Intelligence post-Snowden: a debate

[jmm99]

Black Hat USA 2013 Gen. Alexander Keynote (1 hour video).

Regards

Mike

[Watcher In The Middle]

Anecdotally, I'm hearing from some friendly 'sales pukes' that the entire NSA 'spying' aspect is starting to become an issue in overseas technology sales efforts - and it's not positive. US technology companies trying to make tech sales for hardware and/or software, or web enabled services that could contain 'backdoors' or direct NSA access are having harder sales efforts, due to the 'Uncle' oversight effect (real or imagined). Serious money is involved.

This issue is not going away anytime soon. Search apps like DuckDuckGo are going to become more prevalent.

But the real issue is going to come to the forefront when US based multinational networking vendors start losing out to foreign multinationals like Huawei, because if everything else is equal (both Countries are spying on you), why not take the vendor that's 25-30% cheaper.

Hey, supposedly we'll be more secure - just poorer.

[jmm99]

Exclusive: U.S. directs agents to cover up program used to investigate Americans; and How DEA program differs from recent NSA revelations.

Consider the law regarding making false statements to a Federal investigator:http://www.justice.gov/usao/eousa/fo...9/crm00916.htm

Should sauce for the goose be sauce for the gander ?

Regards

Mike

[bourbon]

But the real issue is going to come to the forefront when US based multinational networking vendors start losing out to foreign multinationals like Huawei, because if everything else is equal (both Countries are spying on you), why not take the vendor that's 25-30% cheaper.

Because it still wont be equal. The US government does not conduct economic espionage against foreign targets for the commercial benefit of individual corporations – there are rules against it. We are the only country in the world that does not do this, if for no other reason than the intelligence community would not even know which corporation to give intel to.

[Watcher In The Middle]

That's small consolation when you see articles like this one:

http://www.zerohedge.com/contributed...tech-companies

Disclaimer: IMO, ZeroHedge functions like the gossip column for the Hedgies. Validity: Who knows? But when they hit it, they really score. And they are normally several weeks in advance of MSM.

IMO. this NSA 'spying' issue has the real possibility to swing from just being a privacy issue into also becoming a major economic issue.

[jmm99]

Reflections on NSA Oversight, and a Prediction That NSA Authorities (and Oversight, and Transparency) Will Expand (by Jack Goldsmith, August 9, 2013):

Last Friday I asked how NSA Director Alexander’s claim that “we can audit the actions of our people 100%” was consistent with USG uncertainty about what Snowden stole and with its claims that it was “putting in place actions” to allow it to track its systems administrators. Former NSA General Counsel Stewart Baker answered that the “NSA does a better job of protecting Americans’ private data than it does protecting its sources and methods,” and that “the systems that protect against [searching the databases of information collected by NSA] are a lot more carefully monitored than the systems from which [Snowden stole classified data about various NSA collection programs].”
... (much, much more in article) ...
[BLUF]
Two important lessons of the last dozen years are (1) the government will increase its powers to meet the national security threat fully (because the People demand it), and (2) the enhanced powers will be accompanied by novel systems of review and transparency that seem to those in the Executive branch to be intrusive and antagonistic to the traditional national security mission, but that in the end are key legitimating factors for the expanded authorities. This was true, I argued in Power and Constraint, about habeas review of GTMO detentions, enhanced congressional and judicial oversight of military commissions, the 2008 amendments to FISA, and greater public transparency and congressional oversight of targeted killing by UAV (a process still in flux). And it will be true of expanded NSA authorities as the NSA’s vital capabilities become even more important to our security. In this sense, the Snowden revelations – to the extent that they force NSA to open up, and to get used to greater public scrutiny, and to avoid excesses, and to recalibrate its understanding of the tradeoffs between openness and security – might one day be seen to have paved the way to broader NSA powers.

Jack's point 1 is spot on and is one which I have made here - the USG will increase its powers to meet the national security threat as fully as the USG is able - "because the People demand it". His book, Power and Constraint, can now be bought used VG for $10 (incl. shipping); and is worth the read.

His point 2 is more up in the air. When the "People" find out what the USG has done to fulfil their "demand", all hell can break loose - and more than a few babies can be thrown out with the dirty bath water.

Recall the Church Committee and its "reforms" (applied too often with fireaxe in hand) to correct the CIA abuses (and non-abuses) of the 1950s and 1960s - including such as the CIA-NSA (National Student Association) program. Some of us involved in the student end of the program wondered then (and I still) what the hell was wrong with it. In that event, the rabble rousers definitely won; but did "we, the People" ?

Regards

Mike

[jmm99]

13 Aug - Press Conference Transcript and WH White Paper.

Regards

Mike

[Watcher In The Middle]

POTUS didn't do himself any favors with his press conference. Too much evasion and weasel wording. And when you see stuff like this, well, it carries more weight than all the platitudes handed out in the press conference.

Article from Real Clear Technology

The tech community (overall) just isn't buying what they are selling. From a technical standpoint, the 'approach' the NSA is taking seems to be pretty poorly thought out - of course, since they're working at keeping everything secret from the American public, it's truthfully difficult to tell.

But spying on the American public sure seems like a pretty stupid, and incredibly expensive way to waste tens of billions of taxpayer dollars.

[jmm99]

Inside the Decision to Shut Down Silent Mail (13 Aug 2013):

Silent Phone and Silent Text promise end to end encryption with each service; encrypted data is not stored by the company and metadata from conversations is not stored. The same promises could not be made with Silent Mail, and the blame lies with standard email protocols such as SMTP, POP3 and IMAP that leak too much information and metadata, Callas said. The Lavabit announcement yesterday made it clear that Silent Circle had to act promptly with its product, scrapping a number of other options to phase the service out slowly, not take orders after a particular date, or even give customers 72 hours notice of the decision.

“Then, that is the flag for the warrants to come,” Callas said. “We said we had to do something and do it now, and tell people why we did. I had to think about it in terms of if I were [the government], what would I be doing? I would be typing up the subpoenas to be delivered at 7 a.m.”

Lavabit’s Levison, meanwhile, intimated that the 10-year-old company is in the midst of some unnamed request for user data, details of which it could not legally share. Some have speculated the company is in a battle over a request for Snowden’s passwords or other sensitive data. Rather than comply, Levison said he is suspending operations and preparing an appeal that if favorable, would enable him to revive Lavabit.

“I wish that I could legally share with you the events that led to my decision. I cannot. I feel you deserve to know what’s going on–the first amendment is supposed to guarantee me the freedom to speak out in situations like this,” Levison wrote in a note on the Lavabit site. “Unfortunately, Congress has passed laws that say otherwise. As things currently stand, I cannot share my experiences over the last six weeks, even though I have twice made the appropriate requests.”

Much more in story, with some interesting comments; e.g.:

It is interesting to note how many people are jumping, hopping, infuriatingly mad about this and yet how many have Facebook pages that literally leak personal data about them every day? The problem is that personal privacy is an extremely valuable commodity and yet, the majority of people have sold there’s out for the ability to post a photo of what they ate that night and just who exactly the winner of America’s got talent should be?

Even now as my browser connects to this website it is leaking vast amounts of information about me. my IP address, cookie data, trackers for advertisers. The systems are inherently insecure they weren’t built with security in mind and until people wake up to the value that their personal privacy has we will walk eye’s wide open into the panopticon of the future were what you do and think is as transparent as a single pane of glass.

Regards

Mike

[Watcher In The Middle]

It is interesting to note how many people are jumping, hopping, infuriatingly mad about this and yet how many have Facebook pages that literally leak personal data about them every day?

That's true. It's also voluntary on the part of the individual. There's nothing voluntary about what the NSA 'appears' to be doing. And to make it worse, the federal government has gone out of its way to conceal all of it from the American people. That certainly does not inspire confidence.

Two other points. Since we apparently can't get much in the way of program details, some of our political types fall back on the old adage of "looking for needle(s) in haystacks". Well, if that's the effort they are making, they sure appear to be going about it with a case of the "stupids". Here's why I say that:

There are two (2) primary considerations that you have to meet:
1) You always want to focus on the problem.
2). You always want to deal with the one factor in any project where a critical limitation occurs that is unavoidable.

For Item 1, it's extremely simple: Locate/identify the needles.

For Item 2, it's also simple: Every thing you do is time centric.

Ok, so for Item 1, the NSA 'solution' seems to be is "Step 1: Collect and aggregate all the haystacks". Apart from it being illogical, (what they are doing is building inventory), it's an every increasing inventory.

So what tends to happen in any such organization - more time gets spent on inventory collection and management, then on critical analysis. Classic example of "Hard Engineering vrs. Smart Engineering"; a/k/a "Get a bigger sledgehammer" vrs. "Let's think this through".

Which leads directly into Item 2:

If you are spending more time managing inventory than doing critical analysis, you are burning time, which is the one element you can't recover.

With all that inventory of information, it's probably great for doing 'after-the-fact' analysis (maybe it will help us for the next time), but honestly, the federal national security apparatus ends up looking (and operating) like a fire department that specializes in saving basements.

With all the many billions of dollars and resources being spent on this domestic spying effort, it looks from the outside like a giant case of 'crony capitalism' occurring within the national security apparatus.

[jmm99]

Pre-Snowden - video (1.5 hrs) - content comes at the end of the process.

Regards

Mike

[Watcher In The Middle]

Here's a somewhat technical summary of what NSA is doing:

The NSA is still spying on us.

You are going to see political consequences boiling up out of this whole affair. It's going to take a while, but I'm already seeing average everyday citizens who are sincerely offended that the NSA is spying on them (regardless of what POTUS says). That is their perception. These people are politically active, and both Democrat and Republican. Many of them are being influenced by their kids, who are tech savvy.

The only way I can describe it is to say that they feel the federal government has broken trust with them. This is nowhere near over.

[jmm99]

From Lawfare, The Snowden Revelations and Cybersecurity (by Jack Goldsmith, August 14, 2013).

Jack Goldsmith is the Henry L. Shattuck Professor at Harvard Law School, where he teaches and writes about national security law, presidential power, cybersecurity, international law, internet law, foreign relations law, and conflict of laws. Before coming to Harvard, Professor Goldsmith served as Assistant Attorney General, Office of Legal Counsel from 2003–2004, and Special Counsel to the Department of Defense from 2002–2003.

From Computing Now, Making Sense from Snowden: What’s Significant in the NSA Surveillance Revelations (by Susan Landau, Jul/Aug 2013).

Susan Landau is the author of Surveillance or Security? The Risks Posed by New Wiretapping Technologies (MIT Press 2011) and coauthor of Privacy on the Line: The Politics of Wiretapping and Encryption (MIT Press 2007), and a former Sun Microsystems Distinguished Engineer.

WITM: Agree on your comments.

Regards

Mike

[jmm99]

Judge John D. Bates, well-known for his various decisions cited in the War Crimes thread, headed up the FISA Court until February of this year (Wiki; DCD); he is an older dinosaur: Born on October 11, 1946, in Elizabeth, New Jersey, Bates graduated from Wesleyan University in 1968, and then wound up serving as a first lieutenant in the U.S. Army for three years, 1968-1971. His service included a tour in Vietnam.

From Lawfare:

Ririka Singh: Declassified Intelligence Community Documents:

The Office of the Director of National Intelligence is declassifying a large group of important documents pertaining to NSA surveillance programs under Section 702 of FISA. I will keep updating this list as more files become available. We will be reading and processing the documents over the course of the evening, and will have commentary and analysis available as soon as possible. ...(long list of links to docs) ...

Comments by Ben Wittes et al:

The NSA Documents, Part I: Introduction - see also WP article, NSA gathered thousands of Americans’ e-mails before court ordered it to revise its tactics.

The series of three posts that follows offers a quick and dirty summary of the three FISA Court opinions at issue and the explanations the government gave of the matter in question to Congress. At least for now, we are keeping commentary on the documents to a minimum, though I certainly have thoughts on many aspects of them—about which I will write separately.

The NSA Documents, Part II: The October 2011 FISC Opinion

The NSA Documents, Part III: The November 2011 FISC Opinion

The NSA Documents, Part IV: The September 2012 FISC Opinion

Comment by Carrie Cardero: Initial Observations on Newly Declassified FISA Documents

Before providing some preliminary observations explaining this point, a comment on the release itself: I understand why the Director of National Intelligence (DNI) declassified and released these documents. But I don’t like it one bit. I can imagine at least two possible reasons for the release: either the government knows that more leaks are coming and is trying to get ahead of the newspapers, or, it felt compelled to push back against the story line that the FISA Court is just a shadow of a real court. But I hope it is clear that the critics of surveillance activities only see transparency as the first step in a longer fight. The strategy is a one-two punch. The first punch is transparency. The second is to scale back or eliminate our national security surveillance capabilities altogether. Don’t take my word for it, an activist from the Electronic Frontier Foundation said as much in a discussion I took part in on KCRW’s show “To the Point” yesterday.

KCRW NSA segment starts at 7:30 - WP reporter; Federal judge; Carrie Cordero; EFF spokesman.

EFF Statement (the FISC suitor): EFF Victory Results in Release of Secret Court Opinion Finding NSA Surveillance Unconstitutional - Update: In response to EFF's FOIA lawsuit, the government has released the 2011 FISA court opinion ruling some NSA surveillance unconstitutional.

For over a year, EFF has been fighting the government in federal court to force the public release of an 86-page opinion of the secret Foreign Intelligence Surveillance Court (FISC). Issued in October 2011, the secret court's opinion found that surveillance conducted by the NSA under the FISA Amendments Act was unconstitutional and violated "the spirit of" federal law.
...
Release of the opinion today is just one step in advancing a public debate on the scope and legality of the NSA's domestic surveillance programs. EFF will keep fighting until the NSA's domestic surveillance program is reined in, federal surveillance laws are amended to prevent these kinds of abuse from happening in the future, and government officials are held accountable for their actions.

I'm one of the "critics of surveillance activities"; but I also don't want a replay of damages done by the 1970s Church Committee and others (starting with the Nixon Administration). Ms Cordera's position seems, in effect, to be: you are either for it (the entire NSA program) or against it; which can easily morph into you are either with "us" or against "us", "enemies lists", etc.

Regards

Mike

[jmm99]

Joint Comment by Ritika Singh, Raffaela Wakeman and Benjamin Wittes: The NSA Documents, Part V: The Communications with Congress:

Yesterday’s cache of declassified materials also sheds important light on the administration’s interactions with Congress over intelligence oversight—not just its interactions with the relevant intelligence committees, but those with the rank-and-file members too. Many members of Congress have spent the last few months appearing shocked by information leaked about the NSA’s surveillance programs. The documents released yesterday, however, make clear that any member of Congress who did not know what was going on with respect to Section 702 surveillance did not choose to know—including with regard to the government’s 2011 setback before the FISA Court.

In this post we’ll summarize three executive branch communications to the intelligence committees in Congress regarding the government’s surveillance activities under Section 702 of the FISA Amendments Act (FAA): testimony for a December 2011 hearing, testimony for a February 2012 hearing, and a paper submitted in May 2012. All are focused on the legislative branch’s reauthorization of the FAA, which was set to expire at the end of 2012.

The bottom line is that Congress (for the most part), during the same time that Judge Bates was issuing his sealed decisions, was stupid, hypocritical or both.

----------------------------------------
Ben Wittes: Statement from the NSA and ODNI on WSJ Story, (pay channel) New Details Show Broader NSA Surveillance Reach - Programs Cover 75% of Nation's Traffic, Can Snare Emails. Statement .pdf.

How much credibility do the DNI and NSA have ? Given Mr Clapper's parsing of the word "no" (in his congressional testimony), we might view cautiously such sentences as this: "The NSA does not sift through and have unfettered access to 75% of the United States online communications." True if access is any percentage less than exactly 75%; also true if access is any percentage greater than exactly 75%.

-----------------------------------------
Saving the best wine for last ...

Steve Vladeck (bio): Carrie Cordero Misses the Point (Again) on FISA Reform:

In her post from earlier today responding to yesterday’s government disclosures, Carrie writes that

“I hope it is clear that the critics of surveillance activities only see transparency as the first step in a longer fight. The strategy is a one-two punch. The first punch is transparency. The second is to scale back or eliminate our national security surveillance capabilities altogether.”

I guess Carrie took nothing away from our prior exchange… Yes, some critics of surveillance activities want to “scale back or eliminate our national security surveillance capabilities altogether.” But there are plenty of others, myself included, who have been arguing all along that the end game here is not handicapping our intelligence agencies, but reforming the process so that we can all have more faith that what they’re doing is actually legal.

In that regard, I’m quite surprised that Carrie thinks yesterday’s disclosures establish that “the debate over whether the FISA Court is an effective check on government surveillance activities is over.” Given the language of footnote 14 of the FISA Court’s October 2011 opinion (and if you haven’t read footnote 14, now’s a good time to do so), why should we have any faith that the FISA Court is in a position to meaningfully review what the government is up to in cases other than those in which the government comes clean and admits that it materially misrepresented the NSA’s activities to the FISA Court?

In footnote 14, Judge Bates states that the USG (NSA) "substantially misrepresented" the facts to the FISC on at least 3 occasions within three years of the 2011 opinion. Again, we are dealing with NSA credibility issues.

Steve concludes:

Of course, reasonable people can and will disagree about what the right answers are here. But, Carrie’s post to the contrary notwithstanding, one need not be against governmental surveillance powers in their entirety to think that yesterday’s disclosures only further underscore the need to better empower the FISA Court, rather than accepting the (increasingly alarming) status quo.

and I agree.

Regards

Mike

[jmm99]

WP: The NSA is losing the benefit of the doubt (by Ruth Marcus, 22 Aug 2013):

Footnote 14 should scare every American. Even the parts that aren’t blacked out.

The footnote is contained in the just-declassified 2011 opinion by U.S. District Judge John Bates, then the chief judge of the Foreign Intelligence Surveillance Court.

In the ruling, Bates found that the government had been sweeping up e-mails before receiving court approval in 2008 and, even after that, was illegally collecting “tens of thousands of wholly domestic communications.”

That’s not the really scary part. This is: “The court is troubled that the government’s revelations . . . mark the third instance in less than three years in which the government has disclosed a substantial misrepresentation regarding the scope of a major collection program,” Bates wrote in Footnote 14.

and:

To judge the significance of Bates’s footnote, it helps to know something about the judge. This is no wild-eyed liberal. Bates spent almost two decades in the U.S. Attorney’s Office in Washington. He served as deputy to independent counsel Kenneth Starr during the investigation of President Bill Clinton. He was named to the bench by President George W. Bush.

If Bates is worked up about being misled by the government — and the sober language of that footnote is the judicial version of a severe dressing-down — people should listen.

and finally:

Security demands secrecy. The Constitution demands that secrecy be coupled with oversight. In theory, that oversight is twofold, from Congress and the judiciary, through the mechanism of the surveillance court.

In practice, oversight necessarily depends on some measure of good will from the overseen. No matter how well-intentioned and diligent the overseers, particularly in an area as technologically murky and politically fraught as surveillance, the intelligence experts tend to hold the cards.Their deeply ingrained institutional bias is to reveal only what is absolutely necessary, to trust their secrets and secret methods to as few outsiders as possible. When that instinct for secrecy edges into a willingness to mislead, tacitly or explicitly, effective oversight collapses.

We have already seen this phenomenon on display before Congress, in the person of Director of National Intelligence James Clapper. In March, Sen. Ron Wyden asked Clapper whether the NSA collects “any type of data at all on millions or hundreds of millions of Americans.” Clapper’s answer, “No . . . not wittingly.”

This was, as Clapper acknowledged, “clearly erroneous.” His belated apology rings hollow. Clapper was not only forewarned about the question, he refused to correct his misrepresentation for months, until it was proved false.

Regards

Mike

[Firn]

Keep up the good work. I pretty much fully agree with all your points.

[jmm99]

These both deal with technical and methodological issues. However, if you happened to stay tuned through all of Bill Binney's video cited above (link to video), you will appreciate their importance to Judge Bates' opinions and to what needs "tweaking".

The NSA Documents, Part VI: The 2011 Minimization Procedures (by Sean Mirski and Benjamin Wittes, August 23, 2013):

Two months ago, we ran a post explaining the NSA’s minimization procedures based on a copy of the procedures (dating from June 2009) that had been leaked to the Guardian. In light of the mass declassification that occurred this week, however, we now have access to a more recent version of the minimization procedures (dating from October 2011). The new procedures remain largely the same from the 2009 version to the 2011 one—much of the language is verbatim the same. There are a few changes, however, that are important and deserve to be noted. In particular, the procedures were revised to satisfy the FISA Court’s concerns about multi-communications transactions; indeed, these revisions were the big part that gave Judge Bates sufficient comfort so as to allow him ultimately to grant the government’s move for recertification.

and The NSA Documents, Part VII: The Compliance Report (by Jane Chong, August 24, 2013):

The final document in the cache declassified by the Office of the Director of National Intelligence (ODNI) on Wednesday is the ninth joint compliance assessment conducted by the ODNI and the Department of Justice’s National Security Division (NSD). The FISA Amendments Act of 2008 requires the Attorney General and the DNI to assess NSA compliance with Section 702 targeting and minimization procedures and to submit their findings to the Foreign Intelligence Surveillance Court (FISC) and certain congressional committees at least once every six months. The 52-page report, dated August 2013, examines agency compliance from June 1, 2012 through November 30, 2012.

The document is interesting both because it is a more exhaustive account of compliance matters than is the internal document leaked by Edward Snowden to the Washington Post and because it is more recent. It contains a large amount of new information about the rigors of the bureaucratic process surrounding both collection and collection oversight.

The main sections are:

1. Overview of Compliance Oversight Regime

2. Trends in Targeting

3. Causes of Compliance Incidents

The article discusses these areas as fully as constraints (and redactions) permit.

Firn: thank you for your interest in this topic.

Regards

Mike

[davidbfpo]

From my reading the public debate in the USA is different from the very limited debate in the UK, so this polemical lady writer - from a conservative angle - has waded in.

Rightly she asks:

How much are we prepared to compromise with our idea of a life worth living in order to pursue the chimera of perfect safety?

Link:http://www.telegraph.co.uk/news/ukne...-freedoms.html

On what the USA has been told, in the earlier NSA explanations, I cannot see the logic and purpose of checking so much data, then retaining some of it. The plots disrupted score has been dissected by others and is not an explanation.

We tend to concentrate on the apparent counter-terrorism rationale for the information gathering, when it is clear it is far wider and includes counter-espionage for example.

[Firn]

Personally I believe the topic is highly important and it is great to see it tackled with a lawyerly approach.

From the start the various agencies and the executive followed the time-honored defence of conceding only what has already been all too obvious. In the process they drew a denial line into public sphere only to be force to redraw it again and again, looking ever more the worse for it. Maybe it is the nature of the beast but it doesn't inspire any confidence into the system...

Ironically I seen now a google-delivered ad praising wireless IP surveillance cameras. Clearly the algorithms are doing their work, sadly I guess privacy and data protection isn't quite as easy to buy.