in Congress against this amendment have tried to stop it by totally misrepresenting what the amendment covers, and that appears to be the strategy of Nunes and Westmoreland this time around.

In the letter being sent around to other Representatives, they lay on a thick layer of misleading to downright false FUD (fear, uncertainty and doubt) -- and of course, they exploit the tragedy in Orlando to further their misleading claims.

The national security threats to the United States and its allies are greater today than at any point since 9/11. To keep Americans safe, our Intelligence Community needs to fully employ every tool available to it. We cannot be lulled into a false sense of security. As recent events in Orlando have made tragically clear, terrorists will continue to attack the U.S. homeland.

That seems like a somewhat misleading and self-serving description of what happened in Orlando. While there's still a variety of reports, it's clear that the shooter was an American, born in America, and it doesn't appear he had any connection whatsoever to overseas terrorist organizations. In short: this doesn't look like an issue that the intelligence community would have been able to figure anything out about. The shooter was already known to the FBI, who investigated him and found nothing. And then it appears that he did the shooting on his own, meaning there is little "communication" that the intel community would have needed to track. But even if there was, nothing in this amendment would stop law enforcement or the intelligence community from getting access to such information. Nothing.

But Nunes and Westmoreland are just warming up. It's the next part that is really extremely misleading.

Despite the threats that face us, Congressman Massie and Congresswoman Lofgren's amendment to the Department of Defense Appropriations Act (H.R. 5293) would end the use of a vital tool for identifying and disrupting terrorist plots at home and abroad. If this amendment were enacted, the Intelligence Community would not be able to look through information lawfully collected under FISA Section 702 to see if Omar Siddiqui Mateen, the Orlando nightclub attacker, was in contact with any terrorist groups outside the United Statets.

This is just blatantly false. It's true that outlawing backdoor searches would mean that law enforcement and intelligence wouldn't be able to do backdoor searches on Mateen's communications, but this falsely implies that's the only way in which Mateen's communications could be checked. That's just wrong. Law enforcement still can (and I'm sure already has) get access to Mateen's call records and lots of other communications information through a variety of third parties (and I'm sure would have no trouble getting warrants issued if necessary). Law enforcement and the intelligence community could still get a warrant to search through the information that has been collected. They just need to get a warrant -- which should be pretty damn easy. So there's nothing stopping law enforcement from figuring out if Mateen was in contact with people overseas. The bill just means that the intelligence community can't just go randomly sniffing through the massive database they've already collected of "incidental" information from other searches.

This is no way to legislate. To blatantly mislead their Congressional colleagues in order to protect programs that harm Americans' privacy and security is a pretty cowardly approach to handling these issues. It's fine to debate the relative merits (or lack of merits) of the Section 702 program or other surveillance techniques, but flat out lying to colleagues to block an amendment that they've overwhelmingly supported for the past two years just seems... dishonest and sleazy.

Filed Under: amendment, appropriations, backdoor searches, backdoors, devin nunes, encryption, house intelligence committee, lynn westmoreland, omar mateen, section 702, surveillance, thomas massie, zoe lofgren

After Spending Time As Surveillance Subjects, Intelligence Oversight Committee Suddenly Performing Some Oversight

from the we'll-get-to-the-bottom-of-this-thing-that-was-only-supposed-to-happen-to-ot dept

Once again, it appears the only way to make our nation's intelligence oversight committees care about surveillance is to include them in the "fun."

Fervent surveillance apologist Dianne Feinstein had zero fucks to give about the steady stream of leaks until it became apparent that the CIA was spying on her staffers while they put together the Torture Report. Likewise, many members of the House Intelligence Committee couldn't be bothered to care much about domestic surveillance until they, too, were "inadvertently" included in the NSA's dragnet.

Suddenly, it's time to start caring about the NSA's broad powers.

The U.S. House Intelligence Committee will consider whether new safeguards are needed for handling communications intercepted by the National Security Agency that involve U.S. lawmakers or other Americans, the top Democrat on the panel said on Wednesday.

Yes, these legislators are unhappy their phone calls with foreign officials might have been collected on the regular by the nation's foremost interceptor of communications. And, in what is certainly viewed as largesse by this committee, the proposed rules (whatever they are) will be extended to non-elected Americans.

The Office of the Director of the National Intelligence further clarified the proposed changes discussed during the closed-door briefing by declining to comment on the "classified" proceedings.

One thing is clear, though. Changes will be happening, presumably to further protect the content of legislators' phone calls from the NSA, or at the very least, toughen up minimization procedures. The official statement from the Committee appends "all Americans" after an ellipsis ("explore whether any additional safeguards are necessary when it comes to incidental collection—not only for members of Congress... but for all Americans") so the smart money is on trickle-down surveillance protection. Presumably, we'll all be apprised of any additional protections on a need-to-know basis.

Heading up this new-found enthusiasm for small-batch surveillance reform is Devin Nunes, the Chairman of the Intelligence Committee. His previous efforts on behalf of Americans and their civil liberties include:

Attempting to prevent the Privacy and Civil Liberties Oversight Board from doing its job; and

Pushing a clean reauthorization of Section 215 -- an effort he only dropped because he couldn't rustle up enough support.

So, that's the champion fighting against abusive spying and he's seemingly only interested because his stuff might have gotten caught in the dragnet.

Filed Under: congress, house intelligence committee, nsa, oversight, surveillance