DOJ Rings Up Another Leaker, Nailing Financial Investigation Official For Handing Docs To Buzzfeed

from the stop-handing-journalists-info-the-public-might-want-to-see! dept

Another government employee has been charged with leaking sensitive info. This time it's a Financial Crimes Enforcement Network (FinCEN) official -- one who apparently handed dozens of suspicious activity reports (SARs) to Buzzfeed.

Manhattan U.S. Attorney Geoffrey Berman, who was picked by Trump to replace Preet Bharara’s deputy Joon Kim, denounced BuzzFeed’s accused source.

“Natalie Mayflower Sours Edwards, a senior-level FinCEN employee, betrayed her position of trust by repeatedly disclosing highly sensitive information contained in Suspicious Activity Reports (SARs) to an individual not authorized to receive them,” Berman said in a statement Wednesday announcing the charges.

The leaked SARs dealt with alleged money laundering by Russian diplomats, as well as transactions possibly related to the purchase of hacked Hillary Clinton emails by a GOP figure. These were supposedly the basis for nine Buzzfeed articles over the last year, with the most recent article cited in the complaint appearing only a few days ago (October 15).

The complaint [PDF] itself is an interesting read. It makes it clear investigators don't necessarily need to see the content of a person's messages to draw inferences about their behavior.

18. Based upon my training, experience, my conversations with other law enforcement agents with training and experience in cyber technology, and my conversations with law enforcement agents who have reviewed records received in response to a judicially-authorized pen register and trap and trace order for the EDWARDS Cellphone (the "EDWARDS Pen"), I have learned, among other things, that:

a.The EDWARDS Cellphone utilized a mobile messaging service that utilizes end-to-end encryption (the "Encrypted Application"), that is, a method of secure communication that prevents third-parties from accessing data, including the companies that host the end-to-end services, and law enforcement.

b. On or about August 1, 2018, within approximately six hours of the EDWARDS Pen becoming operative--and the day after the July 2018 Article was published--the EDWARDS Cellphone exchanged approximately 70 messages via the Encrypted Application with the Reporter-1 Cellphone during an approximately 20-minute time span between 12:33 a.m. and 12:54 a.m.

c.Between on or about July 31, 2018 and August 2, 2018, the EDWARDS Cellphone and the personal cellphone of CC-1 exchanged dozens of messages via the Encrypted Application.

d. On or about August 2, 2018, approximately one week prior to the publication of the First August 2018 Article, the EDWARDS Cellphone exchanged approximately 541 messages with the Reporter-1 Cellphone via the Encrypted Application.

e. On or about August 10, 2018, the day of the publication of the First August 2018 Article, the EDWARDS Cellphone and the Reporter-1 Cellphone exchanged approximately 11 messages via the Encrypted Application.

It doesn't appear investigators were able to access the content of the messages until they examined Edwards' phone.

Throughout the course of 2018, EDWARDS engaged in hundreds of electronic communications with Reporter-1, many via an encrypted application. A review to date, pursuant to a judicially-authorized search warrant executed today, of EDWARDS's personal cellphone has revealed that that cellphone contains the substance of many of these communications, including, as described in greater detail below, communications in which EDWARDS transmitted or described SARs or other protected information to Reporter-1.

So much for going dark. Presumably the information obtained with the pen register order was enough to secure a warrant to search a cellphone and flash drive owned by Edwards. "Reporter-1" is likely Jason Leopold, who wrote or co-wrote every article named in the DOJ complaint. This also means the DOJ likely has a whole bunch of conversations between a journalist and his source, although obtaining them from the source makes it far less of a First Amendment issue.

The other interesting part of the complaint is this: Edwards viewed her leaks as whistleblowing and had pursued a whistleblower complaint in the past.

During the interview described herein, EDWARDS told the Interviewing Agents, in sum and substance, that she is a "whistleblower" who provided the SARs to Reporter-1 for "record keeping." Based on my participation in this investigation and my conversations with other law enforcement agents, I am aware that, prior to the SARs Disclosures, EDWARDS had previously filed a whistleblower complaint unrelated to the SARs Disclosures, and that EDWARDS had also reached out to congressional staffers regarding, among other things, her unrelated whistleblower complaint.

These leaked SARS may have been one of the "other things" she spoke to staffers about. It appears she felt these SARs would just be buried by the administration. Or she felt these were of enough public interest they should be publicly-disclosed. Or it just may be the excuse she gave investigators during the interview.

Whatever the case, one thing remains clear: the Trump Administration is definitely interested in punishing whistleblowers, self-described or otherwise. As Trevor Timm of the Freedom of the Press Foundation points out, this is the fifth time journalists' sources have been charged with felonies since Trump took office. If he keeps it up, Obama's record-setting persecution of whistleblowers will be viewed with fond remembrance usually reserved for misremembering America's halcyon days of segregation and post-war baby making.

Filed Under: financial information, fincen, leaks, natalie edwards, reporters, sars, wiretap
Companies: buzzfeed

Lawsuit Over DHS First Amendment-Violating Suspicious Activity Reports Given Green Light By Judge

from the Get-a-job,-terrorist! dept

Say what you will about the internet, but the nation's best conspiracy theorists are employed by the US government. A case involving five individuals who ended up in DHS Suspicious Activity Reports (SARs) is being allowed to move forward. What's remarkable about the lawsuit's allegations is how little it takes to find yourself on the receiving end of extra surveillance and attention.

At the heart of the lawsuit are the SARs themselves -- the paperwork generated with the assistance of "see something, say something" tips from civilians, anything law enforcement/security guards consider to be a "bit off," and the many scattered DHS Fusion Centers' desire to appear useful and fundable.

Case in point: California resident Wiley Gill.

Lead plaintiff Wiley Gill is a white man who converted to Islam as a student at California State University, Chico, and he drew the attention of the Chico Police Department in May 2012. (Chico is about 180 miles due north of San Francisco.) According to the SAR about Gill, the officer entered Gill’s residence in response to an apparent domestic violence incident (Gill was home alone). The officer then saw on a webpage “titled something similar to ‘Games that fly under the radar’" on Gill’s computer.

"Coupled with the fact he is unemployed, appears to shun law enforcement contact, has potential access to flight simulators via the Internet which he tried to minimize is worthy of note," the SAR, entitled "Suspicious Male Subject in Possession of Flight Simulator Game," concludes.

Unemployed. Doesn't hang out with cops. Plays games and uses the internet. All inherently suspicious because of this tenuous thread: the 9/11 terrorists used flight simulators to train for their attacks. (The SAR guidelines warn that "acquisition of expertise" related to "aviation activity" is suspicious enough to be awarded a capital "S.") Had the Chico Police Dept. bothered to toss a little respect the Fourth Amendment's way, Gill would likely be nothing more than just some guy looking for a job rather than currently involved in a federal civil rights lawsuit over government surveillance.

This tiny bit of unrelated "data" was gathered by the Chico PD, which entered Gill's residence without a warrant or his consent. According to the lawsuit filed by the ACLU, the "domestic violence call" that predicated the search of Gill's residence was likely bogus and only used as justification to search a residence the CPD planned to search anyway. For the better part of two years, Gill had several previous "interactions" with Chico police officers, almost all of them based solely on his appearance ("full beard and traditional garb," "pious demeanor") and religious activities.

Gill did nothing more than "look Muslim" and play videogames. Other plaintiffs did little more than commit photography.

Internationally-renowned photographer (and former Sara Lee/Levi's executive), James Prigoff, became the subject of a Suspicious Activity Report for trying to take photographs of something that has been previously photographed hundreds of times without incident: the "Rainbow Swash" painting that adorns a Boston oil refinery's storage tank. Prigoff was approached by the company's security guards and told he couldn't photograph the oft-photographed storage tank. Despite leaving and providing no contact information, Prigoff was visited by a member of the FBI's Joint Terrorism Task Force shortly after returning to his home in Sacramento.

Plaintiff Aaron Conklin, a graphic design student, was approached by sheriff's deputies while photographing a refinery. He was told he would be put on a "NSA watchlist."

Sometimes, all it takes to appear suspicious enough to report is to stay in the same area for an indeterminate amount of time. Another plaintiff, Tariq Razak, was described by the reporting agency as "surveying entry/exit points" of the Santa Ana Train Depot before leaving with a woman wearing "a white burka head dress." In reality, he was really waiting for mother ("white burka"), who was using the restroom.

Sometimes just doing your job can put you on a watchlist.

Khaled Ibrahim is a U.S. citizen of Egyptian descent who works for a computer network consulting and service company in Silicon Valley, California. Mr. Ibrahim is the subject of a SAR that the ACLU of Northern California obtained through a Public Records Act request. The SAR describes a “[s]uspicious attempt to purchase large number of computers.” Mr. Ibrahim had attempted to make a bulk purchase of computers from Best Buy in his capacity as a purchasing agent for his company.

The government's ideas of what might be terrorist-related activity continues to expand. And even as the DHS plumbs the depths of absurdity with its SARs, the real terrorists remain unaffected. As the ACLU notes in its lawsuit on behalf of the five plaintiffs, the GAO itself has called the program worthless, noting that it has produced nothing in the way of "results-oriented outcomes" (arrests, indictments, thwarted attacks) but has done plenty of damage to Americans' civil liberties.

But the DHS clearly wants to continue violating rights while producing no results. The government moved to dismiss this lawsuit, claiming none of the plaintiffs can prove a "legally cognizable injury" and attempted to put the blame back on the shoulders of local law enforcement agencies. This didn't sit well with Judge Richard Seeborg.

Defendants primarily frame their challenge to plaintiffs’ standing as a purported failure to allege facts showing causation and redressability. Defendants’ argument characterizes plaintiffs’ supposed injuries as arising, if at all, primarily from the actions of the “front line” state and local law enforcement authorities. Defendants contend plaintiffs have not alleged, and credibly cannot, that the scrutiny they purportedly received from state and local police, or even from private security personnel, was the result of the challenged protocols or other conduct of defendants.

The allegations of the complaint, however, show that the gravamen of the alleged injuries lie not in actions of “front line” authorities standing alone, but in the fact that those authorities, pursuant to the guidance and training provided by defendants, submit SAR reports under criteria and circumstances that are allegedly inconsistent with legal principles and policies embodied in other law. Plaintiffs’ cognizable challenge is not to the conduct of law enforcement or private security officers during the alleged encounters per se, although there is at least some implication that plaintiffs believe Defendants’ Standards lead front line personnel to overreach even at the point of making initial observations. Plaintiffs are claiming injury from what occurs AFTER the encounters, pursuant to the Standards. As such, defendants’ contentions as to causality and redressability both fail.

The harms plaintiffs seek to remedy arise directly from the existence of Defendants’ Standards. If plaintiffs can show those standards violate the APA, they will be declared invalid.

While invoking causality and redressability as the main purported shortcomings of plaintiffs’ standing, defendants also imply that merely being the subject of an SAR, in the national database, should not be deemed a cognizable injury. In light of the privacy and reputational interests involved, however, this argument is not tenable.

The lawsuit will move forward, dragging along with it the tattered reputation of the DHS and its GAO-condemned "Fusion Centers." When it takes little more than a religious belief and a browser window containing details on flight sim software to raise someone to the level of "terrorist," the underlying system is not only broken, but swiftly becoming an easy-to-use tool for racial and religious profiling. And when the fear of terrorist attacks is used as a crutch to shut down First Amendment activity, the government itself has gone as far off the rails as those who remain convinced the 9/11 attacks were an inside job. They both gather around the same rally point -- the smoking ruins of a terrorist attack -- and see nothing in their fellow citizens but enemies on the verge of violence.

Filed Under: dhs, first amendment, homeland security, sars, suspicious activity reports, wiley gill
Companies: aclu

DailyDirt: Fighting The Next Pandemic

from the urls-we-dig-up dept

The last flu season was pretty rough, but there's a new H7N9 strain that has no vaccine (yet!) and is starting to infect and kill people (instead of sticking to birds). We're just about coming to the tenth anniversary of SARS, and we're still creating over 100 million flu vaccines every year using egg embryos -- a process that takes months, time that we might not have if a really serious flu strain spreads quickly across the globe. Here are a few projects that are making vaccines more quickly.

• Tobacco plants can be made transgenic in order to grow vaccines for us, and they've been shown to be able to produce over a million doses of vaccine in a few weeks. DARPA has a challenge out to anyone who can produce vaccines at a rate of 10 million doses in a month. [url]
• Genetically modified tobacco plants can be grown and harvested by robots -- producing vaccine proteins very quickly and efficiently -- without the need for human labor. These robots can grow tens of thousands of tobacco plants in a batch, and it's likely only a matter of time before researchers can get these plant factories to produce other kinds of pharmaceuticals. [url]
• Flublok relies on insects to grow flu vaccines for us -- a process that has been used for other kinds of vaccines, but has only started to be used for the flu. Flublok has already been FDA approved, so it will be available to patients for the 2013-2014 flu season. [url]
• Bananas could potentially be grown with edible vaccines, but the regulatory hurdles for development have caused researchers to focus on non-edible vaccines grown in other plants (like tobacco). Bananas grown for edible vaccines might still be viable for treating fish or other animals. [url]

If you'd like to read more awesome and interesting stuff, check out this unrelated (but not entirely random!) Techdirt post via StumbleUpon.

Filed Under: bananas, flu, flu season, flublok, gmo, h7n9, robots, sars, tobacco, vaccine
Companies: darpa