Snowden Docs: New Zealand Spying On Friendly Neighboring Countries For The NSA

from the Five-Eyes-but-one-master dept

More Snowden docs have been released, covering the extent of GCSB's (New Zealand's intelligence agency) spying on supposedly "friendly" island nations. As is par for the course for intelligence programs, the documents show massive bulk collections of data and communications -- all of which are immediately shared with the other members of the "Five Eyes" club.

Since 2009, the Government Communications Security Bureau intelligence base at Waihopai has moved to "full-take collection", indiscriminately intercepting Asia-Pacific communications and providing them en masse to the NSA through the controversial NSA intelligence system XKeyscore, which is used to monitor emails and internet browsing habits.

This sort of spying -- while apparently "normal," in light of previously-released documents -- indicates many governments enjoy spying for spying's sake, rather than for the justifications they often offer in defense of untargeted surveillance.

The documents, provided by US whistleblower whistleblower Edward Snowden, reveal that most of the targets are not security threats to New Zealand, as has been suggested by the Government.

Instead, the GCSB directs its spying against a surprising array of New Zealand's friends, trading partners and close Pacific neighbours. These countries' communications are supplied directly to the NSA and other Five Eyes agencies with little New Zealand oversight or decision-making, as a contribution to US worldwide surveillance.

New Zealand's intelligence agency, along with Prime Minister John Key, have previously refused to acknowledge or deny the use of the NSA's XKeyscore system. A short blurb from the obtained documents renders this Glomar null.


The wording indicates that GCSB is indeed using this system for its collections, which are then immediately accessible to the NSA. NSA analysts must first read through an online ("iLearn") briefing on NZ law and answer a few questions correctly before they're allowed to search the collection.

The collection itself is impressive. It contains phone calls, text messages, emails and social media interactions. In the parlance of the Five Eyes intelligence agencies, this is "full-take," a far more intrusive form of surveillance than skimming metadata off the top.

Even though it's purportedly an anti-terrorism tool, the surrounding friendly nations have given New Zealand little reason to spy on them. But that's how the anti-terrorism game is played by spy agencies: everything from everyone, for as long as possible. What's not legal to "look at" in one country can always be used by another. The built-in "protections" for each nation's citizens are nearly useless, considering the breadth and depth of these untargeted collections. Incidental collections are a certainty, rather than an anomaly analysts should be wary of.

Whatever's being collected had better be doing a bang-up job keeping terrorists at bay. Prime Minister John Key has openly stated that sending his own citizens off to die is foreign warzones is just paying Five Eyes membership dues.

In his strongest hint yet that the Cabinet will approve a deployment of troops to train Iraqis alongside Australians, Mr Key in an interview with the BBC drew heavily on New Zealand pulling its weight as part of "a club".

"Ultimately are we going to say we are going to be part of a club like [we] are with Five Eyes intelligence?

"Even if the contribution is small - of course it will be proportional - there has to be some contribution," he said.

"It is the price of the club."

Of course, Key has also reassured New Zealand citizens that the GCSB isn't spying on them, betting his job against that probability.

Asked if he and GCSB chief Ian Fletcher would resign if there were mass surveillance, he said yes.

"But the facts of life are it won't happen."

For that to happen, the GCSB would have to undertake illegal activity.

He clarified later saying "both" would resign if there was mass surveillance.

"If I wholesale blatantly flout the law as Prime Minister I'm never going to survive anyway."

Key's hedges make it almost impossible to hold him to his promise. Domestic surveillance has been confirmed, both by these documents and previous revelations. The interception points and untargeted dragnet make it inevitable that New Zealanders' communications are being swept up indiscriminately. The problem is that this is likely legal. The only way to violate New Zealand's surveillance laws (and hold PM Key to his promise) is to find proof that GCSB is intentionally targeting its countrymen. By making surveillance programs broad and untargeted, the GCSB can avoid violating the law while still collecting a great deal of domestic data and communications. Minimization comes into play post-collection, but there's nothing built into the system to prevent -- or even minimize -- these "incidental" collections.

Whatever the GCSB offers in assurances about minimization should probably be ignored. It doesn't maintain any control over the communications it grabs. The collection belongs to the NSA. GCSB analysts have to run queries through the American agency just to see what it's gathered from its neighbors.

The documents show that when GCSB staff want to access communications intercepted at Waihopai, they have to log into NSA computer databases. Minutes of a June 2009 meeting at the NSA headquarters, where a GCSB officer was present, show how integrated the GCSB is into the NSA systems. The GCSB officer, manager of an intelligence analysis unit, told the meeting that 20 per cent of GCSB's analytic workforce did not have accounts or access to key NSA databases.

Because the GCSB doesn't control the database, it really can't destroy anything it shouldn't have access to. New Zealanders caught in this dragnet now "belong" to the NSA, which has very few minimization procedures for foreign collections -- even if the actual "collection" utilized another agency and occurred under another set of laws. GCSB analysts may constrain themselves from searching or viewing New Zealanders' communications, but it can't promise to delete unlawfully-obtained "incidental" collections.

It works out this way: the New Zealand government will provide military support -- including the deployment of troops -- in exchange for whatever the NSA allows it to look at. It provides the intercepts, but the NSA enjoys the greatest share of its "partner's" collection efforts. This hardly seems like an equitable exchange. And now New Zealand is going to be dealing with irritated neighboring countries and more than a few irate New Zealanders. And for what? A massive, untargeted collection that it doesn't even control and which does very little to aid in the country's anti-terrorism efforts.

Filed Under: ed snowden, gcsb, john key, new zealand, nsa, surveillance, xkeyscore

Does The XKeyscore Source Code Leak Point To Another NSA Leaker?

from the new-goal:-a-leaker-a-year-for-the-next-decade! dept

The recent leak of the XKeyscore source code has raised an interesting question. Is there a second leaker? The report written by Jacob Appelbaum and others for DasErste.de detailed the NSA's targeting of Tor users (and even those who just read about Tor) and the harvesting of their communications, but very explicitly did not state that Snowden was the source of this code snippet.

Others noticed this lack of attribution and commented on it. Cory Doctorow at Boing Boing apparently received confirmation that this particular leak was not from Snowden's trove of documents.

Another expert said that s/he believed that this leak may come from a second source, not Edward Snowden, as s/he had not seen this in the original Snowden docs; and had seen other revelations that also appeared independent of the Snowden materials.

Cryptologist and security expert Bruce Schneier (who has seen the documents released to journalists by Snowden) concurred with Doctorow's conclusion.

And, since Cory said it, I do not believe that this came from the Snowden documents. I also don't believe the TAO catalog came from the Snowden documents. I think there's a second leaker out there.

The TAO catalog was originally revealed by Der Spiegel with reporting by (again) Jacob Appelbaum and Greenwald/Snowden partner Laura Poitras. Nothing in the story explicitly states its origin, although the inclusion of Poitras at least suggests the documents can be traced back to Snowden's stash.

Glenn Greenwald, however, offered his agreement with Schneier's take here:

Seems clear at this point RT @ageis @vruz Bruce Schneier: "I think there's a second [NSA] leaker out there." https://t.co/0iCULZWf0L — Glenn Greenwald (@ggreenwald) July 4, 2014

If so, then that's two people who have seen Snowden's documents, including one with ongoing access, claiming there's a second leaker. And if so, the NSA's problem, instead of gradually disappearing from the public eye, will become more severe. Coupled with the recent leak published by the Washington Post, which shows the agency harvests and stores plenty of unminimized non-terrorist communications with its 702 collections (the same collection the Privacy and Civil Liberties Oversight Board recently found to be more law-abiding and less Constitutionally unsound than the bulk metadata program), the agency now looks worse than ever. It was completely unprepared for the Snowden revelations, but at least by this point, it has a general feel for the leak release process. Now, it possibly has another leaker offering new data and info to journalists, one which is a totally unknown quantity.

At this point, all anyone has is speculation. If there's another leaker, it's doubtful he or she will make his/her identity known any time soon. Snowden revealed himself as a leaker and that hasn't exactly worked out well for him.

But there's also some indications that this snippet of code came from Snowden's leaks. Errata Security (the group of bloggers that exposed the fakery behind NBC's pre-Winter Olympics "report" that all visitors to Sochi would be instantly hacked) has done its own fisking of the code snippet and come to the following conclusions.

1. The signatures are old (2011 to 2012), so it fits within the Snowden timeframe, and is unlikely to be a recent leak.

2. The code is weird, as if they are snippets combined from training manuals rather than operational code. That would mean it is “fake”.

3. The story makes claims about the source that are verifiably false, leading us to believe that they may have falsified the origin of this source code.

4. The code is so domain specific that it probably is, in some fashion, related to real XKeyScore code – if fake, it's not completely so.

Errata Security notes some of the oddities of the code, pointing out that it looks more like something pulled from a training exercise or manual rather than directly from XKeyscore itself. More investigation by Errata Security and The Grugq (another security expert) apparently uncovered the fact that the text was pulled from a document (pdf, docx, etc.) rather than an actual source file. But the aspect that seems to indicate this is part of Snowden's stash is the timeline.

As this post to the Tor developer mailing list describes, the signatures in the code are old. The earliest date this file can be valid is 2011-08-08, when the Linux journal reported on TAILS. The latest date might be 2012-09-21, just before a new server was added to Tor that isn't in the XKeyScore list. Since this is shortly before Snowden first tried to contact Greenwald, the dates sync up.

If the code is unrecognizable by those who've had access to the documents, that's probably due to it being compiled from various pages and mocked up into a short code excerpt. Rob Graham at Errata Security doesn't feel it's necessarily fake, but believes the origin of the quoted source code may have been obscured -- hence, no citation of Snowden's leaks or any acknowledgment of existing NSA files.

Of course, this could mean another leaker is simply hiding behind Snowden, and has pulled files roughly in the same date range in order to deliver new leaks in order to remain undetected. If there is another leaker, my guess is he/she will be discovered rather than coming out publicly.

New leaker or no, the one-two punch of published leaks by Jacob Appelbaum and Barton Gellman (of the Washington Post) shows that the NSA is doing everything it's been accused of -- namely, hoovering up and holding onto incidental communications (even those originating from "untargeted" American citizens) and viewing anyone with even a passing interest in anonymity or encryption as "suspicious."

Filed Under: leaker, nsa, source code, surveillance, training manuals, xkeyscore

NSA's XKeyscore Source Code Leaked! Shows Tor Users Classified As 'Extremists'

from the peeling-away-the-layers dept

We learnt about the NSA's XKeyscore program a year ago, and about its incredibly wide reach. But now the German TV stations NDR and WDR claim to have excerpts from its source code. We already knew that the NSA and GCHQ have been targeting Tor and its users, but the latest leak reveals some details about which Tor exit nodes were selected for surveillance -- including at least one in Germany, which is likely to increase public anger there. It also shows that Tor users are explicitly regarded as "extremists" (original in German, pointed out to us by @liese_mueller):

The source code contains both technical instructions and comments from the developers that provide an insight into the mind of the NSA. Thus, all users of such programs are equated with "extremists".

Such is the concern about Tor that even visitors to Tor sites -- whether or not they use the program -- have their details recorded:

not only long-term users of this encryption software become targets for the [US] secret service. Anyone who wants to visit the official Tor Web site simply for information is highlighted.

The source code also gives the lie to the oft-repeated claim that only metadata, not content, is gathered:

With the source code can be proven beyond reasonable doubt for the first time that the NSA is reading not only so-called metadata, that is, connection data. If emails are sent using the Tor network, then programming code shows that the contents -- the so-called email-body -- are evaluated and stored.

As well as all this interesting information, what's important here is that it suggests the source of this leak -- presumably Edward Snowden, although the German news report does not name him -- copied not just NSA documents, but source code too. As in the present case, that is likely to provide a level of detail that goes well beyond descriptive texts.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: content, extremists, gchq, metadata, nsa, source code, surveillance, tor, xkeyscore

How The NSA Gamified Spying On Everyone With 'Skilz' Points For NSA Analysts

from the bragging-rights-are-everything. dept

With a new batch of Snowden documents being revealed by Der Spiegel, mostly concerning the NSA's operations in Germany, Andrea Peterson over at The Switch, noticed one only moderately terrifying tidbit in one of the documents: the NSA appears to have taken a lesson from the whole "gamification" movement and used it to help the NSA better spy on people.

You know all about "gamification" of course. The idea of adding "points" of some sort to just about everything, just to tap into people's competitive spirit so they have something to compare. Sometimes it includes things like being able to "level up" and unlocking features. The document in question is a document about some NSA training on the XKeyscore system, which, you'll recall, allows NSA analysts to pull up all sorts of info on people. Here's a screenshot we posted nearly a year ago: The document has clearly been written by someone who is having quite a bit of fun, and references seven-headed dragons and Forrest Gump trolling for shrimp among other things. It includes bizarre "quotes" about how awesome XKeyscore is, as if it's a bad marketing brochure for some enterprise software:

"The first time I saw XKS, I said, 'Whoa!!' It is intimidating because you open it up and you see all these queries and fields," said [REDACTED] "We took the students from that response to being able to approach it and navigate around in it. They see it differently now and know it's not a seven-headed dragon." This gentle introduction has definitely enabled analysts to ease into XKS and get more comfortable, and with that it has radically changed the overall mentality towards the tool.

[....] Before the training, I was just happy to use it and not go to jail," said [REDACTED] .... "Now, I feel comfortable in my ability to use it and NOT go to jail. I used to always ask someone to look over my query before I submitted it. Now, my hand doesn't need to be held."

The document also talks about just how awesome XKeyscore is in that it comes up with results that other NSA systems can't turn up:

"Our analysts have been building hashes for document tracking and rolling them into fingerprints. We have been getting documents in XKS that we were not getting in our PINWALE queries. Just today analysts found reportable material from the Tunisian Ministry of Interior that was not from any selectors we were targeting. Now we know what we can do with XKS and exactly why we want to use it -- to make these discoveries.

These discoveries are igniting a trend of using XKS on a daily basis. "For daily pulls, analysts go through TransX, PINWALE, and now XKS to see what's new for the day," [REDACTED] said.

And then... we get to the gamification stuff, in which they discuss "XKS Skilz points." I'm not joking. XKS. Skilz. Points.

Combine these exciting finds with the introduction of XKS Skilz points, and you can see why McDonald's teamed up with Monopoly years ago: people buy more and even super size their orders just to get game pieces. With the brainchild of Skilz, where analysts can earn points and unlock achievements for performing tasks in XKS, people are willing to try new things within the tool. Analysts think to themselves, "Using the Prvot Data feature will earn 30 points... I'm going to try it and see what happens." Discovery! Points! We have been lured by our geeky desire to unlock achievements and earn points, and bragging rights are everything.

"Definitely a number of users have gotten into the Skilz points. We have several people at level six. They see what they need to do to earn more points and start trying out different things," said [REDACTED] In fact, ECC analysts now have the highest average of Skilz points compared to all of the S2 product lines and have written the most fingerprints per-capita! Some people say that the potent combination of Skilz points, the Circuit Training, and the team of easily-accessible, on-site instructors is the secret to ECC's successes with XKS.

It reads so crazy, I'm half hoping the NSA just comes out and admits that this is an internal April Fool's joke, but I fear that it may actually be serious. You can see that part on the bottom of page 3 in the embed below, or hell, here's a screenshot: Gamification can be a potentially useful tool, but something seems kinda scary to think that the NSA is turning surveillance into a game where analysts get extra points and powers by doing more spying with the system. Just the fact that the document admits that they're using this to drudge up information that they can't find through their other systems and it's doubly concerning. Surveillance shouldn't be seen as a game by anyone.

Filed Under: gamification, nsa, skilz, surveillance, training, xkeyscore