Time to Investigate John Brennan and Those Air Marshals Again

Back in September I noted that the entire narrative of the guilty plea from Donald Sachtleben presented the false impression that he was the first, only, or most dangerous leaker about the UndieBomb 2.0.

But, as bmaz emphasized in his post on Donald Sachtleben’s plea agreement, there’s no hint of prosecuting Brennan, who leaked Top Secret details about the British/Saudi double agent into AQAP, even while they’re imprisoning Donald Sachtleben, who is only accused of leaking details he knew to be Secret.

[snip]

They would also have you believe the AP had no inkling of the UndieBomb plot until ABC reported inflammatory claims about cavity bombs on April 30, 2012, even in spite of ABC’s reference to TSA head John Pistole’s earlier fear-mongering about it and in spite of additional reporting about broad Air Marshall mobilization.

That was nonsensical on its face.

But it is something that Sachtleben went out of his way to make clear at his sentencing yesterday.

“I was neither the sole nor the original source of information to ‘Reporter A’ about the suicide bomb,” Sachtleben said in a statement sent by his law firm. “The information I shared with Reporter A merely confirmed what he already believed to be true. Any implication that I was the direct source of a serious leak is an exaggeration.”

Ah well. Eric Holder has his head, and DOJ doesn’t have to prosecute the CIA Director now.

Lavabit and The Definition of US Government Hubris

Graphic by Darth

Graphic by Darth

Well, you know, if you do not WANT the United States Government sniffing in your and your family’s underwear, it is YOUR fault. Silly American citizens with your outdated stupid piece of paper you call the Constitution.

Really, get out if you are a citizen, or an American communication provider, that actually respects American citizen’s rights. These trivialities the American ethos was founded on are “no longer operative” in the minds of the surveillance officers who claim to live to protect us.

Do not even think about trying to protect your private communications with something so anti-American as privacy enabling encryption like Lavabit which only weakly, at best, even deigned to supply.

Any encryption that is capable of protecting an American citizen’s private communication (or even participating in the TOR network) is essentially inherently criminal and cause for potentially being designated a “selector“, if not target, of any number of searches, whether domestically controlled by the one sided ex-parte FISA Court, or hidden under Executive Order 12333, or done under foreign collection status and deemed “incidental”. Lavabit’s Ladar Levinson knows.

Which brings us to where we are today. Let Josh Gerstein set the stage:

A former e-mail provider for National Security Agency leaker Edward Snowden, Lavabit LLC, filed a legal brief Thursday detailing the firm’s offers to provide information about what appear to have been Snowden’s communications as part of a last-ditch offer that prosecutors rejected as inadequate.

The disagreement detailed in a brief filed Thursday with the U.S. Court of Appeals for the Fourth Circuit resulted in Lavabit turning over its encryption keys to the federal government and then shutting down the firm’s secure e-mail service altogether after viewing it as unacceptably tainted by the FBI’s possession of the keys.

I have a different take on the key language from Lavabit’s argument in their appellate brief though, here is mine:

First, the government is bereft of any statutory authority to command the production of Lavabit’s private keys. The Pen Register Statute requires only that a company provide the government with technical assistance in the installation of a pen- trap device; providing encryption keys does not aid in the device’s installation at all, but rather in its use. Moreover, providing private keys is not “unobtrusive,” as the statute requires, and results in interference with Lavabit’s services, which the statute forbids. Nor does the Stored Communications Act authorize the government to seize a company’s private keys. It permits seizure of the contents of an electronic communication (which private keys are not), or information pertaining to a subscriber (which private keys are also, by definition, not). And at any rate it does not authorize the government to impose undue burdens on the innocent target business, which the government’s course of conduct here surely did.

Second, the Fourth Amendment independently prohibited what the government did here. The Fourth Amendment requires a warrant to be founded on probable cause that a search will uncover fruits, instrumentalities, or evidence of a crime. But Lavabit’s private keys are none of those things: they are lawful to possess and use, they were known only to Lavabit and never used by the company to commit a crime, and they do not prove that any crime occurred. In addition, the government’s proposal to examine the correspondence of all of Lavabit’s customers as it searched for information about its target was both beyond the scope of the probable cause it demonstrated and inconsistent with the Fourth Amendment’s particularity requirement, and it completely undermines Lavabit’s lawful business model. General rummaging through all of an innocent business’ communications with all of its customers is at the very core of what the Fourth Amendment prohibits.

The legal niceties of Lavabit’s arguments are thus:

The Pen Register Statute does not come close. An anodyne mandate to provide information needed merely for the “unobtrusive installation” of a device will not do. If there is any doubt, this Court should construe the statute in light of the serious constitutional concerns discussed below, to give effect to the “principle of constitutional avoidance” that requires this Court to avoid constructions of statutes that raise colorable constitutional difficulties. Norfolk S. Ry. Co. v. City of Alexandria, 608 F.3d 150, 156–57 (4th Cir. 2010).

And, later in the pleading:

By those lights, this is a very easy case. Lavabit’s private keys are not connected with criminal activity in the slightest—the government has never accused Lavabit of being a co-conspirator, for example. The target of the government’s investigation never had access to those private keys. Nor did anyone, in fact, other than Lavabit. Given that Lavabit is not suspected or accused of any crime, it is quite impossible for information known only to Lavabit to be evidence that a crime has occurred. The government will not introduce Lavabit’s private keys in its case against its target, and it will not use Lavabit’s private keys to impeach its target at trial. Lavabit’s private keys are not the fruit of any crime, and no one has ever used them to commit any crime. Under those circumstances, absent any connection between the private keys and a crime, the “conclusion[] necessary to the issuance of the warrant” was totally absent. Zurcher, 436 U.S., at 557 n.6 (quoting, with approval, Comment, 28 U. Chi. L. Rev. 664, 687 (1961)).

What this boils down to is, essentially, the government thinks the keys to Lavabit’s encryption for their customers belong not just to Lavabit, and their respective customers, but to the United States government itself.

Your private information cannot be private in the face of the United States Government. Not just Edward Snowden, but anybody, and everybody, is theirs if they want it. That is the definition of bullshit.

[Okay, big thanks to Darth, who generously agreed to let us use the killer Strangelovian graphic above. Please follow Darth on Twitter]

Charles McCullough Too Busy Investigating Leakers to Investigate the Dragnet

As I noted back in September, Patrick Leahy and a bunch of other Senators asked the Intelligence Community Inspector General Charles McCullough to investigate the dragnet.

In particular, we urge you to review for calendar years 2010 through 2013:

  • the use and implementation of Section 215 and Section 702 authorities, including the manner in which information – and in particular, information about U.S. persons – is collected, retained, analyzed and disseminated;
  • applicable minimization procedures and other relevant procedures and guidelines, including whether they are consistent across agencies and the extent to which they protect the privacy rights of U.S. persons;
  • any improper or illegal use of the authorities or information collected pursuant to them; and
  • an examination of the effectiveness of the authorities as investigative and intelligence tools.

McCullough just answered.

No.

“At present, we are not resourced to conduct the requested review within the requested timeframe,” wrote McCullough, before adding he and other agency inspectors general are weighing now whether they can combine forces on a larger probe.

Leahy had asked McCullough to finish in what was then 15 months, December 2014, which would make it available for the PATRIOT Reauthorization due the next year.

Note, McCullough gave the same answer he and NSA’s IG gave when Ron Wyden asked how many Americans get caught up in the dragnet.

Not enough resources.

Mind you, he apparently has enough resources to do this:

Finally, we began to implement a program to lead IC-wide administrative investigations into unauthorized disclosures of classified information (i.e., “leak”) matters.

[snip]

The Investigations Division reviewed hundreds of closed cases from across the IC. Going forward, the division will engage in gap mitigation for those cases where an agency does not have the authority to investigate (multiple agencies or programs) or where DOJ declined criminal prosecution. The division will conduct administrative investigations with IG Investigators from affected IC elements to maximize efficiencies, expedite investigations, and enhance partnerships.

[snip]

The Investigations Division is reviewing 375 unauthorized disclosure case files.

But not enough resources to review a massive dragnet affecting every American in time to have results before the dragnet gets reauthorized.

Update: And apparently the Senate Intelligence Committee just told ODNI to investigate more leaks and pre-leaks.

  • Empowering the Director of National Intelligence to improve the government’s process to investigate (and reinvestigate) individuals with security clearances to access classified information;

The Spooks Will Never Have Their Software Self-Spying Working

Mark Hosenball seems to have gotten as obsessed with the Intelligence Community’s inability or unwillingness to implement the automated Insider Threat tracking software mandated by Congress (see here and here). After reporting last week that the Hawaii NAS location where Edward Snowden worked didn’t have insider threat detection software installed because of bandwidth problems, he reported earlier this week that DOD will miss the new Congressionally mandated deadlines to have it working, again partly for bandwidth reasons.

But the intelligence agencies have already missed an October 1 deadline for having the software fully in use, and are warning of further delays.

Officials responsible for tightening data security say insider threat-detection software, which logs events such as unusually large downloads of material or attempts at unauthorized access, is expensive to adopt.

It also takes up considerable computing and communications bandwidth, degrading the performance of systems on which it is installed, they said.

[snip]

The latest law requires the agencies to have the new security measures’ basic “initial operating capability” installed by this month and to have the systems fully operational by October 1, 2014.

But U.S. officials acknowledged it was unlikely agencies would be able to meet even that deadline, and Congress would likely have to extend it further. One official said intelligence agencies had already asked Congress to extend the deadline beyond October 2014 but that legislators had so far refused.

If the Intelligence Committees were unable to get the IC to take this mandate seriously after the Chelsea Manning leaks, I don’t see any reason they’ll show more focus on doing so after Edward Snowden. They seem either unable to back off their spying bandwidth draw far enough to implement the security to avoid another giant leak, or unwilling to subject their workers (or themselves?) to this kind of scrutiny.

This is why I made the Ozymandias joke the other day. Parallel with our headlong rush toward destruction via climate change, the IC doesn’t seem able to reverse the manic demand for more data long enough to protect the collection systems they’ve got, or at least the mission critical ones. That is not a sign of an organization that can survive long.

Surveillance Logic: Snowden Is Bad because AQAP Conference Call Leak Was

McClatchy did an interview with former national security official Ken Wainstein. He focuses on leaks, explaining how sometimes the “good leaks” don’t get prosecuted and admitting that overclassification is a problem.

But in response to McClatchy’s suggestion that Edward Snowden’s leaks are good, Wainstein responds in a bizarre fashion — by bringing up an entirely different leak.

Q: Do you weigh the public’s interest in the information that was leaked and whether it served the public good? For example, would you weigh whether Snowden’s actions triggered a broader debate about classified programs that the public should have known more about?

A: I think prosecutors would look at the intent of the leaker and what that person was intending to do.

But you wouldn’t have consensus that (the Snowden leak) was the best way to bring about this debate and that there hasn’t been damage. Just last week, for example, there was talk about how al Qaeda has shut down some of its communications because of aleak. I wouldn’t say it’s a given that it’s in the public interest that these disclosures are out there.

Wainstein’s talking, of course, of the NYT report that the public reports about the AQAP conference call story caused the terrorists to start using other communication methods.

But there are several problems with his claim. First, as I’ve pointed out, there’s a significant likelihood the leak in question came from AQAP sympathizers in the Yemeni government; in any case the leak was sourced to a broadly known fact in Yemen, not the US.

More importantly, the entire point of the story was that that AQAP leak had done more damage than all of Edward Snowden’s leaks. In fact, when criticized for the story, NYT’s editor pointed to that comparative fact as the entire point of the story.

He also said that many of the critics of the story “are missing part of the news here – that Snowden has not given away the store” in terms of harming national security or counterterrorism efforts.

The article, Mr. Hamilton said, “told an important and surprising story given the focus on Edward Snowden and the N.S.A. leaks. It had the kind of detail about terrorist operations that only reporters with long experience in national security coverage – and sources they can trust – can uncover.”

In other words, in response to a suggestion that Snowden’s leak did more harm than good, Wainstein points to a story that, even if the emphasis was wrong, pointed out that Snowden hadn’t done much damage.

Maybe Wainstein brought it up to suggest that McClatchy had better watch out; the AQAP story was also a McClatchy story. He’d be better off thanking McClatchy for making it clear someone in Yemen doesn’t keep our secrets very well.

But I guess that would ruin his entire scold about Edward Snowden.

The Kiddie Porn and the UndieBomb

Screen shot 2013-09-26 at 1.22.11 PMI was at a funeral Monday and Tuesday. So when I heard the FBI had busted the guy who leaked the UndieBomb 2.0 story, I assumed they had finally arrested John Brennan.

But, as bmaz emphasized in his post on Donald Sachtleben’s plea agreement, there’s no hint of prosecuting Brennan, who leaked Top Secret details about the British/Saudi double agent into AQAP, even while they’re imprisoning Donald Sachtleben, who is only accused of leaking details he knew to be Secret.

A law enforcement official indicated that the case has not been officially closed but the charges against Sachtleben are the only ones expected.

(Sure, the evidence that Sachtleben was involved with kiddie porn seems solid, but then Brennan drone-killed children, so he’s not above reproach for his treatment of children either.)

But that is by no means the weirdest thing about the government’s treatment of the UndieBomb 2.0 leak investigation.

The entire premise of the FBI narrative is that they exercised greater care with a kiddie porn accusee they had dead to rights than they did the 100 or so AP reporters who got sucked up in their overbroad dragnet. They would have you believe that, even after seizing a CD holding a November 2, 2006 SECRET CIA intelligence report at Sachtleben’s house in May 2012 pursuant to a kiddie porn warrant (which they have not produced in the docket), they just sat on his devices for almost a year until they obtained the phone records for 20 AP phone lines, in a seizure far more intrusive into journalism than any recent known subpoena.

Sachtleben was identified as a suspect in the case of this unauthorized disclosure only after toll records for phone numbers related to the reporter were obtained through a subpoena and compared to other evidence collected during the leak investigation. This allowed investigators to obtain a search warrant authorizing a more exhaustive search of Sachtleben’s cell phone, computer, and other electronic media, which were in the possession of federal investigators due to the child pornography investigation.

(I may be mistaken, but I don’t think the FBI made this claim in any court document, so I assume it is bullshit, especially since they had had to do extensive forensic searches of Sachtleben’s computer and he had already signed a plea deal forfeiting it.)

They would also have you believe the AP had no inkling of the UndieBomb plot until ABC reported inflammatory claims about cavity bombs on April 30, 2012, even in spite of ABC’s reference to TSA head John Pistole’s earlier fear-mongering about it and in spite of additional reporting about broad Air Marshall mobilization. DOJ goes to great lengths to make you believe AP first texted Sachtleben on April 30 and not, say, on April 28 (which would mean the kiddie porn investigation accelerated after such contact), though there’s no reason to believe that’s true and the AP call records DOJ obtained apparently go back to well before April 30. They also suggest AP was asking Sachtleben about an Asiri bomb, though the first text they include is an assertion — not a question — that Asiri has been busy.

They would have you believe that two Pulitzer Prize winners would defy White House and CIA wishes with a story sourced to a single source who, just a day earlier, had provided a mistaken guess about the excitement. Read more

Further Implications of UndieBomb II Leaker Guilty Plea

As you have likely heard by now, a former FBI agent has agreed to plead guilty to leaking material about the second underwear bomb attempt to reporters in May of 2012. Charlie Savage of the New York Times has the primary rundown:

A former Federal Bureau of Investigation agent has agreed to plead guilty to leaking classified information to The Associated Press about a foiled bomb plot in Yemen last year, the Justice Department announced on Monday. Federal investigators said they identified him after obtaining phone logs of Associated Press reporters.

The retired agent, a former bomb technician named Donald Sachtleben, has agreed to serve 43 months in prison, the Justice Department said. The case brings to eight the number of leak-related prosecutions brought under President Obama’s administration; under all previous presidents, there were three such cases.

“This prosecution demonstrates our deep resolve to hold accountable anyone who would violate their solemn duty to protect our nation’s secrets and to prevent future, potentially devastating leaks by those who would wantonly ignore their obligations to safeguard classified information,” said Ronald C. Machen Jr., the United States attorney for the District of Columbia, who was assigned to lead the investigation by Attorney General Eric H. Holder Jr.

In a twist, Mr. Sachtleben, 55, of Carmel, Ind., was already the subject of a separate F.B.I. investigation for distributing child pornography, and has separately agreed to plead guilty in that matter and serve 97 months. His total sentence for both sets of offenses, should the plea deal be accepted by a judge, is 140 months.

Here is the DOJ Press Release on the case.

Here is the information filed in SDIN (Southern District of Indiana). And here is the factual basis for the guilty plea on the child porn charges Sachtleben is also pleading guilty to.

So Sachtleben is the leaker, he’s going to plead guilty and this all has a nice beautiful bow on it! Yay! Except that there are several troubling issues presented by all this tidy wonderful case wrap up.

First off, the information on the leak charges refers only to “Reporter A”, “Reporter A’s news organization” and “another reporter from Reporter A’s news organization”. Now while the DOJ may be coy about the identities, it has long been clear that the “news organization” is the AP and “Reporter A” and “another reporter” are AP national security reporters Matt Apuzzo and Adam Goldman (I’d hazard a guess probably in that order) and the subject article for the leak is this AP report from May 7, 2012.

What is notable about who the reporters are, and which story is involved, is that this is the exact matter that was the subject of the infamous AP phone records subpoenas that were incredibly broad – over 20 business and personal phone lines. These subpoenas, along with those in the US v. Steven Kim case collected against James Rosen and Fox News, caused a major uproar about the sanctity of First Amendment press and government intrusion thereon.

The issue here is that Attorney General Eric Holder and the DOJ, as a result of the uproar over the Read more

Bradley Manning’s Sentence, Parole and Appeal Implications

CryingJusticeOn Monday I laid out the dynamics that would be in play for the court in considering what sentence to give Bradley Manning in light of both the trial evidence and testimony, and that presented during the sentencing phase after the guilty verdict was rendered. Judge Lind has entered her decision, and Bradley Manning has been sentenced to a term of 35 years, had his rank reduced to E-1, had all pay & allowances forfeited, and been ordered dishonorably discharged. This post will describe the parole, appeal and incarceration implications of the sentence just imposed.

Initially, as previously stated, Pvt. Manning was credited with the 112 days of compensatory time awarded due to the finding that he was subjected to inappropriate pre-trial detention conditions while at Quantico. Pvt. Manning was credited with a total 1294 days of pre-trial incarceration credit for the compensatory time and time he has already served since the date of his arrest.

Most importantly at this point, Manning was sentenced today to a prison term of 35 years and the issue of what that sentence means – above and beyond the credit he was given both for compensatory time and time served – is what is critical going forward. The following is a look at the process, step by step, Bradley Manning will face.

The first thing that will happen now that Judge Lind has gaveled her proceedings to a close is the court will start assembling the record, in terms of complete transcript, exhibits and full docket, for transmission to the convening authority for review. It is not an understatement to say that this a huge task, as the Manning record may well be the largest ever produced in a military court martial. It will be a massive undertaking and transmission.

At the same time, the defense will start preparing their path forward in terms of issues they wish to argue. It is my understanding that Pvt. Manning has determined to continue with David Coombs as lead counsel for review and appeal, which makes sense as Coombs is fully up to speed and, at least in my opinion, has done a fantastic job. For both skill and continuity, this is a smart move.

The next step will be designation of issues to raise for review by the “convening authority”. In this case, the convening authority is Major General Jeffrey Buchanan, who heads, as Commanding General, the US Army’s Military District of Washington. This step is quite different than civilian courts, where a defendant proceeds directly to an appellate court.

The accused first has the opportunity to submit matters to the convening authority before the convening authority takes action – it’s not characterized as an “appeal,” but it’s an accused’s first opportunity to seek relief on the findings and/or the sentence. According to the Manual for Courts-Martial, Rule for Court-Martial 1105:

(a) In general. After a sentence is adjudged in any court-martial, the accused may submit matters to the convening authority in accordance with this rule.

(b) Matters which may be submitted.
(1) The accused may submit to the convening au­ thority any matters that may reasonably tend to af­ fect the convening authority’s decision whether to disapprove any findings of guilty or to approve the sentence. The convening authority is only required to consider written submissions.
(2) Submissions are not subject to the Military Rules of Evidence and may include:
(A) Allegations of errors affecting the legality of the findings or sentence;
(B) Portions or summaries of the record and copies of documentary evidence offered or intro­ duced at trial;
(C) Matters in mitigation which were not avail­ able for consideration at the court-martial; and
(D) Clemency recommendations by any mem­ber, the military judge, or any other person. The defense may ask any person for such a recommendation.

Once the convening authority has the full record and the defense has designated its matters for review, Buchanan will perform his review and determine whether any adjustments to the sentence are appropriate, and that will be considered the final sentence. At this point, the only further review is by a traditional appeal process.

Generally, the level of appellate review a case receives depends on the sentence as approved by the Read more

The Bradley Manning Sentencing Dynamics

U.S. Army Private First Class Bradley Manning stands convicted of crimes under the Uniform Code of Military Justice (UCMJ). The convictions result from two events. The first was a voluntary plea of guilty by Pvt. Manning to ten lesser included charges in February, and the remainder from a verdict of guilty after trial entered by Judge Denise Lind on July 30.

The maximum possible combined sentence originally stood at 136 years for the guilty counts, but that was reduced to a maximum possible sentence of 90 years after the court entered findings of merger for several of the offenses on August 6. The “merger” resulted from the partial granting of a motion by Mr. Manning’s attorney arguing some of the offenses were effectively the same conduct and were therefore multiplicitous. The original verdict status, as well as the revised verdict status after the partial merger of offenses by the court, is contained in a very useful spreadsheet created by Alexa O’Brien (whose tireless coverage of the Manning trial has been nothing short of incredible).

Since the verdict and merger ruling, there have been two weeks of sentencing witnesses, testimony and evidence presented by both the government and defense to the court. It is not the purpose of this post to detail the testimony and evidence per se, but rather the mechanics of the sentencing process and how it will likely be carried out. For detailed coverage of the testimony and evidence, in addition to Alexa O’Brien, the reportage of Kevin Gosztola at FDL Dissenter, Julie Tate at Washington Post, Charlie Savage at New York Times and Nathan Fuller at the Bradley Manning Support Network has been outstanding.

All that is left are closing arguments and deliberation by Judge Lind on the final sentence she will hand down. So, what exactly does that portend for Bradley Manning, and how will it play out? Only Judge Lind can say what the actual sentence will be, but there is much guidance and procedural framework that is known and codified in rules, practice and procedure under the UCMJ.

Initially, the obvious should be stated, Bradley Manning is in front of an Army court martial process under the UCMJ, and while there is Read more

The Clapper Review: How to Fire 90% of SysAdmins?

Yesterday, I noted it took just 72 hours from Obama to turn an “independent” “outside” review of the government’s SIGINT programs into the James Clapper Review of James Clapper’s SIGINT Programs.

But many other commenters have focused on the changed description of the review’s mandate. In his speech on Friday, Obama said the review would study, “how we can maintain the trust of the people, how we can make sure that there absolutely is no abuse in terms of how these surveillance technologies are used, ask how surveillance impacts our foreign policy.”

On Monday, his instruction to James Clapper said the review would, “whether, in light of advancements in communications technologies, the United States employs its technical collection capabilities in a manner that optimally protects our national security and advances our foreign policy while appropriately accounting for other policy considerations, such as the risk of unauthorized disclosure and our need to maintain the public trust.”

Both addressed public trust. But Monday’s statement replaced a focus on “absolutely no abuse” with “risk of unauthorized disclosure.”

Now, I’m not certain, but I’m guessing we all totally misunderstood (by design) Obama’s promises on Friday.

The day before the President made those promises, after all, Keith Alexander made a different set of promises.

“What we’re in the process of doing – not fast enough – is reducing our system administrators by about 90 percent,” he said.

The remarks came as the agency is facing scrutiny after Snowden, who had been one of about 1,000 system administrators who help run the agency’s networks, leaked classified details about surveillance programs to the press.

Before the change, “what we’ve done is we’ve put people in the loop of transferring data, securing networks and doing things that machines are probably better at doing,” Alexander said.

We already know that NSA’s plan to minimize the risk of unauthorized disclosure involves firing 900 SysAdmins (Bruce Schneier provides some necessary skepticism about the move). They probably believe that automating everything (including, presumably, the audit-free massaging of the metadata dragnet data before analysts get to it) will ensure there “absolutely is no abuse.”

And by turning the review intended to placate the civil libertarians into the review that will come up with the brilliant idea of putting HAL in charge of spying, the fired SysAdmins might just blame the civil libertarians.

So this review we all thought might improve privacy? Seems, instead, designed to find ways to fire more people faster.