Former US Intelligence Analysts Sued For Hacking A Saudi Activist's Phone On Behalf Of The United Arab Emirates

from the hacking-victim-getting-the-chance-to-inflict-some-misery-of-her-own dept

In early 2019, a whistleblower revealed some ugliness emanating from the United Arab Emirates: former NSA analysts working for a private company hired to perform counterterrorism work for the government were spying on journalists, activists, and the occasional American citizen on behalf of their royal benefactors.

Why these analysts were working for known human rights abusers was unclear. Why they decided this work should involve targeting people who weren't terrorists, but rather critics of the UAE government, was similarly left unexplained. The program was called Project Raven and former employee Lori Stroud was the only person involved willing to speak publicly about its activities. Everyone else -- from the NSA to the UAE government -- refused to comment.

More than two years later, the harms perpetrated by these former analysts were given a price tag. Three former US intelligence community analysts (two of which worked for the NSA) were fined $1.68 million for utilizing powerful hacking tools to target dissidents, activists, journalists, and the occasional American citizen for the UAE government. The tools used included "Karma," which was capable of remotely compromising targets' phones without any interaction from phone owners, allowing for wholesale collection of photos, emails, text messages and location information.

Over the years covered in the indictment (which resulted in the fines mentioned above), the analysts began with Project Raven, which migrated from Cyberpoint (a company associated with Italy's infamous Hacking Team), before finally ending up as a wholly-UAE-owned company called Darkmatter.

It's this company that's now being sued by one of its targets, a Saudi activist represented by the EFF.

The Electronic Frontier Foundation (EFF) filed a lawsuit today on behalf of prominent Saudi human rights activist Loujain AlHathloul against spying software maker DarkMatter Group and three of its former executives for illegally hacking her iPhone to secretly track her communications and whereabouts.

AlHathloul is among the victims of an illegal spying program created and run by former U.S. intelligence operatives, including the three defendants named in the lawsuit, who worked for a U.S. company hired by United Arab Emirates (UAE) in the wake of the Arab Spring protests to identify and monitor activists, journalists, rival foreign leaders, and perceived political enemies.

The defendants include Darkmatter, the UAE-owned company that acted on behalf of the Kingdom of Saudi Arabia. Also named are the three former US Intelligence Community analysts who were fined $1.68 million by the federal government in September 2021.

A lot of what's alleged mirrors what we've been seeing over the past several months emanating from Israel malware manufacturer, NSO Group: powerful phone hacking tools, authoritarian governments, and the targeting of government critics, political opponents, and journalists. We've heard plenty about who's been targeted. We don't often hear what happens to those targeted when the governments targeting them finally catch up to them. AlHathoul's lawsuit [PDF] details the end result of her targeting by former NSA analysts working for Project Raven and Darkmatter.

[AlHathloul's] phone was initially hacked in 2017, gaining access to her texts, email messages, and real-time location data. Later, AlHathloul was driving on the highway in Abu Dhabi when she was arrested by UAE security services, and forcibly taken by plane to the KSA, where she was imprisoned twice, including at a secret prison where she was subject to electric shocks, flogging, and threats of rape and death.

I'm sure the named analysts would prefer not to know the human misery their work for the UAE and KSA (Kingdom of Saudi Arabia) resulted in. It's always easier to think of targets in the abstract: an identifier devoid of personal agency, compromised and controlled by ones and zeroes similarly devoid of personality. This lawsuit will force them to confront what they enabled and, possibly, compensate this activist for the harms they enabled.

Filed Under: activism, hacking, karma, malware, nsa, spyware
Companies: darkmatter

CIA, NSA Block Ads Network-Wide To Protect Agencies. Ron Wyden Says Rest Of Gov't Should Do The Same.

from the [glaring-pointedly]-they're-not-wrong dept

Not everyone uses an ad-blocker. But most people do. And no matter how much online publications claim ad blocking is the same thing as stealing, it really isn't. If they're bent out of shape about it, it's because they assault users with ads, burying content behind a wall of uncurated virtual salesmen. If it bleeds, it leads, the old saying goes, but now it refers to readers' processing power and data allotments.

Far too many online publications consider processing the check on the ad buy to be the end of their responsibility. But ad servers get hijacked. Other ad companies get purchased by ad pushers with more malleable morals. Everyone collects reams of data on every site visitor. The end user of sites seems to be the last concern for ad brokers and the people who sell to them, so it's no surprise more people are deploying ad blockers, seeing as readers of even supposedly-reputable sites have been hit with malware, spyware, and auto-playing video when just trying to access some content.

Ads can be dangerous. They can compromise systems and hijack browsers. The general public definitely knows this. Enjoy this shade thrown at ad saturation and website design overcompensation:

The government knows this as well. And it should, although it really shouldn't be a trailing indicator on abusive ad deployment. The spyingest agencies of the Intelligence Community don't just suggest employees should use ad blockers. It mandates them. Here's Joseph Cox for Motherboard:

Lots of people who use ad blockers say they do it to block malicious ads that can sometimes hack their devices or harvest sensitive information on them. It turns out, the NSA, CIA, and other agencies in the U.S. Intelligence Community (IC) are also blocking ads potentially for the same sorts of reasons.

The IC, which also includes the parts of the FBI, DEA, and DHS, and various DoD elements, has deployed ad-blocking technology on a wide scale, according to a copy of a letter sent by Congress and shared with Motherboard.

The letter [PDF], written by Senator Ron Wyden, suggests the rest of the federal government follow the NSA's lead and implement "network-based ad-blocking technologies" at all federal agencies.

While the intelligence community has acted to protect its personnel and computers from malvertising based threats, many other federal agencies have not, and are unlikely to until they are required to do so. To that end, as OMB [Office of Management and Budget] finalizes its recently released draft Federal Zero Trust Strategy, detailing the specific actions that OMB is requiring federal agencies to take to secure their systems from hackers, I urge OMB to also require agencies to implement the CISA and NSA guidance to block ads.

"Zero trust." That sounds like an accurate court of the trust most online advertisers have earned. It's a cesspool out there and publications looking for the easiest way to convert readers to dollars have proven willing to splash around in it under the assumption they'll always be able to blame the foul odors on their ad partners. But that assumes people will be willing to forgive continuous abuse as long as they can access "free" content. That's a risky assumption.

And it doesn't have to be this way. Techdirt has experimented with a blend of ads and direct connection with readers to pay the bills. As ad providers have become less trustworthy and old standbys (like Google's AdSense) have become increasingly erratic with their policy enforcement, Techdirt has dropped ads completely. There are no Google ads on Techdirt and no analytics trackers logging reader info for data brokers who not only help serve up "targeted" ads but also sell data in bulk to government agencies. Techdirt runs clean and is almost entirely reader-supported. Very few sites are willing to give up money to ensure the safety and privacy of their readers and that's why ad blocking has never been considered a threat to Techdirt's business model.

Ad blocking is a must-have these days, even for the federal government. Too much abuse and too little oversight has turned a nicety into a necessity. And if online publications don't like the current state of affairs, they really have no one but themselves to blame.

Filed Under: ad blocking, cia, cybersecurity, intelligence community, nsa, ron wyden

Three Former US Intelligence Analysts Fined $1.6 Million For Helping The UAE Government Spy On Dissidents And Activists

from the oh...-and-US-people-too! dept

Three former US intelligence community employees (two who worked for the NSA) have just agreed to pay $1.68 million in fines for violating export control regulations by providing the United Arab Emirates government with powerful hacking tools that government used to target dissidents, pro-democracy activists, and other perceived enemies of the UAE.

If that seems a little light for giving authoritarian thugs better ways to locate, punish, or completely disappear residents and citizens who have angered them by asking for basic human rights, you're right: it is. But that's what the DOJ has agreed to do.

On Sept. 7, U.S. citizens, Marc Baier, 49, and Ryan Adams, 34, and a former U.S. citizen, Daniel Gericke, 40, all former employees of the U.S. Intelligence Community (USIC) or the U.S. military, entered into a deferred prosecution agreement (DPA) that restricts their future activities and employment and requires the payment of $1,685,000 in penalties to resolve a Department of Justice investigation regarding violations of U.S. export control, computer fraud and access device fraud laws. The Department filed the DPA today, along with a criminal information alleging that the defendants conspired to violate such laws.

According to court documents, the defendants worked as senior managers at a United Arab Emirates (U.A.E.)-based company (U.A.E. CO) that supported and carried out computer network exploitation (CNE) operations (i.e., “hacking”) for the benefit of the U.A.E government between 2016 and 2019. Despite being informed on several occasions that their work for U.A.E. CO, under the International Traffic in Arms Regulations (ITAR), constituted a “defense service” requiring a license from the State Department’s Directorate of Defense Trade Controls (DDTC), the defendants proceeded to provide such services without a license.

These services included the provision of support, direction and supervision in the creation of sophisticated “zero-click” computer hacking and intelligence gathering systems – i.e., one that could compromise a device without any action by the target. U.A.E. CO employees whose activities were supervised by and known to the defendants thereafter leveraged these zero-click exploits to illegally obtain and use access credentials for online accounts issued by U.S. companies, and to obtain unauthorized access to computers, like mobile phones, around the world, including in the United States.

There's even more detail in the indictment [PDF] filed last September, which contains a long list of charges against each of the defendants. There are also many details left hidden -- details that have been made public by previous reporting, but which the DOJ insists on pretending it can't say out loud.

Reuters published a long expose of this trio's efforts back in 2019. It did so with the help of former NSA employee, Lori Stroud, who became part of "Project Raven," a clandestine group composed of former US intelligence analysts who aided UAE in surveilling other governments, militants, and activists opposed to the UAE's oppressive governing.

They also apparently helped the UAE spy on US citizens:

[I]n 2016, the Emiratis moved Project Raven to a UAE cybersecurity firm named DarkMatter. Before long, Stroud and other Americans involved in the effort say they saw the mission cross a red line: targeting fellow Americans for surveillance.

“I am working for a foreign intelligence agency who is targeting U.S. persons,” she told Reuters. “I am officially the bad kind of spy.”

Project Raven originated in Cyberpoint, a Maryland-based computer security company. Baier worked for Cyberpoint when he recruited Stroud. Cyberpoint has its own disturbing connections -- ones exposed by the hacking of Italian malware purveyor, Hacking Team.

The document dump includes lists of client information, including an Excel file that appears to show that Cyberpoint was the partner used to sell Hacking Team spyware to the United Arab Emirates. The firm began selling to the UAE in 2011 and has earned at least $634,500 in revenue from the relationship. The UAE paid an annual maintenance fee through January of this year.

Cyberpoint’s point of contact with Hacking Team is “mbaier@cyberpointllc.com,” according to the client document.

As can be inferred from the email address, Marc Baier was instrumental in this effort, which allowed Hacking Team to elude local restrictions and UN bans on selling to blacklisted countries. By using Cyberpoint as a middleman, Hacking Team sold UAE powerful exploits. And it appears Project Raven developed some nasty tricks of its own -- ones capable of taking over targets' phones to bcc: UAE on all communications.

The ex-Raven operatives described Karma as a tool that could remotely grant access to iPhones simply by uploading phone numbers or email accounts into an automated targeting system. The tool has limits — it doesn’t work on Android devices and doesn’t intercept phone calls. But it was unusually potent because, unlike many exploits, Karma did not require a target to click on a link sent to an iPhone, they said.

In 2016 and 2017, Karma was used to obtain photos, emails, text messages and location information from targets’ iPhones. The technique also helped the hackers harvest saved passwords, which could be used for other intrusions.

Despite this information being in the public domain since January 2019, the DOJ's September 14, 2021 statement tries to play it coy:

U.S. Company Two updated the operating system for its smartphones and other mobile devices in September 2016, undercutting the usefulness of KARMA. Accordingly, CIO created KARMA 2, which relied on a different exploit. In the summer of 2017, the FBI informed U.S. Company Two that its devices were vulnerable to the exploit used by KARMA 2. In August 2017, U.S. Company Two updated the operating system for its smartphones and other mobile devices, limiting KARMA 2’s functionality. However, both KARMA and KARMA 2 remained effective against U.S. Company Two devices that used older versions of its operating system.

Back to the Reuters report:

The former operatives said that by the end of 2017, security updates to Apple Inc’s iPhone software had made Karma far less effective.

And that makes the mysterious "U.S. Company One" that Baier and the other two defendants worked for Cyberpoint, Hacking Team's middleman and eventual partner in hacking crime with the UAE government following the migration of Project Raven from Cyberpoint to Darkmatter (i.e., the "U.A.E. Co.")

Given what has already been made public about this, the fine (which is split between the three defendants) seems incredibly low. And yet the DOJ personnel involved are out there trying to pretend this wrist slap will act as some kind of deterrent. Here's Acting Assistant Attorney General Mark Lesko:

“Hackers-for-hire and those who otherwise support such activities in violation of U.S. law should fully expect to be prosecuted for their criminal conduct.”

Great. Except no real prosecution happened here. Here's more:

“The FBI will fully investigate individuals and companies that profit from illegal criminal cyber activity,” said Assistant Director Bryan Vorndran of the FBI’s Cyber Division. “This is a clear message to anybody, including former U.S. government employees, who had considered using cyberspace to leverage export-controlled information for the benefit of a foreign government or a foreign commercial company – there is risk, and there will be consequences.”

This only shows both the risks and the consequences are minimal.

What it really shows is that if you commit the right kinds of crime, you can pretty much get away with it. I doubt anyone but the defendants are happy with this agreement. But a case like this -- one that involves multiple malware developers involved with multiple shady governments -- is already problematic for all of the involved stakeholders, who would prefer to keep their cyber secrets secret. It also involves former NSA employees who brokered deals with malware developers to allow UAE to purchase regulated digital weapons from companies that were either forbidden or unwilling to sell to the UAE government directly. And then there's Apple, which had to patch its own products twice to eliminate the flaws being exploited by UAE government spies -- itself not a fan of discussing proprietary info in public.

That's a lot of information no one would want to see discussed, even in general terms, in open court. There's only so much redaction and sealed documents can hide. And there's a chance the defendants -- with little left to lose during a serious prosecution -- would start advocating for this information to be revealed to the public. A lot of entities wanted these people punished. And many of those same entities had no desire to see this thing go to trial.

In the end, it's a settlement, not an agreement, and it gives the appearance the DOJ doesn't really want to push a prosecution where its own dirty spyware laundry, along with that of some of its preferred contractors, might be aired. The $1.6 million fine seems more like a buyout, with the DOJ obtaining a little credibility and no one accused of anything left stinging too much from this performative slap.

Filed Under: daniel gericke, export controls, marc baier, nsa, ryan adams, uae, usic

Appeals Court Says State Secrets Privilege Means NSA Can Avoid Wikimedia Foundation's Unlawful Surveillance Allegations

from the create-enough-state-secrets-and-you-can-get-away-with-anything dept

The Snowden leaks exposing NSA dragnet surveillance prompted a lot of litigation. Cast a wide enough net and you're bound to snag it on some people's rights. The Wikimedia Foundation was one of several parties who sued over the NSA's seemingly unconstitutional collection efforts, targeting the agency's "upstream" harvesting of all data and communications straight from internet backbones.

To keep the case in court, Wikimedia had to plausibly allege its data and communications had been scooped up by the NSA. Fortunately, Ed Snowden had provided some pretty solid evidence for the Foundation. A leaked NSA presentation showed Wikipedia was included in the agency's HTTP dragnet:

Well, that leaked presentation, which included the Wikipedia logo as part of the traffic the NSA could snag from internet backbones wasn't enough to impress the district court, which dismissed the lawsuit. It was revived by the appeals court a couple of years later, which said it had alleged enough plausible harm and possible targeting to pursue its First and Fourth Amendment claims.

It went back down to the lower court, which did the same thing it did the first time around. The suit was again dismissed, this time because the district court felt the Foundation didn't bring enough factual allegations to the table. But then, how could it? The NSA basically said facts could not be introduced or argued.

On remand, the district court ordered jurisdictional discovery. But when Wikimedia sought evidence related to Upstream, the NSA invoked the state secrets privilege.

That's from the Fourth Circuit's second pass [PDF] at the Wikimedia lawsuit. This time around the Appeals Court says it disagrees the lawsuit should have been dismissed for lack of standing, but that determination makes no difference when the government says the subject matter is too sensitive to be sued over.

After a discussion of what may or may not be inferred from the limited amount of information disclosed or discussed publicly about this NSA collection, the Appeals Court says no one will be discussing it any further, at least not in this Circuit.

Wikimedia argued the government can't use the state secret privilege to evade its obligations to hand over information about dragnet surveillance, citing FISA and appellate precedent.

Relying heavily on Fazaga, Wikimedia claims that the third condition unambiguously encompasses the circumstances at hand: Wikimedia is an aggrieved person that made a motion before the district court under Federal Rule of Civil Procedure 37(a) to compel discovery of “materials relating to electronic surveillance.” Id. at § 1806(f). Wikimedia thus reads § 1806(f) as a free-floating right to obtain information related to the government’s electronic surveillance pursuant to any (and all) federal statutes or rules.

The Fourth Circuit says Wikimedia's interpretation is wrong.

Reading the third condition in context reveals that Wikimedia’s gloss makes for a shiny but ill-fitting shoe. Both parties agree that § 1806(f) may apply regardless of who initiated the suit. But we agree with the government that § 1806(f) describes procedures for determining the admissibility of electronic surveillance information only when the government seeks to use such evidence in a particular proceeding—whether civil or criminal. Thus, even assuming that Wikimedia is an aggrieved person, we conclude that it can’t use § 1806(f) to force the government to introduce electronic surveillance information into this case,

Even if the court were to agree with Wikimedia's interpretation, it wouldn't change anything. Determining that the NSA engaged in unlawful surveillance of Wikimedia would only require suppression of evidence collected unlawfully. That's not what Wikimedia is seeking here. It's asking the court to review evidence of NSA collection activities to determine whether or not Wikimedia can continue its lawsuit over alleged unlawful surveillance.

This may be a Congressional problem, albeit one created in an attempt to solve a problem, the Court points out:

Congress provided for judicial review of executive branch surveillance, but it did so to “strike[] a fair and just balance between protection of national security and protection of personal liberties.” The government’s reading of § 1806(f) fits that schema exactly. In that provision, Congress permits the government to use electronic surveillance evidence in court against a litigant while withholding materials related to that surveillance from that individual in the interests of national security. But in the same breath, Congress also allows an aggrieved person to challenge the government’s use of such evidence and have a court evaluate the lawfulness of the government’s actions.

Far from giving the government exclusive control over challenges to surveillance, we think this reading of § 1806(f) acknowledges the court’s role in preserving the compromise Congress made between individual rights and national security.

But the compromise requires more from plaintiffs like Wikimedia, the court continues. And it goes farther than shutting down legal challenges of FISA-approved surveillance. Sometimes, the government just gets to win.

[T]his problem isn’t unique to FISA. Every state secrets case presents the possibility that a plaintiff will be denied—in the interests of national security—a remedy available by law.

And no one gets to ask questions about secret surveillance techniques because they're secret, says the Fourth Circuit, closing the loop on the state secrets discussion and terminating Wikimedia's lawsuit for the second time.

Wikimedia claims that the NSA is acquiring all communications on a chokepoint cable that it is monitoring. There’s simply no conceivable defense to this assertion that wouldn’t also reveal the very information that the government is trying to protect: how Upstream surveillance works and where it’s conducted. Indeed, “the whole object of [Wikimedia’s] suit and of the discovery” is to inquire into “the methods and operations of the [NSA]”—“a fact that is a state secret.”

[...]

The district court thus correctly held that, in the face of the state secrets privilege, Wikimedia can’t continue to litigate the Wikimedia Allegation to support standing.

This probably isn't supposed to come across as a judicial shrug, but it sure feels like it.

To sum up, evidence of the Wikimedia Allegation establishes a genuine issue of material fact as to standing, but the state secrets privilege prevents further litigation of that issue.

The house wins. And it didn't even have to show its cards. Wikimedia may actually be able to allege an injury that gives it standing, but it can't do that without the government discussing its surveillance programs, which it won't. And the court can't make it do it.

Filed Under: 4th amendment, 4th circuit, ed snowden, nsa, state secrets, surveillance, upstream collection
Companies: wikimedia

FISA Court Says FBI May Be Abusing Surveillance Powers; Will Continue To Allow It To Abuse Surveillance Powers

from the but-the-court-has-made-it-clear-it's-disappointed dept

Reform efforts following the Snowden leaks led to some minor improvements at the FISA Court. The USA Freedom Act gave the court permission to allow someone to present the side of the surveilled from time to time and introduced some reporting requirements that allowed Americans to see just a bit more about how their surveillance tax dollars were spent.

But if anything is going to change the way America's surveillance agencies perform their duties, it's going to be up to the FISA Court, which can reject requests and shut down surveillance programs until they're fixed. The Section 215 collection of phone records may have reached an early end-of-life after the untargeted bulk collection of phone records was banned, but other surveillance authorities continue unaltered. The one that leads to most surveillance abuses is one the court can't seem to bring under control: Section 702.

This is supposed to be surveillance of foreign national security targets, but agencies with access to 702 collection far too routinely use this as a backdoor to American's communications. And nothing about that has changed, eight years down the road from the Snowden leaks. A newly declassified decision [PDF] from the FISA Court shows the court is still willing to overlook egregious abuses of this authority to spy on Americans.

Here's the EFF's summary of last November's decision -- one made public late last month by the FISA Court.

[T]he FISC again found that a series of overly complex but still ultimately swiss cheese agency protocols -- that are admittedly not even being followed -- resolve the Fourth Amendment problems caused by the massive governmental seizures and searches of our communications currently occurring under FISA Section 702. The annual review by the FISC is required by law -- it’s supposed to ensure that both the policies and the practices of the mass surveillance under 702 are sufficient. It failed on both counts.

The key part of this summary is this: "admittedly not being followed." Even when the government admits it's violating rights, the FISA Court says that's ok… as long as the government admits it. Candor is appreciated, but it would be better if the government stopped violating its own protocols and the rights of Americans. That's where the FISA Court should draw the line. But it doesn't. And it hasn't in years.

While the Court has expressed concerns about certain communications being swept up in 702 collections and disseminated to agencies who won't use this information solely for national security purposes, it's ok with that happening, so long as the NSA and other agencies check all the internal guideline boxes before violating the Fourth Amendment or, as is specifically discussed in this case, accessing privileged attorney-client communications.

The FISA Court says it has no problem with the NSA accessing privileged communications since it won't be directly involved in any criminal cases. But it can see how other agencies without the same foreign-facing directives might end up in the possession of privileged conversations.

That being said, the government is admonished to guard against the possibility that NSA, in compliance with its procedures, might disseminate to FBI a report based on a privileged communication described in Section 5(c) of the NSA procedures (pertaining to a criminal charge in the United States) that, had the FBI obtained it through its own collection efforts, the FBI would be required to sequester with the Court under FBI Minimization Procedures…

Swell, but the Court goes on to say this isn't something it's going to worry about.

The Court again concludes that NSA’s procedures, as a whole and applied to it, an agency with no law-enforcement mission or authority, are reasonably designed to protect the substantial privacy interests in attorney-client communications, consistent with the need to exploit those communications for legitimate foreign-intelligence purposes.

This kind of ignores the fact that prosecutions of foreign terrorists generally involve US courts. So even if the NSA isn't exactly in the law enforcement business, its collections aid and abet domestic law enforcement agencies that do directly work with prosecutors and build criminal cases.

Marcy Wheeler's summary of the FISA opinion is even more caustic. Here's the bullet point breakdown of the Court's acquiescence to the government's claims that it's really, really hard to keep the FBI from looking at stuff it's not supposed to be looking at when it accesses 702 collections.

• It took time for them to make the changes in their systems

• It took time to train everyone

• Once everyone got trained they all got sent home for COVID

• Given mandatory training, personnel “should be aware” of the requirements, even if actual practice demonstrates they’re not

• FBI doesn’t do that many field reviews

• Evidence of violations is not sufficient evidence to find that the program inadequately protects privacy

• The opt-out system for FISA material — which is very similar to one governing the phone and Internet dragnet at NSA until 2011 that also failed to do its job — failed to do its job

• The FBI has always provided national security justifications for a series of violations involving their tracking system where an Agent didn’t originally claim one

• Bulk queries have operated like that since November 2019

In short, the FBI keeps screwing up. And it keeps telling the FISA Court it will do better. Then the FBI doesn't actually improve and the Court gives it a pass because it's trying to try. The bulwark put in place to deter the government from abusing its powers and violating rights isn't doing its job. It's deciding that national security work is too important to subject to serious judicial scrutiny.

Filed Under: abuse, doj, fbi, fisa, fisa court, fisc, mass surveillance, nsa, section 702, surveillance, usa freedom act

NSA Director Says More Domestic Surveillance Might Stop Foreign Hacking; Fails To Explain Why NSA Isn't Stopping Much Foreign Hacking

from the what-if-we-just-did-the-thing-we-already-do-but-not-through-the-back-door dept

Never let a good crisis go to waste. The federal government is always on the lookout for expansion opportunities and a bad actor known colloquially as "Current Events" keeps handing the government what it's looking for.

On January 6th, a bunch of Trump fans, who thought it was possible to overturn certified election results, raided the Capitol building. Five people, including a Capitol police officer, died during the attack. This horrific event was turned into a chance to increase domestic surveillance by the incoming president, who threatened Americans with the sort of good time they've been afflicted with since October 26, 2001.

Domestic terrorism legislation was an administration "priority," something that would free investigative and intelligence agencies to turn their surveillance programs inward and more directly target US citizens.

The blockbuster breach of widely-used SolarWinds network software affected dozens of federal agencies and millions of users around the world. In response to this travesty, the director of the NSA and its military counterpart CYBERCOM (Cyber Command) floated the idea of allowing the NSA (and others) to gaze inwardly at the country's moving (computer) parts. Here's Spencer Ackerman, writing for The Daily Beast:

“We truly need to look at the ability for us to see ourselves and right now it's difficult for us to see ourselves,” [General Paul] Nakasone testified on Thursday to the Senate Armed Services Committee. Adversaries like China and Russia “are operating with increased sophistication, scope [and] scale, including operations that can end “before a warrant can be issued,” he warned.

“If we have a problem where we only see our adversaries when they operate outside of their country and we don't see them when they operate inside our country it's very difficult for us to be able to—to, as I say, connect those dots,” Nakasone said. “That's something that—that the administration and obviously, others are addressing right now.”

The NSA thinks it doesn't have enough visibility. And it's true, information sharing has long been an intergovernmental problem. Information sharing between the government and private companies has also been less than ideal, largely due to the fact that the government demands more than it's willing to share -- and that includes known exploits and bugs it's currently using to engage in worldwide surveillance.

What Nakasone is suggesting sounds like domestic surveillance of private networks to potentially thwart attacks and root out persistent threats. That doesn't sound much like America though. And there's no reason to believe the NSA and DoD are better qualified to do this job than the private sector. The NSA and others have suffered their own security breaches and carelessly handled sensitive tools/information. Giving up privacy (and some security) for nominal gains in "visibility" would be a really bad idea.

For what it's worth, the NSA quickly walked back Nakasone's statement... at least as much as it could. It claimed its director was not "advocating" for "additional authorities." That may be true but dropping this hint in Congressional testimony is a handy way to submit a P.O. for a larger Overton Window for the NATSEC corner office.

But, more to the point, Nakasone's testimony did not contain anything that should give anyone confidence the NSA is up to the task of thwarting foreign cyberthreats.

Nakasone did not testify that NSA or CYBERCOM was able to detect malicious campaigns like SolarWinds or Microsoft Exchange abroad before they entered American digital infrastructure, making it questionable whether expanding such detection across the domestic internet would be effective.

Hindsight is 20/20. Foresight appears to be almost nonexistent, even with the tech tools the NSA has at its disposal. If it couldn't mitigate the damage before it turned federal agencies into unwitting honeypots for data exfiltration (and that includes the supposed securers of the Homeland, the Department of Homeland Security and its cybersecurity branch), it shouldn't be given all access passes to domestic networks under the theory that it might be able to do marginally better with greater "visibility."

Filed Under: cybercom, hacking, insurrection, nsa, paul nakasone, solarwinds hack, surveillance

The SolarWinds Hack Is Just The Same Sort Of Espionage The US Government Engages In Every Day

from the ugly-and-inconvenient-truth dept

A historic hack of unprecedented scale has set off alarms in the US government -- itself a target of suspected Russian hackers who leveraged IT infrastructure company SolarWinds' massive customer base to compromise an unknown number of victims. Among those victims were several US government agencies, including the DHS's cybersecurity wing, which announced its own breach hours after issuing a dire warning to potentially affected government agencies.

Is it time to panic? No, says the lame duck president, who claims this is already "under control" -- something that very definitely isn't true. SolarWinds says it has 18,000 customers using the affected Orion software. And many of those customers (which include Fortune 500 companies and major telcos/service providers) have thousands of customers of their own -- all of which may be operating compromised systems. The DHS said the only way to ensure systems are clear of this threat was to airgap them and uninstall the infected software.

Others who have been briefed on the hack are far less cheery about its ongoing impact. Trump tweeted there was nothing to worry about. Republican allies seem more concerned than the man who won't have to worry about this for much longer.

Shortly after Mr. Trump’s tweet, Sen. Marco Rubio (R., Fla), acting chairman of the Senate Intelligence Committee, said it was “increasingly clear that Russian intelligence conducted the gravest cyber intrusion in our history.”

Mr. Rubio added on Twitter that efforts to determine the extent and damage of the hack were ongoing and that remediation would take significant time and resources. “Our response must be proportional but significant,” he said.

The 2050s will be like 1950s, apparently: with America in the midst of another Cold War.

But is it true this is the "gravest cyber intrusion in our history?" Or is it just the "gravest" intrusion that's targeted us? After all, the Russians don't have a monopoly on government-ordained hacking. Our intelligence and security agencies deploy their own persistent threats -- something we've done for years with minimal blowback. These calls for a cyber war by pundits and government officials aren't anything to be applauded. I don't think America really wants to get involved in another forever war -- one whose wins and losses can't be tallied with temporary "liberations" and body bag back orders.

Let's be cautious, says Jack Goldsmith. Better yet, let's be aware of the hypocrisy of the stance some government officials are demanding we take.

The lack of self-awareness in these and similar reactions to the Russia breach is astounding. The U.S. government has no principled basis to complain about the Russia hack, much less retaliate for it with military means, since the U.S. government hacks foreign government networks on a huge scale every day.

Turning a cyber war into a shooting war isn't just an overreaction. It's illegal under international law. That doesn't mean nothing should be done about it. It just means the US government can't pretend it doesn't engage in the same activities some now want to go to war over. What's happened here might be unprecedented in scale, but it's the same thing every government with enough resources has done for years. It's not a war waiting to happen. It's business as usual.

Peacetime government-to-government espionage is as old as the international system and is today widely practiced, especially via electronic surveillance. It can cause enormous damage to national security, as the Russian hack surely does. But it does not violate international law or norms.

In recent years, the US government has deployed more offensive weapons in hopes of deterring cyber attacks. It really hasn't worked. Meeting escalation with more escalation is unlikely to change the standard operating procedures of espionage, especially since the US government hasn't rolled back its offensive efforts in the wake of massive breaches.

But there may be a way forward -- one almost impossible to achieve but promising enough it shouldn't be dismissed out of hand.

[The US government] has not seriously considered the traditional third option when defense and deterrence fail in the face of a foreign threat: mutual restraint, whereby the United States agrees to curb certain activities in foreign networks in exchange for forbearance by our adversaries in our networks. There are many serious hurdles to making such cooperation work, including precise agreement on each side’s restraint, and verification. But given our deep digital dependency and the persistent failure of defense and deterrence to protect our digital systems, cooperation is at least worth exploring.

There's no moral high ground to claim here. And refusing to consider bringing some of our cyber boys back home leaves us with nothing but continuous escalation. This hack is raising uncomfortable questions about our own practices. Let's see if anyone in the White House is willing to honestly confront the consequences of our own actions and find another route towards safety and national security.

Filed Under: cyber war, cybersecurity, dhs, hacks, hypocrisy, nsa, russia, surveillance, us
Companies: solarwinds

Patriot Act Used By The FBI To Collect Internet Browsing Data, Contradicting Claims Made To Oversight

from the oh-no-this-must-be-the-first-time-the-IC-has-lied-to-its-oversight-[faints] dept

The NSA shut down its bulk phone records collection -- authorized under Section 215 -- after it became apparent it wasn't worth the effort. Reforms put in place by the USA Freedom Act prevented the agency from collecting it all and sorting it out later. Instead, it had to approach telcos with actual targeted requests and only haul away responsive records. The NSA somehow still managed to overcollect records, putting it in violation of the law. The NSA hinted the program had outlived its usefulness anyway, suggesting it had far better collections available under other authorities that it would rather not subject to greater scrutiny.

But this didn't end the government's bulk records collections. It just ended the phone metadata program. The NSA still collects other records in bulk, including banking records and, oddly, books checked out by library patrons. The broad authority of Section 215 could be read to allow the government collect other records, like email metadata and internet activity. Reasoning that people voluntarily create records of their internet use by using third-party services to surf the web, the government hinted it could sweep these up just as easily as it had swept up call records.

The government's attempt to collect internet history under this authority ran into some friction earlier this year when the Senate voted to block this collection. Senator Ron Wyden directly asked the director of national intelligence (DNI) to inform the Senate whether or not agencies under its purview had gathered internet use records under this authority. He received this answer.

In a Nov. 6 letter to Mr. Wyden, John Ratcliffe, the intelligence director, wrote that Section 215 was not used to gather internet search terms, and that none of the 61 orders issued last year under that law by the Foreign Intelligence Surveillance Court involved collection of “web browsing” records.

Wyden took this response to mean that implementing a ban on collection of internet history records could be put into place without negatively affecting any intelligence gathering activities. But when the New York Times pressed DNI John Ratcliffe on specifics, a new party inserted itself into the conversation: the DOJ. According to its response, the FBI had already done the thing the DNI had just told Sen. Wyden it hadn't.

In fact, “one of those 61 orders resulted in the production of information that could be characterized as information regarding browsing,” Mr. Ratcliffe wrote in the second letter. Specifically, one order had approved collection of logs revealing which computers “in a specified foreign country” had visited “a single, identified U.S. web page.”

So, the FBI was collecting internet browsing records, albeit with an order that only targeted foreign users visiting one US web page. Still, this wasn't what the DNI originally said to Sen. Wyden. This set Wyden off. Again. The supposedly honest answer he received in response to his questions wasn't actually all that honest. As he pointed out in his statement, the belated admission raised questions about domestic surveillance and potential abuse of Section 215 authority to collect something the DNI said no one was collecting. And, if nothing changed, there was no guarantee the Intelligence Community wouldn't talk itself into believing a collection of internet browsing data would be cool and legal.

“More generally,” Mr. Wyden continued, “the D.N.I. has provided no guarantee that the government wouldn’t use the Patriot Act to intentionally collect Americans’ web browsing information in the future, which is why Congress must pass the warrant requirement that has already received support from a bipartisan majority in the Senate.”

Previous attempts to erect a warrant requirement for the collection of internet data or search histories have failed to reach the president's desk. This latest admission has refueled the fire to protect Americans (or visitors to American websites) from government overreach. Even if such a collection targets only foreign internet users, there's no guarantee it won't sweep up US citizens -- like pretty much every other bulk collection has.

At this point, everything is up in the air. There's a new president headed into office who might be more receptive to reform efforts, but he's also the man who served the Obama Administration -- one that wasn't all that concerned about domestic surveillance until it became impossible to ignore the documents leaked by Ed Snowden. Even then, its response was tepid at best and it still allowed IC surveillance business to continue pretty much uninterrupted -- something it used to justify extrajudicial killings based on little more than metadata. This needs to be fixed, but surveillance reform advocates still lack majority support. And the guy headed to the White House has never seemed all that concerned about surveillance abuses.

Filed Under: 4th amendment, browsing data, bulk records, doj, fbi, fisa, fisc, john ratcliffe, mass surveillance, metadata, nsa, odni, patriot act, ron wyden, section 215, usa freedom act, warrant

Government Argues In Court That It Can Kill US Citizens At Will With Zero Judicial Oversight

from the your-tax-dollars-incoming dept

The federal government is back in court, arguing for its unilateral right to kill US citizens. Two journalists who had appeared to have been mistakenly targeted by drone strikes sued the government in 2017, seeking an injunction forbidding their own government from extrajudicially killing them.

The journalists, Ahmad Zaidan and Bilal Kareem, both experienced near misses by drone strikes. The suspicion they were mistakenly targeted was confirmed by an NSA document leaked by Ed Snowden that claimed Zaidan -- an Al Jazeera journalist -- was a member of Al Qaeda. His targeting was related to the government's bulk collection of metadata, which would have placed Zaidan close to several Al Qaeda members. His proximity to Al Qaeda members was to be expected, given his coverage of Al Qaeda activity and other events/incidents in the areas he covered.

All it takes is metadata to get someone killed -- even US citizens like Bilal Kareem who, like Zaidan, routinely covered Al Qaeda activity and spoke to Al Qaeda members. Kareem's solo lawsuit demanding confirmation that he had been placed on the government's kill list was terminated by the DC Circuit Court in 2019, which held that the information was too sensitive to share with US citizens possibly marked for death by their own government.

His joint lawsuit with Zaidan lives on, however. And it may finally provide the journalists with some answers. As Megan Mineiro reports for Courthouse News Service, the DC judges handling the case seemed rather shocked by the government's assertions.

Drawing alarm at the D.C. Circuit, a lawyer for the United States argued Monday that the government has the power to kill its citizens without judicial oversight when state secrets are involved.

“Do you appreciate how extraordinary that proposition is?” U.S. Circuit Judge Patricia Millett asked Justice Department attorney Bradley Hinshelwood, paraphrasing his claim as giving the government the ability to “unilaterally decide to kill U.S. citizens.”

The "state secrets" assertion was the same claim used to escape Kareem's solo lawsuit. But it doesn't appear to be working quite as well this time -- not when the government is saying it can engage in extrajudicial, extraterritorial killings of US citizens and other non-terrorists. "We kill people based on metadata," a former US government official gleefully exclaimed in response to Snowden leaks. That still holds true, and it appears the government loses no sleep when it kills the wrong people based on flawed assumptions about patterns in its metadata stash.

The government's alternate argument wasn't much better. It basically claimed Kareem couldn't prove the US targeted him because lots of people were throwing around bombs and missiles.

Shrugging off Kareem’s claims as baseless speculation, the government argued the alleged airstrikes occurred at a time when Syria was wracked by civil war.

“In all of these circumstances, he’s not even the only person present, much less is there anything to suggest that he’s actually the target of any of these specific attacks,” Hinshelwood said.

Of course, the government could easily prove it never targeted these journalists by handing over information about the contested drone strikes. But it won't. It would rather argue it can kill whoever it wants without oversight or judicial review. The government would rather make this bold statement in open court than submit classified info directly to judges and lawyers with security clearance that would confirm or refute the placement of the plaintiffs on kill lists. The government's priorities are incredibly screwed up. And we have a long and pointless "war on terror" to thank for its refusal to answer questions about its drone strike programs -- programs that may well be targeting innocent people (including US citizens).

Filed Under: ahmad zaidan, al qaeda, bilal kareem, doj, drone strikes, extrajudicial assassination, judicial oversight, kill list, metadata, national security, nsa, state secrets, terrorism, us citizens

Senator Wyden Wants To Know If The NSA Is Still Demanding Tech Companies Build Backdoors Into Their Products

from the build-them-or-we'll-just-build-our-own dept

It's been more than a half-decade since it made headlines, but the NSA's hardware manipulation programs never went away. These programs -- exposed by the Snowden leaks -- involved the NSA compromising network hardware, either through interception of physical shipments or by the injection of malicious code.

One major manufacturer -- Cisco -- was righteously angered when leaked documents showed some of its hardware being "interdicted" by NSA personnel. It went directly to Congress to complain. The complaint changed nothing. (Cisco, however, changed its shipping processes.) But even though the furor has died down, these programs continue pretty much unhindered by Congressional oversight or public outcry.

One legislator hasn't forgotten about the NSA's hardware-focused efforts. Senator Ron Wyden is still demanding the NSA answer questions about these programs and give him details about "backdoors" in private companies' computer equipment. The DOJ and FBI may be making a lot of noise about encryption backdoor mandates, but one federal agency is doing something about it. And it has been for years.

Not only has the NSA installed its own backdoors in intercepted devices, it has been working with tech companies to develop special access options in networking equipment. This allows the agency to more easily slurp up communications and internet traffic in bulk. Senator Wyden wants answers.

The agency developed new rules for such practices after the Snowden leaks in order to reduce the chances of exposure and compromise, three former intelligence officials told Reuters. But aides to Senator Ron Wyden, a leading Democrat on the Senate Intelligence Committee, say the NSA has stonewalled on providing even the gist of the new guidelines.

“Secret encryption back doors are a threat to national security and the safety of our families – it’s only a matter of time before foreign hackers or criminals exploit them in ways that undermine American national security,” Wyden told Reuters. “The government shouldn’t have any role in planting secret back doors in encryption technology used by Americans.”

No one knows what's in the guidelines and whether they forbid the NSA from backdooring hardware or software sold to US buyers. All the NSA is willing to say is it's trying to patch things up with domestic tech vendors by, um, giving them more stuff to patch up.

The agency declined to say how it had updated its policies on obtaining special access to commercial products. NSA officials said the agency has been rebuilding trust with the private sector through such measures as offering warnings about software flaws.

This is a welcome change after years of exploit hoarding. But there's no reason to believe the NSA isn't holding useful flaws back until they've outlived their exploitability. As for the built-in backdoors, the NSA refuses to provide any details. It won't even answer to its oversight. And if it won't do that, it really needs to stop saying things about "robust oversight" every time more surveillance abuses by the agency are exposed.

There's more to this than potential domestic surveillance. Any flaw deliberately introduced in hardware and software can be exploited by anyone who discovers it, not just the agency that requested it. The threat isn't theoretical. It's already happened. In 2015, it was discovered that malicious hackers had exploited what appeared to be a built-in flaw to intercept and decrypt VPN traffic running through Juniper routers. This appeared to be a byproduct of the NSA's "Tailored Access Operations." While Juniper has never acknowledged building a backdoor for the NSA, the circumstantial evidence points in No Such Agency's direction.

[Juniper] acknowledged to security researcher Andy Isaacson in 2016 that it had installed Dual EC [Dual Elliptic Curve] as part of a “customer requirement,” according to a previously undisclosed contemporaneous message seen by Reuters. Isaacson and other researchers believe that customer was a U.S. government agency, since only the U.S. is known to have insisted on Dual EC elsewhere.

This is the danger of relying on deliberately introduced flaws to gather intelligence or obtain evidence. Broken is broken and broken tools are toys for malicious individuals, which includes state-sponsored hackers deployed by this nation's enemies. It's kind of shitty to claim you're in the national security business when you're out there asking companies to add more attack vectors to their products.

Filed Under: 4th amendment, backdoors, nsa, ron wyden, surveillance
Companies: cisco, juniper