Another Word For It Patrick Durusau on Topic Maps and Semantic Diversity

May 3, 2016

“Rule of Law” and Lauri Love

Filed under: Cybersecurity,FBI,Government,NSA — Patrick Durusau @ 9:45 am

My recent post, How-To Document Conspiracies and Other Crimes raised concerns with some readers since I did not address the legal niceties of the indictment. Burden of proof, claims not facts, etc. All of which were irrelevant to my point of using “secure IRC” to document a conspiracy or other crimes.

True or false, the indictment serves to illustrate the impact of self-documenting the commission of crimes, if indeed any crimes were committed.

What prompted this post was the suggestion that I was ignoring the “rule of law” in cases such as the one involving Lauri Love.

Perhaps the hacker community is unaware that the “rule of law” is a fiction which the sovereign sets aside at its convenience.

That has always been the case but the disturbing development during the Fear of Terror era, is that abandonment of the “rule of law” has become overt policy.

Iran-Contra is an example of abandoning the “rule of law” but at least those involved were talked about as criminals.

Fast forward to post 9/11 and examples of abandoning the “rule of law” explode: FBI instructs agents to conceal information from triers of fact U.s. v. Michaud, FBI hacking (FBI uses zero day exploits), Director of National Intelligence lies to Congress (Lies, Damned Lies, and Clapper (2015)), are just a few examples. (Is anyone keeping a list of the admitted lies to triers of fact and/or Congress?)

The public and unashamed abandonment of the “rule of law” along with any notion of an independent judiciary, has a deeply corrosive effect on the legitimacy of government.

Judges where alleged crimes against the state are prosecuted, should remember the state abandoned the “rule of law” first. It has no one but itself to blame for the consequences that follow.

May 2, 2016

NSA Work/Life Balance [child porn]

Filed under: Government,NSA — Patrick Durusau @ 9:16 pm

If you haven’t seen the new intelligence careers NSA site, it deserves a look.

I do have a correction to the benefits page, which describes Work/Life Balance:

nsa-work-life

After reading: FEDS Have Found ‘Unbelievable’ Amounts of Child Porn on National Security Computers. Is This the Solution? by Aliya Sternstein, shouldn’t child porn be added to that list?

If from a security perspective, possession of child porn opens NSA staff to blackmail, I suggest they legalize possession of child porn by NSA staff.

That would remove the potential for blackmail and it would encourage longer careers at the NSA.

The NSA is very unlikely to be monitoring my blog so if you know any NSA staffers, please ping them with this post.

April 5, 2016

NSA-grade surveillance software: IBM i2 Analyst’s Notebook (Really?)

Filed under: Government,Graphs,Neo4j,NSA,Privacy,Social Networks — Patrick Durusau @ 8:20 pm

I stumbled across Revealed: Denver Police Using NSA-Grade Surveillance Software which had this description of “NSA-grade surveillance software…:”


Intelligence gathered through Analyst’s Notebook is also used in a more active way to guide decision making, including with deliberate targeting of “networks” which could include loose groupings of friends and associates, as well as more explicit social organizations such as gangs, businesses, and potentially political organizations or protest groups. The social mapping done with Analyst’s Notebook is used to select leads, targets or points of intervention for future actions by the user. According to IBM, the i2 software allows the analyst to “use integrated social network analysis capabilities to help identify key individuals and relationships within networks” and “aid the decision-making process and optimize resource utilization for operational activities in network disruption, surveillance or influencing.” Product literature also boasts that Analyst’s Notebook “includes Social Network Analysis capabilities that are designed to deliver increased comprehension of social relationships and structures within networks of interest.”

Analyst’s Notebook is also used to conduct “call chaining” (show who is talking to who) and analyze telephone metadata. A software extension called Pattern Tracer can be used for “quickly identifying potential targets”. In the same vein, the Esri Edition of Analyst’s Notebook integrates powerful geo-spatial mapping, and allows the analyst to conduct “Pattern-of-Life Analysis” against a target. A training video for Analyst’s Notebook Esri Edition demonstrates the deployment of Pattern of Life Analysis in a military setting against an example target who appears appears to be a stereotyped generic Muslim terrorism suspect:

Perhaps I’m overly immune to IBM marketing pitches but I didn’t see anything in this post that could not be done with Python, R and standard visualization techniques.

I understand that IBM markets the i2 Analyst’s Notebook (and training too) as:

…deliver[ing] timely, actionable intelligence to help identify, predict, prevent and disrupt criminal, terrorist and fraudulent activities.

to a reported tune of over 2,500 organizations worldwide.

However, you have to bear in mind the software isn’t delivering that value-add but rather the analyst plus the right data and the IBM software. That is the software is at best only one third of what is required for meaningful results.

That insight seems to have gotten lost in IBM’s marketing pitch for the i2 Analyst’s Notebook and its use by the Denver police.

But to be fair, I have included below the horizontal bar, the complete list of features for the i2 Analyst’s Notebook.

Do you see any that can’t be duplicated with standard software?

I don’t.

That’s another reason to object to the Denver Police falling into the clutches of maintenance agreements/training on software that is likely irrelevant to their day to day tasks.


IBM® i2® Analyst’s Notebook® is a visual intelligence analysis environment that can optimize the value of massive amounts of information collected by government agencies and businesses. With an intuitive and contextual design it allows analysts to quickly collate, analyze and visualize data from disparate sources while reducing the time required to discover key information in complex data. IBM i2 Analyst’s Notebook delivers timely, actionable intelligence to help identify, predict, prevent and disrupt criminal, terrorist and fraudulent activities.

i2 Analyst’s Notebook helps organizations to:

Rapidly piece together disparate data

Identify key people, events, connections and patterns

Increase understanding of the structure, hierarchy and method of operation

Simplify the communication of complex data

Capitalize on rapid deployment that delivers productivity gains quickly

Be sure to leave a comment if you see “NSA-grade” capabilities. We would all like to know what those are.

February 28, 2016

Media Makes Terrorists Good At Encryption [Projecting Ignorance]

Filed under: Cryptography,Cybersecurity,Government,NSA,Security — Patrick Durusau @ 9:15 pm

CIA Director: It’s the Media’s Fault That Terrorists Are So Good at Encryption by Kate Knibbs.’

From the post:


Ledgett poked his finger at the media even more explicitly. “We track when our foreign intelligence targets talk about the security of their communication,” he said. “And we see a growing number of them, because of what’s in the press about the value of encryption, moving towards that.”

The implication of these statements—that media reports are somehow optimized to help terrorists be better at evading law enforcement—is a dangerous one. Yes, of course terrorists read. But Brenner and Ledgett’s statements situate media support for strong encryption on the side of terrorism. Neither intelligence leader recognized how members of their own communities might also benefit from media reports about encryption. In fact, neither Brennan or Ledgett bothered to acknowledge that their own agencies rely on encryption as a crucial security measure.

Neither Brennan or Ledgett specified which reports were believed to be frequently dog-eared on ISIS squatters, but that doesn’t matter. Extremists are interested in privacy tools, and media reports on privacy tools. Saying that they read about which tools to use is just saying that any group with goals attempts to find information that will help achieve those goals. Implying that media reports are aiding and abetting the enemy—not to mention the notion that reports highlighting privacy protections are somehow devious—is just unfair and chilling.

Kate’s right about blaming the media for extremists using encryption is far fetched, not to mention “…just unfair and chilling.”

But what we are witnessing is the projection (Jung) of ignorance of the speakers onto others.

These witnesses making these statements have as much expertise at encryption as I do at break dancing. Which is to say none at all.

They are sock puppets who “learn” about encryption or at least buzz phrases about encryption from public media.

On in the case of the FBI, from an FBI training manual that shows images of hard wired connections in a phone junction box.

Comey now wonders why encryption is allowed to defeat such measures. You have to wonder if Comey has noticed that cellphones are not followed by long phone lines.

Other than summarizing their nonsensical statements, the news media in general should not interview, quote or report any statement by these witnesses without a disclaimer that such witnesses are by definition incompetent on the question at hand.

Members of Congress can continue to billow and coo with those of skills equal to their own but the public should be forewarned of their ignorance.

October 28, 2015

Twitter – Tying Your Twitter Account to SMS-Enabled Phone

Filed under: Cybersecurity,Government,NSA,Privacy,Security — Patrick Durusau @ 3:30 pm

I tried to create a new Twitter account today but much to my surprise I could not use a phone number already in use by another Twitter account.

Moreover, the phone number has to be of an SMS-enabled phone.

I understand the need for security but you do realize that the SMS-enabled phone requirement ties your Twitter account to a particular phone. Yes?

Now, who was it that was tracking all phone traffic?

Oh, I remember, Justice Department plotting to resume NSA bulk phone records collection, it was the NSA!

The number of government mis-steps and outrages in just a few months is enough to drive earlier ones from immediate memory. It’s sad to have a government that deeply incompetent and dishonest.

The SMS-enabled phone requirement of Twitter makes binding your Twitter posts to a specific phone easy.

Although it will be portrayed as requiring sophisticated analysis tools in order to justify the NSA’s budget.

Suggestion: Twitter should display the SMS code on a page returned to the browser requesting an account.

Unless of course, Twitter has already joined itself at the hip to the NSA.

June 1, 2015

Non-prosecution of Clapper – A Mark of Privilege?

Filed under: Government,NSA,Politics — Patrick Durusau @ 10:31 am

As of today, it has been 811 days since Gen. Clapper lied to the United States Senate Select Committee on Intelligence:

On March 12th, 2013, during a United States Senate Select Committee on Intelligence hearing, Senator Ron Wyden asked Director of National Intelligence James R. Clapper the following question:

“Does the NSA collect any type of data at all on millions or hundreds of millions of Americans?”

Director Clapper responded “No, sir.”

Incredulously, Senator Wyden asked “It does not?”

Director Clapper responded “Not wittingly. There are cases where they could inadvertantly perhaps collect, but not wittingly.”

So that he would be prepared to answer, Senator Wyden gave these questions to Director Clapper’s office a day in advance of the hearing. Upon the hearing’s completion, he also gave the Director a chance to amend his answer. He opted not to do so.

A video of Clapper committing perjury can be found at: Has James Clapper been indicted for perjury yet?, along with links to people across the political spectrum calling for his prosecution.

I find it extremely ironic that US District Judge Katherine Forrest would characterize the Ulbricht’s arguments as “a mark of privilege” in light of the ongoing illegal activities of the NSA and the non-prosecution of Gen. Clapper for perjury. Judge says Ulbricht’s “harm reduction” arguments are fantasies, a mark of privilege.

At the very worst, for all the boo-hooing at his sentencing hearing, Ross Ulbricht was just a common criminal. Even the twenty-year minimum sentence is harsh in light of the need of the government to improve its own cybersecurity. Being sentenced to do community service half-time for the government as a cybersecurity consultant for a term of years would more than have repaid any imagined debt to society.

Clapper’s crime on the other hand, strikes at the heart of the controller of the purse (the legislative branch), to know how funds it has appropriated are being used. To say nothing of its monitoring the executive branch for its adherence to laws passed by the legislative branch.

The executive branch pursues Ulbricht and not Clapper. The judicial branch ignores the ongoing criminal enterprise that is the current executive branch and wastes valuable cyber talent in a fit of pique.

Clapper should be prosecuted for perjury and his many other crimes. Ulbricht should be resentenced and a sentence that makes meaningful use of his talents for public good should be imposed. (Since the executive branch can ignore laws at will, the judge can ignore any minimum sentencing requirements as well.)

May 24, 2015

Kafka and the Foreign Intelligence Surveillance Court (FISA)

Filed under: Government,NSA,Security — Patrick Durusau @ 2:07 pm

Quiz: Just how Kafkaesque is the court that oversees NSA spying? by Alvaro Bedoya and Ben Sobel.

From the post:

When Edward Snowden first went public, he did it by leaking a 4-page order from a secret court called the Foreign Intelligence Surveillance Court, or FISA court. Founded in 1978 after the Watergate scandal and investigations by the Church Committee, the FISA court was supposed to be a bulwark against secret government surveillance. In 2006, it authorized the NSA call records program – the single largest domestic surveillance program in American history.

“The court” in Franz Kafka’s novel The Trial is a shadowy tribunal that tries (and executes) Josef K., the story’s protagonist, without informing him of the crime he’s charged with, the witnesses against him, or how he can defend himself. (Worth noting: The FISA court doesn’t “try” anyone. Also, it doesn’t kill people.)

Congress is debating a bill that would make the FISA court more transparent. In the meantime, can you tell the difference between the FISA court and Kafka’s court?

After you finish the quiz, if you haven’t read The Trial by Franz Kafka, you should.

I got 7/11. What’s your score?

The FISA court is an illusion of due process that has been foisted off on American citizens.

To be fair, the number of rejected search or arrest warrants in regular courts is as tiny as the number of rejected applications in FISA court. (One study reports 1 rejected search warrant out of 1,748. Craig D. Uchida, Timothy S. Bynum, Search Warrants, Motions to Suppress and Lost Cases: The Effects of the Exclusionary Rule in Seven Jurisdictions, 81 J. Crim. L. & Criminology 1034 (1990-1991), at page: 1058)

However, any warrant issued by a regular court, including the affidavit setting forth “probable cause” becomes public. Both the police and judicial officers know the basis for warrants will be seen by others, which encourages following the rules for probable cause.

Contrast that with the secret warrants and the basis for secret warrants from the FISA court. There is no opportunity for the public to become informed about the activities of the FISA courts or the results of the warrants that it issues. The non-public nature of the FISA court deprives voters of the ability to effectively voice concerns about the FISA court.

The only effective way to dispel the illusion that secrecy is required for the FISA court is for there to be massive and repetitive leaks of FISA applications and opinions. Just like with the Pentagon Papers, the sky will not fall and the public will learn the FISA court was hiding widespread invasions of privacy based on the thinnest tissues of fantasy from intelligence officers.

If you think I am wrong about the FISA court, name a single government leak that did not reveal the government breaking the law, attempting to conceal incompetence or avoid accountability. Suggestions?

May 10, 2015

Simple Math Defeats NSA

Filed under: Cybersecurity,NSA,Security — Patrick Durusau @ 3:13 pm

The simple math problem that blows apart the NSA’s surveillance justifications by Ryan Cooper.

From the post:

Here’s a question about death and probability, done first by Cory Doctorow. Suppose one out of every million people is a terrorist (if anything, an overestimate), and you’ve got a machine that can determine whether someone is a terrorist with 99.9 percent accuracy. You’ve used the machine on your buddy Jeff Smith, and it gives a positive result. What are the odds Jeff is a terrorist?

Try to figure it out, or at least guess, before you read on.

Similar conclusion to Begging National Security Questions #1 where out of 10,295,642,951 airline passengers screened from 2002 – 2015, the TSA has yet to catch a single terrorist. Not one.

Perhaps critics (I’m one) of the NSA are asking the wrong questions.

Surely NSA staff mathematicians know the problems both formal and practical with the surveillance activities at the NSA. Even the political appointees at DHS have noticed a drought of ten years without a single terrorist. Their competitors at the FBI coerce the mentally ill into terrorist suspects.

What if the debate over the justifications for surveillance is a distraction? While we sally back and forth over statistics, methodologies, legal issues, etc., the real drivers for the activity are elsewhere?

Since the NSA budget is top-secret, let’s look at the Department of Homeland Security budget, from 2002 to 2015. I used the budget-in-brief documents from DHS Budget. (I didn’t see any machine readable files. Let me know if there are other sources with machine readable files. Thanks!)

Total DHS Budgets by Year:

2002 $20 billion
2003 $38 billion
2004 $36 billion
2005 $40 billion
2006 $41 billion
2007 $43 billion
2008 $46 billion
2009 $51 billion
2010 $55 billion
2011 $56 billion
2012 $57 billion
2013 $59 billion
2014 $60 billion
2015 $61 billion
2016 $65 billion
Total $628 billion

The self-professed justification of the DHS can be found in the first paragraph if its Budget-in-Brief for 2016:

The Department of Homeland Security’s (DHS) ultimate mission is to secure the Nation from the many threats we face. This requires the dedication of nearly a quarter million employees with responsibilities that range from facilitating the efficient flow of commerce; preventing terrorism; protecting our national leaders; securing and managing the border; enforcing and administering immigration laws; and preparing for and responding to disasters. Our duties are wide-ranging, but our goal is quite clear—keep America safe.

It is an article of faith, dogma, inerrant truth, at least for the DHS that America faces many threats. No amount of evidence can shake their faith in that proposition.

Why not take a non-refutation approach? Just bypass the bass intoning of “America faces many threats,” and jump to what is being done to respond to those threats?

I hate conceding factual falsehoods but more effective engagement on budget waste may (no guarantees) lead to less surveillance and more useful spending of federal funds.

First, we need an image that captures the essence of the DHS budget. Here is my suggestion:

cookie-jar

Second, focus on the cookie part of the imagery. What cookies did your locality get last year from the DHS? Those cookies have more to do with the distribution of money than any attempt to “…keep American safe.” And no doubt some of those 250,000 DHS staff work in your community, shop in your stores, buy homes, etc. If you aren’t getting your share of the cookies, time to complain.

Third, mine the DHS budget for the many ineffectual programs (like the TSA) which have yet to produce a single terrorist. Go ahead and concede the fantasy of terrorists and even encourage it. Then you can ask: “OK, so if terrorists are lurking nearly everywhere, why haven’t you caught even one?”

I think there are a variety of factors driving DHS:

  • The government wants to be seen as doing something to prevent terrorism, even if their efforts are totally ineffectual. Such as feeling up little children at airports.
  • The DHS distributed jobs and purchases across the economy and that is viewed as a benefit (cookie) by many member of congress.
  • Preservation of the DHS as a department, which is its main rationale for continuing to exist. Going on fourteen (14) years without a single terrorist arrest by the TSA should be proof enough that the United States is a terrorist desert (except for the mentally ill entrapped by the FBI).

Let’s concede the terrorist fantasy and then cut the legs out from under DHS.

May 3, 2015

Debating Public Policy, On The Basis of Fictions

Filed under: Cybersecurity,Government,NSA,Security,Uncategorized — Patrick Durusau @ 4:12 pm

Striking a Balance—Whistleblowing, Leaks, and Security Secrets by Cody Poplin.

From the post:

Last weekend, the New York Times published an article outlining the strength of congressional support for the CIA targeted killing program. In the story, the Times also purported to reveal the identities of three covert CIA operatives who now hold senior leadership roles within the Agency.

As you might expect, the decision generated a great deal of controversy, which Lawfare covered here and here. Later in the week, Jack Goldsmith interviewed Executive Editor of the New York Times Dean Baquet to discuss the decision. That conversation also prompted responses from Ben, Mark Mazzetti (one of the authors of the piece), and an anonymous intelligence community reader.

Following Times’ story, the Johns Hopkins University Center for Advanced Governmental Studies, along with the James Madison Project and our friends at Just Security, hosted an a timely conference on Secrecy, Openness and National Security: Lessons and Issues for the Next Administration. In a panel entitled Whistleblowing and America’s Secrets: Ensuring a Viable Balance, Bob Litt, General Counsel for the Office of the Director of National Security, blasted the Times, saying that the paper had “disgraced itself.”

However, the panel—which with permission from the Center for Advanced Governmental Studies, we now present in full—covered much more than the latest leak published in the Times. In a conversation moderated by Mark Zaid, the Executive Director of the James Madison Project, Litt, along with Ken Dilanian, Dr. Gabriel Schoenfeld, and Steve Vladeck, tackled a vast array of important legal and policy questions surrounding classified leak prosecutions, the responsibilities of the press, whistleblower protections, and the future of the Espionage Act.

It’s a jam-packed discussion full of candid exchanges—some testy, most cordial—that greatly raises the dialogue on the recent history of leaks, prosecutions, and future lessons for the next Administration.

Spirited debate but on the basis of known fictions.

For example, Bob Litt, General Counsel for the Office of the Director of National Security, poses a hypothetical question that compares an alleged suppression of information about the Bay of Pigs invasion to whether a news organization would be justified in leaking the details of plans to assassinate Osama bin Laden.

The premise of the hypothetical is flawed. It is based on an alleged statement by President Kennedy wishing the New York Times had published the details in their possession. One assumes so that public reaction would have prevented the ensuing disaster.

The story of President Kennedy suppressing a story in the New York Times about the Bay of Pigs is a myth.

Busting the NYTimes suppression myth, 50 years on reports:


Indeed, the Times’ purported spiking has been called the “symbolic journalistic event of the 1960s.”

Only the Times didn’t censor itself.

It didn’t kill, spike, or otherwise emasculate the news report published 50 years ago tomorrow that lies at the heart of this media myth.

That article was written by a veteran Times correspondent named Tad Szulc, who reported that 5,000 to 6,000 Cuban exiles had received military training for a mission to topple Fidel Castro’s regime; the actual number of invaders was about 1,400.

The story, “Anti-Castro Units Trained At Florida Bases,” ran on April 7, 1961, above the fold on the front page of the New York Times.

The invasion of the Bay of Pigs happened ten days later, April 17, 1961.

Hardly sounds like suppression of the story does it?

That is just one fiction that formed the basis for part of the discussion in this podcast.

Another fiction is that leaked national security information, take some of Edward Snowden‘s materials for example, were damaging to national security. Except that those who claim to know can’t say what information or how it was damaging.

Without answers to what information and how it was damaging to national security, their claims of “damage to national security” should go straight into the myth bin. The unbroken record of leaks shows illegal activity, incompetence, waste and avoidance of responsibility. None of those are in the national interest.

If the media does want to act in the “public interest,” then it should stop repeating unsubstantiated claims of damage to the “national interest,” by the security community. Repeated falsehoods does not make them useful for debates of public policy. When advanced such claims should be challenged and then excluded from further discussion without sufficient details for the public to reach their own conclusion about the claim.

Another myth in this discussion is the assumption that the media has a in loco parentis role vis-a-vis the public. That media representatives should act on the public’s behalf in determining what is or is not in the “public interest.” Complete surprise to me and I have read the Constitution more than once or twice.

I don’t remember seeing the media called out in the Constitution as guardians for a public too stupid to decide matters of public policy for itself.

That is the central flaw with national security laws and the rights of leakers and leakees. The government of the United States, for those unfamiliar with the Constitution, is answerable under the Constitution to the citizens of the United States. Not any branch of government or its agencies but to the citizens.

There are no exceptions to United States government being accountable to its citizens. Not one. To hold government accountable, its citizens need to know what government has been doing, to whom and why. The government has labored long and hard, especially its security services, to avoid accountability to its citizens. Starting shortly after its inception.

There should be no penalties for leakers or leakees. Leaks will cause hardships, such as careers ending due to dishonestly, incompetence, waste and covering for others engaged in the same. If you don’t like that, move to a country where the government isn’t answerable to its citizens. May I suggest Qatar?

April 26, 2015

New York Times Gets Stellarwind IG Report Under FOIA

Filed under: Government,NSA,Privacy — Patrick Durusau @ 4:57 pm

New York Times Gets Stellarwind IG Report Under FOIA by Benjamin Wittes.

A big thank you! to Benjamin Wittes and the New York Times.

They are the only two (2) stories on the Stellarwind IG report, released Friday evening, that give a link to the document!

The NYT story with the document: Government Releases Once-Secret Report on Post-9/11 Surveillance by Charlie Savage.

The document does not appear at:

Office of the Director of National Intelligence (as of Sunday, 25 April 2015, 17:45 EST).

US unveils 6-year-old report on NSA surveillance by Nedra Pickler (Associated Press or any news feed that parrots the Associated Press).

Suggestion: Don’t patronize news feeds that refer to documents but don’t include links to them.

April 22, 2015

QUANTUM-type packet injection attacks [From NSA to Homework]

Filed under: Cybersecurity,NSA,Security — Patrick Durusau @ 4:12 pm

QUANTUM-type packet injection attacks

From the homework assignment:

CSE508: Network Security (PhD Section), Spring 2015

Homework 4: Man-on-the-Side Attacks

Part 1:

The MotS injector you are going to develop, named ‘quantuminject’, will capture the traffic from a network interface in promiscuous mode, and attempt to inject spoofed responses to selected client requests towards TCP services, in a way similar to the Airpwn tool.

Part 2:

The MotS attack detector you are going to develop, named ‘quantumdetect’, will capture the traffic from a network interface in promiscuous mode, and detect MotS attack attempts. Detection will be based on identifying duplicate packets towards the same destination that contain different TCP payloads, i.e., the observation of the attacker’s spoofed response followed by the server’s actual response. You should make every effort to avoid false positives, e.g., due to TCP retransmissions.

See the homework details for further requirements and resources.

If you need a starting point for “Man-on-the-Side Attacks,” I saw Bruce Schneier recommend: Our Government Has Weaponized the Internet. Here’s How They Did It by Nicholas Weaver.

You may also want to read: Attacking Tor: how the NSA targets users’ online anonymity by Bruce Schneier, but with caveats.

For example, Bruce says:

To trick targets into visiting a FoxAcid server, the NSA relies on its secret partnerships with US telecoms companies. As part of the Turmoil system, the NSA places secret servers, codenamed Quantum, at key places on the internet backbone. This placement ensures that they can react faster than other websites can. By exploiting that speed difference, these servers can impersonate a visited website to the target before the legitimate website can respond, thereby tricking the target’s browser to visit a Foxacid server.

In the academic literature, these are called “man-in-the-middle” attacks, and have been known to the commercial and academic security communities. More specifically, they are examples of “man-on-the-side” attacks.

They are hard for any organization other than the NSA to reliably execute, because they require the attacker to have a privileged position on the internet backbone, and exploit a “race condition” between the NSA server and the legitimate website. This top-secret NSA diagram, made public last month, shows a Quantum server impersonating Google in this type of attack.

Have you heard the story of the mountain hiker who explained he was wearing sneakers instead of boots in case he and his companion were chased by a bear? The companion pointed out that no one can outrun a bear, to which the mountain hiker replied, “I don’t have to outrun the bear, I just have to outrun you.

A man-in-the-middle attack can be made from a privileged place on the Internet backbone, but that’s not a requirement. The only requirement is that my “FoxAcid” server has to respond more quickly than the website a user is attempting to contact. That hardly requires a presence on the Internet backbone. I just need to out run the packets from the responding site.

Assume I want to initiate a man-on-the-side attack against a user or organization at a local university. All I need do is obtain access to the university connection to the Internet, on the university side of the connection and by definition I am going to be faster than any site remote to the university.

So I would disagree with Bruce’s statement:

They are hard for any organization other than the NSA to reliably execute, because they require the attacker to have a privileged position on the internet backbone, and exploit a “race condition” between the NSA server and the legitimate website.

Anyone can do man-on-the-side attacks, the only requirement is being faster than the responding computer.

The NSA wanted to screw everyone on the Internet, hence the need to be on the backbone. If you are less ambitious, you can make do with far less expensive and rare resources.

March 23, 2015

Bearing Arms – 2nd Amendment and Hackers – The Constitution

Filed under: Cybersecurity,NSA,Security — Patrick Durusau @ 8:09 pm

All discussions of the right to bear arms in the United States start with the Second Amendment. But since words can’t interpret themselves for specific cases, our next stop is the United States Supreme Court.

One popular resource, The Constitution of the United States of America: Analysis and Interpretation (popularly known as the Constitution Annotated), covers the Second Amendment in a scant five (5) pages.

There is a vast sea of literature on the Second Amendment but there is one case that established the right to bear arms is an individual right and not limited to state militias.

In District of Columbia vs. Heller, 554 U.S. 570 (2008), Justice Scalia writing for the majority found that the right to bear arms was an individual right, for the first time in U.S. history.

The unofficial syllabus notes:

The prefatory clause comports with the Court’s interpretation of the operative clause. The “militia” comprised all males physically capable of acting in concert for the common defense. The Antifederalists feared that the Federal Government would disarm the people in order to disable this citizens’ militia, enabling a politicized standing army or a select militia to rule. The response was to deny Congress power to abridge the ancient right of individuals to keep and bear arms, so that the ideal of a citizens’ militia would be preserved. Pp. 22–28.

Interesting yes? Disarm the people in order to enable “…a politicized standing army (read NSA/CIA/FBI/DHS) or a select militia to rule.”

If citizens are prevented from owning hacking software and information, necessary for their own cybersecurity, have they not been disarmed?

Justice Scalia’s opinion is rich in historical detail and I will be teasing out the threads that seem most relevant to an argument that hacking tools and knowledge should fall under the right to bear arms under the Second Amendment.

In the mean time, some resources that you will find interesting/helpful:

District of Columbia v. Heller in Wikipedia is a quick read and a good way to get introduced to the case and the issues it raises. But only as an introduction, you would not perform surgery based on a newspaper report of a surgery. Yes?

A definite step up in analysis is SCOTUSblog, District of Columbia v. Heller. You will find twenty (20) blog posts on Heller, briefs and documents in the case, plus some twenty (20) briefs supporting the petitioner (District of Columbia) and forty-seven (47) briefs supporting the respondent (Heller). Noting that attorneys could be asked questions about any and all of the theories advanced in the various briefs.

Take this as an illustration of why I don’t visit SCOTUSblog as often as I should. I tend to get lost in the analysis and start chasing threads through the opinions and briefs. One of the many joys being that rarely you find anyone with a hand waving citation “over there, somewhere” as you do in CS literature. Citations are precise or not at all.

No, I don’t propose to drag you through all of the details even of Scalia’s majority opinion but just enough to frame the questions to be answered in making the claim that cyber weapons are the legitimate heirs of arms for purposes of the Second Amendment and entitled to the same protection as firearms.

Do some background reading today and tomorrow. I am re-reading Scalia’s opinion now and will let it soak in for a day or so before posting an outline of it relevant for our purposes. Look for it late on Wednesday, 25 March 2015.

PS: Columbia vs. Heller, 554 U.S. 570 (2008), the full opinion plus dissents. A little over one hundred and fifty (150) pages of very precise writing. Enjoy!

March 22, 2015

A Well Regulated Militia

Filed under: Cybersecurity,NSA,Security — Patrick Durusau @ 6:45 pm

The NSA’s plan: improve cybersecurity by hacking everyone else by Trevor Timm.

From the post:

The National Security Agency want to be able to hack more people, vacuum up even more of your internet records and have the keys to tech companies’ encryption – and, after 18 months of embarrassing inaction from Congress on surveillance reform, the NSA is now lobbying it for more powers, not less.

NSA director Mike Rogers testified in front of a Senate committee this week, lamenting that the poor ol’ NSA just doesn’t have the “cyber-offensive” capabilities (read: the ability to hack people) it needs to adequately defend the US. How cyber-attacking countries will help cyber-defense is anybody’s guess, but the idea that the NSA is somehow hamstrung is absurd.

Like everyone else I like reading hacking stories, particularly the more colorful ones! But for me, at least until now, hacking has been like debugging core dumps, it’s an interesting technical exercise but not much more than that.

I am incurious about the gossip the NSA is sweeping up for code word access, but I am convinced that we all need a strong arm to defend our digital privacy and the right to tools to protect ourselves.

The dangers to citizens have changed since James Madison wrote in the Bill or Rights:

“A well regulated Militia, being necessary to the security of a free State, the right of the people to keep and bear Arms, shall not be infringed.”

In 1789, oppression and warfare was conducted with muzzle loaders and swords. Guns are still a common means of oppression, but the tools of oppression have grown since 1789. Then there was no mass surveillance of phone traffic, bank accounts, camera feeds, not to mention harvesting of all network traffic. Now, all of those things are true.

Our reading of the Second Amendment needs to be updated to include computers, software developed for hacking, training for hackers and research on hacking. Knowing how to break encryption isn’t the same thing as illegally breaking encryption. It is a good way to test whether the promised encryption will exclude prying government eyes.

I’m not interested in feel good victories that come years after over reaching by the government. It’s time for someone to take up the gage that the NSA has flung down in the street. Someone who traffics in political futures and isn’t afraid to get their hands dirty.

The NRA has been a long term and successful advocate for Second Amendment rights. And they have political connections that would take years to develop. When was the last time you heard of the NRA winning symbolic victories for someone after they had been victimized? Or do you hear of victories by the NRA before their membership is harmed by legislation? Such as anti-hacking legislation.

Since the NRA is an established defender of the Second Amendment, with a lot of political clout, let’s work on expanding the definition of “arms” in the Second Amendment to include computers, knowledge of how to break encryption and security systems, etc.

The first step is to join the NRA (like everybody they listen to paying members first).

The second step is educate other NRA members and the public posed by unchecked government cyberpower. Current NRA members may die with their guns in hand but government snoops know what weapons they have, ammunition, known associates, and all of that is without gun registration. A machine pistol is a real mis-match against digital government surveillance. As in the losing side.

The third step is to start training yourself as a hacker. Setup a small network at home so you can educate yourself, off of public networks, about the weaknesses of hardware and software. Create or join computer clubs dedicated to learning hacking arts.

BTW, the people urging you to hack Y12 (a nuclear weapons facility), Chase and the White House are all FBI plants. Privately circulate their biometrics to other clubs. Better informants that have been identified than unknowns. Promptly report all illegal suggestions from plants. You will have the security agencies chasing their own tails.

Take this as a warm-up. I need to dust off some of my Second Amendment history. Suggestions and comments are always welcome.

Looking forward to the day when even passive government surveillance sets off alarms all over the net.

February 20, 2015

The Great SIM Heist

Filed under: Cybersecurity,NSA,Security — Patrick Durusau @ 4:47 pm

The Great SIM Heist – How Spies Stole the Keys to the Encryption Castle by Jeremy Scahill and Josh Begley.

From the post:

AMERICAN AND BRITISH spies hacked into the internal computer network of the largest manufacturer of SIM cards in the world, stealing encryption keys used to protect the privacy of cellphone communications across the globe, according to top-secret documents provided to The Intercept by National Security Agency whistleblower Edward Snowden.

The hack was perpetrated by a joint unit consisting of operatives from the NSA and its British counterpart Government Communications Headquarters, or GCHQ. The breach, detailed in a secret 2010 GCHQ document, gave the surveillance agencies the potential to secretly monitor a large portion of the world’s cellular communications, including both voice and data.

The company targeted by the intelligence agencies, Gemalto, is a multinational firm incorporated in the Netherlands that makes the chips used in mobile phones and next-generation credit cards. Among its clients are AT&T, T-Mobile, Verizon, Sprint and some 450 wireless network providers around the world. The company operates in 85 countries and has more than 40 manufacturing facilities. One of its three global headquarters is in Austin, Texas and it has a large factory in Pennsylvania.

In all, Gemalto produces some 2 billion SIM cards a year. Its motto is “Security to be Free.”

Read the original post to get an idea of the full impact of this heist.

Bottom line: Anything transmitted or stored electronically (phone, Internet, disk drive) should be considered as compromised.

How can people protect themselves when their government “protectors” are spying on them in addition to many others?

There isn’t a good answer to that last question but one needs to be found and soon.


Update: Mike Masnick says theft of SIM encryption keys demonstrates that any repository of backdoors will be a prime target for hackers, endangering the privacy of all users with those backdoors. Not a theoretical risk, the NSA and others have demonstrated the risk to be real. See: NSA’s Stealing Keys To Mobile Phone Encryption Shows Why Mandatory Backdoors To Encryption Is A Horrible Idea

February 17, 2015

Russian researchers expose breakthrough U.S. spying program

Filed under: Cybersecurity,NSA,Security — Patrick Durusau @ 2:57 pm

Russian researchers expose breakthrough U.S. spying program by Joseph Menn.

From the post:

The U.S. National Security Agency has figured out how to hide spying software deep within hard drives made by Western Digital, Seagate, Toshiba and other top manufacturers, giving the agency the means to eavesdrop on the majority of the world’s computers, according to cyber researchers and former operatives.

That long-sought and closely guarded ability was part of a cluster of spying programs discovered by Kaspersky Lab, the Moscow-based security software maker that has exposed a series of Western cyberespionage operations.

Kaspersky said it found personal computers in 30 countries infected with one or more of the spying programs, with the most infections seen in Iran, followed by Russia, Pakistan, Afghanistan, China, Mali, Syria, Yemen and Algeria. The targets included government and military institutions, telecommunication companies, banks, energy companies, nuclear researchers, media, and Islamic activists, Kaspersky said. (reut.rs/1L5knm0)

Don’t have a sense for all thirty countries? Reuters has a visual to help with that:

Reuters-Equation-Infection

The Reuters report is great but if you want more technical details, see: Equation Group: The Crown Creator of Cyber-EspionageThe original Kaspersky report, and Equation: The Death Star of Malware Galaxy by GReAT (Kaspersky Labs’ Global Research & Analysis Team), which is an in depth review of the exploit.

There is a comment to the GReAT blog post that reads:

Ok, reading through NSA files that Der Spiegel released i found this:

http://www.spiegel.de/media/media-35661.pdf

This is a file that shows the job postings for NSA interns, you can find a NSA wiki link in the last page. And this is very interesting:

(TS//SI//REL) Create a covert storage product that is enabled from a hard drive firmware modification. The ideia would be to modify the firmware of a particular hard drive so that it normally only recognizes half of its available space. It would report this size back to the operating system and not provide any way to access the additional space.

This is a 2006 document, it took 8 years to finish this product, which is what kaspersky found.

So maybe you guys would easily find the malware if you revert the firmware to a state prior of this date.

Has anyone been collecting hard drive firmware? Another example of where “secret” code exposes users to dangers difficult to guard against.

Public open source code (whether “free” or not) should be a legal requirement for the distribution of software and/or devices with firmware. Just for security reasons alone.

BTW, anyone still in favor of “trusting” the intelligence community if they say your privacy is being respected?

I found the Reuters story because of a tweet by Violet Blue. I then tracked down the source documents for your convenience (I haven’t seen them in other accounts).

February 16, 2015

Intelligence Sharing, Crowd Sourcing and Good News for the NSA

Filed under: Crowd Sourcing,Intelligence,NSA — Patrick Durusau @ 3:11 pm

Lisa Vaas posted an entertaining piece today with the title: Are Miami cops really flooding Waze with fake police sightings?. Apparently an NBC affiliate (not FOX, amazing) tried its hand at FUD, alleging that Miami police officers were gaming Waze.

There is a problem with that theory, which Lisa points out quoting Julie Mossler, a spokes person for Waze:

Waze algorithms rely on crowdsourcing to confirm or negate what has been reported on the road. Thousands of users in Florida do this, both passively and actively, every day. In addition, we place greater trust in reports from heavy users and terminate accounts of those whose behavior demonstrate a pattern of contributing false information. As a result the Waze map will remain reliable and updated to the minute, reflecting real-time conditions.

Oops!

See Lisa’s post for the blow-by-blow account of this FUD attempt by the NBC affiliate.

However foolish an attempt to game Waze would be, it is a good example to promote the sharing of intelligence.

Think about it. Rather than the consensus poop that emerges as the collaboration of the senior management in intelligence agencies, why not share all intelligence between agencies between working analysts addressing the same areas or issues? Make the “crowd” people who have similar security clearances and common subject areas. And while contributions are trackable within a agency, to the “crowd,” everyone has a handle and their contributions on shared intelligence is voted up or down. Just like with Waze, people will develop reputations within the system.

I assume for turf reasons you could put handles on the intelligence so the participants would not know its origins as well, just until people started building up trust in the system.

Changing the cultures at the intelligence agencies, which hasn’t succeeded since 9/11, would require a more dramatic approach than has been tried to date. My suggestion is to give the Inspector Generals the ability to block promotions and/or fire people in the intelligence agencies who don’t actively promote the sharing of intelligence. Where “actively promotes” is measured by intelligence shared and not activities to plan to share intelligence, etc.

Unless and until there are consequences for the failure of members of the intelligence community to put the interests of their employers (in this case, citizens of the United States) above their own or that of their agency, the failure to share intelligence since 9/11 will continue.

PS: People will object that the staff in question have been productive, loyal, etc., etc. in the past. The relevant question is whether they have the skills and commitment that is required now? The answer to that last question is either yes or no. Employment is an opportunity to perform, not an entitlement.

February 14, 2015

Thank Snowden: Internet Industry Now Considers The Intelligence Community An Adversary, Not A Partner

Filed under: Cybersecurity,NSA,Open Source,Security — Patrick Durusau @ 2:31 pm

Thank Snowden: Internet Industry Now Considers The Intelligence Community An Adversary, Not A Partner by Mike Masnick

From the post:

We already wrote about the information sharing efforts coming out of the White House cybersecurity summit at Stanford today. That’s supposedly the focus of the event. However, there’s a much bigger issue happening as well: and it’s the growing distrust between the tech industry and the intelligence community. As Bloomberg notes, the CEOs of Google, Yahoo and Facebook were all invited to join President Obama at the summit and all three declined. Apple’s CEO Tim Cook will be there, but he appears to be delivering a message to the intelligence and law enforcement communities, if they think they’re going to get him to drop the plan to encrypt iOS devices by default:


In an interview last month, Timothy D. Cook, Apple’s chief executive, said the N.S.A. “would have to cart us out in a box” before the company would provide the government a back door to its products. Apple recently began encrypting phones and tablets using a scheme that would force the government to go directly to the user for their information. And intelligence agencies are bracing for another wave of encryption.

Disclosure: I have been guilty of what I am about to criticize Mike Masnick about and will almost certainly be guilty of it in the future. That, however, does not make it right.

What would you say is being assumed in the Mike’s title?

Guesses anyone?

What if it read: U.S. Internet Industry Now Considers The U.S. Intelligence Community An Adversary, Not A Partner?

Does that help?

The trivial point is that the “Internet Industry” isn’t limited to the U.S. and Mike’s readership isn’t either.

More disturbing though is that the “U.S. (meant here descriptively) Internet Industry” at one point did consider the “U.S. (again descriptively) Intelligence Community” as a partner at one point.

That being the case and seeing how Mike duplicates that assumption in his title, how should countries besides the U.S. view the reliability (in terms of government access) of U.S. produced software?

That’s a simple enough question.

What is your answer?

The assumption of partnership between the “U.S. Internet Industry” and the “U.S. Intelligence Community” would have me running to back an alternative to China’s recent proposal for source code being delivered to the government (in that case China).

Rather than every country having different import requirements for software sales, why not require the public posting of commercial software source for software sales anywhere?

Posting of source code doesn’t lessen your rights to the code (see copyright statutes) and it makes detection of software piracy trivially easy since all commercial software has to post its source code.

Oh, some teenager might compile a copy but do you really think major corporations in any country are going to take that sort of risk? It just makes no sense.

As far as the “U.S. Intelligence Community” concerns, remember “The treacherous are ever distrustful…” The ill-intent of the world they see is a reflection of their own malice towards others. Or after years of systematic abuse, the smoldering anger of the abused.

February 8, 2015

National Security Strategy – February 2015

Filed under: Government,NSA,Security — Patrick Durusau @ 6:53 pm

National Security Strategy – February 2015 by Barack Obama.

If you are not already following the U.S. Dept. of Fear (FearDept) on Twitter, you should be.

FearDept tweets that “terrorism” is mentioned fifty-three (53) times in thirty-five (35) pages.

Despite bold claims about our educational system, it is mentioned only sixteen (16) times. And the president doesn’t mention that LSU is facing a one-third (1/3) cut to its budget, damaging higher education in Louisiana in ways that won’t be easy to repair. Cutting Louisiana higher education by $300 million, putting it into perspective Louisiana isn’t the only state raising tuition and cutting state support for higher education, but it is one of the worst offenders.

If you want to know exactly how grim the situation is for education, see: States Are Still Funding Higher Education Below Pre-Recession Levels, which details how all fifty (50) states, save for Alaska and North Dakota, have cut funding for education. The report explores a variety of measures to illustrate the impact that funding cuts and tuition increases have had on education.

Unlike the extolling of the U.S. education system rhetoric in President Obama’s text, the report concludes:

States have cut higher education funding deeply since the start of the recession. These cuts were in part the result of a revenue collapse caused by the economic downturn, but they also resulted from misguided policy choices. State policymakers relied overwhelmingly on spending cuts to make up for lost revenues. They could have lessened the need for higher education funding cuts if they had used a more balanced mix of spending cuts and revenue increases to balance their budgets.

To compensate for lost state funding, public colleges have both steeply increased tuition and pared back spending, often in ways that may compromise the quality of the education and jeopardize student outcomes. Now is the time to renew investment in higher education to promote college affordability and quality.

Strengthening state investment in higher education will require state policymakers to make the right tax and budget choices over the coming years. A slow economic recovery and the need to reinvest in other services that also have been cut deeply means that many states will need to raise revenue to rebuild their higher education systems. At the very least, states must avoid shortsighted tax cuts, which would make it much harder for them to invest in higher education, strengthen the skills of their workforce, and compete for the jobs of the future.

The conclusions on education funding were based on facts. President Obama’s text is based on fantasies that support the military-industrial complex and their concubines.

Can you name a foreign terrorist attack on the United States other than 9/11? That’s what I thought. Unique events are not a good basis for policy making or funding.

February 5, 2015

Intelligence agencies tout transparency [Clapper? Eh?]

Filed under: Government,NSA,Transparency — Patrick Durusau @ 6:54 pm

Intelligence agencies tout transparency by Josh Gerstein.

From:

A year and a half after Edward Snowden’s surveillance revelations changed intelligence work forever, the U.S. intelligence community is formally embracing the value of transparency. Whether America’s spies and snoopers are ready to take that idea to heart remains an open question.

On Tuesday, Director of National Intelligence James Clapper released a set of principles that amounts to a formal acknowledgement that intelligence agencies had tilted so far in the direction of secrecy that it actually undermined their work by harming public trust.

“The thought here was we needed to strategically get on the same page in terms of what we were trying to do with transparency,” DNI Civil Liberties Protection Officer Alex Joel told POLITICO Monday. “The intelligence community is by design focused on keeping secrets rather than disclosing them. We have to figure out how we can work with our very dedicated work force to be transparent while they’re keeping secrets.”

The principles (posted here) are highly general and include a call to “provide appropriate transparency to enhance public understanding about the IC’s mission and what the IC does to accomplish it (including its structure and effectiveness).” The new statement is vague on whether specific programs or capabilities should be made public. In addition, the principle on handling of classified information appears largely to restate the terms of an executive order President Barack Obama issued on the subject in 2009.

If I understand the gist of this story correctly, the Director of National Intelligence (DNI) James Clapper, the same James Clapper that lied to Congress about the NSA, wants regain the public’s trust. Really?

Hmmm, how about James Clapper and every appointed official in the security services resigning as a start. The second step would be congressional appointment of oversight personnel who can go anywhere, see any information, question anyone, throughout the security apparatus and report back to Congress. Those reports back to Congress can elide details where necessary but by rotating the oversight personnel, they won’t become captives of the agencies where they work.

BTW, the intelligence community is considering how it can release more information to avoid “program shock” from Snowden like disclosures. Not that they have released any such information but they are thinking about it. OK, I’m thinking about winning $1 million in the next lottery drawing. Doesn’t mean that it is going to happen.

Let’s get off the falsehood merry-go-round that Clapper and others want to keep spinning. Unless and until all the known liars are out of government and kept out of government, including jobs with security contractors, there is no more reason to trust our intelligence community any more than we would trust the North Korean intelligence community.

Perhaps more of a reason to trust the North Korean intelligence community because at least we know whose side they are on. As far as the DNI and the rest of the U.S. security community, hard to say whose side they are on. Booz Allen’s? NSA’s? CIA’s? Some other contractors? Certainly not on the side of Congress and not on the side of the American people, despite their delusional pretensions to the contrary.

No doubt there is a role for a well-functioning and accountable intelligence community for the United States. That in no way could be applied to our current intelligence community, which is is a collection of parochial silos more concerned with guarding their turf and benefiting their contractors than any semblance of service to the American people.

Congress needs to end the intelligence community as we know it and soon. In the not distant future, the DNI and not the President will be the decision maker in Washington.

February 4, 2015

What Happens if We #Sunset215? [Patriot Act surveillance]

Filed under: Government,NSA,Security — Patrick Durusau @ 3:11 pm

What Happens if We #Sunset215? by Harley Geiger.

From the post:

A law the government cites as authority for the bulk collection of millions of Americans’ communications records—Section 215 of the PATRIOT Act—expires unless Congress extends it by Memorial Day weekend.

The Center for Democracy & Technology, and other public interest groups, believes that Sec. 215 should sunset unless it is reformed to stop nationwide surveillance dragnets. What would happen to domestic bulk collection if Sec. 215 sunsets?

After a detailed review of the history and nuances of Sec. 215, Harley says:


Sunset of Sec. 215 would prevent new bulk collection programs under Sec. 215, but would not affect current bulk collection programs under Sec. 215, nor prevent bulk collection programs under the FISA pen/trap statute. From the perspective of the intelligence community, a sunset of Sec. 215 would deprive the government of an evidence-gathering tool with many targeted, legitimate uses other than bulk collection.

I’m sorry, that went by a little fast.

Even if Sec. 215 sunsets, what evidence is there that the government would stop conducting new bulk collection programs or more targeted uses other than bulk collection?

The evidence we do have suggests that sunsetting Sec. 215 will have no impact on NSA data collection efforts. For example, James Clapper lying to Congress. Fire James Clapper. What does that say to lower staffer who appear before Congress or who are interviewed by investigators? Particularly with regard to the consequences of lying to Congress or to investigators?

If Congress and other investigators can’t get truthful answers from the NSA, who is to say that Sec. 215 sunsetting has had any impact at all? A drop in FISA requests? Perhaps the NSA just decides to drop the fiction that the FISA court is any meaningful limit on their power.

The post footer says:

Harley Geiger is Advocacy Director and Senior Counsel at the Center for Democracy & Technology (CDT).

And I am sure that he is far more qualified than I am to address the policy issues of Sec. 215, if one assumes the government is telling the truth and playing by the rules Congress has passed. But the evidence we have to date suggests that the government isn’t telling the truth and pays lip service to any rule that Congress passes.

What needs to sunset is all bulk data collection and all targeted collection that is not subject to the traditional safeguards of U.S. district courts. My suggestion is embedded congressional oversight in all agencies that conduct surveillance with clearance to see or go anywhere, including any compartmentalized projects.

If the argument is that the honest public need not fear bulk surveillance, then honest agencies need fear no embedded congressional oversight.

January 31, 2015

Your Weekly Snowden Dribble

Filed under: Cybersecurity,Government,NSA,Security — Patrick Durusau @ 7:56 pm

Levitation program tracked file-sharing sites by David Meyer.

From the post:

The Canadian spy agency CSE monitors activity across over 100 free file upload sites, a newly-revealed PowerPoint document from NSA whistleblower Edward Snowden’s cache has shown.

The document describing CSE’s Levitation program was published on Wednesday by The Intercept, reporting alongside Canadian broadcaster CBC. Although Canada has long been known to be a member of the core Anglophone “Five Eyes” spying club, this is the first Snowden revelation putting it at the forefront of one of the Eyes’ mass surveillance programs.

I was truly surprised that the Canadians were monitoring file sharing sites. Shouldn’t that be contracted out to the mad dogs at the RIAA and MPAA, etc.? Cheaper and doubtful you could find anyone more persistent.

On the downside they would want the phone logs of every teenager suspected of copying a song off the radio. To find clusters of copyright thieves. Maybe it is better to have the Canadians do it.

“…we have not identified a single instance…” Ineffectual Phone Surveillance

Filed under: Government,NSA,Security — Patrick Durusau @ 2:23 pm

Tim Cushing has a great piece, Privacy Board Says NSA Doesn’t Know How Effective Its Collection Programs Are, Doesn’t Much Care Either at TechDirt on the latest report of the Privacy and Civil Liberties Oversight Board (PCLOB) on government surveillance in the United States.\

As a result of his post, I went searching for the Board’s earlier report on vacuuming up phone records. In part that earlier report reads:

The threat of terrorism faced today by the United States is real. The Section 215 telephone records program was intended as one tool to combat this threat—a tool that would help investigators piece together the networks of terrorist groups and the patterns of their communications with a speed and comprehensiveness not otherwise available. However, we conclude that the Section 215 program has shown minimal value in safeguarding the nation from terrorism. Based on the information provided to the Board, including classified briefings and documentation, we have not identified a single instance involving a threat to the United States in which the program made a concrete difference in the outcome of a counterterrorism investigation. Moreover, we are aware of no instance in which the program directly contributed to the discovery of a previously unknown terrorist plot or the disruption of a terrorist attack. And we believe that in only one instance over the past seven years has the program arguably contributed to the identification of an unknown terrorism suspect. Even in that case, the suspect was not involved in planning a terrorist attack and there is reason to believe that the FBI may have discovered him without the contribution of the NSA’s program.

The Board’s review suggests that where the telephone records collected by the NSA under its Section 215 program have provided value, they have done so primarily in two ways: by offering additional leads regarding the contacts of terrorism suspects already
known to investigators, and by demonstrating that foreign terrorist plots do not have a U.S. nexus. The former can help investigators confirm suspicions about the target of an inquiry or about persons in contact with that target. The latter can help the intelligence community focus its limited investigatory resources by avoiding false leads and channeling efforts where they are needed most. But with respect to the former, our review suggests that the Section 215 program offers little unique value but largely duplicates the FBI’s own information gathering efforts. And with respect to the latter, while the value of proper resource allocation in time-sensitive situations is not to be discounted, we question whether the American public should accept the government’s routine collection of all of its telephone records because it helps in cases where there is no threat to the United States. (emphasis added)

What amazes me is that Tim’s review of the current report reflects that the vacuuming of phone records continues and there has been no effort to develop metrics to test the effectiveness of surveillance programs.

Recommendation 10: Develop a Methodology to Assess the Value of Counterterrorism Programs

Status: Not implemented

I wonder why the “…we have not identified a single instance…” line doesn’t come up in every presidential news conference, every interview with candidates for the House or the Senate, interviews with presidential hopefuls? It should come up repeatedly until the program is terminated by the executive branch or Congress defunds the NSA.

The president and others may be testy because they want to spin some other tale for public consumption but here we have a bi-partisan board that has seen the classified evidence and has reported to the public that the mass collection of phone records is ineffective. (full stop) The effectiveness of mass phone surveillance is no long up for debate. The facts are in.

The question is what will the public do with those facts? Not vote for anyone who refuses to defund the NSA or terminate the phone surveillance program?

That’s a start but just to emphasize the point, call the Whitehouse and your representative and both senators daily to request the ending of the bulk phone records surveillance program. That will also illustrate how the NSA program captures constituents communicating with their elected representatives.

January 17, 2015

Obama backs call for tech backdoors [Government Frontdoors?]

Filed under: Cybersecurity,NSA,Security — Patrick Durusau @ 8:37 pm

Obama backs call for tech backdoors

From the post:

President Obama wants a backdoor to track people’s social media messages.

The president on Friday came to the defense of British Prime Minister David Cameron’s call for tech companies to create holes in their technology to allow the government to track suspected terrorists or criminals.

“Social media and the Internet is the primary way in which these terrorist organizations are communicating,” Obama said during a press conference with Cameron on Friday.

“That’s not different from anybody else, but they’re good at it and when we have the ability to track that in a way that is legal, conforms with due process, rule of law and presents oversight, then that’s a capability that we have to preserve,” he said.

While Obama measured his comments, he voiced support for the views expressed by Cameron and FBI Director James Comey, who have worried about tech companies’ increasing trends towards building digital walls around users’ data that no one but them can access.

Rather than argue about tech backdoors someday, why not have government frontdoors?

ISPs can copy and direct all email traffic to and from .gov addresses to a big inbox on one of the cloud providers. So that the public can keep a closer eye on the activities of “our” government. Think of it as citizen oversight.

Surely no sensitive information about citizens finds its way into government email so we won’t need any filtering.

Petition your elected representatives for a government frontdoor. For federal, state and local governments. As taxpayers we own the accounts. Just like a private employer. The owners of those accounts wants access to them.

Now that would be open data that could make a real difference!

I first saw this in a tweet by Violet Blue.

PS: We also need phone records for office and cell phones of all government employees. Signals data I think they call it.

Bulk Collection of Signals Intelligence: Technical Options (2015)

Filed under: Intelligence,NSA — Patrick Durusau @ 8:07 pm

Bulk Collection of Signals Intelligence: Technical Options (2015)

Description:

The Bulk Collection of Signals Intelligence: Technical Options study is a result of an activity called for in Presidential Policy Directive 28, issued by President Obama in January 2014, to evaluate U.S. signals intelligence practices. The directive instructed the Office of the Director of National Intelligence (ODNI) to produce a report within one year “assessing the feasibility of creating software that would allow the intelligence community more easily to conduct targeted information acquisition rather than bulk collection.” ODNI asked the National Research Council (NRC) — the operating arm of the National Academy of Sciences and National Academy of Engineering — to conduct a study, which began in June 2014, to assist in preparing a response to the President. Over the ensuing months, a committee of experts appointed by the Research Council produced the report.

Believe it or not, you can’t copy-n-paste from the pre-publication PDF file. Truly irritating.

From the report:

Conclusion 1. There is no software technique that will fully substitute for bulk collection where it is relied on to answer queries about the past after new targets become known.

A key value of bulk collection is its record of past signals intelligence that may be relevant to subsequent investigations. If past events become interesting in the present, because intelligence-gathering priorities change to include detection of new kinds of threats or because of new events such as the discovery that an individual is a terrorist, historical events and the context they provide will be available for analysis only if they were previously collected. (Emphasis in the original)

The report dodges any questions about effectiveness or appropriateness of bulk collection of signals data. However, its number one conclusion provides all the ammunition one needs to establish that bulk signals intelligence gathering is a clear and present danger to the American people and any semblance of a democratic government.

Would deciding that all Muslims from the Middle East represented potential terrorist threats to the United States qualify as a change in intelligence-gathering priorities? So all the bulk signals data from Muslims and their contacts in the United States suddenly becomes fair game for the NSA to investigate?

I don’t think any practicing Muslim is a threat to any government but you saw how quickly the French backslide into bigotry after Charlie Hebdo. Maybe they didn’t have that far to go. Not any further than large segments of the U.S. population.

Our National Research Council is too timid voice an opinion other than to say if you don’t preserve signals records you can’t consult them in the future. But whether there is any danger or is this a good policy choice, they aren’t up for those questions.

The focus on signals intelligence makes you wonder how local and state police have operated all these years without bulk signals intelligence? How have they survived without it? Well, for one thing they are out in the communities they serve, not cooped up in cube farms with other people who don’t have any experience with the communities in question. Simply being a member of the community makes them aware of new comers, changes in local activity, etc.

Traditional law enforcement doesn’t stop crime as a general rule because that would require too much surveillance and resources to be feasible. When a crime has been committed, law enforcement gathers evidence and in a very large (90%+) number of cases, captures the people responsible.

Which is a interesting parallel to the NSA, which has also not stopped any terrorist plots as far as anyone knows. Well, there as that case in the State of Georgia where two aging alcoholics were boosting about producing Ricin and driving down I-285 throwing it out the window. The government got a convicted child molester to work as in informant to put those two very dangerous terrorists in jail. And I don’t think the NSA was in on that one anyway.

If the NSA has stopped a major terrorist plot, something that actually was going to be another 9/11, you know it would have been leaked long before now. The absence of such leaks is the best evidence for the lack of any viable terrorist threats in the United States that I can think of.

And what if we stop bulk signals data collection and there is another terrorist attack? So, what is your question? Bulk signals collection hasn’t stopped one so far so if we stop bulk signals collection and there is another terrorist attack, look at all the money we will have saved for the same result. Just as a policy matter, we shouldn’t spend money for no measurable result.

If you really think terrorism is a threat, take the money from bulk signal data collection and fund state and local police hiring, training and paying (long term, not just a grant) more local police officers out in their communities. That will do more to reduce the potential for all types of crimes, including those labeled as terrorism.

To put it another way, bulk signal data collection is a form of wealth sharing, wealth sharing from the public treasury to contractor’s. Wealth sharing that has been shown to be ineffectual against terrorism. Why continue it?

December 30, 2014

NSA IOB Dump Finally Complete!

Filed under: NSA,Security — Patrick Durusau @ 5:34 pm

The “Christmas Eve” NSA file dump that you will see reported at: NSA Waited Until Christmas Eve To Release Details Of Its Illegal Surveillance On Americans, What you need to know about the NSA document dump, and, U.S. Spy Agency Reports Improper Surveillance of Americans, repeated by various other sources, which never mentioned the dump being incomplete, is now complete.

I reported in Merry Christmas From the NSA! Missing Files about 15 missing files, which by my report of: NSA IOB Report Dump – Still Missing Files had become 3 missing files and when I checked today, the NSA file dump is complete, all being silent corrections to the file dump.

You will notice that the final three files: 3Q FY10, 3Q FY09, 4Q FY09 are named differently from the other files:

nsa-iob-30Dec2014

as text:

IOB/FY2010_1Q_IOB_Report.pdf
IOB/FY2010_2Q_IOB_Report.pdf
IOB/3Q_FY2010.pdf
IOB/FY2010_4Q_IOB_Report.pdf

IOB/FY2009_1Q_IOB_Report.pdf
IOB/FY2009_2Q_IOB_Report.pdf
IOB/3Q_FY2009.pdf
IOB/4Q_FY2009.pdf

Data analysis resources should be focused on the 3rd quarter report for 2010 and 3rd quarter and 4th quarter reports for 2009, especially as compared to other materials (Snowden?) for those time frames.

My heuristic being that people don’t delay without a reason. It isn’t necessary to know the reason, just to observe the delay. Could be entirely due to incompetence but if you count:

  1. Christmas Eve as happenstance
  2. Second incomplete dump as coincidence
  3. File renaming issue is three, enemy action.

I have local copies of the files as they exist as of 17:13 on 30 December 2014 and I will be tarring those up for upload to my site later this evening. Please replicate them elsewhere as you see fit.

Suggestions on tooling, collaborations, analysis, etc. welcome!

December 28, 2014

Prying Eyes: Inside the NSA’s War on Internet Security

Filed under: Cybersecurity,NSA,Privacy,Security — Patrick Durusau @ 5:03 pm

Prying Eyes: Inside the NSA’s War on Internet Security

Summary:

US and British intelligence agencies undertake every effort imaginable to crack all types of encrypted Internet communication. The cloud, it seems, is full of holes. The good news: New Snowden documents show that some forms of encryption still cause problems for the NSA.

A very long and comprehensive article from the SPIEGEL on encryption that may cause issues for the NSA. It is too complete to easily summarize so I suggest you read it in full and then take the following actions:

  • If you are not a cryptographer or child of a cryptographer, donate to one of more of the open source encryption projects you will find in the SPIEGEL article. Monthly if at all possible. Perhaps you can’t write encryption code but you can support those who do.
  • Use and consistently update your encryption technology and support those who work to make encryption easier to use. We need to create a tsunami of highly encrypted data everyday. From phone calls and IMs to emails and documents.
  • Politically resist all laws or regulations that make interception and/or decryption of communications legal and/or easier. You may not think you are committing a crime, but when government officials declare crimes and execute the guilty in private, how do you know?
  • Should you encounter any documents or data that expose government surveillance programs, there are existing examples of what you should do.

Once upon a time, privacy was a matter of the difficulty of tracking down physical copies of public records and asking neighbors what you liked to talk about. Those difficulties no longer exist and the electronic debris of our lives tells more than you might know.

The only privacy you have today is the privacy that you stake out and protect on your own. There are no guarantees that you will be successful in protecting your privacy but I can guarantee you won’t have any privacy if you don’t try.

December 27, 2014

NSA IOB Report Dump – Still Missing Files

Filed under: News,NSA — Patrick Durusau @ 3:10 pm

In Merry Christmas From the NSA! Missing Files, I reported a blog entry on the Christmas Eve posting of Intelligence Oversight Board reports covering a span of years. On closer inspection, I found a number of second quarter reports were missing.

The very next day, 26 December 2014, another blog post reported on the NSA posting and following the link there, most of the missing files had been supplied by the NSA, with nary a peep about the previously missing files.

Today is 27 December 2014 and the following files continue to be missing:

3Q FY10, 3Q FY09, 4Q FY09

I realize that I am being unreasonable. The NSA posting was only missing 15 files out of 48. The current NSA posting continues to miss 3 files out of 48. The stories got NSA correct, some files were released, and the URL was right. What more could you ask for?

I will have to let you answer that last question for yourselves. I will say something untowards if I continue this post.


I have created a compressed tar ball with all the NSA IOB reports that are currently on the NSA website. Avoiding being on the NSA web logs doesn’t count for much because I am sure they are tracking all web traffic anyway. But, as a sign of annoyance with the NSA, please obtain the incomplete file set here (92 MB approximately).

December 25, 2014

Merry Christmas From the NSA! Missing Files

Filed under: Government,NSA — Patrick Durusau @ 4:25 pm

U.S. Spy Agency Reports Improper Surveillance of Americans by David Lerman.

From the post:

The National Security Agency today released reports on intelligence collection that may have violated the law or U.S. policy over more than a decade, including unauthorized surveillance of Americans’ overseas communications.

The NSA, responding to a Freedom of Information Act lawsuit from the American Civil Liberties Union, released a series of required quarterly and annual reports to the President’s Intelligence Oversight Board that cover the period from the fourth quarter of 2001 to the second quarter of 2013.

The heavily-redacted reports include examples of data on Americans being e-mailed to unauthorized recipients, stored in unsecured computers and retained after it was supposed to be destroyed, according to the documents. They were posted on the NSA’s website at around 1:30 p.m. on Christmas Eve.

I was downloading the NSA reports so I could package them up on my website and GitHub, so you would not have to leave traffic on the NSA web logs when I discovered that the second quarter reports for every year are missing.

Oh, they show up in the index but the PDF files for the first and second quarters of each year have the same name.

  • /public_info/_files/IOB/FY2013_1Q_IOB_Report.pdf 1Q FY13
  • /public_info/_files/IOB/FY2013_1Q_IOB_Report.pdf 2Q FY13
  • /public_info/_files/IOB/FY2012_1Q_IOB_Report.pdf 1Q FY12
  • /public_info/_files/IOB/FY2012_1Q_IOB_Report.pdf 2Q FY12
  • /public_info/_files/IOB/FY2011_1Q_IOB_Report.pdf 1Q FY11
  • /public_info/_files/IOB/FY2011_1Q_IOB_Report.pdf 2Q FY11
  • /public_info/_files/IOB/FY2010_1Q_IOB_Report.pdf 1Q FY10
  • /public_info/_files/IOB/FY2010_1Q_IOB_Report.pdf 2Q FY10
  • /public_info/_files/IOB/FY2009_1Q_IOB_Report.pdf 1Q FY09
  • /public_info/_files/IOB/FY2009_1Q_IOB_Report.pdf 2Q FY09
  • /public_info/_files/IOB/FY2008_1Q_IOB_Report.pdf 1Q FY08
  • /public_info/_files/IOB/FY2008_1Q_IOB_Report.pdf 2Q FY08
  • /public_info/_files/IOB/FY2007_1Q_IOB_Report.pdf 1Q FY07
  • /public_info/_files/IOB/FY2007_1Q_IOB_Report.pdf 2Q FY07
  • /public_info/_files/IOB/FY2006_1Q_IOB_Report.pdf 1Q FY06
  • /public_info/_files/IOB/FY2006_1Q_IOB_Report.pdf 2Q FY06
  • /public_info/_files/IOB/FY2005_1Q_IOB_Report.pdf 1Q FY05
  • /public_info/_files/IOB/FY2005_1Q_IOB_Report.pdf 2Q FY05
  • /public_info/_files/IOB/FY2004_1Q_IOB_Report.pdf 1Q FY04
  • /public_info/_files/IOB/FY2004_1Q_IOB_Report.pdf 2Q FY04
  • /public_info/_files/IOB/FY2003_1Q_IOB_Report.pdf 1Q FY03
  • /public_info/_files/IOB/FY2003_1Q_IOB_Report.pdf 2Q FY03
  • /public_info/_files/IOB/FY2002_1Q_IOB_Report.pdf 1Q FY02
  • /public_info/_files/IOB/FY2002_1Q_IOB_Report.pdf 2Q FY02

I have personally verified that the files listed above, for each year are in fact duplicates of each other. This was no simple naming mistake.

This will, of course, make automatic downloading scripts overwrite files while maintaining the correct number of files were downloaded.

BTW, the files for 3rd quarter of 2010, 3rd and 4th quarters of 2009, and the 2nd, 3rd and 4th quarters of 2001 are missing as well.

Courts should take judicial notice of the routine pettiness of the NSA when fashioning remedies for failures to disclose. That will leave the NSA no one but themselves to blame for increasingly burdensome disclosures.

I first saw the NSA story in a tweet by Veli-Pekka Kivimäki.


Update: The missing files have been uploaded by the NSA. The last edited date for the files remains unchanged from 23 December 2014.

The next time I notice an error like this, I will capture an image file, digitally sign it and post it to a third party site.

Tomorrow I will grab a copy of the latest version of the files and tar them up so you won’t have to be recorded on the NSA web logs.

December 11, 2014

Wall Street Journal Retraction? (Michael V. Hayden)

Filed under: Government,NSA,Politics — Patrick Durusau @ 1:45 pm

You may have missed NSA Reform That Only ISIS Could Love that appeared in the Wall Street Journal as an opinion piece on November 17, 2014. Less than a month before the release of the executive summary of the Senate Report on CIA Torture.

As a long time reliable source of information to the financial community, the Wall Street Journal should disavow that opinion piece as purposefully mis-leading the very readers it claims to serve.

Why? Consider the excellent summary in Hayden’s testimony vs. the Senate report by the Washington Post that compares Hayden’s recorded testimony to the Senate Select Committee on Intelligence on April 12, 2007, to the written executive summary of the Senate Report on Torture.

There you will find a consistent patterns of lies and deception that make any statements by Michael V. Hayden unworthy of belief. Moreover, since his pattern of lying has not changed over the years, it injects known falsehood into a vital national debate.

To amend for the perpetuation of this liar’s spew, the Wall Street Journal should disavow NSA Reform That Only ISIS Could Love, denounce Michael V. Hayden as a public liar and call for the release of the full and unedited version of the Senate Report on CIA Torture.

While I may not always agree with the Wall Street Journal editorial line, it has always been faithful to the business community that it serves. The WSJ has done a disservice to that community with the Michael V. Hayden opinion piece and should now make amends.


While the Wall Street Journal considers its perpetuation of lies by Michael V. Hayden, other organizations should reconsider their relationships with Michael V. Hayden.

George Mason University, School of Policy, Government and International Affairs, for example, where Michael V. Hayden is a Distinguished Visiting Professor. Unless they are offering a graduate degree in lying to the American public.

Motorolo Solutions has Michael V. Hayden on its board of directors. I wonder how the shareholders of Motorola Solutions, which is 312th on the Fortune 500 list for 2014 feel about having a torture concealer and advocate on their board of directors?

Which reminds me, what is the statute of limitations on lying to Congress? All I could find readily was: Statutes of Limitation in Federal Criminal Cases: An Overview by Charles Doyle (2012). The general rule appears to be a five year statute of limitation and since lying to Congress doesn’t appear to have a separate limit, it may be five years. That’s not legal advice! Check with a lawyer before you make statements to Congress and better yet, why not tell the truth?

December 9, 2014

What does the NSA think of academic cryptographers? Recently-declassified document provides clues

Filed under: Cryptography,NSA — Patrick Durusau @ 7:55 pm

What does the NSA think of academic cryptographers? Recently-declassified document provides clues by Scott Aaronson.

From the post:

Brighten Godfrey was one of my officemates when we were grad students at Berkeley. He’s now a highly-successful computer networking professor at the University of Illinois Urbana-Champaign, where he studies the wonderful question of how we could get the latency of the Internet down to the physical limit imposed by the finiteness of the speed of light. (Right now, we’re away from that limit by a factor of about 50.)

Last week, Brighten brought to my attention a remarkable document: a 1994 issue of CryptoLog, an NSA internal newsletter, which was recently declassified with a few redactions. The most interesting thing in the newsletter is a trip report (pages 12-19 in the newsletter, 15-22 in the PDF file) by an unnamed NSA cryptographer, who attended the 1992 EuroCrypt conference, and who details his opinions on just about every talk. If you’re interested in crypto, you really need to read this thing all the way through, but here’s a small sampling of the zingers:

Are there any leaked copies of more recent issues of CryptoLog?

I ask because of the recent outcry about secure encryption of cell phones by default. The government should not be able to argue both ways, one that non-government cryptography work is valueless and at the same time, deprive the average citizen of some modicum of privacy. Which is it?

I know the FBI wants us to return to physical phone lines and junction boxes so they can use their existing supply of wire tapping gear but that’s just not going to happen. Promise.

« Newer PostsOlder Posts »

Powered by WordPress