Barton Gellman reports: President Obama said Friday, in his first major speech on electronic surveillance, that “the United States is not spying on ordinary people who don’t threaten our national security.”
Obama placed restrictions on access to domestic phone records collected by the National Security Agency, but the changes he announced will allow it to continue — or expand — the collection of personal data from billions of people around the world, Americans and foreign citizens alike.
Obama squares that circle with an unusually narrow definition of “spying.” It does not include the ingestion of tens of trillions of records about the telephone calls, e-mails, locations and relationships of people for whom there is no suspicion of relevance to any threat.
In his speech, and an accompanying policy directive, Obama described principles for “restricting the use of this information” — but not for gathering less of it.
Alongside the invocation of privacy and restraint, Obama gave his plainest endorsement yet of “bulk collection,” a term he used more than once and authorized explicitly in Presidential Policy Directive 28. In a footnote, the directive defined the term to mean high-volume collection “without the use of discriminants.” [Continue reading…]
Category Archives: surveillance
Obama’s (still) unanswered question on phone spying
National Journal reports: Ending bulk data collection, which the NSA claims is authorized under Section 215 of the Patriot Act, has been the top priority for civil liberties groups.
Obama announced on Friday that he will end the program “as it currently exists.”
Starting immediately, NSA analysts will need approval from the Foreign Intelligence Surveillance Court every time they want to access the phone database. Obama also said he plans to eventually move the database out of the government’s hands. The president directed Attorney General Eric Holder and top intelligence officials to come up with a plan by March 28 for turning over control of the database.
But no matter who stores the data, the NSA will want to ensure that its analysts can still access it when they want to map the connections of a potential terrorist group. That could mean the administration will ask Congress to enact a mandate requiring phone companies to store their customers’ data on behalf of the NSA.
Privacy advocates warn that a data retention mandate would turn phone companies into agents of the NSA.
“To the contrary, companies should be working on ways to store less user data for less time—decreasing the risks from data breaches and intrusions like the one that just happened to Target,” wrote Cindy Cohn and Rainey Reitman of the Electronic Frontier Foundation. “Data retention heads in the wrong direction for our security regardless of whether the government or private parties store the information.”
Kevin Bankston, a policy director for the New American Foundation, said that if the alternative to government storage is mandatory data retention or a requirement for phone companies to turn the data over to some other third party, “the President should be prepared for a major legislative battle with key members of Congress, the technology industry and the privacy community arrayed against him.” [Continue reading…]
NSA collects millions of text messages daily in ‘untargeted’ global sweep
The Guardian reports: The National Security Agency has collected almost 200 million text messages a day from across the globe, using them to extract data including location, contact networks and credit card details, according to top-secret documents.
The untargeted collection and storage of SMS messages – including their contacts – is revealed in a joint investigation between the Guardian and the UK’s Channel 4 News based on material provided by NSA whistleblower Edward Snowden.
The documents also reveal the UK spy agency GCHQ has made use of the NSA database to search the metadata of “untargeted and unwarranted” communications belonging to people in the UK.
The NSA program, codenamed Dishfire, collects “pretty much everything it can”, according to GCHQ documents, rather than merely storing the communications of existing surveillance targets.
The NSA has made extensive use of its vast text message database to extract information on people’s travel plans, contact books, financial transactions and more – including of individuals under no suspicion of illegal activity. [Continue reading…]
NSA devises radio pathway into computers
The New York Times reports: The National Security Agency has implanted software in nearly 100,000 computers around the world that allows the United States to conduct surveillance on those machines and can also create a digital highway for launching cyberattacks.
While most of the software is inserted by gaining access to computer networks, the N.S.A. has increasingly made use of a secret technology that enables it to enter and alter data in computers even if they are not connected to the Internet, according to N.S.A. documents, computer experts and American officials.
The technology, which the agency has used since at least 2008, relies on a covert channel of radio waves that can be transmitted from tiny circuit boards and USB cards inserted surreptitiously into the computers. In some cases, they are sent to a briefcase-size relay station that intelligence agencies can set up miles away from the target.
The radio frequency technology has helped solve one of the biggest problems facing American intelligence agencies for years: getting into computers that adversaries, and some American partners, have tried to make impervious to spying or cyberattack. In most cases, the radio frequency hardware must be physically inserted by a spy, a manufacturer or an unwitting user.
The N.S.A. calls its efforts more an act of “active defense” against foreign cyberattacks than a tool to go on the offensive. But when Chinese attackers place similar software on the computer systems of American companies or government agencies, American officials have protested, often at the presidential level. [Continue reading…]
Phone firms balk at proposal that would force them to store surveillance data
The Associated Press reports: Telephone companies are quietly balking at the idea of changing how they collect and store Americans’ phone records to help the National Security Agency’s surveillance programs. They’re worried about their exposure to lawsuits and the price tag if the U.S. government asks them to hold information about customers for longer than they already do.
President Barack Obama is expected to announce Friday what changes he is willing to make to satisfy privacy, legal and civil liberties concerns over the NSA’s surveillance practices. One of the most important questions is whether the government will continue to collect millions of Americans’ phone records every day so that the government can identify anyone it believes might be communicating with known terrorists.
The president’s hand-picked review committee has recommended ending the phone records program as it exists. It suggested shifting the storage of the phone records from the NSA to phone companies or an unspecified third party, and it recommended new legal requirements before the government could search anyone’s phone records.
The phone companies don’t want the job. Executives and their lawyers have complained about the plan in confidential meetings with administration officials and key congressional intelligence and other committees, according to interviews by The Associated Press. Two phone executives familiar with the discussions said the cellular industry told the government that it prefers the NSA keep control over the surveillance program and would only accept changes if they were legally required. The executives spoke on condition of anonymity because they were not authorized to disclose the private discussions. But there have been public complaints, too. [Continue reading…]
Remembering Aaron Swartz
At the Electronic Frontier Foundation, Parker Higgins writes: One year ago, we lost Aaron Swartz, a dear friend and a leader in the fight for a free and open Internet. The shock was, and remains, a profound one. It’s a testament to the power of his commitments and ideals that both in life and in death he has inspired millions around the world, including all of us at EFF, to redouble our own efforts to advance the causes that he believed in, and to untangle the twisted and brutal computer crime laws that were used to persecute him.
Aaron was a passionate activist, but he also stood out as a technologist whose ambitions were always aligned towards a better, more just future. His pioneering work demonstrated a passion for harnessing technology to advance the public interest. As the Internet community confronted massive new challenges to free speech and privacy in 2013, there were many moments when we wondered quietly about what Aaron would have said and done.
Sadly, we are left to wonder. We know from his work on the software that would become SecureDrop that Aaron believed in making the world a safer place for whistleblowers to expose injustice and wrongdoing. We are all worse off without the passion and curiosity he surely would have brought to Edward Snowden’s continuing disclosures about NSA spying. We are reminded of Aaron as we push forward in our court cases against the NSA, help organizing against the spying with the stopwatching.us coalition, evaluate the Congressional proposals and, of course, as we continue to build and support technologies that let people take their privacy into their own hands. Aaron understood deeply that, more than ever in a world where information is power, both legal and technical protections for privacy are essential to keep people from being rendered powerless. [Continue reading…]
NSA phone record collection does little to prevent terrorist attacks, group says
The Washington Post reports: An analysis of 225 terrorism cases inside the United States since the Sept. 11, 2001, attacks has concluded that the bulk collection of phone records by the National Security Agency “has had no discernible impact on preventing acts of terrorism.”
In the majority of cases, traditional law enforcement and investigative methods provided the tip or evidence to initiate the case, according to the study by the New America Foundation, a Washington-based nonprofit group.
The study, to be released Monday, corroborates the findings of a White House-appointed review group, which said last month that the NSA counterterrorism program “was not essential to preventing attacks” and that much of the evidence it did turn up “could readily have been obtained in a timely manner using conventional [court] orders.” [Continue reading…]
What it’s like when the FBI asks you to backdoor your software
SecurityWatch: At a recent RSA Security Conference, Nico Sell was on stage announcing that her company — Wickr — was making drastic changes to ensure its users’ security. She said that the company would switch from RSA encryption to elliptic curve encryption, and that the service wouldn’t have a backdoor for anyone.
As she left the stage, before she’d even had a chance to take her microphone off, a man approached her and introduced himself as an agent with the Federal Bureau of Investigation. He then proceeded to “casually” ask if she’d be willing to install a backdoor into Wickr that would allow the FBI to retrieve information.
This encounter, and the agent’s casual demeanor, is apparently business as usual as intelligence and law enforcement agencies seek to gain greater access into protected communication systems. Since her encounter with the agent at RSA, Sell says it’s a story she’s heard again and again. “It sounds like that’s how they do it now,” she told SecurityWatch. “Always casual, testing, because most people would say yes.” [Continue reading…]
NSA and GCHQ activities appear illegal, says EU parliamentary inquiry
The Guardian reports: Mass surveillance programmes used by the US and Britain to spy on people in Europe have been condemned in the “strongest possible terms” by the first parliamentary inquiry into the disclosures, which has demanded an end to the vast, systematic and indiscriminate collection of personal data by intelligence agencies.
The inquiry by the European parliament’s civil liberties committee says the activities of America’s National Security Agency (NSA) and its British counterpart, GCHQ, appear to be illegal and that their operations have “profoundly shaken” the trust between countries that considered themselves allies.
The 51-page draft report, obtained by the Guardian, was discussed by the committee on Thursday. Claude Moraes, the rapporteur asked to assess the impact of revelations made by the whistleblower Edward Snowden, also condemns the “chilling” way journalists working on the stories have been intimidated by state authorities.
Though Snowden is still in Russia, MEPs are expected to take evidence from him via video-link in the coming weeks, as the European parliament continues to assess the damage from the disclosures. Committee MEPs voted overwhelmingly on Thursday to have Snowden testify, defying warnings from key US congressmen that giving the “felon” a public platform would wreck the European parliament’s reputation and hamper co-operation with Washington. [Continue reading…]
How the NSA almost killed the Internet
Wired reports: On June 6, 2013, Washington Post reporters called the communications departments of Apple, Facebook, Google, Yahoo, and other Internet companies. The day before, a report in the British newspaper The Guardian had shocked Americans with evidence that the telecommunications giant Verizon had voluntarily handed a database of every call made on its network to the National Security Agency. The piece was by reporter Glenn Greenwald, and the information came from Edward Snowden, a 29-year-old IT consultant who had left the US with hundreds of thousands of documents detailing the NSA’s secret procedures.
Greenwald was the first but not the only journalist that Snowden reached out to. The Post’s Barton Gellman had also connected with him. Now, collaborating with documentary filmmaker and Snowden confidante Laura Poitras, he was going to extend the story to Silicon Valley. Gellman wanted to be the first to expose a top-secret NSA program called Prism. Snowden’s files indicated that some of the biggest companies on the web had granted the NSA and FBI direct access to their servers, giving the agencies the ability to grab a person’s audio, video, photos, emails, and documents. The government urged Gellman not to identify the firms involved, but Gellman thought it was important. “Naming those companies is what would make it real to Americans,” he says. Now a team of Post reporters was reaching out to those companies for comment.
It would be the start of a chain reaction that threatened the foundations of the industry. The subject would dominate headlines for months and become the prime topic of conversation in tech circles. For years, the tech companies’ key policy issue had been negotiating the delicate balance between maintaining customers’ privacy and providing them benefits based on their personal data. It was new and controversial territory, sometimes eclipsing the substance of current law, but over time the companies had achieved a rough equilibrium that allowed them to push forward. The instant those phone calls from reporters came in, that balance was destabilized, as the tech world found itself ensnared in a fight far bigger than the ones involving oversharing on Facebook or ads on Gmail. Over the coming months, they would find themselves at war with their own government, in a fight for the very future of the Internet. [Continue reading…]
Big Brother’s little siblings: How local police departments are spying on us now, too
Michael Price writes: By now, it’s well known that the National Security Agency is collecting troves of data about law-abiding Americans. But the NSA is not alone: A series of new reports show that state and local police have been busy collecting data on our daily activities as well — under questionable or nonexistent legal pretenses. These revelations about the extent of police snooping in the U.S. — and the lack of oversight over it — paint a disturbing picture for anyone who cares about civil liberties and privacy protection.
The tactics used by law enforcement are aggressive, surreptitious and surprising to even longtime surveillance experts. One report released last month made front page news: an investigation by more than 50 journalists that found that local law enforcement agencies are collecting cellphone data about thousands of innocent Americans each year by tapping into cellphone towers and even creating fake ones that act as data traps.
A new report by the Brennan Center for Justice at NYU School of Law details how police departments around the country have created data “fusion centers” to collect and share reports about residents. But the information in these reports seldom bears any relation to crime or terrorism. In California, for example, officers are encouraged to document and immediately report on “suspicious” activities such as “individuals who stay at bus or train stops for extended periods while buses and trains come and go,” “individuals who carry on long conversations on pay or cellular phones,” and “joggers who stand and stretch for an inordinate amount of time.” In Houston, the criteria are so broad they include anything deemed “suspicious or worthy of reporting.” Many police departments and fusion centers have reported on constitutionally protected activities such as photography and political speech. They have also demonstrated a troubling tendency to focus on people who appear to be of Middle Eastern origin. [Continue reading…]
Leading British cryptographer says MI5 should be abolished
Tamlin Magee writes: Privacy campaigner and Cambridge University’s Head of Cryptography Professor Ross J Anderson has suggested one way to begin stamping out the British state’s unaccountable involvement in the NSA spying scandal: end the domestic secret services entirely.
“Were I a legislator,” Anderson says, “I would simply abolish MI5.”
Speaking with Forbes, Anderson notes the only way this kind of systemic data collection has been made possible was through the business models of private industry. The value of information-driven web companies such as Facebook and Google is built around their ability to gather vast tracts of data. It was something the intelligence agencies would have struggled with alone.
“It would never have been realistic for governments to collect so much data because they just don’t have the technical nous or managerial skill to set up and operate the systems concerned,” Anderson says. “Only private industry could do that. But, of course, now that the systems exist, spooks want access to them.” [Continue reading…]
New York Times calls on Obama to grant Snowden clemency
An Editorial in the New York Times says: Seven months ago, the world began to learn the vast scope of the National Security Agency’s reach into the lives of hundreds of millions of people in the United States and around the globe, as it collects information about their phone calls, their email messages, their friends and contacts, how they spend their days and where they spend their nights. The public learned in great detail how the agency has exceeded its mandate and abused its authority, prompting outrage at kitchen tables and at the desks of Congress, which may finally begin to limit these practices.
The revelations have already prompted two federal judges to accuse the N.S.A. of violating the Constitution (although a third, unfortunately, found the dragnet surveillance to be legal). A panel appointed by President Obama issued a powerful indictment of the agency’s invasions of privacy and called for a major overhaul of its operations.
All of this is entirely because of information provided to journalists by Edward Snowden, the former N.S.A. contractor who stole a trove of highly classified documents after he became disillusioned with the agency’s voraciousness. Mr. Snowden is now living in Russia, on the run from American charges of espionage and theft, and he faces the prospect of spending the rest of his life looking over his shoulder.
Considering the enormous value of the information he has revealed, and the abuses he has exposed, Mr. Snowden deserves better than a life of permanent exile, fear and flight. He may have committed a crime to do so, but he has done his country a great service. It is time for the United States to offer Mr. Snowden a plea bargain or some form of clemency that would allow him to return home, face at least substantially reduced punishment in light of his role as a whistle-blower, and have the hope of a life advocating for greater privacy and far stronger oversight of the runaway intelligence community.
•
Mr. Snowden is currently charged in a criminal complaint with two violations of the Espionage Act involving unauthorized communication of classified information, and a charge of theft of government property. Those three charges carry prison sentences of 10 years each, and when the case is presented to a grand jury for indictment, the government is virtually certain to add more charges, probably adding up to a life sentence that Mr. Snowden is understandably trying to avoid.
The president said in August that Mr. Snowden should come home to face those charges in court and suggested that if Mr. Snowden had wanted to avoid criminal charges he could have simply told his superiors about the abuses, acting, in other words, as a whistle-blower.
“If the concern was that somehow this was the only way to get this information out to the public, I signed an executive order well before Mr. Snowden leaked this information that provided whistle-blower protection to the intelligence community for the first time,” Mr. Obama said at a news conference. “So there were other avenues available for somebody whose conscience was stirred and thought that they needed to question government actions.”
In fact, that executive order did not apply to contractors, only to intelligence employees, rendering its protections useless to Mr. Snowden. More important, Mr. Snowden told The Washington Post earlier this month that he did report his misgivings to two superiors at the agency, showing them the volume of data collected by the N.S.A., and that they took no action. (The N.S.A. says there is no evidence of this.) That’s almost certainly because the agency and its leaders don’t consider these collection programs to be an abuse and would never have acted on Mr. Snowden’s concerns.
In retrospect, Mr. Snowden was clearly justified in believing that the only way to blow the whistle on this kind of intelligence-gathering was to expose it to the public and let the resulting furor do the work his superiors would not. Beyond the mass collection of phone and Internet data, consider just a few of the violations he revealed or the legal actions he provoked:
■ The N.S.A. broke federal privacy laws, or exceeded its authority, thousands of times per year, according to the agency’s own internal auditor.
■ The agency broke into the communications links of major data centers around the world, allowing it to spy on hundreds of millions of user accounts and infuriating the Internet companies that own the centers. Many of those companies are now scrambling to install systems that the N.S.A. cannot yet penetrate.
■ The N.S.A. systematically undermined the basic encryption systems of the Internet, making it impossible to know if sensitive banking or medical data is truly private, damaging businesses that depended on this trust.
■ His leaks revealed that James Clapper Jr., the director of national intelligence, lied to Congress when testifying in March that the N.S.A. was not collecting data on millions of Americans. (There has been no discussion of punishment for that lie.)
■ The Foreign Intelligence Surveillance Court rebuked the N.S.A. for repeatedly providing misleading information about its surveillance practices, according to a ruling made public because of the Snowden documents. One of the practices violated the Constitution, according to the chief judge of the court.
■ A federal district judge ruled earlier this month that the phone-records-collection program probably violates the Fourth Amendment of the Constitution. He called the program “almost Orwellian” and said there was no evidence that it stopped any imminent act of terror.
The shrill brigade of his critics say Mr. Snowden has done profound damage to intelligence operations of the United States, but none has presented the slightest proof that his disclosures really hurt the nation’s security. Many of the mass-collection programs Mr. Snowden exposed would work just as well if they were reduced in scope and brought under strict outside oversight, as the presidential panel recommended.
When someone reveals that government officials have routinely and deliberately broken the law, that person should not face life in prison at the hands of the same government. That’s why Rick Ledgett, who leads the N.S.A.’s task force on the Snowden leaks, recently told CBS News that he would consider amnesty if Mr. Snowden would stop any additional leaks. And it’s why President Obama should tell his aides to begin finding a way to end Mr. Snowden’s vilification and give him an incentive to return home.
Video: Glenn Greenwald keynote at Chaos Communications Congress (30C3), Hamburg
Inside the NSA’s catalog of surveillance magic
Sean Gallagher writes: The National Security Agency’s sophisticated hacking operations go way beyond using software vulnerabilities to gain access to targeted systems. The agency has a catalog of tools available that would make James Bond’s Q jealous, providing NSA analysts access to just about every potential source of data about a target.
In some cases, the NSA has modified the firmware of computers and network hardware—including systems shipped by Cisco, Dell, Hewlett-Packard, Huawei, and Juniper Networks—to give its operators both eyes and ears inside the offices the agency has targeted. In others, the NSA has crafted custom BIOS exploits that can survive even the reinstallation of operating systems. And in still others, the NSA has built and deployed its own USB cables at target locations—complete with spy hardware and radio transceiver packed inside.
Documents provided by former NSA contractor Edward Snowden to Der Spiegel reveal a fantastical collection of surveillance tools dating back to 2007 and 2008 that gave the NSA the power to collect all sorts of data over long periods of time without detection. The tools, ranging from back doors installed in computer network firmware and software to passively powered bugs installed within equipment, give the NSA a persistent ability to monitor some targets with little risk of detection. While the systems targeted by some of the “products” listed in the documents are over five years old and are likely to have been replaced in some cases, the methods and technologies used by all the exploit products could easily still be in use in some form in ongoing NSA surveillance operations. [Continue reading…]
Jacob Applebaum, co-author of the Der Spiegel report, spoke yesterday at the 30th annual Chaos Communication Congress where he presented new details including the NSA’s ability to hack a Wi-Fi network from up to eight miles away.
No doubt about effectiveness of mass metadata collection, claims federal judge — ignoring evidence to the contrary
Adam Serwer writes: When Judge William H. Pauley ruled that the National Security Agency’s metadata program was lawful on Friday, he argued that there was no significant dispute about “the effectiveness of bulk telephony metadata collection.”
Pauley — who issued his ruling from a courthouse less than two miles from where the twin towers once stood — then offered a series of examples cited by the NSA to bolster their claims that the program is effective, all of which have been “seriously disputed.”
Only four plots among the fifty-four the NSA claims to have helped foil have been made public. Pauley cited three of those four plots in arguing that the metadata program was effective, but journalists and legislators have picked already picked those examples apart. ProPublica published a piece in October by Justin Elliott and Theodoric Meyer noting that in each of the three cases Pauley mentions, there were serious doubts as to whether or not the NSA was exaggerating either the plot itself or the impact of the program.
Pauley cites the case of Najibullah Zazi, who was convicted of a plot to bomb the New York subway in 2009. An Associated Press examination concluded that the NSA had the authority to monitor the email account that lead to Zazi’s capture even without the authority to gather communications records in bulk.
Pauley also cited an effort by a man named Khalid Ouazzani to attack the New York Stock Exchange. But Ouazzani was convicted of funding al Qaeda, and as ProPublica notes neither he nor anyone else was ever actually charged or convicted of a plot to bomb the NYSE.
Pauley also cites the case of David Headley, who was involved in the 2008 terrorist attack in Mumbai and was involved in a plot to attack on a Danish newspaper which had published cartoons depicting the Islamic prophet Mohammed. But according to ProPublica, it was British intelligence, not the NSA’s datagathering, that first brought Headly to U.S. authorities’ attention.
All of this information would have been available to Pauley, because the ProPublica piece disputing the NSA’s claims was cited as a footnote in the prior ruling by Judge Richard Leon that found the NSA’s data gathering program unconstitutional. Pauley refers to Leon’s ruling multiple times in his own, indicating that he read it. [Continue reading…]
UN’s Navi Pillay compares uproar over mass surveillance to fight against apartheid
The Guardian reports: The UN human rights chief, Navi Pillay, has compared the uproar in the international community caused by revelations of mass surveillance with the collective response that helped bring down the apartheid regime in South Africa.
Pillay, the first non-white woman to serve as a high-court judge in South Africa, made the comments in an interview with Sir Tim Berners-Lee on a special edition of BBC Radio 4’s Today programme, which the inventor of the world wide web was guest editing.
Pillay has been asked by the UN to prepare a report on protection of the right to privacy, in the wake of the former National Security Agency analyst Edward Snowden leaking classified documents about UK and US spying and the collection of personal data.
The former international criminal court judge said her encounters with serious human rights abuses, which included serving on the Rwanda tribunal, did not make her take online privacy less seriously. “I don’t grade human rights,” she said. “I feel I have to look after and promote the rights of all persons. I’m not put off by the lifetime experience of violations I have seen.”
She said apartheid ended in South Africa principally because the international community co-operated to denounce it, adding: “Combined and collective action by everybody can end serious violations of human rights … That experience inspires me to go on and address the issue of internet [privacy], which right now is extremely troubling because the revelations of surveillance have implications for human rights … People are really afraid that all their personal details are being used in violation of traditional national protections.” [Continue reading…]
Outsourcing mass surveillance
The Washington Post reports: A measure that President Obama is considering as a way to curb the National Security Agency’s mass storage of phone data is already facing resistance — not only from the intelligence community but also from privacy advocates, the phone industry and some lawmakers.
Obama last week suggested that he was open to the idea of requiring phone companies to store the records and allowing the government to search them under strict guidelines. Currently, the agency stores those records itself, part of a sprawling collection program that came to light through documents shared by former NSA contractor Edward Snowden.
But now, industry officials, privacy advocates and congressional officials are expressing resistance to any alternatives that involve mandating phone companies to hold the data for longer periods. And other possible scenarios, including having a private third party store the records, also raise concerns, they say.
Civil libertarians consider mandated phone-company or third-party storage an unacceptable “proxy” for the NSA’s holding of the database. Last Thursday, a group of privacy advocates met with White House officials and urged them not to seek legislation to mandate data retention, among other things. [Continue reading…]