J. G. Sandom ~ Author

404 — After Michael Flynn’s Resignation, Surveillance Defenders Suddenly Care About Wiretap Abuse

The hypocrisy of the Drumpf Administration is breathtaking. Now that it's one of their own, they're all hot and heavy about government surveillance. In point of fact, Michael Flynn didn't do anything that any other front man for an incoming President has done, including that bastion of reactionary radicalism Jimmy Carter! Please. The Democratic outrage is as disingenuous as Republican horror. "I am shocked, shocked that there is gambling going on here." All I can say is, "Your winnings, sir." These issues are exactly the ones I cover in my novel, 4o4 - A John Decker Thriller, about the surveillance state, recently listed as a Top Ten Amazon Bestseller in Technothrillers. For more on this story, visit The Intercept. 

Rep. Devin Nunes, chairman of the House Permanent Select Committee on Intelligence speaks to reporters after attending the GOP weekly meeting at the U.S. Capitol on Feb. 14, 2017, in Washington.

After Michael Flynn’s Resignation, Surveillance Defenders Suddenly Care About Wiretap Abuse

by Alex Emmons

REP. DEVIN NUNES, the chairman of the House Intelligence Committee and a leading defender of government surveillance programs, reacted with outrage when he found out the FBI had listened in on conversations between the Russian ambassador and a top Trump official.

“I expect for the FBI to tell me what is going on, and they better have a good answer,” the California Republican told the Washington Post. “The big problem I see here is that you have an American citizen who had his phone calls recorded.”

Telephone conversations between Michael Flynn, Trump’s former national security adviser, and Russian Ambassador Sergey Kislyak led to Flynn’s resignation.

The fact that communications from the Russian delegation in Washington are closely monitored should surprise no one. The FBI routinely uses the NSA’s eavesdropping techniques to monitor the delegation — for obvious intelligence and counterintelligence reasons â€” and as a former top intelligence official in the Obama administration, Flynn must have known that his conversation would be intercepted.

Yet after the news of Flynn’s resignation, several traditional surveillance defenders rushed to the defense of his privacy rights as an “American citizen.”

The surveillance-touting Wall Street Journal in an editorial Monday dropped its usual use of the term “intelligence professionals” to question whether “U.S. spooks” had a court order to listen to Flynn’s conversations.

What’s particularly ironic about Nunes’s comments was that he seemed to be ignoring one of the biggest gaps in U.S. surveillance law — one which he has personally defended — that allows the government to spy on millions of Americans without any sort of probable cause by targeting their communications with people overseas.

“The concept that many Americans’ communications are incidentally recorded when speaking to foreign targets is Foreign Intelligence 101,” said Jake Laperruque, senior counsel at the Constitution Project. “It’s hard to believe a competent intelligence committee chair doesn’t understand this.”

The Wall Street Journal has also celebrated the law that contains the loophole and after its reauthorization in 2013 praised Obama as an “unapologetic asserter of Presidential powers.”

In 2015, Reps. Zoe Loefgren, D-Calif., and Thomas Massie, R-Ky., introduced an amendment that would have required the FBI to get a search warrant in the exact situation Flynn is facing: when they rely on capabilities of the NSA to target international communications that involve Americans.

But rather than expressing concern then, Nunes sent a letter to his colleagues opposing the measure. “When the Intelligence Community acquires the communications of CT [counterterrorism] or CI [counterintelligence] targets abroad, among the most critical issues is to determine if they are communicating with persons in the United States,” he wrote.

In an email to The Intercept, a spokesman for Nunes tried to walk back the congressman’s earlier statement, saying his concerns were about whether Flynn’s identity could have legally been “unmasked” due to minimization procedures built into the Foreign Intelligence Surveillance Act.

The minimization procedures call for the redaction of names of “U.S. persons” when they are caught up in international surveillance. But they allow the identity of U.S. persons to be unmasked whenever it is necessary to understand the communication — which is almost certainly the case with Flynn’s call.

“This seems to be an excuse that either doesn’t comprehend or want to acknowledge how broadly the FBI can fully access any Americans’ incidentally recorded communications under FISA,” Laperruque said.

This is hardly the first time that foreign intelligence wiretaps have gotten U.S. persons in trouble. The FBI has relied on NSA-collected information in a number of criminal cases — and has even repeatedly failed to provide legal notice to defendants that the evidence used in their case was acquired that way.

It’s also not the first time that NSA hawks have — if briefly — leapt to the defense of privacy rights when the privacy being violated involved them or their political allies.

Last year, for example, Sen. Marco Rubio — who has argued for expanding and permanently extending many of the NSA’s surveillance programs — responded with shock and outrage upon learning in 2015 that the NSA was spying on the Israeli government and swept up some of his own communications in the process.

The problem for these newfound surveillance critics is that if they want to demand protections for Americans caught up in the NSA’s web, they have to do so for all Americans — not just their political allies.

404 — Feds charge NSA contractor with felony theft of government property and the unauthorized removal of classified materials

What's happened to Harold T. Martin III? He was arrested and then just disappeared. Is he now at some black site in Egypt or something?  This kind of leak is exactly what I cover in my novel, 4o4 - A John Decker Thriller, about the surveillance state, recently listed as a Top Ten Amazon Bestseller in Technothrillers. For more on this story, visit The Washington Post. 

An aerial view of the National Security Agency headquarters in Fort Meade, Md., in January 2010. (Larry Downing/Reuters)

Prosecutors to seek indictment against former NSA contractor as early as this week

By Ellen Nakashima February 6

Federal prosecutors in Baltimore are expected to seek an indictment as early as this week against a former National Security Agency contractor who is accused of carrying out the biggest theft of classified information in U.S. history.

The indictment against Harold T. Martin III is expected to contain charges of violating the Espionage Act by “willfully” retaining information that relates to the national defense, including classified data such as NSA hacking tools and operational plans against “a known enemy” of the United States, according to individuals familiar with the case.

Martin, 52, was arrested Aug. 29 at his home in Glen Burnie, Md., and he has been held in a detention facility since. A U.S. District Judge last fall declined Martin’s request to be released from jail pending an eventual trial or resolution of the case, ruling that he was a flight risk.

In a complaint unsealed in October, the government charged Martin with felony theft of government property and the unauthorized removal and retention of classified materials, a misdemeanor. The prosecutors said then that they expected that the indictment would also include charges of violations of the Espionage Act, offenses that carry a prison term of up to 10 years for each count.

Such charges, prosecutors said, if run consecutively, could amount to a sentence as high as 30 years to life in prison.

The Justice Department declined to comment Monday.

In court hearings and filings, prosecutors have characterized Martin’s actions as highly damaging to national security. Over the course of 20 years working with various federal agencies, Martin took “irreplaceable classified material on a breathtaking scale,” said Zachary A. Myers, an assistant U.S. attorney with the District of Maryland, at a detention hearing in October.

Myers said Martin took “many thousands of pages” of classified material as well as 50 terabytes of digital data, much of which has “special handling caveats.”

Martin previously worked in the Navy, leaving active duty in 1992 and then held a variety of tech jobs with government contractors. He worked at the NSA from 2012 to 2015, where he was an employee of the intelligence contractor Booz Allen Hamilton.

For some portion of that time, Martin was in the NSA’s elite hacker unit, Tailored Access Operations, which makes and deploys software used to penetrate foreign targets’ computer networks for foreign espionage purposes.

Some U.S. officials said that Martin allegedly made off with more than 75 percent of TAO’s library of hacking tools — an allegation which, if true, would be a stunning breach of security.

James Wyda, one of Martin’s defense attorneys, declined to comment.

His attorneys have previously portrayed him as a patriot who took material home to become better in his job, not to pass them to a foreign spy agency and betray his country. The desire to improve became a compulsion, Wyda argued at the detention hearing.

“This is the behavior of a compulsive hoarder who could not stop gathering and possessing the documents he treasured,” Wyda said.

Martin’s theft was discovered more than a year after another breach at TAO, in which a longtime employee was discovered to have taken without authorization significant quantities of the unit’s hacking tools. The breach was not thought to be as serious as Martin’s, but it caused concern within the intelligence community

404 — N.S.A. Gets More Latitude to Share Intercepted Communications

As if Obama's legacy isn't bad enough, now â€” just in time for our new President â€” he gives this present to the intelligence services, further eroding our privacy rights under the 4th Amendment. This is exactly the kind of issue I struggle with in my novel, 4o4 - A John Decker Thriller, about the surveillance state, recently listed as a Top Ten Amazon Bestseller in Technothrillers. For more on this story, visit The New York Times. 

James R. Clapper, center, the director of national intelligence, with Adm. Michael S. Rogers, right, director of the National Security Agency, during a Senate hearing last week.

N.S.A. Gets More Latitude to Share Intercepted Communications 

By CHARLIE SAVAGE

WASHINGTON — In its final days, the Obama administration has expanded the power of the National Security Agency to share globally intercepted personal communications with the government’s 16 other intelligence agencies before applying privacy protections.

The new rules significantly relax longstanding limits on what the N.S.A. may do with the information gathered by its most powerful surveillance operations, which are largely unregulated by American wiretapping laws. These include collecting satellite transmissions, phone calls and emails that cross network switches abroad, and messages between people abroad that cross domestic network switches.

The change means that far more officials will be searching through raw data. Essentially, the government is reducing the risk that the N.S.A. will fail to recognize that a piece of information would be valuable to another agency, but increasing the risk that officials will see private information about innocent people.

Attorney General Loretta E. Lynch signed the new rules, permitting the N.S.A. to disseminate “raw signals intelligence information,” on Jan. 3, after the director of national intelligence, James R. Clapper Jr., signed them on Dec. 15, according to a 23-page, largely declassified copy of the procedures.

Previously, the N.S.A. filtered information before sharing intercepted communications with another agency, like the C.I.A. or the intelligence branches of the F.B.I. and the Drug Enforcement Administration. The N.S.A.’s analysts passed on only information they deemed pertinent, screening out the identities of innocent people and irrelevant personal information.

Now, other intelligence agencies will be able to search directly through raw repositories of communications intercepted by the N.S.A. and then apply such rules for “minimizing” privacy intrusions.

“This is not expanding the substantive ability of law enforcement to get access to signals intelligence,” said Robert S. Litt, the general counsel to Mr. Clapper. “It is simply widening the aperture for a larger number of analysts, who will be bound by the existing rules.”

But Patrick Toomey, a lawyer for the American Civil Liberties Union, called the move an erosion of rules intended to protect the privacy of Americans when their messages are caught by the N.S.A.’s powerful global collection methods. He noted that domestic internet data was often routed or stored abroad, where it may get vacuumed up without court oversight.

“Rather than dramatically expanding government access to so much personal data, we need much stronger rules to protect the privacy of Americans,” Mr. Toomey said. “Seventeen different government agencies shouldn’t be rooting through Americans’ emails with family members, friends and colleagues, all without ever obtaining a warrant.”

The N.S.A. has been required to apply similar privacy protections to foreigners’ information since early 2014, an unprecedented step that President Obama took after the disclosures of N.S.A. documents by the former intelligence contractor Edward J. Snowden. The other intelligence agencies will now have to follow those rules, too.

Under the new system, agencies will ask the N.S.A. for access to specific surveillance feeds, making the case that they contain information relevant and useful to their missions. The N.S.A. will grant requests it deems reasonable after considering factors like whether large amounts of Americans’ private information might be included and, if so, how damaging or embarrassing it would be if that information were “improperly used or disclosed.”

The move is part of a broader trend of tearing down bureaucratic barriers to sharing intelligence between agencies that dates back to the aftermath of the terrorist attacks of Sept. 11, 2001. In 2002, the Foreign Intelligence Surveillance Court secretly began permitting the N.S.A., the F.B.I. and the C.I.A. to share raw intercepts gathered domestically under the Foreign Intelligence Surveillance Act.

After Congress enacted the FISA Amendments Act — which legalized warrantless surveillance on domestic soil so long as the target is a foreigner abroad, even when the target is communicating with an American — the court permitted raw sharing of emails acquired under that program, too.

In July 2008, the same month Congress passed the FISA Amendments Act, President George W. Bush modified Executive Order 12333, which sets rules for surveillance that domestic wiretapping statutes do not address, including techniques that vacuum up vast amounts of content without targeting anybody.

After the revision, Executive Order 12333 said the N.S.A. could share the raw fruits of such surveillance after the director of national intelligence and the attorney general, coordinating with the defense secretary, agreed on procedures. It took another eight years to develop those rules.

The Times first reported the existence of those deliberations in 2014 and later filed a Freedom of Information Act lawsuit for documents about them. It ended that case last February, and Mr. Litt discussed the efforts in an interview at that time, but declined to divulge certain important details because the rules were not yet final or public.

Among the most important questions left unanswered in February was when analysts would be permitted to use Americans’ names, email addresses or other identifying information to search a 12333 database and pull up any messages to, from or about them that had been collected without a warrant.

There is a parallel debate about the FISA Amendments Act’s warrantless surveillance program. National security analysts sometimes search that act’s repository for Americans’ information, as do F.B.I. agents working on ordinary criminal cases. Critics call this the “backdoor search loophole,” and some lawmakers want to require a warrant for such searches.

By contrast, the 12333 sharing procedures allow analysts, including those at the F.B.I., to search the raw data using an American’s identifying information only for the purpose of foreign intelligence or counterintelligence investigations, not for ordinary criminal cases. And they may do so only if one of several other conditions are met, such as a finding that the American is an agent of a foreign power.

However, under the rules, if analysts stumble across evidence that an American has committed any crime, they will send it to the Justice Department.

The limits on using Americans’ information gathered under Order 12333 do not apply to metadata: logs showing who contacted whom, but not what they said. Analysts at the intelligence agencies may study social links between people, in search of hidden associates of known suspects, “without regard to the location or nationality of the communicants.”

404 — The Obama Legacy and Mass Surveillance

This is a greast piece by one of the few thought leaders today who truly represents the Black prophetic tradition, carrying on the legacy of Frederick Douglass, Harriet Tubman and MLK. I would, however add, three other great failings to this list: 1) Obama's signing of the NDAA, featuring Sections 1021 & 1022, which enables the state to lock up anyone in a military prison indefinitely without trial or due process in violations of our Bill of Rights; 2) not only Obama's treatment of whistleblowers like Kiriakou, but also his State Department's treatment of journalists like James Rosen and James Risen, which undermines our entire free press in violation of the 1st Amendment; and 3) Obama's continuation, and expansion of GW Bush's warrantless mass surveillance, in violation of the 4th Amendment. All of these measures are stains on his record that will forever blight his legacy. For more on the Surveillance State, check out my latest novel, 4o4 - A John Decker Thriller, recently listed as a Top Ten Amazon Bestseller in Technothrillers. To access this story in The Guardian, click here.

Pity the sad legacy of Barack Obama
Cornel West

Eight years ago the world was on the brink of a grand celebration: the inauguration of a brilliant and charismatic black president of the United States of America. Today we are on the edge of an abyss: the installation of a mendacious and cathartic white president who will replace him.

This is a depressing decline in the highest office of the most powerful empire in the history of the world. It could easily produce a pervasive cynicism and poisonous nihilism. Is there really any hope for truth and justice in this decadent time? Does America even have the capacity to be honest about itself and come to terms with its self-destructive addiction to money-worship and cowardly xenophobia?

Ralph Waldo Emerson and Herman Melville – the two great public intellectuals of 19th-century America – wrestled with similar questions and reached the same conclusion as Heraclitus: character is destiny (“sow a character and you reap a destiny”).

The age of Barack Obama may have been our last chance to break from our neoliberal soulcraft. We are rooted in market-driven brands that shun integrity and profit-driven policies that trump public goods. Our “post-integrity” and “post-truth” world is suffocated by entertaining brands and money-making activities that have little or nothing to do with truth, integrity or the long-term survival of the planet. We are witnessing the postmodern version of the full-scale gangsterization of the world.

The reign of Obama did not produce the nightmare of Donald Trump – but it did contribute to it. And those Obama cheerleaders who refused to make him accountable bear some responsibility.

A few of us begged and pleaded with Obama to break with the Wall Street priorities and bail out Main Street. But he followed the advice of his “smart” neoliberal advisers to bail out Wall Street. In March 2009, Obama met with Wall Street leaders. He proclaimed: I stand between you and the pitchforks. I am on your side and I will protect you, he promised them. And not one Wall Street criminal executive went to jail.

We called for the accountability of US torturers of innocent Muslims and the transparency of US drone strikes killing innocent civilians. Obama’s administration told us no civilians had been killed. And then we were told a few had been killed. And then told maybe 65 or so had been killed. Yet when an American civilian, Warren Weinstein, was killed in 2015 there was an immediate press conference with deep apologies and financial compensation. And today we still don’t know how many have had their lives taken away.

We hit the streets again with Black Lives Matter and other groups and went to jail for protesting against police killing black youth. We protested when the Israeli Defense Forces killed more than 2,000 Palestinians (including 550 children) in 50 days. Yet Obama replied with words about the difficult plight of police officers, department investigations (with no police going to jail) and the additional $225m in financial support of the Israeli army. Obama said not a mumbling word about the dead Palestinian children but he did call Baltimore black youth “criminals and thugs”.

In addition, Obama’s education policy unleashed more market forces that closed hundreds of public schools for charter ones. The top 1% got nearly two-thirds of the income growth in eight years even as child poverty, especially black child poverty, remained astronomical. Labor insurgencies in Wisconsin, Seattle and Chicago (vigorously opposed by Mayor Rahm Emanuel, a close confidant of Obama) were passed over in silence.

In 2009, Obama called New York City mayor Michael Bloomberg an “outstanding mayor”. Yet he overlooked the fact that more than 4 million people were stopped-and-frisked under Bloomberg’s watch. Along with Carl Dix and others, I sat in a jail two years later for protesting these very same policies that Obama ignored when praising Bloomberg.

Yet the mainstream media and academia failed to highlight these painful truths linked to Obama. Instead, most well-paid pundits on TV and radio celebrated the Obama brand. And most black spokespeople shamelessly defended Obama’s silences and crimes in the name of racial symbolism and their own careerism. How hypocritical to see them now speak truth to white power when most went mute in the face of black power. Their moral authority is weak and their newfound militancy is shallow.

The gross killing of US citizens with no due process after direct orders from Obama was cast aside by neoliberal supporters of all colors. And Edward Snowden, Chelsea Manning, Jeffrey Sterling and other truth-tellers were demonized just as the crimes they exposed were hardly mentioned.

The president’s greatest legislative achievement was to provide healthcare for over 25 million citizens, even as another 20 million are still uncovered. But it remained a market-based policy, created by the conservative Heritage Foundation and first pioneered by Mitt Romney in Massachusetts.

Obama’s lack of courage to confront Wall Street criminals and his lapse of character in ordering drone strikes unintentionally led to rightwing populist revolts at home and ugly Islamic fascist rebellions in the Middle East. And as deporter-in-chief – nearly 2.5 million immigrants were deported under his watch – Obama policies prefigure Trump’s barbaric plans.

Bernie Sanders gallantly tried to generate a leftwing populism but he was crushed by Clinton and Obama in the unfair Democratic party primaries. So now we find ourselves entering a neofascist era: a neoliberal economy on steroids, a reactionary repressive attitude toward domestic “aliens”, a militaristic cabinet eager for war and in denial of global warming. All the while, we are seeing a wholesale eclipse of truth and integrity in the name of the Trump brand, facilitated by the profit-hungry corporate media.

What a sad legacy for our hope and change candidate – even as we warriors go down swinging in the fading names of truth and justice.

404 — Euro's highest court rules "general and indiscriminate retention" of emails is illegal!

“General and indiscriminate retention” of emails and electronic communications by governments is illegal, the EU’s highest court has ruled, in a judgment that could trigger challenges against the UK’s new Investigatory Powers Act. Now if we could only get our own Supreme Court to see things the same way. But with two corporatist establishment Parties running the show, this is far from likely. Perhaps after 2020! For more on this issue, check out 4o4 - A John Decker Thriller, about the surveillance state, recently listed as a Top Ten Amazon Bestseller in Technothrillers. Click here for the full story from The Guardian.

The European court of justice.

EU's highest court delivers blow to UK snooper's charter

Indiscriminate collection of emails is illegal, court rules in response to challenge originally brought by David Davis

by Owen Bowcott, Legal affairs correspondent

“General and indiscriminate retention” of emails and electronic communications by governments is illegal, the EU’s highest court has ruled, in a judgment that could trigger challenges against the UK’s new Investigatory Powers Act – the so-called snooper’s charter.

Only targeted interception of traffic and location data in order to combat serious crime – including terrorism – is justified, according to a long-awaited decision by the European court of justice (ECJ) in Luxembourg.

The finding came in response to a legal challenge initially brought by the Brexit secretary, David Davis, when he was a backbench MP, and Tom Watson, Labour’s deputy leader, over the legality of GCHQ’s bulk interception of call records and online messages.

Davis and Watson, who were supported by Liberty, the Law Society, the Open Rights Group and Privacy International, had already won a high court victory on the issue, but the government appealed and the case was referred by appeal judges to the ECJ. The case will now return to the court of appeal to be resolved in terms of UK legislation.

The aim of going to Luxembourg was to clarify EU law on surveillance. The two MPs had argued successfully in the domestic courts that the Data Retention and Investigatory Powers Act (Dripa) 2014 was illegal. Dripa has since been replaced by the Investigatory Powers Act, which comes into force at the end of this month.

At issue was whether there are EU standards on data retention that need to be respected by member states in domestic legislation. The result, though immediately significant, could prove academic once the UK has withdrawn from the EU and the ECJ no longer has jurisdiction over the UK.

In a summary of the ruling, the court said electronic communications allow “very precise conclusions to be drawn concerning the private lives of persons whose data has been retained”.

It added: “The interference by national legislation that provides for the retention of traffic data and location data with that right must therefore be considered to be particularly serious.

“The fact that the data is retained without the users of electronic communications services being informed of the fact is likely to cause the persons concerned to feel that their private lives are the subject of constant surveillance. Consequently, only the objective of fighting serious crime is capable of justifying such interference.

“Legislation prescribing a general and indiscriminate retention of data … exceeds the limits of what is strictly necessary and cannot be considered to be justified within a democratic society.” Prior authorisation by a court or independent body to access retained data is required for each official request, the ECJ said.
Before becoming Brexit minister, Davis travelled to Luxembourg to hear the case. He argued that the British government was “treating the entire nation as suspects” by ignoring safeguards on retaining and accessing personal communications data.

Davis, one of the most vociferous critics of the state’s powers to collect data on its citizens, withdrew from the case following his ministerial appointment.

The Dripa case was heard by 15 ECJ judges. It coincided with successive atrocities in Paris, Brussels and Nice that reinforced political demands for expansion of powers to intercept emails and phone calls to help catch Islamic State militants operating on the continent.

Lawyers for the UK government maintained that intercepted communications have been at the heart of every terrorist case investigated by police and the security services in recent years.

Responding to the ruling, Watson said: “At a time when we face a real and ever-present terrorist threat, the security forces may require access to personal information none of us would normally hand over. That’s why it’s absolutely vital that proper safeguards are put in place to ensure this power is not abused, as it has been in the recent past.

“Most of us can accept that our privacy may occasionally be compromised in the interests of keeping us safe, but no one would consent to giving the police or the government the power to arbitrarily seize our phone records or emails to use as they see fit. It’s for judges, not ministers, to oversee these powers.”

Martha Spurrier, director of the human rights group Liberty, said: “Today’s judgment upholds the rights of ordinary British people not to have their personal lives spied on without good reason or an independent warrant. The government must now make urgent changes to the Investigatory Powers Act [IPA] to comply with this.

“This is the first serious post-referendum test for our government’s commitment to protecting human rights and the rule of law. The UK may have voted to leave the EU – but we didn’t vote to abandon our rights and freedoms.” Liberty is preparing to challenge the IPA in court.

Jim Killock, executive director of the Open Rights Group, said: “Blanket surveillance of our communications is intrusive and unacceptable in a democracy.

“The government must act quickly to rewrite the IPA or be prepared to go to court again.”

A Home Office spokesperson said: “We are disappointed with the judgment from the European court of justice and will be considering its potential implications.

“The government will be putting forward robust arguments to the court of appeal about the strength of our existing regime for communications data retention and access.”

The shadow home secretary, Diane Abbott, said: “Many of us warned that these powers were far too widely drawn. Effectively, they allow for fishing expeditions where data is collected on a vast number of individuals. They also allow for data gathering against anyone suspected of the most minor crimes, not just terrorism and organised crime, and there is insufficient judicial oversight. Targets were not informed.”

The Liberal Democrat home affairs spokesman Brian Paddick said: “Collecting and storing everyone’s internet web browsing histories and phone records so government agencies can look at them is an Orwellian nightmare that intrudes into our privacy and erodes our civil liberties.”

Daniel Carey, the solicitor from Deighton Pierce Glynn who represented the Open Rights Group and Privacy International, said: “The court is very clear that indiscriminately retaining everyone’s metadata is unlawful, which is a point my clients placed particular emphasis on. This prohibition arises out of longstanding EU legislation, which the UK played an important role in creating.”

Camilla Graham Wood, of Privacy International, said: “Today’s judgment is a major blow against mass surveillance and an important day for privacy. It makes clear that blanket and indiscriminate retention of our digital histories can be a very intrusive form of surveillance that needs strict safeguards against abuse and mission creep.”

The National Police Chiefs’ Council lead for communications data, assistant chief constable Richard Berry said: “We will work within any authorisation and oversight regime deemed appropriate by parliament and courts of law. But it is important for us to have a regime that is practical and dynamic enough to be able to respond to the volume and urgency of our cases. Any changes that impede our ability to access data quickly with appropriate safeguards will undermine our ability to keep people safe.”

A few of us begged and pleaded with Obama to break with the Wall Street priorities and bail out Main Street. But he followed the advice of his “smart” neoliberal advisers to bail out Wall Street. In March 2009, Obama met with Wall Street leaders. He proclaimed: I stand between you and the pitchforks. I am on your side and I will protect you, he promised them. And not one Wall Street criminal executive went to jail.

We called for the accountability of US torturers of innocent Muslims and the transparency of US drone strikes killing innocent civilians. Obama’s administration told us no civilians had been killed. And then we were told a few had been killed. And then told maybe 65 or so had been killed. Yet when an American civilian, Warren Weinstein, was killed in 2015 there was an immediate press conference with deep apologies and financial compensation. And today we still don’t know how many have had their lives taken away.

We hit the streets again with Black Lives Matter and other groups and went to jail for protesting against police killing black youth. We protested when the Israeli Defense Forces killed more than 2,000 Palestinians (including 550 children) in 50 days. Yet Obama replied with words about the difficult plight of police officers, department investigations (with no police going to jail) and the additional $225m in financial support of the Israeli army. Obama said not a mumbling word about the dead Palestinian children but he did call Baltimore black youth “criminals and thugs”.

In addition, Obama’s education policy unleashed more market forces that closed hundreds of public schools for charter ones. The top 1% got nearly two-thirds of the income growth in eight years even as child poverty, especially black child poverty, remained astronomical. Labor insurgencies in Wisconsin, Seattle and Chicago (vigorously opposed by Mayor Rahm Emanuel, a close confidant of Obama) were passed over in silence.

In 2009, Obama called New York City mayor Michael Bloomberg an “outstanding mayor”. Yet he overlooked the fact that more than 4 million people were stopped-and-frisked under Bloomberg’s watch. Along with Carl Dix and others, I sat in a jail two years later for protesting these very same policies that Obama ignored when praising Bloomberg.

Yet the mainstream media and academia failed to highlight these painful truths linked to Obama. Instead, most well-paid pundits on TV and radio celebrated the Obama brand. And most black spokespeople shamelessly defended Obama’s silences and crimes in the name of racial symbolism and their own careerism. How hypocritical to see them now speak truth to white power when most went mute in the face of black power. Their moral authority is weak and their newfound militancy is shallow.

The gross killing of US citizens with no due process after direct orders from Obama was cast aside by neoliberal supporters of all colors. And Edward Snowden, Chelsea Manning, Jeffrey Sterling and other truth-tellers were demonized just as the crimes they exposed were hardly mentioned.

The president’s greatest legislative achievement was to provide healthcare for over 25 million citizens, even as another 20 million are still uncovered. But it remained a market-based policy, created by the conservative Heritage Foundation and first pioneered by Mitt Romney in Massachusetts.

Obama’s lack of courage to confront Wall Street criminals and his lapse of character in ordering drone strikes unintentionally led to rightwing populist revolts at home and ugly Islamic fascist rebellions in the Middle East. And as deporter-in-chief – nearly 2.5 million immigrants were deported under his watch – Obama policies prefigure Trump’s barbaric plans.

Bernie Sanders gallantly tried to generate a leftwing populism but he was crushed by Clinton and Obama in the unfair Democratic party primaries. So now we find ourselves entering a neofascist era: a neoliberal economy on steroids, a reactionary repressive attitude toward domestic “aliens”, a militaristic cabinet eager for war and in denial of global warming. All the while, we are seeing a wholesale eclipse of truth and integrity in the name of the Trump brand, facilitated by the profit-hungry corporate media.

What a sad legacy for our hope and change candidate – even as we warriors go down swinging in the fading names of truth and justice.

 

404 — Massive botnet called Mirai uses Internet of Things to mount DDoS attack to cripple Internet worldwide

Vulnerable cameras and digital video recorders (DVRs) were hacked to create a massive botnet called Mirai, which was turned on targets to fill their web pipes with traffic and knock them offline — classic distributed denial of service (DDoS) attacks, just like the ones that occur in my latest novel, 4o4 - A John Decker Thriller, about the surveillance state, recently listed as a Top Ten Amazon Bestseller in Technothrillers. For more on this story, visit Forbes Magazine. 

A map of Mirai botnet infections, from MalwareTech. Mirai was used in unprecedented DDoS attacks in September.

Is This One Company To Blame For Cameras Exploited In Record Web Attacks?

By Thomas Fox-Brewster

The Internet of Things is a security nightmare, as proven by record 1 terabit per-second attacks last month. Vulnerable cameras and digital video recorders (DVRs) were hacked to create a massive botnet called Mirai, which was turned on targets to fill their web pipes with traffic and knock them offline – classic distributed denial of service (DDoS) attacks.

No single company was deemed responsible for all those vulnerable machines. Indeed, after the source code for their malware was released, investigative reporter Brian Krebs was able to list a host of camera manufacturers whose machines were targeted. Their mistake was one all too common in the IoT world: they used default passwords that were either previously-known or easily-guessable. Mirai would scan the internet for those machines and attempt to break in with those credentials.

 

But one researcher, Flashpoint’s Zachary Wikholm, today claimed to have found a single Chinese firm, Hangzhou XiongMai Technologies (XM), that shipped flawed code allowing the perpetrators to potentially amass nearly half a million bots for their malicious network. Whilst other manufacturers, like China’s Dahua, saw their kit compromised, Wikholm believes XM tech was compromised far more. “Flashpoint’s analysis on the attack data shows … a very large percentage of these IPs involved in the DDoS attacks were hosting XiongMai Technologies-based products,” he wrote in a blog post today.

XM creates software running on its own and partner manufacturers’ cameras and DVRs, according to Wikholm. He discovered two significant weaknesses in XM software. First, the company had added default passwords for connections over Telnet, accessible to any hacker on the planet. And, said Wikholm, those passwords were widely known and easy to find with some Google searches.

He found an equally astonishing vulnerability on the XM web app for connected cameras. Though the login over XM’s NetSurveillance portal required a username and password, Wikholm discovered it was possible to entirely bypass the process by providing the IP address of a target device and adding “DVR.htm” to the end. That made the request for credentials entirely pointless and allowed anyone with a web connection to take control of the camera. “Any DVR, NVR or camera running the web software ‘uc-httpd’, especially version 1.0.0 is potentially vulnerable. Out of those, any that have the ‘Expires: 0′ field in their server header are vulnerable to both,” Wikholm added.

Those weaknesses made it simple for hackers to build the Mirai botnet – deemed to be responsible for the attacks on gaming company Blizzard, Krebs’s website and French hosting giant OVH.  As many as 515,000 systems across 123 countries contained the XM code with the two vulnerabilities, Wikholm told FORBES. He believes most of those devices are now part of the Mirai botnet, though he cannot offer proof. A previous estimate from a security expert who goes by the name MalwareTech put infections at 120,000. That estimate was based on real-time infections MalwareTech recorded. The botnet is much bigger than that, claimed Flashpoint’s researcher.

As indicated by a query on Internet of Things search engine Shodan, most of them are located in Vietnam, Brazil, Turkey and China. That chimes with data that showed much of the Mirai attack traffic came from those nations, though anti-DDoS vendor Akamai saidWednesday that most traffic came from China, whilst Wikholm found most of the vulnerable XM-based devices were located in Vietnam.

As XM shipped vulnerable kit, a number of the camera manufacturers targeted by Mirai had already taken steps to protect their kit, including enforcement of a strong password. According to Krebs, Samsung and Panasonic had both done just that.

Though enforcing strong passwords would help in most cases, with the XM kit, there is no option to change those credentials as the Telnet login is hardcoded in. That means only a firmware rewrite on the manufacturer side would solve the issue, said Wikholm. A true fix would require not only XM to update its software, but all of its partner manufacturers too. They’d also have to have an over-the-air update capability. Put simply, Wikholm told me, it’d be a huge task to secure these devices and take a serious chunk out of the Mirai botnet.

Neither Dahua nor XM had responded to requests for comment at the time of publication.

Tips and comments are welcome at TFox-Brewster@forbes.com or tbthomasbrewster@gmail.com for PGP mail. Get me on Twitter @iblametom and tfoxbrewster@jabber.hot-chilli.net for Jabber encrypted chat.

404 — Yahoo complies with classified directive to build custom software to search all customers' emails

Reuters’s Joseph Menn has reported that just last year, Yahoo chose to comply with a classified “directive” to build “a custom software program to search all of its customers’ incoming emails for specific information provided by U.S. intelligence officials” — the NSA in particular. If you don't have a compelling reason to have a Yahoo email account, it's time to get rid of it ASAP. Why support an organization that will so willingly sell out your privacy to the Feds? These are exactly the issues I struggle with in my novel, 4o4 - A John Decker Thriller, about the surveillance state, recently listed as a Top Ten Amazon Bestseller in Technothrillers. For more on this story, visit The Intercept. 

DELETE YOUR YAHOO ACCOUNT

Sam Biddle

THERE’S NO GOOD reason to have a Yahoo account these days. But after Tuesday’s bombshell report by Reuters, indicating the enormous, faltering web company designed a bespoke email-wiretap service for the U.S. government, we now know that a Yahoo account is a toxic surveillance liability.

Reuters’s Joseph Menn is reporting that just last year, Yahoo chose to comply with a classified “directive” to build “a custom software program to search all of its customers’ incoming emails for specific information provided by U.S. intelligence officials” — the NSA in particular.

[UPDATE at 10:08 a.m., Oct. 5, 2016: Yahoo has issued a labored non-denial denial, insisting that the Reuters story is “misleading.” See our new story.]

It’s still unknown what the “specific information” here was — or is — but Yahoo CEO Marissa Mayer’s decision not to put up any fight against the extremely broad request apparently prompted the departure of then-Chief Information Security Officer Alex Stamos, now head of security at Facebook.

Reached via Twitter DM, Stamos told The Intercept that he’s “not commenting at all on Yahoo.” When asked if Facebook had ever received a similar government directive, Stamos replied that he would “pass that to Facebook comms.”

A Facebook spokesperson told The Intercept, â€œFacebook has never received a request like the one described in these news reports from any government, and if we did we would fight it.”

It remains unclear what form the directive took, though according to Andrew Crocker, an attorney with the Electronic Frontier Foundation, the best guess is that it invoked Section 702 of the Foreign Intelligence Surveillance Act, which permits the bulk collection of communications for the purpose of targeting a foreign individual.

But this Yahoo program doesn’t appear to have had even an ostensibly non-U.S. target. Rather, literally every single person with a Yahoo email inbox was evidently placed under surveillance, regardless of citizenship.

Crocker said the Yahoo program seems “in some ways more problematic and broader” than previously revealed NSA bulk surveillance programs like PRISM or Upstream collection efforts. “It’s hard to think of an interpretation” of the Reuters report, he explained, “that doesn’t mean Yahoo isn’t being asked to scan all domestic communications without a warrant” or probable cause.

“The Fourth Amendment implications of that are pretty staggering,” Crocker said.

The Yahoo program, as described, also differs from previous federal data grabs in that the scanning occurred in real time, as messages arrived in a user’s inbox, rather than being conducted in an archive of stored communications.

The fact that every single Yahoo email account was subject to this surveillance seems at odds with figures in Yahoo’s transparency report, which claims fewer than 20,000 accounts were tapped at the behest of the U.S. government. It would also appear to run contrary to the spirit of two quotations on Yahoo’s transparency site, where Yahoo General Counsel Ron Bell claims, “We fight any requests that we deem unclear, improper, overbroad, or unlawful,” and Mayer says, “We’ve worked hard over the years to earn our users’ trust and we fight hard to preserve it.”

The Reuters report is sourced to “two former employees and a third person apprised of the events,” rather than government officials — raising the possibility that similar orders have been issued to other major service providers.

An Apple spokesperson said â€œwe have never received a request of this type,” and that “If we were to receive one, we would oppose it in court.” This spokesperson also pointed to a section from a recent public letter by CEO Tim Cook, which he said was still accurate:

Finally, I want to be absolutely clear that we have never worked with any government agency from any country to create a backdoor in any of our products or services. We have also never allowed access to our servers. And we never will.

A Google spokesperson provided the following statement: â€œWe’ve never received such a request, but if we did, our response would be simple: ‘no way.’” The spokesperson later clarified that the company has not received a “directive” or “order” to that effect, either.

“We have never engaged in the secret scanning of email traffic like what has been reported today about Yahoo,” a Microsoft spokesperson said in a statement. The spokesperson would not comment on the record as to whether the company has ever received such a request.

Asked whether Twitter had ever received such a directive aimed at its messaging system, Nu Wexler, the company’s public policy communications chief, replied that “Federal law prohibits us from answering your question, and we’re currently suing the Justice Department for the ability to disclose more information about government requests.” Twitter filed the lawsuit in 2014.

In a subsequent statement, Wexler clarified:

We’ve never received a request like this, and were we to receive it we’d challenge it in a court. Separately, while federal law prohibits companies from being able to share information about certain types of national security related requests, we are currently suing the Justice Department for the ability to disclose more information about government requests.

Yahoo issued this statement: “Yahoo is a law abiding company, and complies with the laws of the United States.”

Patrick Toomey, a staff attorney with the American Civil Liberties Union, said in a statement that “the order issued to Yahoo appears to be unprecedented and unconstitutional. The government appears to have compelled Yahoo to conduct precisely the type of general, suspicionless search that the Fourth Amendment was intended to prohibit.”

He added: “It is deeply disappointing that Yahoo declined to challenge this sweeping surveillance order, because customers are counting on technology companies to stand up to novel spying demands in court.”

Here is how to delete your Yahoo account.

Update: October 4, 2016
This article has been updated to include comments from Microsoft, Twitter, Google, Facebook,  Yahoo, and Apple.

404 — The NDAA's provisions 1021 & 1022 authorize the indefinite military detention of Americans without trial

In 2012, the U.S. Congress passed the National Defense Authorization Act (NDAA) with relatively little attention from the media―despite the freedoms it obliterated. The NDAA was enacted to empower the U.S. military to fight the war on terror. But buried in this law are two provisions (Sections 1021 and 1022) that authorize the indefinite military detention, without charge or trial, of any person labeled a “belligerent”―including an American citizen. YOU can be targeted at any time by a U.S. President without any requirements for due process. These are exactly the issues I struggle with in my novel, 4o4 - A John Decker Thriller, about the surveillance state, recently listed as a Top Ten Amazon Bestseller in Technothrillers. For more, check out this story at The Huffington Post.

Dear Americans: This Law Makes It Possible To Arrest And Jail You Indefinitely Anytime

Terrorism may not be the worst threat to freedom that we face.

Steve Mariotti Steve Mariotti is the founder of the Network for Teaching Entrepreneurship (NFTE) and an advocate for entrepreneurs worldwide.

In 2014 alone, terrorism killed nearly 30,000 men, women and children. As horrible as this is, terrorism may not be the worst threat to freedom that we face. The real threat is how quickly we Americans have given our government carte blanche to fight the War on Terror. This has already caused far greater damage to our civil liberties than the terrorists themselves could ever hope to achieve.

In 2012, the U.S. Congress passed the National Defense Authorization Act (NDAA) with relatively little attention from the media―despite the freedoms it obliterated. The NDAA was enacted to empower the U.S. military to fight the war on terror. But buried in this law are two provisions (Sections 1021 and 1022) that authorize the indefinite military detention, without charge or trial, of any person labeled a “belligerent”―including an American citizen.

These NDAA provisions (which have been re-approved by Congress and signed by President Obama every year since 2012) override habeas corpus―the essence of our justice system. Habeas corpus is the vital legal procedure that prevents the government from detaining you indefinitely without showing just cause. When you challenge your detention by filing a writ of habeas corpus, you must be promptly brought before a judge or into court, where lawful grounds must be shown for your detention or you must be released.

Under Section 1021, however, anyone who has committed a “belligerent act,” can be detained indefinitely, without charges or trial, as a “suspected terrorist.” This is a direct violation of the U.S. Constitution and our Bill or Rights. In The Federalist No. 84, Alexander Hamilton stressed the importance of the writ of habeas corpus to protect against “the favorite and most formidable instruments of tyranny.”

Only 13 senators voted against the NDAA in 2012, including Bernie Sanders (I-VT), Al Franken (D-Minn) and Rand Paul (I-KY).

According to Dan Johnson, the 23-year-old founder of People Against the NDAA (PANDA), our current presidential candidates do not seem concerned about it either. “Hillary Clinton has been entirely silent about it, while Donald Trump has come dangerously close to endorsing it, approving of military trials for American citizens at Guantanamo Bay just this month,” Johnson notes.

A protester questions the NDAA’s place in American law (source)

I asked Johnson to explain how the NDAA was passed and what implications it holds for a free America.

Steve Mariotti: How did you learn about this little-known law, the NDAA?

Dan Johnson: Five years ago, I came across a video, 61 senators betrayed you today. A curious political science major, I clicked to find Senator Lindsey Graham on the Senate floor vehemently promoting the idea that “enemy combatants” should not be entitled to due process.

Senator Graham was speaking in support of the 2012 National Defense Authorization Act (NDAA), which was signed into law by President Obama on New Year’s Eve in 2011. The NDAA authorizes the President to order the U.S. military to detain anyone in the United States without charges or a trial, until the war on terror ends. During that detention, the detainee is classified as an enemy spy, abelligerent. Even if you are an American citizen, you could be tried in military court, transferred to another country, or even executed... all without charges or a trial.

For these reasons, the NDAA is being opposed by groups that span the political spectrum―from the ACLU to Rush Limbaugh. It has been the subject of a lawsuit in Hedges v. Obama and is formally banned in several places.

Senator Lindsay Graham promoting the NDAA on the Senate floor.

SM: What is so scary about the NDAA?

DJ: The NDAA’s detention section harkens back to one of the worst civil rights violations in U.S. history: when the U.S. government detained over 120,000 Japanese-Americans, and a few thousand German- and Italian- Americans, without charge or trial. This abuse was allowed only because of Executive Order 9066, signed into law by President Roosevelt in post-Pearl Harbor 1942. The order authorized the Secretary of War and his commanders to re-designate parts of the United States as military battlefields.

Men, women and children were incarcerated in the U.S. due to their ethnic heritage during WWII (Source)

The NDAA also applies the laws of war on American soil―except under this law, everyone, whether an American citizen or not, is robbed of their rights. Under Section 1021, anyone who has committed a belligerent act, which even the government could not define when questioned in court, can be detained indefinitely, without charges or trial, as a “suspected terrorist.”

In essence, the 2012 NDAA brought the war on terror home. It is the authority used to kill American citizens abroad and justify the abuses at Guantanamo Bay. And now it applies on American soil.

SM: Who are the “covered persons” in the 2012 NDAA?

DJ: The 2012 NDAA’s detention provisions apply to anyone, anywhere. But who is most likely to have the NDAA used against them? It depends on how you define the word terrorist.

The Department of Homeland Security said that individuals or organizations “reverent of individual liberty” and “suspicious of centralized federal authority” pose a threat. The state of Georgia calls publishing “public records” terrorism. The FBI added the director of an anti-fracking film to the terror watchlist; and tells business owners to look for terrorists via “strange odors,” “ordering a specific hotel room,” and demanding “identity ‘privacy’ in dozens of their documents.

The government won’t define “terrorist” in order to keep their options flexible. So it means whatever they want it to mean, at any point. And under the 2012 NDAA, the term “terrorist” can be applied to whomever they want to apply it to, at any point.

SM: Does that really mean American citizens could be treated like POWs (prisoners of war)  by the military?

DJ: If only we were so lucky. It’s actually worse than that.

The Geneva Conventions created in 1949 were a set of treaties that established international law standards for the humanitarian treatment of people involved in war. The Geneva Conventions split people on a battlefield into two categories:combatants (soldiers) and non-combatants (civilians). Under the Geneva Conventions, POWs are captured combatants protected by international law from torture, starvation and the denial of medical care.

After 9-11, the U.S. government wanted to get around the Geneva Convention’s ban on torture of combatants so it created a new category: unlawful enemy combatant, i.e. a “terrorist.” This is a person who took up arms on a battlefield but is not entitled to POW protections. As Department of Defense General Counsel William Haynes wrote in a letter to the Council on Foreign Relations, regarding Guantanamo Bay: “All of the detainees are unlawful combatants and thus do not as a matter of law receive the protections of the Third Geneva Convention.”

In 2009, Congress passed the second Military Commissions Act, which quietly replaced unlawful enemy combatant with unprivileged enemy belligerent. Both noncombatants and civilians could then be categorized as “enemy belligerents,” and denied their Geneva Conventions rights. 

When the United States executed American citizen Anwar-al-Awlaki and his son in Yemen via drone strike on September 30, 2011, the rationale for the attack was that al-Awlaki had been labeled “an unprivileged enemy belligerent.” Under the 2012 NDAA, any American citizen can now be labeled the same.

A 2013 protest of the NDAA and detention of prisoners in Guantanamo, led by Amnesty International (source)

SM: Who is making the decision to implement this?

DJ: The 2012 NDAA grants one person in particular, the president of the United States, the authority to determine who is and is not considered a “suspected terrorist.” But he can designate that authority to anyone he would like, and we would not know because it would be considered a State Secret.

It was introduced in the Senate by Senator Carl Levin (D-MI) and a concurrent version was introduced in the House by Rep. Buck McKeon (R-CA). It was bipartisan legislation, passing 93-7 in the Senate and 283-136 in the House.

A previous champion of the fight against the NDAA was Rep. Justin Amash, but recently, no representative in either house has introduced legislation to curb the NDAA. It is the realization of one of my greatest fears: once Americans forget about this legislation, that’s when it will be used en masse.

SM: Are American civilians currently being detained under NDAA?

DJ: The scary thing is that we do not actually know. Why?

• The government does not need a warrant to detain you.
• The government does not have to produce any record of your detention.
• The military, unlike the police, does not need to take record of your arrest.

Congress tried and failed to pass a provision that would have required the Secretary of Defense to submit a list of detainees under the NDAA to Congress every year.

In Hedges v. Obama, a case brought by journalists and activists who believed the NDAA’s detention provisions could be used to detain them, the government refused to confirm or deny that these provisions were in play right now. Judge Katherine Forrest agreed that the NDAA “does not pass muster under the First Amendment itself” and issued a permanent injunction preventing the enforcement of the NDAA.

In response, the Federal government immediately applied for an emergency stay to delay the case This very fact hints that the government is probably holding American civilians under the NDAA. We just don’t know where.

SM: When will this bill expire?

DJ: When will the war on terror end? That’s when the NDAA powers expire. America entered this war with the Authorization for Use of Military Force in 2001, which authorized “necessary and appropriate force” to go after Al-Qaeda and the Taliban, and to go to war in Afghanistan. It is also the same bill quoted by the 2012 NDAA.

So when the war on terror ends, that’s when these extraordinary military powers will end. And in all probability, the answer is never.

If you would like to help stop the NDAA, visit PANDA’s Take Back Your Town page here.

 

404 — Pulitzer Prize-winning journalist Gellman thinks the House Intelligence Committee's report on Snowden is a crock

Two time Pulitzer Prize-winning investigative journalist, Barton Gellman, thinks the House Intelligence Committee's report on Ed Snowden is a crock of shit. And he is absolutely right. The surveillance state is doing everything in its power to silence whistleblowers who are trying to exercise their 1st and 4th Amendment rights. Our Constitution is being shredded daily. Our Founding Fathers are rolling over in their graves. Snowden should be pardoned by President Obama . . . but that neoliberal coward doesn't want to confront the oligarchs who control him. Before he was elected, the President was adamant about protecting whistleblowers. And yet, the Obama Administration has the worse record of ANY President when it comes to prosecuting whistleblowers. Snowden gave up his life for us so we could know how our own government is violating our Constitutional rights. What are you doing to help him get home? These are exactly the issues I struggle with in my novel, 4o4 - A John Decker Thriller, about the surveillance state, recently listed as a Top Ten Amazon Bestseller in Technothrillers. For more on this story, visit The Century Foundation, a progressive, nonpartisan think tank that seeks to foster opportunity, reduce inequality, and promote security at home and abroad. 

The House Intelligence Committee’s Terrible, Horrible, Very Bad Snowden Report

BARTON GELLMAN
Barton Gellman is a critically honored author, journalist, and blogger. His professional distinctions include two Pulitzer Prizes (individual and team), the George Polk Award, and Harvard's Goldsmith Prize for investigative reporting.

Late yesterday afternoon the House Permanent Select Committee on Intelligence released a three-page executive summary (four, if we count the splendid cover photo) of its two-year inquiry into Edward Snowden’s National Security Agency (NSA) disclosures. On first reading, I described it as an “aggressively dishonest” piece of work.

With a day or so to reflect on it, I believe it’s worse than that. The report is not only one-sided, not only incurious, not only contemptuous of fact.

It is trifling.

After twenty-five months of labor, the committee’s “comprehensive review” of an immensely complex subject weighs in at thirty-six pages. (None of which we may read, because it “must remain classified.”) I have graded college term papers that long. It is one more dispiriting commentary on the state of legislative oversight that the committee’s twenty-two members, Republican and Democratic, were unanimous in signing their names.

A reminder at the outset. I am one of four journalists (with Laura Poitras, Glenn Greenwald, and Ewen MacAskill) who received classified archives of NSA documents from Snowden. I am writing a book on the subject for Penguin Press. Feel free to consider, as you read this, that my stories in The Washington Post played a role in the disclosures that the committee is at pains to denounce.

 

The real burden of this report, released on the eve of the premiere of Oliver Stone’s Snowden film, is to offer a counter-narrative. An accompanying press release quotes committee members describing Snowden as “no hero,” “not a patriot,” and “a traitor.”

Since I’m on record claiming the report is dishonest, let’s skip straight to the fourth section. That’s the one that describes Snowden as “a serial exaggerator and fabricator,” with “a pattern of intentional lying.” Here is the evidence adduced for that finding, in its entirety.

“He claimed to have left Army basic training because of broken legs when in fact he washed out because of shin splints.”

This is verifiably false for anyone who, as the committee asserts it did, performs a “close review of Snowden’s official employment records.” Snowden’s Army paperwork, some of which I have examined, says he met the demanding standards of an 18X Special Forces recruit and mustered into the Army on June 3, 2004. The diagnosis that led to his discharge, on crutches, was bilateral tibial stress fractures.

“He claimed to have obtained a high school degree equivalent when in fact he never did.”

I do not know how the committee could get this one wrong in good faith. According to the official Maryland State Department of Education test report, which I have reviewed, Snowden sat for the high school equivalency test on May 4, 2004. He needed a score of 2250 to pass. He scored 3550. His Diploma No. 269403 was dated June 2, 2004, the same month he would have graduated had he returned to Arundel High School after losing his sophomore year to mononucleosis. In the interim, he took courses at Anne Arundel Community College.

“He claimed to have worked for the CIA as a ‘senior advisor,’ which was a gross exaggeration of his entry-level duties as a computer technician.”

Judge for yourself. Here are the three main roles Snowden played at the Central Intelligence Agency (CIA). (1) His entry level position, as a contractor, was system administrator (one among several) of the agency’s Washington metropolitan area network. (2) After that he was selected for and spent six months in training as a telecommunications information security officer, responsible for all classified technology in U.S. embassies overseas. The CIA deployed him to Geneva under diplomatic cover, complete with an alias identity and a badge describing him as a State Department attache. (3) In his third CIA job, the title on his Dell business card was “solutions consultant / cyber referent” for the intelligence community writ large—the company’s principal point of contact for cyber contracts and proposals. In that role, Snowden met regularly with the chiefs and deputy chiefs of the CIA’s technical branches to talk through their cutting edge computer needs.

“He also doctored his performance evaluations…”

Truly deceptive, this. I will tell the story in my book. Suffice to say that Snowden discovered and reported a security hole in the CIA’s human resources intranet page. With his supervisor’s permission, he made a benign demonstration of how a hostile actor could take control. He did not change the content of his performance evaluation. He changed the way it displayed on screen.

“… and obtained new positions at NSA by exaggerating his resume and stealing the answers to an employment test.”

The first clause is too vague to check. The second seems to be based on an unsubstantiated public statement from Booz Allen vice chairman Mike McConnell. I cannot purport to know for sure, but I do know this. The exam in question is routinely given to freshly enlisted Navy and Air Force recruits to determine their aptitude for entry level “computer network operations.” Snowden was a Microsoft Certified Systems Engineer with years of experience under his belt by then. I can’t explain why anyone thinks he would have to steal the answers.

“In May 2013, Snowden informed his supervisor that he would be out of the office to receive treatment for worsening epilepsy. In reality, he was on his way to Hong Kong with stolen secrets.”

True! When Snowden decided to leave the NSA with a cache of documents for public release, he gave a false cover story for his absence.

That’s it. That’s the committee’s whole case for Snowden as big fat liar. I won’t belabor the irony, but let’s note in passing that four of the six claims are egregiously false, and a fifth is hard to credit. We can only hope the classified report, which boasts 230 footnotes, has better evidence. If you know whether or not that’s the case, feel free to let me know.

The report’s executive summary also has plenty of misleading claims on other subjects—a remarkable number, really, for just three pages. Most have been the stuff of tub-thumping denunciations for years. Snowden “fled to Russia.” Well, no. He tried to fly to Ecuador, and the U.S. government trapped him in the Moscow transit lounge by revoking his passport. Or … Snowden could have relied on whistleblower protections. The Washington Post examined that proposition and found it largely incorrect. Or … Snowden stole 1.5 million classified documents. In fact, the nation’s most senior intelligence officers, no admirers of Snowden, have repeatedly said they can only surmise the number. Then-Defense Intelligence Agency (DIA) Director Michael T. Flynn, who is now advising Donald Trump, said “we assume that he took” every document he could reach. Then-NSA Director Keith Alexander said the agency could only count “what he touched, what he may have downloaded.”

Consider, next, the question of damage. I believe Snowden’s disclosures did a lot more good than harm, but I do not share the view of some of his fans that he did no damage at all. Even so, what are we to make of Subcommittee Chairman Lynn Westmoreland? In language largely echoed by the official report, Westmoreland said Snowden “did more damage to U.S. national security than any other individual in our nation’s history.” How about FBI agent Robert Hanssen, who helped the former Soviet Union roll up a whole U.S. espionage network and kill our agents? Or Julius Rosenberg, maybe, who only handed over plans for the atomic bomb? Or, as some would have it, George W. Bush, for the catastrophic choices he made in Iraq?

Another way to think on this is to ask, what counts as damage? Google, Microsoft, Yahoo, and others decided to encrypt the links between their data centers after my colleague Ashkan Soltani and I disclosed that the NSA wasbreaking into their private clouds. Now the NSA probably can’t do that any more, or not as easily. It has to use legal process and approach the companies through the front door. Is that damage? Is that disconnected, as the committee implies, from any legitimate question of “privacy or civil liberties”? Or are the new restrictions on surveillance a policy response to intelligence overreach?

Let me close with a dog that doesn’t bark at all. The committee states, in its press release, that this report is aimed at examining “post-Snowden reforms.” There is no discussion at all of reform when it comes to the powers, policies, and practices of surveillance. Only one reform is deemed worth mentioning, and here the committee judges the NSA harshly. There is “more work” to do, the committee says, to make sure its secrets are locked down tighter from now on.

Editor’s Note: Commentary has been updated as of September 18, 2016 changing “Or the Rosenbergs, maybe, who only handed over plans for the thermonuclear bomb?” to “Or Julius Rosenberg, maybe, who only handed over plans for the atomic bomb?”.

404 — All the ways your wireless router can spy on you, including reading your lips!

Now that practically everyone has a wireless router, it's rather dispiriting to read how vulnerable we all are to hackers as a result. Check out this excellent piece from The Atlantic. It reveals all the ways our WiFi signals are likely to be compromised, which is exactly what happens in my novel 4o4 - A John Decker Thriller, about the surveillance state, recently listed as a Top Ten Amazon Bestseller in Technothrillers.

All the Ways Your Wi-Fi Router Can Spy on You
It can even be trained to read your lips.

KAVEH WADDELL

City dwellers spend nearly every moment of every day awash in Wi-Fi signals. Homes, streets, businesses, and office buildings are constantly blasting wireless signals every which way for the benefit of nearby phones, tablets, laptops, wearables, and other connected paraphernalia.

When those devices connect to a router, they send requests for information—a weather forecast, the latest sports scores, a news article—and, in turn, receive that data, all over the air. As it communicates with the devices, the router is also gathering information about how its signals are traveling through the air, and whether they’re being disrupted by obstacles or interference. With that data, the router can make small adjustments to communicate more reliably with the devices it’s connected to.

But it can also be used to monitor humans—and in surprisingly detailed ways.

As people move through a space with a Wi-Fi signal, their bodies affect it, absorbing some waves and reflecting others in various directions. By analyzing the exact ways that a Wi-Fi signal is altered when a human moves through it, researchers can “see” what someone writes with their finger in the air, identify a particular person by the way that they walk, and even read a person’s lips with startling accuracy—in some cases even if a router isn’t in the same room as the person performing the actions.

Several recent experiments have focused on using Wi-Fi signals to identify people, either based on their body shape or the specific way they tend to move. Earlier this month, a group of computer-science researchers at Northwestern Polytechnical University in China posted a paper to an online archive of scientific research, detailing a system that can accurately identify humans as they walk through a door nine times out of ten.

The system must first be trained: It has to learn individuals’ body shapes so that it can identify them later. After memorizing body shapes, the system, which the researchers named FreeSense, watches for people walking across its line of sight. If it’s told that the next passerby will be one of two people, the system can correctly identify which it is 95 percent of the time. If it’s choosing between six people, it identifies the right one 89 percent of the time.

The researchers proposed using their technology in a smart-home setting: If the router senses one person’s entry into a room, it could communicate with other connected devices—lights, appliances, window shades—to customize the room to that person’s preferences.

FreeSense mirrored another Wi-Fi-based identification system that a group of researchers from Australia and the UK presented at a conference earlier this year. Their system, Wi-Fi ID, focused on gait as a way to identify people from among a small group. It achieved 93 percent accuracy when choosing among two people, and 77 percent when choosing from among six. Eventually, the researchers wrote, the system could become accurate enough that it could sound an alarm if an unrecognized intruder entered.

Something in the way? No problem. A pair of MIT researchers wrote in 2013 that they could use a router to detect the number of humans in a room and identify some basic arm gestures, even through a wall. They could tell how many people were in a room from behind a solid wooden door, a 6-inch hollow wall supported by steel beams, or an 8-inch concrete wall—and detect messages drawn in the air from a distance of five meters (but still in another room) with 100 percent accuracy.

(Using more precise sensors, the same MIT researchers went on to develop systems that can distinguish between different people standing behind walls, and remotely monitor breathing and heart rates with 99 percent accuracy. President Obama got a glimpse of the latter technology during last year’s White House Demo Day in the form of Emerald, a device geared towards elderly people that can detect physical activity and falls throughout an entire home. The device even tries to predict falls before they happen by monitoring a person’s movement patterns.)

Beyond human identification and general gesture recognition, Wi-Fi signals can be used to discern even the slightest of movements with extreme precision.

A system called “WiKey” presented at a conference last year could tell what keys a user was pressing on a keyboard by monitoring minute finger movements. Once trained, WiKey could recognize a sentence as it was typed with 93.5 percent accuracy—all using nothing but a commercially available router and some custom code created by the researchers.

And a group of researchers led by a Berkeley Ph.D. student presented technology at a 2014 conference that could “hear” what people were saying by analyzing the distortions and reflections in Wi-Fi signals created by their moving mouths. The system could determine which words from a list of lip-readable vocabulary were being said with 91 percent accuracy when one person was speaking, and 74 percent accuracy when three people were speaking at the same time.

Many researchers presented their Wi-Fi sensing technology as a way to preserve privacy while still capturing important data. Instead of using cameras to monitor a space—recording and preserving everything that happens in detail—a router-based system could detect movements or actions without intruding too much, they said.

I asked the lead researcher behind WiKey, Kamran Ali, whether his technology could be used to secretly steal sensitive data. Ali said the system only works in controlled environments, and with rigorous training. “So, it is not a big privacy concern for now, no worries there,” wrote Ali, a Ph.D. student at Michigan State University, in an email.

But as Wi-Fi “vision” evolves, it may become more adaptable and need less training. And if a hacker is able to gain access to a router and install a WiKey-like software package—or trick a user into connecting to a malicious router—he or she can try to eavesdrop on what’s being typed nearby without the user ever knowing.

Since all of these ideas piggyback on one of the most ubiquitous wireless signals, they’re ripe for wide distribution once they’re refined, without the need for any new or expensive equipment. Routers could soon keep kids and older adults safe, log daily activities, or make a smart home run more smoothly—but, if invaded by a malicious hacker, they could also be turned into incredibly sophisticated hubs for monitoring and surveillance.