The UK government’s response to Snowden’s leaks has been twofold: that everything is legal, and that everything is subject to rigorous scrutiny. We now know that the first of these is not true, and the second is hardly credible either, given that the UK’s main intelligence watchdog has only one full-time member. There’s one other main oversight body, the UK’s Intelligence and Security Committee of Parliament (ISC), which is tasked with examining:
the policy, administration and expenditure of the Security Service, Secret Intelligence Service (SIS), and the Government Communications Headquarters (GCHQ).
The ISC was criticized as part of a larger condemnation of intelligence oversight by another UK Parliament committee. The head of the ISC, Sir Malcolm Rifkind, was reported by the Guardian as dismissing those criticisms as “old hat,” as if that somehow made them acceptable. Rifkind has now been caught up in a rather more serious row, which involves reporters from the UK’s Channel 4 and The Telegraph newspaper posing as representatives of a Chinese company:
PMR, a communications agency based in Hong Kong was set up, backed by a fictitious Chinese businessman. PMR has plenty of money to spend and wants to hire influential British politicians to join its advisory board and get a foothold in the UK and Europe.
Here’s what Channel 4 and the Telegraph allege happened in their meeting with Rifkind:
Sir Malcolm also claimed he could write to a minister on behalf of our company without saying exactly who he was representing
Sir Malcolm added that he could see any foreign ambassador in London if he wanted, so could provide ‘access’ that is ‘useful’
Rifkind said that he was “self-employed” — in fact, he is a Member of Parliament, and receives a salary of £67,000 per year — and that his normal fee was “somewhere in the region of £5,000 to £8,000” for half a day’s work. There’s no suggestion that Rifkind made any reference during the sting to his role as head of the ISC, but that’s not really the point. He was offering a Chinese company access to influential people purely because he would get paid to do so, and that is surely not the kind of person you would want to grant the high-level security clearance Rifkind enjoys.
Tag: Edward Snowden
Former FBI Director Defends Metadata Collection
The current practices of the Foreign Intelligence Surveillance Act court are effective and don’t need to be changed, according to former FBI director Robert Mueller.
“Yes, it’s worthwhile. Metadata of telephone companies is terribly helpful,” Mueller said, speaking Tuesday morning at an American Bar Association breakfast held at the the University Club in Washington, D.C.
Mueller cited the example of the Boston Marathon bombing as evidence that bulk collection is important, saying that analysis of metadata was able to rule out potential associates of the Tsarnaev brothers. “They had additional IEDs [Improvised Explosive Devices],” Mueller said, adding that bulk collection helped prevent a second attack.
Metadata collection, he said, “is tremendously helpful in identifying contacts.”
The FISA court’s bulk metadata collection program has come under intense scrutiny in light of disclosures made by former National Security Agency contractor Edward Snowden. Congress now has until the end of May to decide whether to reauthorize Section 215 of the Patriot Act, which allows the bulk collection program.
Legislators are working on the language for a reauthorization bill, according to Mueller. “They’re tweaking it, trying to accommodate additional concerns, like privacy,” he said.
Mueller also defended current procedures, which have been criticized for not allowing those subject to surveillance to argue in front of the FISA court. “I’m not sure you need to change what’s been in effect,” he said.
Mueller also didn’t mince words when asked about a possible plea deal for Snowden.
“He’s indicted,” Mueller said of Snowden. “He should come back and face the music.”
Lawmaker Who Said Snowden Committed Treason, Now On The Other Side Of Metadata Surveillance
Rep. Aaron Schock is frequently referred to as a “rising star” in Congress, but this week, the Associated Press reported on a scandal involving Schock and his use of taxpayer and campaign funds for things like flights on private jets (owned by key donors) and a Katy Perry concert. Frankly, I think some of the “scandal” here is a bit overblown. But what struck me is part of how the AP tracked these details about Schock down:
The AP tracked Schock’s reliance on the aircraft partly through the congressman’s penchant for uploading pictures and videos of himself to his Instagram account. The AP extracted location data associated with each image then correlated it with flight records showing airport stopovers and expenses later billed for air travel against Schock’s office and campaign records.
In short, the metadata brought Schock down. Of course, as we’ve been describing, anyone who says that we shouldn’t be concerned about the NSA’s surveillance of metadata, or brushes it away as “just metadata,” doesn’t understand how powerful metadata can be. As former NSA/CIA boss Michael Hayden has said, the government kills people based on metadata.
But it does seem noteworthy that Schock was one of those who claimed that Ed Snowden’s leaking of how the NSA collected metadata on nearly everyone amounted to treason. I wonder if he still feels that way…
European Lawmakers Demand Answers on Phone Key Theft
European officials are demanding answers and investigations into a joint U.S. and U.K. hack of the world’s largest manufacturer of mobile SIM cards, following a report published by The Intercept Thursday.
The report, based on leaked documents provided by NSA whistleblower Edward Snowden, revealed the U.S. spy agency and its British counterpart Government Communications Headquarters, GCHQ, hacked the Franco-Dutch digital security giant Gemalto in a sophisticated heist of encrypted cell-phone keys.
The European Parliament’s chief negotiator on the European Union’s data protection law, Jan Philipp Albrecht, said the hack was “obviously based on some illegal activities.”
“Member states like the U.K. are frankly not respecting the [law of the] Netherlands and partner states,” Albrecht told the Wall Street Journal.
Sophie in ’t Veld, an EU parliamentarian with D66, the Netherlands’ largest opposition party, added, “Year after year we have heard about cowboy practices of secret services, but governments did nothing and kept quiet […] In fact, those very same governments push for ever-more surveillance capabilities, while it remains unclear how effective these practices are.”
“If the average IT whizzkid breaks into a company system, he’ll end up behind bars,” In ’t Veld added in a tweet Friday.
The EU itself is barred from undertaking such investigations, leaving individual countries responsible for looking into cases that impact their national security matters. “We even get letters from the U.K. government saying we shouldn’t deal with these issues because it’s their own issue of national security,” Albrecht said.
Still, lawmakers in the Netherlands are seeking investigations. Gerard Schouw, a Dutch member of parliament, also with the D66 party, has called on Ronald Plasterk, the Dutch minister of the interior, to answer questions before parliament. On Tuesday, the Dutch parliament will debate Schouw’s request.
Additionally, European legal experts tell The Intercept, public prosecutors in EU member states that are both party to the Cybercrime Convention, which prohibits computer hacking, and home to Gemalto subsidiaries could pursue investigations into the breach of the company’s systems.
According to secret documents from 2010 and 2011, a joint NSA-GCHQ unit penetrated Gemalto’s internal networks and infiltrated the private communications of its employees in order to steal encryption keys, embedded on tiny SIM cards, which are used to protect the privacy of cellphone communications across the world. Gemalto produces some 2 billion SIM cards a year.
The company’s clients include AT&T, T-Mobile, Verizon, Sprint and some 450 wireless network providers. “[We] believe we have their entire network,” GCHQ boasted in a leaked slide, referring to the Gemalto heist.
FBI Flouts Obama Directive to Limit Gag Orders on National Security Letters
Despite the post-Snowden spotlight on mass surveillance, the intelligence community’s easiest end-run around the Fourth Amendment since 2001 has been something called a National Security Letter.
FBI agents can demand that an Internet service provider, telephone company or financial institution turn over its records on any number of people — without any judicial review whatsoever — simply by writing a letter that says the information is needed for national security purposes. The FBI at one point was cranking out over 50,000 such letters a year; by the latest count, it still issues about 60 a day.
The letters look like this:
Recipients are legally required to comply — but it doesn’t stop there. They also aren’t allowed to mention the order to anyone, least of all the person whose data is being searched. Ever. That’s because National Security Letters almost always come with eternal gag orders. Here’s that part:
That means the NSL process utterly disregards the First Amendment as well.
More than a year ago, President Obama announced that he was ordering the Justice Department to terminate gag orders “within a fixed time unless the government demonstrates a real need for further secrecy.”
And on Feb. 3, when the Office of the Director of National Intelligence announced a handful of baby steps resulting from its “comprehensive effort to examine and enhance [its] privacy and civil liberty protections” one of the most concrete was — finally — to cap the gag orders:
In response to the President’s new direction, the FBI will now presumptively terminate National Security Letter nondisclosure orders at the earlier of three years after the opening of a fully predicated investigation or the investigation’s close.
Continued nondisclosures orders beyond this period are permitted only if a Special Agent in Charge or a Deputy Assistant Director determines that the statutory standards for nondisclosure continue to be satisfied and that the case agent has justified, in writing, why continued nondisclosure is appropriate.
Despite the use of the word “now” in that first sentence, however, the FBI has yet to do any such thing. It has not announced any such change, nor explained how it will implement it, or when.
THE GREAT SIM HEIST HOW SPIES STOLE THE KEYS TO THE ENCRYPTION CASTLE
AMERICAN AND BRITISH spies hacked into the internal computer network of the largest manufacturer of SIM cards in the world, stealing encryption keys used to protect the privacy of cellphone communications across the globe, according to top-secret documents provided to The Intercept by National Security Agency whistleblower Edward Snowden.
The hack was perpetrated by a joint unit consisting of operatives from the NSA and its British counterpart Government Communications Headquarters, or GCHQ. The breach, detailed in a secret 2010 GCHQ document, gave the surveillance agencies the potential to secretly monitor a large portion of the world’s cellular communications, including both voice and data.
The company targeted by the intelligence agencies, Gemalto, is a multinational firm incorporated in the Netherlands that makes the chips used in mobile phones and next-generation credit cards. Among its clients are AT&T, T-Mobile, Verizon, Sprint and some 450 wireless network providers around the world. The company operates in 85 countries and has more than 40 manufacturing facilities. One of its three global headquarters is in Austin, Texas and it has a large factory in Pennsylvania.
In all, Gemalto produces some 2 billion SIM cards a year. Its motto is “Security to be Free.”
With these stolen encryption keys, intelligence agencies can monitor mobile communications without seeking or receiving approval from telecom companies and foreign governments. Possessing the keys also sidesteps the need to get a warrant or a wiretap, while leaving no trace on the wireless provider’s network that the communications were intercepted. Bulk key theft additionally enables the intelligence agencies to unlock any previously encrypted communications they had already intercepted, but did not yet have the ability to decrypt.
Hoping for spy reforms? Jeb Bush, dangerously close to being the next US prez, backs the NSA
Former Florida governor, brother of former President George W Bush, son of former President George H W Bush, and Republican frontrunner for the 2016 US presidential election, Jeb Bush … has strongly defended the NSA’s mass surveillance of innocent people.
Speaking at the Chicago Council on Global Affairs as part of his run for the White House, Bush made it clear that if he did become president he would retain the programs introduced under his brother’s administration.
While covering broad foreign policy topics, Bush appeared to go off script when he said that in order to effectively tackle Islamic terrorism, it was necessary to have “responsible intelligence gathering and analysis – including the NSA metadata program, which contributes to awareness of potential terror cells and interdiction efforts on a global scale.”
He continued: “For the life of me, I don’t understand.. the debate has gotten off track, where we’re not understanding or protecting.. we do protect our civil liberties.. but this is a hugely important program to use these technologies to keep us safe.”
Fast forward to the 28-minute mark for the fun to begin in this vid, streamed live on Wednesday, of his talk
Researchers Find ‘Astonishing’ Malware Linked to NSA Spying
Security researchers have uncovered highly sophisticated malware that is linked to a secret National Security Agency hacking operation exposed by The Intercept last year.
Russian security firm Kaspersky published a report Monday documenting the malware, which it said had been used to infect thousands of computer systems and steal data in 30 countries around the world. Among the targets were a series of unnamed governments, telecom, energy, and aerospace companies, as well as Islamic scholars, and media organizations.
Kaspersky did not name the NSA as the author of the malware. However, Reuters reported later on Monday that the agency had created the technology, citing anonymous former U.S. intelligence officials.
Kaspersky’s researchers noted that the newly found malware is similar to Stuxnet, a covert tool reportedly created by the U.S. government to sabotage Iranian nuclear systems. The researchers also identified a series of codenames that they found contained within the samples of malware, including STRAIGHTACID, STRAITSHOOTER, and GROK.
Notably, GROK, which Kaspersky said is a piece of malware used to secretly log keystrokes, is tied to secret NSA hacking tactics described in documents from whistleblower Edward Snowden. Last year, The Intercept revealed that the NSA was using a tool called GROK to log keystrokes as part of a toolkit it uses to hack computers and collect data.
The other codenames identified by Kaspersky on Tuesday—such as STRAIGHTACID, STRAITSHOOTER—are strikingly similar to known NSA hacking operations. Leaked NSA documents have revealed that the agency uses hacking tools known as STRAIGHTBIZARRE and FOXACID to break into computers and grab data.
According to Kaspersky, the malware found in the latest discovery is the most advanced ever found and represents an “astonishing technical accomplishment.” It hides deep within an infected computer and can stay on the machine even after attempts to wipe or reformat the hard drive. The security firm has dubbed different variants of the malware EquationLaser, EquationDrug and GrayFish, and they are calling its creators the “Equation Group,” because of the way the spy technology attempts to hide itself in an infected computer using complex encryption.
Internet Industry Now Considers The Intelligence Community An Adversary, Not A Partner
In an interview last month, Timothy D. Cook, Apple’s chief executive, said the N.S.A. “would have to cart us out in a box” before the company would provide the government a back door to its products. Apple recently began encrypting phones and tablets using a scheme that would force the government to go directly to the user for their information. And intelligence agencies are bracing for another wave of encryption.
In fact, it seems noteworthy that this whole issue of increasing encryption by the tech companies to keep everyone out has been left off the official summit schedule. As the NY Times notes, Silicon Valley seems to be pretty much completely fed up with the intelligence community after multiple Snowden revelations revealed just how far the NSA had gone in trying to “collect it all” — including hacking into the foreign data centers of Google and Yahoo. And, on top of that, the NSA’s efforts to buy up zero day vulnerabilities before companies can find out and patch them:
“What has struck me is the enormous degree of hostility between Silicon Valley and the government,” said Herb Lin, who spent 20 years working on cyberissues at the National Academy of Sciences before moving to Stanford several months ago. “The relationship has been poisoned, and it’s not going to recover anytime soon.”