Floating Security

/18 Comments/in /by

Screen Shot 2015-06-29 at 11.25.57 AMGreetings! I’m back, just in time to refill the liquor cabinet. Thanks to Rayne, Jim, bmaz, and Ed for their fascinating posts while I was gone (and if you haven’t read it, I especially recommend Ed’s series on paradigms in economics).

As I mentioned before I left, I just took a vacation with my mom, who turned 75 during our trip. Because seeing Russia and Scandinavia were on her bucket list but she has mobility limitations, we decided to go on a Baltic cruise for the trip (it was my first cruise). Which meant, among other things, we we sailing from Germany past Poland and Kaliningrad to Lithuania on the last days of a NATO war game involving the Baltics, and we were docked in St. Petersburg for 3 days.

While I don’t know whether it was related to the war games, on the night of June 17-18, the ship took what a long-time sailor told us the next day seemed like an evasive maneuver at 2 AM that woke everyone I spoke to up. The following day, at around 6 (almost no one was awake because it was our one sailing day), the crew noted a ship tracking us on our starboard side that seemed very unusual to them. It pulled up ahead of the cruise ship far enough I couldn’t get a good picture or binocular check (it had a mostly red flag) when I returned, but was there for about 6 hours. I suck ass at military ship identification but it might have been a frigate. In any case, the New Cold War™ has not yet heated up sufficiently to turn our cruise ship into the Lusitania, so you’re all stuck with me.

I was just as interested in the security procedures for the ship. There are obvious measures (as those of you who have taken cruises surely know): a card check as you get on and off the boat every time, with metal detectors every time you get back on the boat. What I found interesting, though, were the less obvious measures, something you’d need to have for something that would otherwise be such an easy target but for which you wouldn’t want passengers to realize it. For example, there were undercarriage checks (the kind that are meant to be obvious in places like Brazil) that were not obviously visible. There were deck guards (one of whom got sheepish when I got into a conversation about the sunset he was taking a picture of), which are probably intended to minimize teenage pregnancies as much as anything else, but which keep a low profile on outer decks late at night. You couldn’t see security cameras anywhere, but I’m sure they were omnipresent. I’m really interested in the security checks employees undergo, as there can be up to 1,000 tip-dependent employees from developing nations on board. In any case, I imagine the cruise ship tracks everyone’s movement on board through use of key cards.

I was also interested in how cruise ship security intersected with Russian security (Russia has a 3-day exception to its visa requirement for cruise ship passengers who use a tour guide in Russia and return to their ship every night, but it requires going through customs every time you leave the ship and there is fine print that got a few people in trouble). Every time you left the ship, you’d first be scanned off the ship, then interact with a surly Russian border guard (I tried to little avail to butter them up with my very rudimentary Russian). On return, you’d go through a Russian metal detector to get into the port facility — but the guards only made you put bags through their x-ray machine, not all metal, and they pretty much ignored when you set off the metal detector. In other words, while Russia made a show of preventing weapons or bombs from entering the cruise ship terminal, it was pretty ineffective (there was a toll entry to get to the port itself by car, bus, or truck, though, which may limit what kinds of people could even get to the port). Then, you’d be checked out of Russia by the same surly border guards. Next you’d be checked into the boat and put through another metal detector upon entering the ship (though there were a few weak points to this process that I won’t mention). Though admittedly, the ship security was probably also designed as much to find booze and food that passengers were taking onto the ship, both of which had ostensible security purposes, but also served the cruise’s business model of ensuring captive consumption of booze on board.

In any case, the cruise ship obviously didn’t trust Russia’s security measures, but the latter probably rely much more on their own intelligence and policing.

All of which is to say the cruise ship is an exercise in a mix between security theater (the not entirely perfect metal detector on board) and more obscure but presumably more effective measures. Given the volume of passengers that have to be processed in quick order, it would seem to be proof that such an approach is possible in other areas (including aviation), but we choose not to use it. Or maybe cruise ships are 1) better able to do a cost-benefit analysis and 2) subject to fewer US laws. I’m now interested in more about how cruise ships carry out their security, though expect much of it is secret.

One final observation. I found Lithuania (Klaipeda, right on the border with Kaliningrad) to be the most fascinating stop, in part because it has been a cruise destination for a shorter period of time than, say, Tallinn, and so has not been transformed as much. Mom and I took a ferry to the Curonian Spit, then took a taxi down the spit and then back to Klaipeda; our taxi drivers were a son and then his father in succession. That’s where my (as I noted, very rudimentary) Russian was most interesting. At the ferry, I was told clearly not to use it at all by a maybe 55-year old woman. The son, who had excellent Hollywood English, was more measured. His father, who reminded that he had had to use Russia all through school and military service, was very happy to have a quasi conversation in Russian with me (we occasionally resorted to Polish and Czech at times, as better mutually comprehensible languages). I found the mixed feelings about Russian, in a place with a very audible Russian minority, to be fascinating. But then, Lithuania is ground zero for the New Cold War™ and I can understand how rising tensions exacerbate underlying divisions.

Anyway, that’s the sum of my impressions from being unable to entirely turn off the security side of my brain.

Cyber-spawn Duqu 2.0: Was Malware Infection ‘Patient Zero’ Mapped?

/17 Comments/in , /by

Cybersecurity_MerrillCollegeofJournalismKaspersky Lab reported this morning a next-generation version of Duqu malware infected the information security company’s network.

Duqu is a known reconnaissance malware. Its complexity suggests it was written by a nation-state. The malware appears closely affiliated with the cyber weapon malware Stuxnet.

WSJ reported this particular version may have been used to spy on the P5+1 talks with Iran on nuclear development. Dubbed ‘Duqu 2.0,’ the malware may have gathered audio, video, documents and communications from computers used by talk participants.

Ars Technica reported in depth on Kaspersky’s discovery of the malware and its attributes. What’s really remarkable in this iteration is its residence in memory. It only exists as a copy on a drive at the first point of infection in a network, and can be wiped remotely to destroy evidence of its occupation.

The infosec firm killed the malware in their networked devices by mimicking a power outage. They detached from their network suspect devices believed to contain an infecting copy.

Kaspersky’s Patient Zero was a non-technical employee in Asia. Duqu 2.0 wiped traces of its own insertion from the PC’s drive.

Neither WSJ or Ars Technica noted Kaspersky’s network must have been subject to a program like TREASUREMAP.

…Because the rest of the data remained intact on the PC and its security patches were fully up to date, researchers suspect the employee received a highly targeted spear phishing e-mail that led to a website containing a zero-day exploit. … (bold mine – source: Ars Technica)

How was a single non-technical point of contact in Asia identified as a target for an infected email? Read more →

Intelligence Committees Still Trying to Force Agencies to Follow Reagan’s Rules

/in /by

34 years ago Ronald Reagan issued the Executive Order that still governs most of our country’s intelligence activities, EO 12333.

As part of it, the EO required any agency using information concerning US persons to have a set of procedures laying out how it obtains, handles, and disseminates information (see the language of 2.3 below).

Only — as the Privacy and Civil Liberties Oversight Board started pointing out in August 2013 — some agencies have never complied. In February, PCLOB revealed the 4 agencies that are still flouting Reagan’s rules, along with what they have been using:

The Department of Homeland Security’s notoriously shoddy Office of Intelligence and Analysis: Pending issuance of final procedures, I&A is operating pursuant to Interim Intelligence Oversight Procedures, issued jointly by the Under Secretary for Intelligence and Analysis and the Associate General Counsel for Intelligence (April 3, 2008).

United States Coast Guard (USCG)- Intelligence and counterintelligence elements: Pending issuance of final procedures, operating pursuant to Commandant Instruction – COMDINST 3820.12, Coast Guard Intelligence Activities (August 28, 2003).

Department of Treasury Office of Intelligence and Analysis (OIA): Pending issuance of final procedures. While draft guidelines are being reviewed in the interagency approval process, the Office of Intelligence and Analysis conducts intelligence operations pursuant to EO 12333 and statutory responsibilities of the IC element, as advised by supporting legal counsel.

Drug Enforcement Administration, Office of National Security Intelligence (ONSI): Pending issuance of final procedures, operates pursuant to guidance of the Office of Chief Counsel, other guidance, and: Attorney General approved “Guidelines for Disclosure of Grand Jury and Electronic, Wire, and Oral Interception Information Identifying United States Persons” (September 23, 2002); Attorney General approved “Guidelines Regarding Disclosure to the Director of Central Intelligence and Homeland Security Officials of Foreign Intelligence Acquired in the Course of a Criminal Investigation” (September 23, 2002).

Last year’s House Intelligence Committee version of NSA reform (the one I called RuppRoge) would have included language requiring agencies to finish these procedures — mandated 34 years ago — within 6 months. And now, over a year later, Dianne Feinstein’s latest attempt at reform echoed that language.

Which strongly suggests these agencies are still deadbeats.

As I said in February, I’m most concerned about DEA (because DEA is out of control) and, especially, Treasury (because Treasury’s intelligence activities are a black box with little court review). Treasury is making judgements that can blacklist someone financially, but it has thus far refused to institute procedures to protect Americans’ privacy while it does so.

And no one seems to be rushing to require them to do so.

2.3 Collection of Information. Agencies within the Intelligence Community are authorized to collect, retain or disseminate information concerning United States persons only in accordance with procedures established by the head of the agency concerned and approved by the Attorney General, consistent with the authorities provided by Part 1 of this Order. Those procedures shall permit collection, retention and dissemination of the following types of information:
(a) Information that is publicly available or collected with the consent of the person concerned;
(b) Information constituting foreign intelligence or counterintelligence, including such information concerning corporations or other commercial organizations. Collection within the United States of foreign intelligence not otherwise obtainable shall be undertaken by the FBI or, when significant foreign intelligence is sought, by other authorized agencies of the Intelligence Community, provided that no foreign intelligence collection by such agencies may be undertaken for the purpose of acquiring information concerning the domestic activities of United States persons;
(c) Information obtained in the course of a lawful foreign intelligence, counterintelligence, international narcotics or international terrorism investigation;
(d) Information needed to protect the safety of any persons or organizations, including those who are targets, victims or hostages of international terrorist organizations;
(e) Information needed to protect foreign intelligence or counterintelligence sources or methods from unauthorized disclosure. Collection within the United States shall be undertaken by the FBI except that other agencies of the Intelligence Community may also collect such information concerning present or former employees, present or former intelligence agency contractors or their present or former employees, or applicants for any such employment or contracting;
(f) Information concerning persons who are reasonably believed to be potential sources or contacts for the purpose of determining their suitability or credibility;
(g) Information arising out of a lawful personnel, physical or communications security investigation;
(h) Information acquired by overhead reconnaissance not directed at specific United States persons;
(i) Incidentally obtained information that may indicate involvement in activities that may violate federal, state, local or foreign laws; and
(j) Information necessary for administrative purposes.
In addition, agencies within the Intelligence Community may disseminate information, other than information derived from signals intelligence, to each appropriate agency within the Intelligence Community for purposes of allowing the recipient agency to determine whether the information is relevant to its responsibilities and can be retained by it.

Mike Morell’s Performance of “Intelligence”

/7 Comments/in /by

Given that Bill Harlow co-wrote George Tenet and Jose Rodriguez’ autobiographical novels, it’s fairly clear he continues to propagandize for the CIA years after he left the Agency as Public Affairs officer. Still, his past autobiographical novels were perhaps more convincing than the roll out of Mike Morell’s autobiographical novel, The Great War of Our Time, which Harlow also co-wrote. That’s pretty remarkable given that Morell had more retained credibility than either of the other two. This propaganda tour actually seems to be eroding Morell’s credibility.

Part of the problem is interviews like this, where Morell says both that we should be “all in” with Saudi Arabia (an asinine judgement, in my opinion, perhaps betraying CIA’s close ties to the Saudis) and that we should support secular Bashar al-Assad, which is totally inconsistent with his first stance.

And he makes those two claims in an interview where he also claims that numbers on collateral damage tied to drone strikes are “propaganda.”

“The other thing I’ll say is that this is the most precise weapon in the U.S. arsenal.  Collateral damage is not zero — and gosh, I wish it were zero, but it’s not — but it’s very close to zero.

“Number three, the numbers that you see about huge numbers of collateral damage just aren’t true.  They are put out there as propaganda by people who want this program to go away, and al-Qaida is one of those groups.”

It’s a great display of Morell’s approach to lying.

First, most people don’t claim there are huge numbers of collateral damage. TBIJ — which is both one of the more partisan voices against drone strikes but which also does some of the most meticulous work tracking drone killing over years — shows that civilians amount for around 14%  of those killed (a lower number than some more hawkish counts). The number itself is not, as Morell depicts it, “huge.” But it is, nevertheless, a relatively large amount, one what brings with it a lot of blowback. And the numbers — which again, are similar to those tracked my multiple independent sources — are much higher than CIA publicly claims.

It is CIA, and not drone killing trackers, engaged in propaganda here.

Yet by refuting something his opponents hadn’t asserted, Morell gets to claim to have debunked it.

While I have no idea what part of Sy Hersh’s story on Osama bin Laden are true, Morell’s use of the same method to debunk Hersh suggests he’s engaged — at least partly — in non-denial denial.

Jeff Stein deals with one problem with Morell’s debunking. CIA’s former Deputy Director claims that if we had tipped the Pakistanis (who are dealt with as a monolith in Morell’s story) they would have told Osama bin Laden. Wouldn’t that require knowledge of where he was, and some ongoing interest in protecting him? If so, that actually confirms a key premise of Hersh’s (and other reporters’) stories.

Then there’s Morell’s debunking of the walk-in story.

He claims that we learned of bin Laden’s location not from following the courier and from excellent intelligence analysis, but from a Pakistani intelligence officer who walked into the U.S. Embassy and gave us bin Laden’s whereabouts in exchange for “much of the $25 million reward offered by the U.S.” The truth is that while walk-ins have long been useful in providing intelligence to us world-wide, none of the information that led to finding the location where bin Laden was came from walk-ins.

NBC has already confirmed that there was a walk-in — just that he wasn’t key to identifying OBL’s location.

Editor’s Note: This story has been updated since it was first published. The original version of this story said that a Pakistani asset told the U.S. where bin Laden was hiding. Sources say that while the asset provided information vital to the hunt for bin Laden, he was not the source of his whereabouts.

Morell’s statement is utterly consistent with NBC’s reporting.

Morell claims to debunk Hersh’s claim that CIA obtained DNA from OBL.

bin Laden was very ill, and that early on in his confinement at Abbottabad, the ISI had ordered Amir Aziz, a doctor and a major in the Pakistani army, to move nearby to provide treatment.

[snip]

The planners turned for help to Kayani and Pasha, who asked Aziz to obtain the specimens. Soon after the raid the press found out that Aziz had been living in a house near the bin Laden compound: local reporters discovered his name in Urdu on a plate on the door. Pakistani officials denied that Aziz had any connection to bin Laden, but the retired official told me that Aziz had been rewarded with a share of the $25 million reward the US had put up because the DNA sample had showed conclusively that it was bin Laden in Abbottabad.

But Morell focuses on obtaining DNA from the compound and from OBL’s children, not from OBL himself.

Mr. Hersh says we obtained DNA samples from people in the bin Laden compound before the assault was launched. Wrong again. We would have liked to have obtained samples from the children in the compound to confirm that they were bin Laden’s children, but we did not. [my emphasis]

And Morell claims Hersh’s claim that SEALs couldn’t have thrown OBL body parts out the helicopter over the Hindu Kush …

The remains, including his head, which had only a few bullet holes in it, were thrown into a body bag and, during the helicopter flight back to Jalalabad, some body parts were tossed out over the Hindu Kush mountains – or so the Seals claimed.

… Because he received a burial at sea.

Finally—and most absurdly perhaps—Mr. Hersh cites his sources as telling him that SEALs threw bin Laden body parts off their helicopter over the Hindu Kush and suggests that the burial at sea from the USS Carl Vinson never happened. Bin Laden’s body received a proper Muslim burial at sea. How do I know? I heard the president give the order, and I saw photographs and video of the burial at sea.

Now, to be fair, this is one claim from Hersh I’m most skeptical of (though I realize now the SEALs might have thrown some body parts out the helicopter to leave DNA evidence that OBL was killed there, which was the purported cover story). But Morell’s debunking is no such thing, because it is perfectly possible a shrouded corpse could be buried at sea even if it were missing some body parts. (I’ll also note that JSOC hid what I believe to be trophy photos after this story started breaking, which suggests the SEALs did something with the corpse that would cause problems if it were publicized, though I always assumed they just hammed it up.)

In other words, as Morell does for his drone propaganda, he usually doesn’t debunk what Hersh wrote, but instead something else.

Which is a suggestion that he’s engaged in another cover story.

As FBI Considers Declaring State Secrets over Its Religion Training, ICE Releases Its Martyrdom Border Entry Questions

/1 Comment/in /by

Three years ago, CAIR-MI sued the Department of Homeland Security and FBI because Muslims crossing the US-Canadian border keep getting asked questions about their religion. The suit has proceeded with CAIR getting discovery that largely remains secret.

But in a cross-motion filed last week, the government got really squirrelly relating to some information on how it deals with border questioning. It’s worried about three things: two FBI training documents and the redacted parts of a Sample Questionnaire ICE uses at the border.

At least one of the FBI training documents provides guidance on how the Bureau investigates certain things (likely Sensitive investigative subjects), including religion. The second is a training program attended by an Agent who had asked sensitive questions to one of the plaintiffs.

As set forth in Defendants’ Privilege Log of FBI Documents, FBI #2 is an “FBI operational training providing guidance on certain categories of investigations, one portion of which included questions related to religion.” See Pl. Mot. Exh. E. The Log further explains that the document “contains law enforcement sensitive information, the disclosure of which would impede or impair the effectiveness of an investigation and/or an investigative technique, method or procedure; and national security information.” The Log described FBI #4 as “Training attended by CBP Officer Janos during his affiliation with the FBI Task Force (described in response to Interrogatory 9),” and explained that it is a law enforcement sensitive document, the disclosure of which could harm the effectiveness of an investigation or an investigative technique, and “contains personally identifying information about individuals not party to this action.”

The government says that if the judge rules the first training program relevant to this suit, they may claim state secrets over it.

Therefore, if the Court determines thatthe national security information included in this document is both relevant toPlaintiffs’ equal protection claim and not protected from disclosure by the lawenforcement privilege, then Defendants request at least 60 days to considerwhether that information is subject to an assertion of the state secrets privilege,

Since 2008, when DOJ made it okay to use religion as one factor in investigations, there have been questions about how it might play into those investigations. But apparently, DOJ would rather invoke state secrets than tell us.

Then there’s the other thing the government doesn’t want to reveal: its list of questions it asks (under what circumstances, it won’t say) at the border. Some of those got released in a redacted list to the plaintiffs, released last week as part of a declaration explaining why the questions that get asked of selected people crossing the border can’t be released altogether.

But along with asking questions about who the interviewee’s faith leader is (these questions lay at the heart of the suit), they also ask about martyrdom (though one question remains redacted).

Screen Shot 2015-05-04 at 3.38.25 PM

 

It’s hard to imagine how such questions would ever elicit a useful response — unless the desired response is just to make people nervous. Someone ideological enough to have lost associates as suicide bombers would respond affirmatively rather than hiding their own associations?

But particularly given DHS’ excuse that because, as written, this questionnaire’s religious questions are religion neutral, the questions on martyrdom are absurd. Not because just Jihadists foster the claim of suicide bombing (though I think even that claim could be true), but also because so many completely innocent Muslims have been killed in recent years for living in the wrong place at the wrong time. Do those people count as martyrs? Or is this another attempt to instill an odd multileveled evaluation of deaths, in which the only dead Muslims are those extremists who’ve deliberately killed themselves, and not the million who create the animus?

Or does DHS just plan on deporting someone years from now because someone didn’t identify a relative killed in an asymmetric war as a “martyr,” the word DHS itself picked?

It’s clear DHS is asking religious questions (though it’s not clear whether CAIR will have the ability to show that, because only Muslims get pulled into secondary, the questions end up getting posed only to Muslims). But with this odd martyrdom question, it’s also hard to see how these are effective questions.

Now That’s Some Disturbance in the Force

/13 Comments/in /by

At some time around 9:30 PM ET at the INSA Leadership Dinner, John Brennan suggested that maybe the CIA Director — that is, maybe he — should have a 10 year term.

D/CIA John Brennan says it might make sense to have the CIA director and DNI serve similar terms to the FBI director’s 10-year term.

At 4:30 AM Saudi time (so 9:30 PM ET), Saudi King Salman announced a major royal shake-up. Rather than his brother Muqrin bin Abdulaziz being Deputy and heir to the throne, American favorite and very close Brennan buddy Mohammed bin Nayef will be heir.

Saudi King Salman is announcing a major royal shake-up at 4:30 am. Muqrin is out, M. Bin Nayaf is the new heir, his own son deputy heir.

That’s a rather interesting power move by two closely affiliated types (though I assume that the CIA Director can’t do these things by fiat … yet).

Update: Adding, King Salman’s insomnia induced Kingdom restructuring also apparently made Ambassador to the US (the guy whom Manssor Arbabsiar was purportedly trying to kill) Adel al-Jubeir Foreign Minister.

Michael Horowitz’ Monthly Complaint about FBI and DEA Stonewalling

/2 Comments/in /by

The House Oversight Committee is having a hearing on the problems law enforcement agencies have with sexual harassment and misconduct, as reported by DOJ’s Inspector General. DEA Administrator Michele Leonhart will be offering amusing testimony about how the DEA has given its Agents clear instructions that they’re really the best evah™ but they need to stop breaking the law.

But because I’m an IG nerd, I’m as interested in what has become a monthly event during DOJ Inspector General Michael Horowitz’ tenure, when he provides details of FBI and DEA’s latest stonewalling of oversight. Here’s today’s version:

Further, we cannot be completely confident that the FBI and the DEA provided us with all information relevant to this review. When the OIG finally received from the FBI and DEA the requested information without extensive redactions, we found that it still was incomplete. For example, we determined that the FBI removed a substantial number of cases from the result of their search and provided additional cases to the OIG only after we identified some discrepancies. These cases were within the scope of our review and should have been provided as requested. Likewise, the DEA also provided us additional cases only after we identified some discrepancies. In addition, after we completed our review and a draft of the report, we learned that the DEA used only a small fraction of the terms we had provided to search its database for the information needed for our review. Rather than delay our report further, we decided to proceed with releasing it given the significance of our findings.

We also determined that the DEA initially withheld from us relevant information regarding an open case involving overseas prostitution. During a round of initial interviews, only one interviewee provided us information on this case. We later learned that several interviewees were directly involved in the investigation and adjudication of this matter, and in follow-up interviews they each told us that they were given the impression by the DEA that they were not to talk to the OIG about this case while the case was still open. In order to ensure the thoroughness of our work, the OIG is entitled to receive all information in the agency’s possession regardless of the status of any particular case.

As I have testified on multiple occasions, in order to conduct effective oversight, an Inspector General must have timely and complete access to documents and materials needed for its audits, reviews, and investigations. This review starkly demonstrates the dangers inherent in allowing the Department and its components to decide on their own what documents they will share with the OIG, and even whether the Inspector General Act requires them to provide us with requested information. The delays experienced in this review impeded our work, delayed our ability to discover the significant issues we ultimately identified, wasted Department and OIG resources during the pendency of the dispute, and affected our confidence in the completeness of our review.

This was not an isolated incident. Rather, we have faced repeated instances over the past several years in which our timely access to records has been impeded, and we have highlighted these issues in our reports on very significant matters such as the Boston Marathon Bombing, the Department’s use of the Material Witness Statute, the FBI’s use of National Security Letters, and ATF’s Operation Fast and Furious.

The Congress recognized the significance of this impairment to the OIG’s independence and ability to conduct effect oversight, and included a provision in the Fiscal Year 2015 Appropriations Act — Section 218 — which prohibits the Justice Department from using appropriated funds to deny, prevent, or impede the OIG’s timely access to records, documents, and other materials in the Department’s possession, unless it is in accordance with an express limitation of Section 6(a) of the IG Act. Despite the Congress’s clear statement of intent, the Department and the FBI continue to proceed exactly as they did before Section 218 was adopted – spending appropriated funds to review records to determine if they should be withheld from the OIG. The effect is as if Section 218 was never adopted. The OIG has sent four letters to Congress to report that the FBI has failed to comply with Section 218 by refusing to provide the OIG, for reasons unrelated to any express limitation in Section 6(a) of the IG Act, with timely access to certain records.

We are approaching the one year anniversary of the Deputy Attorney General’s request in May 2014 to the Office of Legal Counsel for an opinion on these matters, yet that opinion remains outstanding and the OIG has been given no timeline for the issuance of the completed opinion. Although the OIG has been told on occasion over the past year that the opinion is a priority for the Department, the length of time that has now passed suggests otherwise. Instead, the status quo continues, with the FBI repeatedly ignoring the mandate of Section 218 and the Department failing to issue an opinion that would resolve the matter. The result is that the OIG continues to be prevented from getting complete and timely access to records in the Department’s possession. The American public deserves and expects an OIG that is able to conduct rigorous oversight of the Department’s activities. Unfortunately, our ability to conduct that oversight is being undercut every day that goes by without a resolution of this dispute.

At some point, Congress is going to have to decide whether it will use the power of the purse — as they have authorized by statute — to force DEA and FBI to meet the same standards of disclosure that mere citizens would be required if DEA and FBI were investigating them.

Until then, we should just assume FBI and DEA are breaking the law.

FBI’s Cell Phone Investigative Kiosk Would Allow Fourth Amendment Violations

/2 Comments/in /by

Jim Comey wants to sacrifice individual security to ensure the FBI can access cell phones easily.

But in an audit of a forensic lab in Philadelphia, DOJ’s Inspector General found that the FBI is not keeping adequate control of the kiosks that FBI uses to do initial reviews of data on cell phones.

As the report describes, cell phone kiosks serve as a “preview” tool of the contents of the data stored on a phone.

Cell Phone Investigative Kiosks (Kiosks) are available at select FBI field offices and RCFLs. A Kiosk is a preview tool that allows users to quickly and easily view data stored on a cell phone, extract the data to use as evidence, put it into a report, and copy the report to an electronic storage device such as a compact disk. Kiosks are not designed to take the place of full-scale cell phone examinations performed by certified Forensic Examiners; however, the evidence produced by a Kiosk is admissible in a court of law. Kiosk users are required to take a one-time hour-long training course and be familiar with computers. In addition, FBI policy requires Kiosk users to confirm they possess the proper legal authority for the search of data on cell phones or loose media.

The FBI only recently started tracking who had access to these kiosks. And when DOJ IG audited this office’s use of the kiosk, it found that 27% of the people who were accessing it hadn’t filled out the requisite paperwork to ensure only appropriate people used it.

We found that the PHRCFL did not have adequate controls over the access and use of its Kiosks. FBI policy requires Kiosk users to confirm they possess the proper legal authority for the search of data on cell phones or loose media. During our fieldwork, the FBI did not provide any information to show that PHRCFL Kiosk users were required to sign-in, identify the case related to the evidence being examined, or, as required by FBI policy, confirm that they possessed the proper legal authority to search for evidence on the cell phone. In addition, the FBI did not provide us with any information regarding controls in place at the PHRCFL to ensure that users do not use the Kiosks for non-law enforcement matters.

[snip]

we conducted limited testing of 25 visits during FYs 2012 through 2014 to verify compliance with the procedures in place. When the PHRCFL began using the Acknowledgment Form in May 2012, its visitor’s log contained a field for the purpose of each visitor’s visit. We selected names from the visitor’s log whose stated purpose for the visit was Kiosk usage and compared those names and dates to the corresponding Acknowledgment Forms. For the 17 visits we selected between May 2012 and January 2013, we found that approximately 24 percent of the PHRCFL Kiosk-related visitor log entries did not have corresponding Acknowledgment Forms.

[snip]

We believe that although the Kiosks are an efficient tool for law enforcement officers to use to examine digital evidence that may not require the extensive examination of a certified Forensic Examiner, Kiosks are vulnerable to potentially serious abuse. For example, without proper controls, it is possible that a Kiosk user could use this tool to view private cell phone information for non-law enforcement purposes. It also is possible for a user to use a Kiosk without proper legal authority, thereby engaging in a Fourth Amendment violation.

Later in the report, the IG noted that none of the centralized databases tracking other uses of the forensic office track use of the kiosk. That, combined with the paperwork failures, would sure permit FBI to do a whole lot of illegal cell phone searching that would not be tracked.

Which might explain why the numbers FBI shows for searching cell phones don’t actually match Director Comey’s stated concerns about iPhone encrypting its phone.

Heinonen Moves Deceptive Anti-Iran Campaign from Washington Post Opinion Page to New York Times News Page

/15 Comments/in , /by
Composite figure of partial screengrabs from the Leadership page for United Against Nuclear Iran showing Heinonen's role as a member of its Advisory Board. Remarkably, Heinonen prefers not to note this role while his spouting his strongest anti-Iran positions.

Composite figure of partial screengrabs from the Leadership page for United Against Nuclear Iran showing Heinonen’s role as a member of its Advisory Board. Remarkably, Heinonen prefers not to note this role while his spouting his strongest anti-Iran positions.

Last week, I called attention to the fact that in printing an op-ed by Olli Heinonen (co-authored by Michael Hayden and Ray Takeyh), the Washington Post failed to disclose Heinonen’s position on the advisory board of the anti-Iran group United Against Nuclear Iran. One week later, the Post still has not corrected its identification of Heinonen. Today, we see that Heinonen’s deceptive anti-Iran campaign continues, where he appears as a key expert quoted in a front page New York Times article by David Sanger and Michael Gordon. Once again, Heinonen is only identified by his previous IAEA and current Harvard roles, ignoring his more relevant current role with UANI.

Ironically, today’s Times story is a follow-up to a story in November in which Sanger committed a glaring error which still has not been noted by the Times. Heinonen’s co-conspirator from the Post op-ed, Ray Takeyh, also makes an appearance in today’s Sanger and Gordon article, suggesting that their propaganda will remain as a package deal for the duration of the P5+1 negotiations.

Note also that last Monday, the defamation case by Victor Restis against UANI was thrown out by a district court after the Department of Justice successfully intervened to have the case quashed under a claim that state secrets would have been divulged. Writing in Bloomberg View, Noah Feldman mused:

What makes matters worse is the lingering possibility, indeed probability, that what the government fears is not a true threat to national security, but a severe case of embarrassment. It’s difficult to escape the conclusion that United Against is a front organization for U.S. intelligence, possibly acting in conjunction with other foreign intelligence services. The allegation that Restis was doing business in Iran seems almost certain to have come from one of these intelligence services. Would acknowledging cooperation between, say, the Central Intelligence Agency and Mossad regarding Iran really upend national security? True, it’s a delicate time in the Iran nuclear negotiations. But no one, least of all the Iranians, doubts that U.S. and Israeli intelligence collaborate.

Though Feldman notes that it seems obvious there is an intelligence conduit between the CIA and/or Mossad and UANI and he even notes that disclosing this now would be awkward for the P5+1 negotiations, he should have gone further to note that this intelligence link, and the subsequent selective leaks, seem aimed to disrupt those negotiations and prevent an agreement.

In that same vein, it should be noted that the Sanger and Gordon article focuses only on barriers to an agreement. In addition to Heinonen and Takeyh, the article also sought out comment from John Boehner. No comment was offered in the article from anyone favoring an agreement or suggesting that Iran has abided by the terms of the interim agreement (although they do note IAEA has reported this cooperation) despite Boehner’s protestation that the Iranians don’t keep their word.

Further, Sanger and Gordon write that Heinonen published a paper on the breakout time needed for Iran to enrich enough uranium to weapons grade to produce a bomb. As a scientist, when I read that someone has published a paper, I assume that means it has appeared in a peer-reviewed journal. Following the link in the Times article for Heinonen’s “paper”, though, brings one to the website for a think tank, where Heinonen’s piece is only referred to as a fact sheet. [And, true to form, the site mentions Heinonen’s former IAEA role but not his current UANI role.]

It is impossible for me to escape the conclusion that Olli Heinonen and Ray Takeyh are part of an organized propaganda campaign aimed at disrupting the P5+1 talks and preventing an agreement. This propaganda is eagerly published by a compliant press, with the New York Times, Washington Post and AP among the most recent examples I have noted.

It is long past time for Heinonen to list his UANI affiliation in all his public pronouncements. His refusal to do so can only be seen as deception on his part and an effort to lend IAEA and Harvard credence to UANI propaganda.

Update: The US has disputed the central claim of the Sanger and Gordon article at the heart of this post. Sanger and Gordon report on that here.

FBI’s Preventative Role: Hygiene for Corporations, Spies for Muslims

/7 Comments/in , , /by

I’m still deep in this 9/11 Follow-up Report FBI, which Jim Comey and now-retired Congressman Frank Wolf had done last year and which released the unsurprising topline conclusion that Jim Comey needs to have more power, released earlier this week.

About the only conclusion in the report that Comey disagreed with — per this Josh Gerstein report — is that it should get out of the business of Countering Violent Extremism.

Comey said he agreed with many of the report’s recommendations, but he challenged the proposal that the FBI leave counter-extremism work to other agencies.

“I respectfully disagree with the review commission,” the director said. “It should not be focused on messages about faith it should not be socially focused, but we have an expertise … I have these people who spend all day long thinking dark thoughts and doing research at Quantico, my Behavioral Analysis Unit. They have an incredibly important role to play in countering violent extremism.”

Here’s what the report had to say about FBI and CVE (note, this is a profoundly ahistorical take on the serial efforts to CVE, but that’s just one of many analytical problems with this report).

The FBI, like DHS, NCTC, and other agencies, has made an admirable effort to counter violent extremism (CVE) as mandated in the White House’s December 2011 strategy, Empowering Local Partners to Prevent Violent Extremism in the United States. In January 2012, the FBI established the Countering Violent Extremism Office (CVEO) under the National Security Branch.322 The CVEO was re-aligned in January 2013 to CTD’s Domestic Terrorism Operations Section, under the National JTTF, to better leverage the collaborative participation of the dozens of participating agencies in FBI’s CVE efforts.323 Yet, even within FBI, there is a misperception by some that CVE efforts are the same as FBI’s community outreach efforts. Many field offices remain unaware of the CVE resources available through the CVEO.324 Because the field offices have to own and integrate the CVE portfolio without the benefit of additional resources from FBI Headquarters, there is understandably inconsistent implementation. The Review Commission, through interviews and meetings, heard doubts expressed by FBI personnel and its partners regarding the FBI’s central role in the CVE program. The implementation had been inconsistent and confusing within the FBI, to outside partners, and to local communities.325 The CVEO’s current limited budget and fundamental law enforcement and intelligence responsibilities do not make it an appropriate vehicle for the social and prevention role in the CVE mission. Such initiatives are best undertaken by other government agencies. The Review Commission recommends that the primary social and prevention responsibilities for the CVE mission should be transferred from the FBI to DHS or distributed among other agencies more directly involved with community interaction.

[snip]

(U) Recommendation 6: The Review Commission recommends that the primary social and prevention responsibilities for the CVE mission should be transferred from the FBI to DHS or distributed among other agencies more directly involved with community interaction.

For what it’s worth, Muslim communities increasingly agree that the FBI — and the federal government generally — should not be in the business of CVE. But that’s largely because the government approaches it with the same view Comey does: by thinking immediately of his analysts thinking dark thoughts at Quantico. So if some agency that had credibility — if some agency had credibility — at diverting youth (of all faiths) who might otherwise get caught in an FBI sting, I could support it moving someplace else, but I’m skeptical DHS or any other existing federal agency is that agency right now.

While the Review doesn’t say explicitly in this section what it wants the FBI to be doing instead of CVE, elsewhere it emphasizes that it wants the FBI to do more racial profiling (AKA “domain awareness”) and run more informants. Thus, I think it fair to argue that the Ed Meese-led panel thinks the FBI should spy on Muslims, not reach out to them. Occupation-style federal intelligence gathering, not community based.

Which is why I think this approach to Muslim communities should be compared directly with the Review’s approach with corporations. The same report that says FBI should not be in the business of CVE — which done properly is outreach to at-risk communities — says that it should accelerate and increase its funding for its outreach to the private sector.

(U) Recommendation 5: The Review Commission recommends that the FBI enhance and accelerate its outreach to the private sector.

  • (U) The FBI should work with Congress to develop legislation that facilitates private companies’ communication and collaboration and work with the US Government in countering cyber threats.
  • (U) The FBI should play a prominent role in coordinating with the private sector, which the Review Commission believes will require a full-time position for a qualified special agent in the relevant field offices, as well as existing oversight at Headquarters.

Indeed, in a paragraph explaining why the FBI should add more private sector liaisons (and give them the same credit they’d get if they recruited corporations as narcs, only corporations shouldn’t be called “sources” because it would carry the stigma of being a narc), the Review approvingly describes the FBI liaison officers working with corporations to promote better Internet hygiene.

The Review Commission learned that the FBI liaison positions have traditionally been undervalued but that has begun to change as more experienced special agents take on the role, although this has not yet resulted in adequate numbers of assigned special agents or adequate training for those in the position. One field office noted that it had 400 cleared defense contractors (CDCs) in its AOR—ranging from large well known names to far smaller enterprises—with only one liaison officer handling hundreds of CDCs. This field office emphasized the critical need for more liaison officers to conduct outreach to these companies to promote better internet hygiene, reduce the number of breaches, and promote long-term cooperation with the FBI.319 Another field office noted, however, some sensitivity in these liaison relationships because labeling private sector contacts as sources could create a stigma. The field office argued that liaison contacts should be considered valuable and special agents should receive credit for the quality of liaison relationships the same way they do for CHSs.320

Ed Meese’s panel wants the FBI to do the digital equivalent of teaching corporations to blow their nose and wash their hands after peeing, but it doesn’t think the FBI should spend time reaching out to Muslim communities but should instead spy on them via paid informants.

Maybe there are good reasons for the panel’s disparate recommended treatment of corporations and Muslim communities. If so, the Review doesn’t explain it anywhere (though the approach is solidly in line with the Intelligence Committees’ rush to give corporations immunity to cyber share information with the federal government).

But it does seem worth noting that this panel has advocated the nanny state for one stakeholder and STASI state for another.