Former Presidential Cybersecurity 'Czar' Slams DOJ/FBI For Its Position On Apple Encryption

from the speak-louder dept

For many years, if you mentioned the term "cybersecurity czar" in the federal government, it only meant Richard Clarke. He was one of the earliest people to focus on computer security as an issue, and as such, became an advisor to multiple presidents on the issue. I haven't always agreed with him -- there have been points in the past where he's appeared as a leading voice in support of greater surveillance and exaggerated claims about a coming "cyberwar". However, in the past few years, Clarke has become much better on these issues, warning (just prior to Snowden's revelations) that the US's focus on surveillance has actually made the public less safe by leaving vulnerabilities open, rather than closing them.

And now he's weighed in, quite vocally, on the whole Apple v. the FBI thing, strongly in support of Apple. To some extent, this isn't a huge surprise as he was among a large group of smart folks who signed onto a letter a year ago opposing encryption backdoors, but his NPR interview gave him a chance to be quite explicit in just how dumb the FBI/DOJ's requests are. It's worth listening to the whole thing, or at least reading the transcript, but here are a few key highlights. Specifically, he argues that the FBI is lying in saying that it can't get access to the content on the phone, and just wants to set a precedent:

If I were in the job now, I would have simply told the FBI to call Fort Meade, the headquarters of the National Security Agency, and NSA would have solved this problem for them. They're not as interested in solving the problem as they are in getting a legal precedent.... Every expert I know believes that NSA could crack this phone. They want the precedent that the government can compel a computer device manufacturer to allow the government in.

Earlier in the interview, he totally dismisses the idea that there's a big dispute in the administration about this, saying that it's just the FBI and DOJ exaggerating:

Well, I don't think it's a fierce debate. I think the Justice Department and the FBI are on their own here. You know, the secretary of defense has said how important encryption is when asked about this case. The National Security Agency director and three past National Security Agency directors, a former CIA director, a former Homeland Security secretary have all said that they're much more sympathetic with Apple in this case. You really have to understand that the FBI director is exaggerating the need for this and is trying to build it up as an emotional case, organizing the families of the victims and all of that. And it's Jim Comey and the attorney general is letting him get away with it.

It's good to see more officials speaking out and calling bullshit on the FBI/DOJ claims on all of this.

Filed Under: all writs act, cybersecurity, doj, encryption, fbi, iphone, nsa, precedent, richard clarke
Companies: apple

New Group Seeking Privacy/Security Balance Loads Up On Former Government Officials And RSA Employees

from the don't-get-your-hopes-up dept

"I helped to organize it [Digital Equilibrium Project] with McKinsey's help with the idea that people on various sides were talking past one another, often without the facts," former Executive Chairman of RSA Art Coviello told eWEEK. "Our participants bring significant networks and resources to bear from themselves and the organizations they work with, and we're confident we have the resources to execute on the mission."

[...]

"We hope to create a groundswell of thinking—not through acrimonious and emotional debate, but through active listening and fact-based dialogue so we can we make progress before it is too late," he said.

So says Art Coviello of his new project -- one that he hopes will bring some coherence to the balancing act between security and privacy.

This is the same Art Coviello who said anonymity is the "enemy of privacy." Why? Because it allows bad people to do bad things and get away with it -- a sentiment echoed by any number of law enforcement officials and intelligence agency heads.

Coviello's timing couldn't be better. Against the backdrop of the FBI's efforts to force Apple to help it break into iPhones, Coviello hopes a balanced discussion of the issues may result in workable common ground between parties he feels often "talk past each other."

But the Digital Equilibrium Project isn't going to be the balanced discussion Coviello is framing it as. The list of participants seems to indicate the discussion will result in severe inner ear damage, rather than equilibrium.

Stewart Baker
Former 1st Assistant Secretary of DHS General Counsel of the NSA

Michael Chertoff
Executive Chairman of The Chertoff Group
U.S. Secretary of Homeland Security (’05-’09)

Edward Davis
Former Boston Police Commissioner

Michael McConnell
Former Director of the NSA and
Director of National Intelligence
[and head of Booz Allen, which goes unmentioned on DEG page...]

JR Williamson
Corporate Chief Information Officer, Northrop Grumman

Richard Clarke
Former White House Advisor
Chairman and CEO, Good Harbor Security Risk Management
[Former "cybersecurity czar" to be more precise, one who has suggested the government "search" internet traffic travelling in and out of the US (to prevent theft by China{?}). On the plus side, he did sign a letter to the Administration stating that mandated encryption backdoors are a terrible idea.]

That's only part of the stacked deck, but what a hand! NSA, DHS, Boston PD, military-industrial contractor, a cybersecurity "czar…"

From there, it gets marginally better.

Tim Belcher
Former CTO, RSA
[RSA worked closely with the NSA to recommend an undermined encryption standard]

Jim Bidzos
Chairman and CEO, Verisign
[Verisign has worked with ICE and others to make site seizures easier, participated in global internet censorship]

Art Coviello
Former Executive Chairman, RSA
[See above]

Kasha Gauthier
Program Committee Co-Chair, NICE
Special Advisor, Boston College Cybersecurity Masters Program
[Not mentioned: Gauthier's position as Director of Academic and Community Alliances at RSA. Also serves as Director of Marketing and Strategy.]

It gets much better from there. Most of the remaining names on this list have a long history of protecting privacy and working towards enhancing security for all internet users, not just government agencies.

Dr. Ann Cavoukian, Ph.D.
Executive Director of the Privacy and Big Data Institute at Ryerson University
[Former Ontario Privacy Commissioner, who has stated that "encryption is freedom" and taken legal action against local law enforcement for sharing sensitive medical information with US law enforcement agencies.]

Larry Clinton
President and CEO, Internet Security Alliance
[The ISA is a trade alliance which lobbies on behalf of businesses. In light of FBI v. Apple, this is possibly a good thing. Clinton's statements indicate he feels the government's belief that "information sharing" will solve cybersecurity woes is largely unfounded.]

Brian Fitzgerald
Chief Marketing Officer, Veracode
[Veracode was founded by white hat hackers and routinely provides updates on the current state of cybersecurity in the nation. Just as routinely, it finds government agencies to be the worst at security.]

J. Trevor Hughes
President and CEO, International Association of Privacy Professionals
[IAPP is a non-profit, "non-advocacy" group, which would make it about as unbiased as anyone can get in this discussion.]

Nuala O’Connor
President and CEO,
Center for Democracy and Technology
[O'Connor was the DHS's first Chief Privacy Officer and did that job well enough to earn the praise of the ACLU and others -- a tough thing to do with the inherent limitations of the position, which did not allow her to publicly criticize the DHS's failures. Since then, she has headed up the Center for Democracy and Technology, which advocates for privacy, freedom of speech and surveillance reform.]

If the RSA insiders are "swing votes," this discussion could actually end up "balanced." But it seems unlikely to result in the common ground Coviello says he's seeking. He wants to break up "polarized, entrenched views" but a majority of those participating will likely advocate for positions that closely align with the government and its contractors.

Fortunately, this wasn't assembled by Congress or the administration, where it might do some actual damage. Some decent discussion may result from this blend of privacy advocates and former government officials, but the composition is still too one-sided to state this with any confidence.

Filed Under: ann cavoukian, art coviello, brian fitzgerald, consortium, edward davis, jim bidzos, jr williamson, kasha gauthier, larry clinton, michael chertoff, michael mcconnell, nuala o'connor, privacy, richard clarke, security, stewart baker, trevor hughes

Pretty Much Anyone With Any Understanding Of Crypto Tells President Obama That Backdooring Crypto Is Monumentally Stupid

from the basic-understanding dept

Nearly 150 tech companies (including us via the Copia Institute), non-profits and computer security experts have all teamed up to send a letter to President Obama telling him to stop these stupid ideas about backdooring encryption that keeping coming out of his administration. The press headlines will note that big companies -- like Google, Apple, Cisco, Microsoft, Twitter and Facebook -- are signing the letter. But significantly more interesting is the signatures from a huge list of computer security experts, all putting their names down on paper to make it clear what a ridiculously bad idea it is to even think about backdooring encryption. Among those signing on are Phil Zimmermann (who lived through this sort of thing before), Whitfield Diffie (guy who invented public key cryptography), Brian Behlendorf, Ron Rivest, Peter Neumann, Gene Spafford, Bruce Schneier, Matt Blaze, Richard Clarke (long-time counterterrorism guy in the White House), Hal Abelson and many, many more. Basically a who's who of people who actually know what they're talking about.

We urge you to reject any proposal that U.S. companies deliberately weaken the security of their products. We request that the White House instead focus on developing policies that will promote rather than undermine the wide adoption of strong encryption technology. Such policies will in turn help to promote and protect cybersecurity, economic growth, and human rights, both here and abroad.

Strong encryption is the cornerstone of the modern information economy’s security. Encryption protects billions of people every day against countless threats—be they street criminals trying to steal our phones and laptops, computer criminals trying to defraud us, corporate spies trying to obtain our companies’ most valuable trade secrets, repressive governments trying to stifle dissent, or foreign intelligence agencies trying to compromise our and our allies’ most sensitive national security secrets.

Encryption thereby protects us from innumerable criminal and national security threats. This protection would be undermined by the mandatory insertion of any new vulnerabilities into encrypted devices and services. Whether you call them “front doors” or “back doors”, introducing intentional vulnerabilities into secure products for the government’s use will make those products less secure against other attackers. Every computer security expert that has spoken publicly on this issue agrees on this point, including the government’s own experts.

There's much more in the full letter which I highly recommend reading. It very nicely summarizes why this is a completely insane idea, and highlights why anyone raising it should be immediately told to move on to some other project instead:

The Administration faces a critical choice: will it adopt policies that foster a global digital ecosystem that is more secure, or less? That choice may well define the future of the Internet in the 21st century. When faced with a similar choice at the end of the last century, during the so-called “Crypto Wars”, U.S. policymakers weighed many of the same concerns and arguments that have been raised in the current debate, and correctly concluded that the serious costs of undermining encryption technology outweighed the purported benefits. So too did the President’s Review Group on Intelligence and Communications Technologies, who unanimously recommended in their December 2013 report that the US Government should “(1) fully support and not undermine efforts to create encryption standards; (2) not in any way subvert, undermine, weaken, or make vulnerable generally available commercial software; and (3) increase the use of encryption and urge US companies to do so, in order to better protect data in transit, at rest, in the cloud, and in other storage.”

The Washington Post quotes another surprising signatory: Paul Rosenzweig, the former Deputy Assistant Secretary for Policy at Homeland Security. If that name sounds familiar, it's because we've quoted his defense of the NSA, once arguing that "too much transparency defeats the very purpose of democracy." If even he is arguing against backdooring encryption, you know it's an idea that should be killed off. In his case, it's because he recognizes the simple reality that seems to have eluded the FBI director:

The signatories include policy experts who normally side with national-security hawks. Paul Rosenzweig, a former Bush administration senior policy official at the Department of Homeland Security, said: “If I actually thought there was a way to build a U.S.-government-only backdoor, then I might be persuaded. But that’s just not reality.”

That's just not reality. And neither should be any policy effort that involves pushing for more backdoors in encryption. It's bad economic policy. It's bad security policy. It's bad crypto policy. It's bad privacy policy. It's just bad policy all around.

And the world would be much better off if all of these security experts and companies could focus on better protecting us from harm, rather than having to join in ridiculous debates about what a bunch of clueless bureaucrats think might be some sort of mythical magic unicorn encryption breaker.

Filed Under: 4th amendment, backdoors, bruce schneier, crypto, encryption, paul rosenzweig, phil zimmermann, privacy, richard clarke, ron rivest, security, vulnerabilitities, whitfield diffie
Companies: apple, cisco, facebook, google, microsoft, twitter

Former CIA Boss, Task Force Member Says Even Though Metadata Collection Hasn't Been Useful, It Should Be Expanded

from the huh? dept

We've pointed out that one of the big surprises in the White House's task force proposals on NSA reform, was that the task force was pretty clear that the NSA had absolutely nothing to support the claims that the Section 215 (of the PATRIOT Act) bulk metadata collection had been even remotely helpful. Multiple members of the task force have discussed how shocked they were to find the lack of any "there" there. As we noted, law professor Geoffrey Stone expressed his shock to NBC:

“It was, ‘Huh, hello? What are we doing here?’” said Geoffrey Stone, a University of Chicago law professor, in an interview with NBC News. “The results were very thin.”

While Stone said the mass collection of telephone call records was a “logical program” from the NSA’s perspective, one question the White House panel was seeking to answer was whether it had actually stopped “any [terror attacks] that might have been really big.”

“We found none,” said Stone.

Meanwhile, Richard Clarke, former anti-terrorist czar to multiple presidents, expressed similar surprise in an interview with On The Media. When asked about that program, he noted that the task force had been given security clearance to go through all of the data and all of the cases where Section 215 data was used, and:

"we came to the conclusion it was not necessary in any case where it was used."

Throughout all of this, I'd been kind of curious to hear where task force panel member Michael Morell came down on all of this. He was the most suspect member of the task force, having been the acting director of the CIA until just a little while before the task force was put together. In other words, he was an ultimate intelligence community insider, and I kind of wondered if he had been a dissenting voice on some of this, overruled by the others.

Well, Morell is now speaking out, and while it's not clear if he was overruled, he is trying very, very hard to spin the proposals and findings over Section 215 into something very different, almost directly in contrast with the statements from Stone and Clarke. Specifically, he is arguing that even though the bulk data collection has been useless he's sure it could be useful in the future if allowed to continue. Actually, he goes beyond that, saying that what would be even more useful is if they added back bulk metadata collection around email, the program that had been stopped back in 2011, as even the NSA itself had admitted it had little to no value. But Morell supports them both, because he thinks that maybe it'll be helpful in the future.

"I would argue actually that the email data is probably more valuable than the telephony data," Morell told National Journal in a telephone interview. "You can bet that the last thing a smart terrorist is going to do right now is call someone in the United States."

Morell also said that while he agreed with the report's conclusion that the telephone data program, conducted under Section 215 of the USA Patriot Act, made "only a modest contribution to the nation's security" so far, it should be continued under the new safeguards recommended by the panel. "I would argue that what effectiveness we have seen to date is totally irrelevant to how effective it might be in the future," he said. "This program, 215, has the ability to stop the next 9/11, and if you added emails in there it would make it even more effective. Had it been in place in 2000 and 2001, I think that probably 9/11 would not have happened."

This is ridiculous on multiple levels. The idea that more data collection would have stopped 9/11 has already been thoroughly debunked by Michael German, who went through the 9/11 Commission report, showing that the intelligence community actually had already collected more than enough info to discover the plot -- they just failed to do anything with the information. And, in fact, that's a key part of the problem: adding more data to the pile actually makes it harder to understand that data. This is why it's silly for NSA defenders to keep talking about "needles and hay stacks." The point of the needle and the haystack is that the more hay you have, the harder it is to find the needle.

Furthermore, it takes some kind of logic to argue that a program that's been in existence for years, with not a single success to show for it, should be kept up (and expanded) just because it might be useful somehow in the future. Elsewhere, Morell faithfully repeated the NSA's other big talking point about how none of what it's doing is "spying on Americans."

“I think that is a perception that's somehow out there. It is not focused on any single American. It is not reading the content of your phone calls or my phone calls or anybody else's phone calls. It is focused on this metadata for one purpose only and that is to make sure that foreign terrorists aren't in contact with anybody in the United States,” said Michael Morell on CBS’ “Face the Nation.”

While some people do think that (and, for what it's worth, it does appear that the NSA is collecting such content on many people, including Americans, through other programs), people are just as concerned about the metadata collection -- as has been clearly explained many times over. Besides, the report that Morell himself was a part of seems to indicate the quite reasonable concern that this data could be seriously abused.

It's interesting to see Morell try to spin his own report, but the words of his fellow panelists show what's really going on. Section 215 hasn't done anything useful. Morell's idea of expanding it and claiming it might do something useful in the future is based on nothing other than the general desire of the intelligence community, which Morell is a part of, to always suck up as much information as possible, no matter what the consequences or harm it may cause.

Filed Under: bulk metadata collection, cia, geoffrey stone, intelligence, michael morell, nsa, richard clarke, section 215, task force

Administration's Surveillance Review Board Appointees Mostly Sympathetic Insiders

from the totally-dying-of-shock-right-now dept

The surveillance review panel (feat. special guest James Clapper!) Obama announced on August 9th has taken shape. Four appointees have been named, and if this ends up being the totality of the panel, there's not much hope it will provide any sort of meaningful pushback on excessive or intrusive surveillance.

As the Washington Post reports, the four members of the panel are all Washington insiders.

[O]bama administration’s surveillance review panel will include former intelligence and White House staffers, including Michael Morell, Richard Clarke, Cass Sunstein and Peter Swire.

Morell is 33-year veteran of the CIA, who retired from his post just two weeks ago. Where he stands on privacy matters isn't exactly clear, but considering his former position as deputy director, it would stand to reason he's more aligned with the NSA's thinking than the public's.

Richard Clarke is a long-time cyberwar hawk, having served as the chairman of the Counter-Terrorism Security Group under George H.W. Bush, as well as a long stint on the National Security Counsel. Clarke has made recent pushes for more offensive cyberwar strategies and has generally contributed to the FUD surrounding these issues.

On the plus side, he was highly critical of the second Bush administration's actions during his testimony to the 9/11 Commission. That being said, he's really not in favor of scaling back surveillance efforts. Orin Kerr sums Clarke up this way in his piece on the surveillance panel.

[I]n my experience working on some similar issues as he did in the government, Clarke had a reputation for seeing everything as an extraordinarily grave national security threat. I would think Clarke is likely to bring in a pro-government perspective on the issues here.

This brings us to Cass Sunstein, who's a bit of a wildcard. Sunstein's written work tends to draw together a blend of constitutional law, behavioral science and economics, often reaching some very interesting conclusions. But what's most concerning about Sunstein's appointment is the views he expressed in a 2008 paper co-authored with Adrian Vermule, where he argued that the government should be paying more attention to those spreading conspiracy theories.

"The existence of both domestic and foreign conspiracy theories, we suggest, is no trivial matter, posing real risks to the government’s antiterrorism policies, whatever the latter may be." They go on to propose that, "the best response consists in cognitive infiltration of extremist groups"...

Glenn Greenwald has more on Sunstein's paper in his 2010 piece for Salon.com

Sunstein advocates that the Government’s stealth infiltration should be accomplished by sending covert agents into “chat rooms, online social networks, or even real-space groups.” He also proposes that the Government make secret payments to so-called “independent” credible voices to bolster the Government’s messaging (on the ground that those who don’t believe government sources will be more inclined to listen to those who appear independent while secretly acting on behalf of the Government).   This program would target those advocating false “conspiracy theories,” which they define to mean: “an attempt to explain an event or practice by reference to the machinations of powerful people, who have also managed to conceal their role.”

This would be designed to increase citizens’ faith in government officials and undermine the credibility of conspiracists.

Whatever you may personally think about conspiracy theorists and the potential dangers they pose, it's hard to believe that government infiltration and propagandizing is the correct response. (It's somewhat hard to argue this sort of activity actually requires a response from the government at all.) Having someone with an inclination towards government-led espionage activities aimed at its own citizens on a surveillance review board isn't exactly a comforting thought.

The final name on the list, Peter Swire, may be the only appointee to take on an actively adversarial role. Swire has long been an advocate for privacy, having served as the Chief Counselor for Privacy in the Office of Management and Budget (OMB) during the Clinton administration.

More recently he has been very active working to achieve a global "Do Not Track" standard and has, over the past several years, written articles and given interviews critical of the agency's activities, including co-signing an amicus brief arguing that the NSA's telephone metadata program is illegal. He's also been a longtime critic of parts of the PATRIOT Act. If anyone's going to be advocating for privacy, it's probably going to be Swire. Unfortunately, this may leave him as the odd man out.

On top of that, this board, composed mainly of government and surveillance proponents, will be reporting directly to confirmed liar James Clapper (the administration phrases it "reporting through") who is or isn't directly involved with the appointment process, depending on how you define the word "establish."

I guess one (or 1.5, depending on Sunstein's contribution) out of four is better than nothing. But by selecting intelligence officials and former administration staff members, Obama is (once again) sending the message that the "debate" will be still be very tightly controlled.

Filed Under: barack obama, cass sunstein, james clapper, michael morell, nsa, nsa surveillance, peter swire, review, review board, richard clarke, surveillance

Former Cybersecurity Czar Thinks DHS Should Spy On All Internet Traffic Crossing Our Borders... Because Of Chinese Pirates?

from the um,-no dept

Richard Clarke, the former cybersecurity czar in the White House -- and a huge, huge, huge proponent of pushing for greater legislation for spying on Americans under the guise of "cybersecurity" (it used to be "cyberwar" but that term was so laughable, it's been downgraded to "cybersecurity) -- has written one of the most ridiculous defenses of new internet spying proposals, claiming that Chinese hackers are stealing all our intellectual property by hacking into computers online. He has no evidence of this. He tells apocryphal stories of Chinese hackers somehow getting all the data from a "$1 billion research program copied by hackers in one night." The whole thing is fear-mongering in the extreme, using the specter of evil "Chinese pirates" hacking computers and stealing important US intellectual property. That's wrong for a variety of reasons that we've discussed multiple times. But where it gets downright silly is in his assertion that (1) the US could magically "stop" these mythical hackers from "stealing" data, and (2) that Homeland Security already has the authority to spy on all internet traffic as it comes over the border:

If given the proper authorization, the United States government could stop files in the process of being stolen from getting to the Chinese hackers. If government agencies were authorized to create a major program to grab stolen data leaving the country, they could drastically reduce today’s wholesale theft of American corporate secrets.

[....]

Under Customs authority, the Department of Homeland Security could inspect what enters and exits the United States in cyberspace. Customs already looks online for child pornography crossing our virtual borders. And under the Intelligence Act, the president could issue a finding that would authorize agencies to scan Internet traffic outside the United States and seize sensitive files stolen from within our borders.

And this does not have to endanger citizens’ privacy rights. Indeed, Mr. Obama could build in protections like appointing an empowered privacy advocate who could stop abuses or any activity that went beyond halting the theft of important files.

Almost everything stated above is ridiculous. As law professor James Grimmelman points out, with this article "Richard Clarke disqualifies himself from participating in any serious discussion of cybersecurity."

Indeed. It's scary to think that Clarke was ever seen as an expert in cybersecurity. He seems to be under the assumption that the internet really is a series of tubes, in which customs agents can simply stop all that data at the border and inspect it. And the idea that appointing a single "privacy advocate" would magically stop abuses? You'd think he just stepped off the turnip truck, rather than having spent many years in government where privacy was regularly abused, despite much more significant safeguards in place. Who does he think he's kidding?

Will we ever have people driving policy discussions on regulating the internet who actually understand the internet?

Filed Under: customs, cybersecurity, dhs, hackers, richard clarke