Former NSA Official Argues The Real Problem With Undisclosed Exploits Is Careless End Users

from the sorry-about-all-the-ransomware dept

As leaked NSA software exploits have been redeployed to cause computer-based misery all over the world, the discussion about vulnerability disclosures has become louder. The argument for secrecy is based on the assumption that fighting an existential threat (terrorism, but likely also a variety of normal criminal behavior) outweighs concerns the general public might have about the security of their software/data/personal information. Plenty of recent real-world examples (hospital systems ransomed! etc.) do the arguing for those seeking expanded disclosure of vulnerabilities and exploits.

Former Deputy Director of the NSA Rick Ledgett appears on the pages of Lawfare to argue against disclosure, just as one would have gathered by reading his brief author bio. Ledgett's arguments, however, feel more like dodges. First off, Ledgett says the NSA shouldn't have to disclose every vulnerability/exploit it has in its arsenal, an argument very few on the other side of the issue are actually making. Then he says arguments against exploit hoarding "oversimplify" the issue.

The WannaCry and Petya malware, both of which are partially based on hacking tools allegedly developed by the National Security Agency, have revived calls for the U.S. government to release all vulnerabilities that it holds. Proponents argue that this would allow patches to be developed, which in turn would help ensure that networks are secure. On its face, this argument might seem to make sense—but it is a gross oversimplification of the problem, one that not only would not have the desired effect but that also would be dangerous.

At this point, you'd expect Ledgett to perform some de-simplification. Instead, the post detours for a bit to do some victim-blaming. It's not the NSA's fault if undisclosed exploits wreak worldwide havoc. It's the end users who are the problem -- the ones who (for various reasons) use outdated system software or don't keep current with patches. This isn't a good argument to make for the very reasons outlined in Ledgett's opening paragraph: software vendors can't patch flaws they're unaware of. This is where disclosure would help protect more users, even if it meant the loss of some surveillance intercepts.

Then Ledgett argues the NSA's leaked exploits weren't really the problem. If they hadn't been available, the malware purveyors just would have used something else.

The actors behind WannaCry and Petya, believed by some to be from North Korea and Russia, respectively, had specific goals when they unleashed their attacks. WannaCry seemed to be straightforward but poorly executed ransomware, while Petya appeared to have a more sinister, destructive purpose, especially in the early Ukraine-based infection vector. Those actors probably would have used whatever tools were available to achieve their goals; had those specific vulnerabilities not been known, they would have used others. The primary damage caused by Petya resulted from credential theft, not an exploit.

This is undoubtedly true. Bad actors use whatever tools help them achieve their ends. It's just that these specific cases -- the cases used by Ledgett to argue against increased disclosure -- were based on NSA exploits vendors hadn't been informed of yet. The patches that addressed more current vulnerabilities weren't issued until after the NSA told Microsoft about them, and it only did that because its toolset was no longer under its control.

Ledgett also points out that the NSA does better than most state entities in terms of disclosure:

Most of the vulnerabilities discovered by the U.S. government are disclosed, and at the National Security Agency the percentage of vulnerabilities disclosed to relevant companies has historically been over 90 percent. This is atypical, as most world governments do not disclose the vulnerabilities they find.

Maybe so, but there's not much honor than just being better than the worst governments. Ledgett only says the NSA is better than "most." This doesn't turn the NSA into a beacon of surveillance state forthrightness. All it does is place it above governments less concerned about the security and wellbeing of their citizens.

Ledgett then goes back to the well, claiming a) the two recent attacks had nothing to do with the NSA, and b) disclosing vulnerabilities would make the NSA less effective.

WannaCry and Petya exploited flaws in software that had either been corrected or superseded, on networks that had not been patched or updated, by actors operating illegally. The idea that these problems would be solved by the U.S. government disclosing any vulnerabilities in its possession is at best naive and at worst dangerous. Such disclosure would be tantamount to unilateral disarmament in an area where the U.S. cannot afford to be unarmed… Neither our allies nor our adversaries would give away the vulnerabilities in their possession, and our doing so would probably cause those allies to seriously question our ability to be trusted with sensitive sources and methods.

The problem here is that Ledgett ignores the obvious: leaked NSA tools helped create the problem. The NSA never disclosed these vulnerabilities to affected software vendors -- at least not until it became obvious it could no longer keep these tools secret.

I'm guessing the NSA is already living through the last part of Ledgett's paragraph. A set of effective, still-undisclosed vulnerabilities being digitally spirited away and dumped into the public's lap probably makes it less likely foreign surveillance partners will be sharing their malware toolkits with the NSA.

This leads right into another argument against vulnerability hoarding: it has been shown with complete clarity that the NSA can't guarantee its exploits will never be used by criminals and malicious governments. The leak of its toolkit shows any suggestion that only the "good guys" will have access to undisclosed vulnerabilities is both ignorant and arrogant. The NSA isn't untouchable. Neither are all the surveillance partners the NSA has shared its tools with.

In the end, it's the private sector's fault, according to Ledgett. The solution is for vendors to write better software and end users to patch more frequently. This is good advice, but not an absolution of the NSA's vulnerability secrecy.

The NSA needs to do better balancing its needs and the security of the general public. Very few people are arguing the NSA should have zero undisclosed exploits. But the exploits dumped by the Shadow Brokers affected older versions of Microsoft system software dating back to Windows XP and they still weren't patched until the exploits had already been made public. These were exploits some in the NSA thought were too powerful, and yet, the NSA did nothing until the malware offspring of its secret exploit stash were taking down systems all over the world.

Filed Under: disclosure, exploits, malware, nsa, rick ledgett, vep, vulnerabilities

CIA And NSA Directors Blame The Media For Terrorists Using Encryption

from the sorry dept

When it comes to the conversation that's going on about the use of encryption, CIA director John Brennan and NSA Deputy Director Rick Ledgett have acquitted themselves rather poorly on a regular basis. It's been an ongoing source of frustration to see the aftermath of the Paris terrorist attacks in particular devolve into a discussion on encryption, despite all evidence suggesting that those attacks weren't planned using any kind of encryption at all. That didn't keep Brennan from claiming that the CIA was unable to keep attacks from occurring due to encryption, nor has it stopped the calls from intelligence officials for even more data collection, despite the fact that those same officials have proven to be soft targets for hackers themselves. Ledgett, meanwhile, has proven to be an adversary of the free press, cheering on the destruction of computers from The Guardian.

And so it is with this backdrop that Brennan and Ledgett sat before Congress and claimed that terrorists were only using all of this encryption because of the god damned media. The hearing was supposed to be for questioning FBI Director James Comey about the dust up between the government and Apple over backdooring iPhones, except Comey essentially answered every question by shrugging his shoulders. Frustrated, the questioners turned to Brennan and Ledgett.

The oddest part came at the end, after everyone realized that Comey wasn’t actually going to say anything substantive. At that point, members of Congress asked CIA Director John Brenner and NSA Deputy Director Rick Ledgett about terrorists “going dark” by using encryption technology. “Going dark” has become an intelligence community slogan, a phrase to describe what happens when it has the legal means to search and intercept digital communications but can’t technically do it because of security protections.

“The ability of these terrorists to communicate with one another that makes it very difficult to uncover has been increasing. It’s very frustrating but very concerning,” Brennan said. “They follow the press, they follow these discussions.”

Ledgett poked his finger at the media even more explicitly. “We track when our foreign intelligence targets talk about the security of their communication,” he said. “And we see a growing number of them, because of what’s in the press about the value of encryption, moving towards that.”

Are we really to believe that the same terrorists of whom the American public ought be so terrified are chiefly informed as to their technological tactics by media and technology outlets? The suggestion appears to be that terror groups were unaware of encryption before coming across reporting on them. Reporting that really only ramped up, mind you, after intelligence officials falsely invoked encryption as the danger. In what world does that timeline result in the media being to blame for terrorists using encryption?

And, more interestingly, what would Brennan and Ledgett have happen, assuming anyone believed this nonsense? Is there to be a moratorium on discussing technology in the press? Some kind of strange silent treatment given to a technology that is in widespread use for all manner of legitimate reasons? What is the point of the comment? It can't accomplish anything, other than to attempt to distract the public from the failings and lies of these same intelligence agencies for a moment.

Neither Brennan or Ledgett specified which reports were believed to be frequently dog-eared on ISIS squatters, but that doesn’t matter. Extremists are interested in privacy tools, and media reports on privacy tools. Saying that they read about which tools to use is just saying that any group with goals attempts to find information that will help achieve those goals. Implying that media reports are aiding and abetting the enemy—not to mention the notion that reports highlighting privacy protections are somehow devious—is just unfair and chilling.

And not only that, but also consider that it will achieve no end. Trying to reduce discussions about encryption doesn't eliminate the technology itself. Try picturing an ISIS operation planner saying, "Man, we wanted to hide our communication, but we couldn't find anything about it on Techdirt so we gave up." If you can do so without laughing, it might be time for a brain tune-up, because something in your head is askew.

The point is that blaming the media is a tactic best left to talk radio shows. Our intelligence officials ought to be able to do better.

Filed Under: cia, encryption, isis, john brennan, media, nsa, rick ledgett, terrorists

Obtained Emails Show NSA Officials Knew In Advance Of GCHQ's Plans To Destroy The Guardian's Computers

from the nice-press-freedom-you-got-here...-it's-be-a-shame-if-something-happened-to dept

Last year, in a move simultaneously symbolic, thuggish and completely futile, GCHQ officials forced The Guardian to destroy computers "containing" Snowden documents. The fact that the documents were also housed elsewhere (including at two American newspapers) mattered little. The point was simple: we can get to you. In the service of "national security," the GCHQ came down on the journalistic entity with something straight out of the Running A Dictatorship For Fun And Profit handbook. Exact words deployed: "You've had your debate. There's no need to write more."

NSA officials notably refused to comment on the GCHQ's actions, perhaps hoping critics would view the silence as disapproval or, at the very least, pointedly not condoning the hardware destruction. The White House publicly condemned the destruction, stating that it was "hard to imagine" this sort of thing happening domestically. That was just the PR front, apparently. Documents obtained by the AP show that NSA officials and administration staff were not only notified in advance of the GCHQ's plans, but also offered their support of this action.

General Keith Alexander, the then director of the NSA, was briefed that the Guardian was prepared to make a largely symbolic act of destroying documents from Edward Snowden last July, new documents reveal.

The revelation that Alexander and Obama's director of national intelligence, James Clapper, were advised on the Guardian's destruction of several hard disks and laptops contrasts markedly with public White House statements that distanced the US from the decision.

GCHQ's attempted prior restraint found support from the upper levels of the NSA. Presumably, officials knew how empty the effort was (what with documents having been spread to the New York Times, ProPublica and others), but that still didn't stop at least one official from greeting the GCHQ's plans with enthusiasm.

An email to Alexander from Rick Ledgett, now deputy director of the NSA, has the subject line "Guardian data being destroyed", and is dated 19 July, a day before the destruction of the files. Most is heavily redacted, but Ledgett remarks: "Good news, at least on this front."

Ledgett has a bizarre definition of "good news." All this move did was confirm that the GCHQ cared more about pretending it could somehow regain control of the situation than it did about freedom of the press. These obtained documents show the NSA's top men think the same way. Given these two countries' close surveillance relationship, this news comes as a bit of a surprise (considering earlier administration statements) but certainly not as a shock.

When one "free world" country applauds another's low-rent thug tactics (even in secrecy), the message is clear: the public needs to be taught not to question things above its pay grade.

Filed Under: destruction, gchq, hard drive, keith alexander, nsa, rick ledgett, surveillance
Companies: the guardian

NSA Officials Hate Ed Snowden With A Passion

from the yes,-emotional-response-is-what-we-need dept

Last week we wrote about Steven Levy's big article concerning the impact on the tech industry of the NSA's activities. This week, he's written a short piece about the two hours he got to spend at Fort Meade in the NSA's headquarters meeting with some of the NSA's top officials there. He explains how they didn't seem to want to cooperate at first, but then became much more accommodating later on. He notes that the NSA doesn't seem to recognize that "protecting" Americans and "breaking everyone's crypto" might be two goals that are at odds with one another. But, the main point he makes: NSA officials really, really, really seem to hate Ed Snowden's guts:

They really hate Snowden. The NSA is clearly, madly, deeply furious at the man whose actions triggered the biggest crisis in its history. Even while contending they welcome the debate that now engages the nation, they say that they hate the way it was triggered. The NSA has an admittedly insular culture — the officials described it as almost like a family.... NSA officials are infuriated that all this havoc was caused by some random contractor. They suggest that had Snowden been familiar with the culture and the ethos of the agency, understood the level of training undergone by its employees, seen the level of regulations and oversight, he would have been less likely to abscond with all those documents. (Snowden’s interviews indicate otherwise.) Still, they are stunned that someone “inside the fence” would do what Snowden did. Even if Snowden is eventually pardoned, he’d do well to steer clear of Fort Meade.

There's something kind of funny about the fact that they look down on him as being "some random contractor" and if only he'd really been a part of the "NSA family" that he'd "understand." That seems quite unlikely, but also suggests one of the many reasons why what the NSA is doing is so problematic. Any mission that involves people having to feel a "part of the group" to make sure that the surveillance isn't abused is a system that will be abused.

Even more troubling, is that the NSA still seems to be reacting emotionally to the whole thing. That's part of the reason they still seem unable to comprehend how much damage they've done -- not Snowden.

Filed Under: ed snowden, emotion, keith alexander, nsa, rick ledgett, steven levy, surveillance

7 Things You Missed If You Didn't Read Wired's Big Story On How The NSA Is Killing The Internet

from the it's-not-almost dept

Steven Levy, who specializes in massive articles looking into aspects of the tech industry, has a new one for Wired, called How the NSA Almost Killed the Internet. It basically looks at how the NSA legally coerced the tech companies into having to comply with certain court orders to hand over information, and how the tech companies have been gagged from explaining what's going on. And then... he gets the NSA's side of the story. Much of what's in there is stuff that you probably already know (especially if you read Techdirt regularly), but I wanted to call out a few tidbits that I hadn't seen or heard anywhere else before:

1. Google doesn't charge the government for requests for information:

   FISA requires the government to reimburse companies for the cost of retrieving information. Google says it doesn’t bother to charge the government. But one company says it uses that clause, hoping to limit the extent of the requests. “At first, we thought we shouldn’t charge for it,” says an executive of that company. “Then we realized, it’s good—it forces them to stop and think.”

   This is kind of a "damned if you do/damned if you don't" situation. I know plenty of folks in the civil liberties community go back and forth on it. When companies do charge, then you see articles about how companies are "making a profit" off of violating our privacy. If they don't charge, then you see arguments about how they're making it too easy for the government to get info. Either way, the standard has been to charge basic costs, so it's interesting to see that Google doesn't charge at all, probably betting on the fact that if they did, it would be misrepresented. Of course, the fact that they don't might be misrepresented as well.
2. The NSA has no response to fear of future abuse of programs beyond "we'd never do that." Seriously.

   Critics charge that while there is not yet any evidence of massive abuse of the NSA’s collected data, there is also no guarantee that a future regime won’t ignore these touted protections. These officials discounted that possibility, saying that the majority of NSA employees wouldn’t stand for such a policy. “If that happened, there would be lines at the Inspector General’s office here, and at Congress as well—longer than a Disneyland line,” Ledgett says. (The fates of several NSA employees-turned-whistleblowers indicate that anyone in that hypothetical queue would be in for a ride far wilder than anything in Anaheim.)

   Sure, except there's a very long history of the NSA and the FBI doing exactly the opposite (the claim of no evidence of massive abuse is not actually true). And, as Levy notes in that final parenthetical, the way whistleblowers are treated these days would probably shorten that line quite a bit.
3. Keith Alexander admits that companies were compelled to comply and admits that we should stand up for the companies not to be harmed by all of this:

   “This isn’t the companies’ fault. They were compelled to do it. As a nation, we have a responsibility to stand up for the companies, both domestically and internationally. That is our nation’s best interest. We don’t want our companies to lose their economic capability and advantage. It’s for the future of our country.”
   
   Those words could have come from a policy spokesperson for Google, Facebook, Microsoft, or Yahoo. Or one of the legislators criticizing the NSA’s tactics. Or even a civil liberties group opposing the NSA. But the source is US Army general Keith Alexander, director of the NSA. Still, even as he acknowledges that tech companies have been forced into a tough position, he insists that his programs are legal, necessary, and respectful of privacy.

   This is just bizarre. If he doesn't want the companies to lose their economic capability and advantage, maybe he shouldn't have undermined a large portion of it.
4. Companies were given about 90 minutes to respond to the (misleading) claims in the original PRISM article that they had given the NSA direct access to their servers.

   “We had 90 minutes to respond,” says Facebook’s head of security, Joe Sullivan. No one at the company had ever heard of a program called Prism. And the most damning implication—that Facebook and the other companies granted the NSA direct access to their servers in order to suck up vast quantities of information—seemed outright wrong. CEO Mark Zuckerberg was taken aback by the charge and asked his executives whether it was true. Their answer: no.
   
   Similar panicked conversations were taking place at Google, Apple, and Microsoft. “We asked around: Are there any surreptitious ways of getting information?” says Kent Walker, Google’s general counsel. “No.”

   This remains one of the most unfortunate bits about the Snowden leaks. While I think that Barton Gellman, Glenn Greenwald and Laura Poitras have done an incredible job with most of their reporting, the original PRISM stories that appeared in the Washington Post and Guardian both came out rushed and were misleading, which is still impacting how people are reporting on these things today. The PRISM program and Section 702 of the FISA Amendments Act have serious issues that need exploring, but it's all been distorted by the misleading initial claims, which implied things that just weren't true.
5. The NSA claims it uses the very same encryption that it tries to push everyone else to use. Yes, the same encryption that Snowden docs have revealed was compromised by the NSA.

   And the NSA insists that, despite the implications of those Snowden-leaked documents, it does not engage in weakening encryption standards. “The same standards we recommend are the standards we use,” Ledgett says. “We would not use standards we thought were vulnerable. That would be insane.”

   Sorry, but no one believes that one at all. The clear takeover by the NSA of NIST standards shows that's clearly not true.
6. The NSA still doesn't realize how serious all of this is. They still think it's just been blown out of proportion.

   They understand that journalism conferences routinely host sessions on protecting information from government snoops, as if we were living in some Soviet society. And they are aware that multiple security specialists in the nation’s top tech corporations now consider the US government their prime adversary.
   
   But they do not see any of those points as a reason to stop gathering data. They chalk all of that negativity up to monumental misunderstandings triggered by a lone leaker and a hostile press.

7. Patent troll Nathan Myhrvold is also completely clueless about national security:

   Former Microsoft research head Nathan Myhrvold recently wrote a hair-raising treatise arguing that, considering the threat of terrorists with biology degrees who could wipe out a good portion of humanity, tough surveillance measures might not be so bad. Myhrvold calls out the tech companies for hypocrisy. They argue that the NSA should stop exploiting information in the name of national security, he says, but they are more than happy to do the same thing in pursuit of their bottom lines. “The cost is going to be lower efficiency in finding terrorist plots—and that cost means blood,” he says.

   This is stupid on so many levels. First, the old argument that it's somehow equivalent of tech companies and the NSA to make use of information -- a claim that Levy ridiculously repeats multiple times in his article -- is a line that has been debunked so many times it's really beneath Levy to give it any life at all, let alone refuse to point out how stupid it is. Companies provide a direct service to users, and they make a decision: If I give this information, I get this service in return. It's a decision made by the consumer, and a trade-off where they decide if it's worth it. We can argue that people should have more information about the costs and benefits, but it's still a trade-off where the final decision is their own. The NSA, on the other hand, is not providing a choice or a trade-off. They're just taking everything in exchange for nothing. And, oh yeah, they have guns and can put you in jail -- something no company can do.
   
   Second, Myhrvold incorrectly buys completely the line that all this data collection has been helpful in stopping terrorists. There's just one problem: there is no evidence to support that. Besides, based on his idiotic reasoning, we might as well just do away with pretty much all our rights. For example, I'm pretty sure that we could all have protected Myhrvold more completely if there were video cameras streaming video of everything he did within the privacy of his own home, cars, office or just walking around, right? We could certainly make sure that no one was attacking him or, better yet, that he wasn't about to attack anyone. The cost of not spying on every moment of Nathan Myhrvold might mean "blood." So, based on his own logic, we should violate his privacy, right?

All in all there's a lot in the article that's worth reading, but those were a few key points that really stood out.

Filed Under: keith alexander, nathan myhrvold, nsa, rick ledgett, steven levy, surveillance, tech industry
Companies: google, yahoo

Some NSA Officials Favor Giving Snowden Limited Amnesty For All The Wrong Reasons

from the but-it-won't-happen dept

CBS News has a report, which apparently will air as part of this weekend's 60 Minutes, in which it's suggested that some top NSA officials favor granting amnesty to Ed Snowden. There actually are a number of good reasons why the US absolutely should give him amnesty. During an interview with 60 Minutes' John Miller, the NSA's Rick Ledgett, who is in charge of the task force trying to prevent another Snowden-like leak, admitted that he thought it made sense to grant Snowden amnesty:

JOHN MILLER: He's already said, "If I got amnesty, I would come back." Given the potential damage to national security, what would your thought on making a deal be?

RICK LEDGETT: So, my personal view is, yes, it's worth having a conversation about. I would need assurances that the remainder of the data could be secured, and my bar for those assurances would be very high. It would be more than just an assertion on his part.

Of course, note the "assurances" necessary. He'd basically have to agree that the "remainder of the data could be secured" and that's clearly not even remotely possible, since those documents have been spread out to a number of third parties already. The reason for granting amnesty is as a recognition that Snowden was, in fact, a whistleblower, who exposed an agency that had gone way too far and then directly lied to Congress about it.

But, of course, even that limited impossible amnesty is too much for NSA boss General Keith Alexander, who apparently thinks in bogus analogies rather than basic cost-benefit analysis.

GEN. KEITH ALEXANDER: This is analogous to a hostage-taker taking 50 people hostage, shooting 10 and then say, "If you give me full amnesty, I'll let the other 40 go." What do you do?

Except that's not analogous at all. It's actually analogous to someone calling out bad behavior and then saying "if you don't prosecute me for bogus reasons, I can help you fix and stop your bad behavior." That seems like a good thing.

MILLER: It's a dilemma.

GEN. ALEXANDER: It is.

MILLER: Do you have a pick?

GEN. ALEXANDER: I do. I think people have to be held accountable for their actions. ... Because what we don't want is the next person to do the same thing, race off to Hong Kong and to Moscow with another set of data, knowing they can strike the same deal.

Actions like... violations of the 4th Amendment of the Constitution? Lying to the American public? Mass surveillance on Americans and foreigners? Actions like purposely putting security holes in technology standards making us all less safe? Actions like "accidentally" spying on people the NSA is not allowed to spy on?

Why then, yes, I actually agree with General Alexander that people have to be held accountable for their actions. I guess he doesn't think that statement applies to himself.

Filed Under: 60 minutes, amnesty, ed snowden, keith alexander, nsa, rick ledgett