Lurking Jared

/9 Comments/in /by

I’m still working my way through the Jim Comey testimony. But I’m frankly shocked by this detail: In Comey’s description of the February 14 Oval Office meeting — after which Trump addressed Comey privately about Mike Flynn’s recent firing — he includes this paragraph.

The President signaled the end of the briefing by thanking the group and
telling them all that he wanted to speak to me alone. I stayed in my chair. As the
participants started to leave the Oval Office, the Attorney General lingered by my
chair, but the President thanked him and said he wanted to speak only with me.
The last person to leave was Jared Kushner, who also stood by my chair and
exchanged pleasantries with me. The President then excused him, saying he
wanted to speak with me.

That is, right before Trump started buttering Comey up about the Mike Flynn investigation, both Jeff Sessions and Jared Kushner lurked around. Notably, Comey describes Kushner “exchang[ing] pleasantries” with Comey, perhaps trying to butter him up.

I’ve written before about the Comey-Kushner connection. Apparently I wasn’t the only one to note how creepy Kushner is.

If We Have to Have FISA, Can We at Least Not Give It to Contractors?

/22 Comments/in , /by

In very close succession today, the Intercept published a story on Russia’s efforts to hack election-related officials and the government arrested the apparent source for that story, a woman named Reality Winner.

The story — which reports GRU attempted to phish some officials — is most interesting for the dates included in the leaked document accompanying the story. The document — dated May 5 but covering events from last fall — describes phishing attempts starting as early as a month before the election up to October 31 or November 1.

That latest date (on a report published six months later) is interesting because we know President Obama used the cyber “red phone” to contact Vladimir Putin on October 31, for the first time in his presidency, to complain about election-related hacking. The dates here at least suggest that there were no more phishing attempts initiated after that call.

Of course, now Russia knows more details about how granularly, and on what schedule, NSA might learn such details.

The other big part of this incident, however, is the revelation that contractors well outside the known entities (like Booz Allen Hamilton) have access to FISA information — as indicated by the classification stamp — and that even people without a need to know that information can access it.

This leak was discovered because another of Intercept’s sources alerted the NSA. But had that not happened (or had the Intercept not showed the NSA a folded document), then it’s not clear this would have been discovered.

I get why we need to disseminate such information widely. But even if this information merely reports on stuff that had already been reported (to the WaPo, long ago), it nevertheless is testament to the degree to which adding contractors adds the likelihood of leaks.

Or let’s put it this way: we’re sharing FISA information with contractors who don’t have a need to know. But we’re not sharing it with defendants whose freedom depends on contesting it. Maybe those priorities are screwy?

 

Putin Starts Talking about Hackers’ Art in Advance of Yevgeniy Nikulin Extradition

/23 Comments/in /by

Yesterday, Vladimir Putin shifted from the public denials he has made about Russia’s role in the hack of the DNC. Whereas even just days ago, he had denied any involvement, yesterday he suggested Russian hackers might on their own decide to hack Russia’s adversaries out of patriotism.

Asked about suspicions that Russia might try to interfere in the coming elections in Germany, Mr. Putin raised the possibility of attacks on foreign votes by what he portrayed as free-spirited Russian patriots. Hackers, he said, “are like artists” who choose their targets depending how they feel “when they wake up in the morning.” Any such attacks, he added, could not alter the result of elections in Europe, America or elsewhere.

Artists, he said, paint if they wake up feeling in good spirits while hackers respond if “they wake up and read that something is going on in interstate relations” that prompts them to take action. “If they are patriotically minded, they start making their contributions — which are right, from their point of view — to the fight against those who say bad things about Russia,” Mr. Putin added, apparently referring to Hillary Clinton.

Putin’s change, to the extent it is one, may reflect recent events in Prague, where Russian hacker Yevgeniy Nikulin had a hearing on America’s extradition request. As the Guardian describes, the Czechs seem fairly close to approving Nikulin’s extradition to the US.

A 17-page affidavit by [FBI Agent Jeffrey] Miller, seen by the Guardian, outlines the evidence against Nikulin to the Czech court. The affidavit lists some of the aliases Nikulin is alleged to have used, including Chinabig01, Eugene, Uarebeenhacked, John Pattison and itBlackHat.

According to Miller’s affidavit, the FBI evidence is based on “witness interviews including confidential sources, ISP records, court-authorised electronic interceptions, and other sources”. Some of the electronic intercepts were emails from the Gmail account of Alexei Belan, a hacker on the FBI wanted list for allegedly conspiring with Russian FSB agents to perpetrate a huge hack on Yahoo in 2014. Belan is on the FBI’s cyber top 10 most wanted list. None of the raw evidence was provided to the court.

The affidavit relates solely to the hacking of LinkedIn, Dropbox and Formspring in 2012, and does not mention any election hacking.

However, Nikulin wrote in a letter from prison that Miller had interrogated him in Prague on 7 February and raised the election hacking. Excerpts of the letter were provided to the Guardian by Nikulin’s lawyers, but there is no way of substantiating the claims he made.

Nikulin claimed Miller demanded he admit to hacking the DNC servers as part of what the FBI is said to have claimed was a nefarious plot ultimately ordered by Trump, and promised him good treatment in the US if he cooperated. Nikulin wrote that he rejected the offer.

While the focus on the Russian hack has always centered on an alleged phish, in fact the mailboxes sent to Wikileaks better match up with credentials made available via the theft Nikulin is alleged to have carried out; the passwords of most of the people would have been available in barely encrypted format. And the mention of Alexey Belen might tie the Yahoo hack to the DNC hack as well.

Nikulin has been telegraphing his claim the US offered him a cooperation agreement for some time. It doesn’t sound legit — after all, the FBI would be as interested in implicating Russia as Trump. But it may be the best way for him to communicate with the Russian government, including Putin, about what kind of story he might proffer to the FBI.

If so, Putin appears to have gotten the message.

Why Did Shadow Brokers Switch Crypto Currencies to Not Make Money With?

/11 Comments/in , /by

The other day, Shadow Brokers announced its new Warez of the month club: Send 100 Zcash, over the next 30 days, and they’ll send back … goodies that have yet to be described.

Zcash is, like Bitcoin, a cryptocurrency, but with a whole lot of smart thinking about how to make it secret.

Now, if the idea were to make money, the switch to Zcash would make sense. Days before Shadow Brokers announced this new gig, someone started cashing out the measly $20K in BTC it had made thus far, and people around the world watched as the money was dispersed through a bunch of other accounts. If the theory is to make money and cash it out, Zcash is a better option. As Matthew Green, who had a hand in setting up Zcash described it, to me.

[U]nlike Bitcoin, it supports untraceable transactions. In these transactions I can send you money such that only you and I (and nobody else) can see the amount or nature of a payment. These are called “shielded transactions”, and they use zero knowledge proofs. Presumably it is this feature that ShadowBrokers are interested in — assuming they are actually interested in any part of making money, and the whole thing isn’t a sham.

It’s the last bit, though, that raises questions for me.

Shadow Brokers set up an auction that was virtually designed to fail. That provided SB the opportunity to keep bitching about it publicly, then ultimately to release more files. It then set up a crowdfunding scheme, which again failed. Which led it to release files that ultimately led to a global ransomware being let loose.

So why switch currencies? SB can fail to make money just as easily with BTC as it can with ZEC.

One possibility is that SB wants to taint the currency. In its post, SB claims ZEC has ties to the federal government.

Zcash is having connections to USG (DARPA, DOD, John Hopkins) and Israel. Why USG is “sponsoring” privacy version of bitcoin? Who the fuck is knowing? In defense, TOR is originally being by similar parties. TheShadowBrokers not fully trusting TOR either. Maybe USG is needing to be sending money outside from banking systems? If USG is hacking and watching banking systems (SWIFT) then adversaries is also hacking and watching banking systems. Maybe is for sending money to deep cover foreign assets? Maybe is being trojan horse with cryptographic flaw or weakness only NSA can exploit? Maybe is not being for money? Maybe is being for Zk-SNARKs research? Maybe fuck it, lets be finding out.

I asked Green about the DARPA, DOD, John Hopkins [sic] slam, and he pointed to the research paper that forms the basis for the currency. In the acknowledgments, the authors thank their underlying sources of funding.

This work was supported by: Amazon.com through an AWS in Education research grant; the Broadcom Foundation and Tel Aviv University Authentication Initiative; the Center for Science of Information (CSoI), an NSF Science and Technology Center, under grant agreement CCF-0939370; the Check Point Institute for Information Security; the U.S. Defense Advanced Research Projects Agency (DARPA) and the Air Force Research Laboratory (AFRL) under contract FA8750-11-2-0211; the European Community’s Seventh Framework Programme (FP7/2007-2013) under grant agreement number 240258; the Israeli Centers of Research Excellence I-CORE program (center 4/11); the Israeli Ministry of Science and Technology; the Office of Naval Research under contract N00014-11-1-0470; the Simons Foundation, with a Simons Award for Graduate Students in Theoretical Computer Science; and the Skolkovo Foundation with agreement dated 10/26/2011. The views expressed are those of the authors and do not reflect the official policy or position of the Department of Defense or the U.S. Government.

Green describes (rightly, says a girl who probably took Soros funding in several ways while an academic) this as just good academic form.

These aren’t organizations that specifically funded *this project*, they’re just organizations that had provided funding to support the various scientists involved. It’s good form to list them all. And obviously Johns Hopkins is my institution, although I don’t do spook stuff.

He also suggested that the dig at ZEC’s funding is just part of the entertainment value that SB uses to get attention.

SB seems to be very astute in the way they cultivate interest among Information Security folks on Twitter. This could be because they’re legitimately also hackers (probably true at least in part). But it also serves their larger information needs because they have a complex message to get out there — and reporters are good at ignoring the message if there are no good interpreters to process it. Entertaining and relating to the infosec community on Twitter means they have a ready-made pool of infosec experts willing to talk to reporters about whatever new thing they’ve done. More tech companies should learn from this strategy, which is sort of clever (in an evil way)!

Along the above lines, adopting a new (and technically very advanced) private cryptocurrency keeps infosec people entertained. It gets RTs and makes people ask questions. Throwing in all the nonsense about backdoors and the DoD is probably entertainment value. Just like their “Russlish” grammar is, and the whole drama about auctions and subscription services.

I’m not so sure.

I can think of at least two other possibilities.

First, currencies have been bouncing around in response to some of this stuff. So it’s possible this is an attempt to flood the market.

Certainly, too, the invocation of DARPA seems about increasing distrust, just as SB did in its efforts to increase the distrust between Microsoft and the government.

More interestingly, though, perhaps this is SB’s way of adding to the risk to NSA of any releases. While some people believe NSA has already disclosed all the vulnerabilities it believes SB to have (indeed, SB’s last post suggested as much as well), if there’s any doubt about that, by using a more secretive currency, it will add the risk to NSA of not knowing who has anything SB sells.

Two Data Points on Jared Kushner

/17 Comments/in , /by

I wanted to pull out two data points in this profile of Jared Kushner, completed in the wake of the WaPo story that Kushner attempted to set up a back channel with Russia.

First, as other stories have, this one blames Kushner for encouraging Trump to fire Jim Comey.

But in recent weeks, the Trump-Kushner relationship, the most stable partnership in an often unstable West Wing, is showing unmistakable signs of strain.

That relationship had already begun to fray a bit after Mr. Trump’s dismissal of the F.B.I. director, James B. Comey, which Mr. Kushner had strongly advocated, and because of his repeated attempts to oust Stephen K. Bannon, Mr. Trump’s chief strategist, as well as the president’s overburdened communications team, especially Sean Spicer, the press secretary.

[snip]

Other times, he serves as a goad, as he did in urging Mr. Comey’s ouster and assuring Mr. Trump that it would be a political “win” that would neutralize protesting Democrats because they had called for Mr. Comey’s ouster over his handling of Hillary Clinton’s use of a private email server, according to six West Wing aides.

I’ve pointed out before how the investigation into Mike Flynn might, with his cooperation, put Kushner at risk. But I’m interested in the new detail that Kushner assured his father that Democrats would love the firing of Comey because of Comey’s handling of the Hillary investigation.

I can see how a dummie might believe that. But I’m at least as interested in how pitching that theory for Comey’s firing implicated Rod Rosenstein, insofar as he wrote a letter providing the fig leaf Hillary-based justification for the firing, and thereby led to the naming of Robert Mueller. Rosenstein is still the Acting Attorney General for the Russia investigation now looking more closely at Kushner, and Kushner has effectively already compromised him.

Amid its larger narrative that Kushner and Trump actually haven’t been that close all that long, the NYT also reminds that Kushner got a lot of credit from his father-in-law for reviving the digital aspect of the campaign.

Mr. Kushner’s reported feeler to the Russians even as President Barack Obama remained in charge of American foreign policy was a trademark move by someone with a deep confidence in his abilities that critics say borders on conceit, people close to him said. And it echoes his history of sailing forth into unknown territory, including buying a newspaper at age 25 and developing a data-analytics program that he has said helped deliver the presidency to his father-in-law.

[snip]

Despite the perception that he is the one untouchable adviser in the president’s inner circle, Mr. Kushner was not especially close to his father-in-law before the 2016 campaign. The two bonded when Mr. Kushner helped to take over the campaign’s faltering digital operation and to sell a reluctant Rupert Murdoch, the chairman of Fox News’s parent company, on the viability of his father-in-law’s candidacy by showing him videos of Mr. Trump’s rally during a lunch at Fox headquarters in mid-2015.

There lots of reasons to look askance at Trump’s data program, even before you consider that it was so central in a year where Trump’s opponent got hacked. So I find it notable (which is where I’ll leave it, for now) that Kushner’s role in the digital side of the campaign was so central to his perceived closeness to Trump.

Ultimately, I keep noting that Kushner hasn’t really been part of the Trump family for that long — just eight years. While I certainly believe Trump looks on the father of his grandchildren as part of the family, I’m not sure how much real vetting they’ve done of him (and with this crowed, everyone is corrupt in any case).

It will be interesting to see, going forward, what bases for mutual loyalty — such as it exists between these two men — there are.

What Would Jared Kushner’s Middle East Peace Look Like?

/25 Comments/in , /by

NYT has gotten a lot of heat for letting associates speaking for Jared Kushner who nevertheless refused to be IDed as such provide this explanation for why he asked Sergey Kislyak for a channel of communications that bypassed any US intelligence scrutiny.

Jared Kushner, President Trump’s son-in-law and senior adviser, spoke in December with Russia’s ambassador to the United States about establishing a secret communications channel between the Trump transition team and Moscow to discuss strategy in Syria and other policy issues, according to three people with knowledge of the discussion.

I would defend NYT on two grounds. First, while I’m totally supportive of WaPo (and others) providing anonymity for their sources who are providing highly sensitive details about what went on, they, too, could provide a bit more detail so readers could understand the motives, not least by indicating whether these were Congressional (and therefore partisan) or intelligence sources.

But I also think it highly likely the relationship between the Syria claim and what is really going on is similar to the original NYT explanation of this meeting — that it served to “establish a line of communication” between the Trump Administration and Russia and what has now been disclosed as an effort to establish a line of communication that bypassed all IC scrutiny. That is, I suspect those who shared this excuse believe it and believe it is rational within a larger context, and I believe it describes part of what they know to be going on. (Don’t go nuts just yet — I’m not defending that belief.)

Before I explain what I mean, consider a few more data points.

First, in this appearance, Juliette Kayyem and Steven Hall distinguish what this appears to be — a channel that bypasses the IC — from one that uses a third country (the Pope, in Kayyem’s example of President Obama’s back channel to Cuba) to establish a dialogue with an estranged country, a traditional back channel.

But remember, this is not the only country Kushner was establishing weird communications with. The WaPo story on this reminds of Trump’s secrecy surrounding a meeting between the Sheikh Mohamed bin Zayed al-Nahyan and Kushner, Flynn, and Bannon.

Trump’s advisers were similarly secretive about meetings with leaders from the United Arab Emirates. The Obama White House only learned that the crown prince of Abu Dhabi was flying to New York in December to see Kushner, Flynn and Stephen K. Bannon, another top Trump adviser, because U.S. border agents in the UAE spotted the Emirate leader’s name on a flight manifest.

And WaPo ties that meeting to a meeting, brokered by UAE, between Erik Prince and a Putin confidante on January 11.

Now consider National Security Adviser H.R. McMaster’s take on all this. First, he’s not all that concerned that his boss’ son-in-law tried to set up a channel of communication using an adversary’s facilities. According to him, they do this all the time!

“We have back-channel communications with any number of individual (countries). So generally speaking, about back-channel communications, what that allows you to do is communicate in a discreet manner,” McMaster said.

“So it doesn’t pre-expose you to any sort of content or any kind of conversation or anything. So we’re not concerned about it.”

Actually, he does have a point there. There’s the Emirates meeting, but there’s also Mike Flynn’s discussions of kidnapping Fethullah Gulen at the behest of Recep Erdogan. You might even include Rudy Giuliani’s intervention in the Reza Zarrab case.

As if McMaster’s lackadaisical attitude about Kushner’s attempt to use Russia’s facilities isn’t weird enough, though, there’s something else. Even before he made this weird defense of Kushner’s back channels, McMaster was excluded from at least one meeting on Trump’s overseas trip: that between Trump and Bibi Netanyahu.

National security advisor H.R. McMaster was left out of a meeting between President Donald Trump and Israeli Prime Minister BenjaminNetanyahu on Monday, a move that raised eyebrows among officials.

According to Kafe Knesset, Trump met with Netanyahu Monday evening, starting with a one-on-one meeting. The forum was soon expanded by several advisors on each side, including Jared Kushner, Jason Greenblatt and Ambassador David Friedman on the U.S. side, according to Israeli officials.

Secretary of State Rex Tillerson was also later invited to the expanded meeting, per an official, but “McMaster sat outside the King David room during the course of the entire meeting.”

So perhaps we can add Israel to the list of countries that Kushner has been establishing back channel communications with.

For better or worse, a back channel with Israel by itself would never get you accused of treason in the US. But I do find it interesting given the underlying precedent to Devin Nunes’ complaints about “unmasking:” the earlier collection of conversations in which Bibi told Members of Congress what the Obama Administration’s plans were with respect to Iran. The conversations of Trump associates that Nunes was outraged were unmasked didn’t involve Russia, he said, but did they involve Israel? Or Turkey or the Emirates?

With all that in mind, consider what the purported Middle East peace that Kushner has reportedly been crafting would actually look like. It’d include unlimited support for Israeli occupation of Palestine. Bashar al-Assad would be ousted, but in a way that would permit Russia a strategic footprint, perhaps with sanction of its occupation of Crimea and Donetsk as well. It’d sanction the increasing authoritarianism in Turkey. It’s sanction Saudi Arabia’s ruthless starvation of Yemen. It’d fuck over the Kurds.

And it’d mean war with Iran.

Trump took steps towards doing most of those things on his trip, not least with his insane weapons deal with Saudi Arabia, itself premised on a formal detachment of weapons sales from any demands for respect for human rights. Of particular note, Trump claimed to be establishing a great peace initiative with Islamic countries, even when discussing meetings that treated Iran (and by association most Shia Muslims) as an enemy.

Several days ago in Saudi Arabia, I met with the leaders of the Muslim world and Arab nations from all across the region. It was an epic gathering. It was an historic event. Kind Salman of Saudi Arabia could not have been kinder, and I will tell you, he’s a very wise, wise man. I called on these leaders and asked them to join in a partnership to drive terrorism from their midst, once and for all. It was a deeply productive meeting. People have said there had really never been anything even close in history. I believe that. Being there and seeing who was there and hearing the spirit and a lot of love, there has never been anything like that in history. And it was an honor to be involved.

Kushner’s “peace plan” is not so much a plan for peace. It’s a plan for a complete remapping of the Middle East according to a vision the Israelis and Saudis have long been espousing (and note the multiple nods on Trump’s trip to the growing alliance between the two, including Trump’s flight directly from Riyadh to Tel Aviv and Bibi’s comment on “common dangers are turning former enemies into partners”). It’s a vision for still more oppression (a view that Trump supports globally, in any case).

Yes, it’d probably all be accomplished with corrupt self-enrichment on the part of all players.

And it’d likely be a complete clusterfuck.

Which is why you’d want to keep all of that — not just the conversations in which you persuade Russia to ditch Iran as an ally, but also the conversations where you reverse long-standing policy with Israel and America’s embrace of human rights — from the intelligence community.

Because the actual experts, the people who’ve long played a game with our frenemies Israel, Saudi Arabia, and Turkey (and a battle with our adversaries like Russia), would explain all the problems with the plan.

I get why the focus on Russia is important, here.

But what if that focus is preventing us from seeing the vast forest of a horribly realigned American foreign policy for one Russian birch tree?

This post has been updated.

Update: A longtime (but anonymous) friend of the blog sent this humorous interpretation.

***************************<eyes only>****************************
To: DJT
Fr: JK
Dt: 5/28/17
Re: NWO
Sir,
This is to summarize the state of play in our negotiations for the NWO Project.
Everything’s a Go.
Oligarch        Turf                          Stipulations
Putin            Russia/Europe            No Muslims/No Refugees/Segregated Minorities
Trump          Americas/Britain        No Muslims/No Refugees/Segregated Minorities
Xi                 Asia/Pacific               No Muslims/No Refugees/Segregated Minorities
?                  Africa
Strongmen
Erdogan
Duterte
Un
Servicers
Israel           Global Finance
Saud            Middle East Portal/Muslim Vetting
Britain          Eurussian Portal
Japan           Pacific Portal
Prince           NWO Police
Winners                    and                    Losers
Authoritarians                                     Democracy
Exceptionalists                                    Rule of Law
Oligarchs                                            Everyone Else
Men                                                   Women
Caucasian/Han                                    All other Ethnicities
Sunni                                                 Shia
Jews                                                  Palestinians
Christians                                           Non-Christians
Russians                                             Europe, Ukraine, Crimea, Al Assad
China                                                 Taiwan, Hawaii (u gave them?)
Israel                                                 Iran, Palestinians
Saud                                                  All of the Middle East ex. Israel
Gen. Bannon says the next step in the plan is Operation Revenge479…
Doing my best to put you in good positions.
Love you, Pop!
J
**********crypto room fsb dc emb uid: skislyak //sci.nwo.kompromat***********

The Anonymous Letter to WaPo

/62 Comments/in /by

Just when I thought we’d have a long weekend without a big news dump, the WaPo published its story revealing Jared Kushner asked Sergey Kislyak to set up a channel of communication with Russia at Russian facilities at a meeting in early December.

Jared Kushner and Russia’s ambassador to Washington discussed the possibility of setting up a secret and secure communications channel between Trump’s transition team and the Kremlin, using Russian diplomatic facilities in an apparent move to shield their pre-inauguration discussions from monitoring, according to U.S. officials briefed on intelligence reports.

Ambassador Sergei Kislyak reported to his superiors in Moscow that Kushner, then President-elect Trump’s son-in-law and confidant, made the proposal during a meeting on Dec. 1 or 2 at Trump Tower, according to intercepts of Russian communications that were reviewed by U.S. officials. Kislyak said Kushner suggested using Russian diplomatic facilities in the United States for the communications.

The meeting also was attended by Michael Flynn, Trump’s first national security adviser.

That story — and additional details on Kushner’s discussions with UAE — is the big headliner.

But the fascinating detail is that WaPo received an anonymous letter with details of this meeting — and other things that the WaPo suggests it may not yet have confirmed — in mid-December.

The Post was first alerted in mid-December to the meeting by an anonymous letter, which said, among other things, that Kushner had talked to Kislyak about setting up the communications channel. This week, officials, who reviewed the letter and spoke on condition of anonymity to discuss sensitive intelligence, said the portion about the secret channel was consistent with their understanding of events.

For instance, according to those officials and the letter, Kushner conveyed to the Russians that he was aware it would be politically sensitive to meet publicly, but it was necessary for the Trump team to be able to continue their communication with Russian government officials.

In addition to their discussion about setting up the communications channel, Kushner, Flynn and Kislyak also talked about arranging a meeting between a representative of Trump and a “Russian contact” in a third country whose name was not identified, according to the anonymous letter.

So who could have sent the letter?

First, consider the timing. The letter was sent within a few weeks of the meeting itself. In between the meeting and sending of the letter, these very same reporters got the scoop that the CIA believed Russia affirmatively wanted Trump elected, a scoop that pre-empted the President’s call for a report on Russian tampering in the election. A week later, two of these reporters got another confirmation that John Brennan said the other agencies agreed with him on the view that Putin wanted Trump elected.

The letter also got received a few days after John McCain got a copy of Christopher Steele’s dossier (reportedly on December 9), followed just four days later by the last known and by far most incendiary installment of the dossier, which for the first time accused Trump’s campaign of paying the DNC hackers.

In other words, WaPo received the letter at a time when the IC was dumping a ton of information implicating Trump. So perhaps it was a spook who heard Kislyak’s description of the meeting on an intercept.

The dominant narrative on those intercepts, however, has said that the IC wasn’t listening closely to Kislyak intercepts until after Russia did not retaliate in response to the hacking sanctions imposed on December 28, and didn’t find the incriminating Mike Flynn conversations until around January 3. If that’s right, then the IC wouldn’t have heard about this meeting until weeks after the letter was sent. [Update: the NYT version of this–which appears to be damage control from the White House–cites a senior American official stating that they learned about this conversation “several months ago,” which would put it after the letter was sent.]

Of course, with the FBI and CIA getting their own raw feeds of data, it’s possible one agency listened to the intercepts (and had the language skills to understand them) before another did. It’s possible, for example, CIA learned about the meeting before FBI did so in the aftermath of the sanctions concerns.

It’s also possible that the Russians sent the letter — or even that Kislyak made up the Kushner claim as disinformation (remember, by this point there were leaks about FISA orders, with reports that Russian interlocutors were changing their communication habits). But it’s unclear what Russia would have to gain by sending a letter in December, rather than waiting until Kushner had compromised himself. Doing so would eliminate all the control they had gained with the information.

Which (barring a spook sending the letter) would seem to leave a Trump associate. Reportedly, WaPo’s Miller said that the letter appears to come from someone inside the Trump transition. Anyone else at the meeting would seem to be an immediate target for Trump retaliation. Though it is possible that Mike Flynn sent the letter, realizing he was getting set up by Trump, which would make the delay in reporting this detail rather interesting. That said, he would have little reason to do so in December, as opposed to now, given that he faces criminal investigation.

Outside of Flynn, though, it’s not clear many people knew this meeting ever happened, much less what happened in it. The meeting was first disclosed by the New Yorker, following which the White House quickly added (in a story to the NYT) Flynn to the story — suggesting he, and not the President’s son-in-law suggested the communication channel.

Michael T. Flynn, then Donald J. Trump’s incoming national security adviser, had a previously undisclosed meeting with the Russian ambassador in December to “establish a line of communication” between the new administration and the Russian government, the White House said on Thursday.

Jared Kushner, Mr. Trump’s son-in-law and now a senior adviser, also participated in the meeting at Trump Tower with Mr. Flynn and Sergey I. Kislyak, the Russian ambassador. But among Mr. Trump’s inner circle, it is Mr. Flynn who appears to have been the main interlocutor with the Russian envoy — the two were in contact during the campaign and the transition, Mr. Kislyak and current and former American officials have said.

[snip]

“They generally discussed the relationship and it made sense to establish a line of communication,” Ms. Hicks said. “Jared has had meetings with many other foreign countries and representatives — as many as two dozen other foreign countries’ leaders and representatives.”

The Trump Tower meeting lasted 20 minutes, and Mr. Kushner has not met since with Mr. Kislyak, Ms. Hicks said.

It later became clear that Kushner hadn’t even shared that meeting with White House staffers (presumably including Don McGahn) when responding the Mike Flynn firing, much less included them on his security clearance form.

The extent of Mr. Kushner’s interactions with Mr. Kislyak caught some senior members of Mr. Trump’s White House team off guard, in part because he did not mention them last month during a debate then consuming the White House: how to handle the disclosures about Mr. Flynn’s interactions with the Russian ambassador.

Ms. Hicks said that Mr. Trump had authorized Mr. Kushner to have meetings with foreign officials that he felt made sense, and to report back to him if those meetings produced anything of note. She said that because in Mr. Kushner’s view the meetings were inconsequential, it did not occur to him to mention them to senior staff members earlier.

“There was nothing to get out in front of on this,” she said.

So there wouldn’t be that many transition staffers who would know of the meeting by mid-December.

That said, one person who knew about the meeting ahead of time was Marshall Billingslea, who tried to warn Flynn about Kislyak. And his request for the Kislyak profile would have alerted the CIA to his concerns about the meeting.

In any case, there are now reports of still more Kushner communications with Kislyak coming out, going back to April 2016. So the FBI sure has a lot to review.

Update: As others have pointed out, at 8:30 there’s a more detailed description of the typed letter, received December 12.

Sheldon Whitehouse and the Russia Investigation Deconfliction

/10 Comments/in , , /by

Laura Rozen has me worried.

She pointed to this CNN article — posted sometime this afternoon — describing Sheldon Whitehouse’s worries that the scope of the DOJ inquiry into Trump and Russia might conflict with the Congressional inquiries.

Sen. Sheldon Whitehouse, the top Democrat on a Judiciary subcommittee, told CNN Thursday that it’s possible Flynn is cooperating with the Justice Department — and that Capitol Hill has not been kept in the loop. He warned that congressional probes that have subpoenaed Flynn for records could undercut Mueller’s investigation if the former national security adviser is secretly working with the Justice Department as part of its broader investigation into possible collusion between Russian officials and Trump associates during the campaign season.

“There is at least a reasonable hypothesis that Mike Flynn is already cooperating with the DOJ investigation and perhaps even has been for some time,” said Whitehouse, a Rhode Island Democrat.

Whitehouse added he had no direct evidence to suggest that Flynn is cooperating with the Justice Department. But he said there is circumstantial evidence to suggest that it could be the case, saying Mueller must immediately detail the situation to “deconflict” with probes on the Hill to “make sure that congressional investigations aren’t inadvertently competing with DOJ criminal investigations.”

[snip]

The Rhode Island Democrat said there are number of factors that suggest Flynn is working the Justice Department in its probe. He pointed out that “all reporting indicates they’ve got him dead to rights on a false statement felony” in his private interview with the FBI over his conversations last year with Russian Ambassador Sergey Kislyak. He also noted that Flynn has gone silent and retroactively signed on as a foreign agent to Turkey. And he noted that a federal grand jury has been summoned and has issued subpoenas to Flynn associates.

“So none of that proves anything but it’s all consistent with the hypothesis that he’s already cooperating,” Whitehouse told CNN.

“But that’s certainly a hypothetical case of a time when we do need need this de-confliction apparatus in place to make sure that congressional investigations aren’t inadvertently competing DOJ criminal investigations.”

Now, in point of fact, that deconfliction has already happened — or at least started. That’s what a May 11 meeting between Rod Rosenstein, Richard Burr, and Mark Warner was described as at the time.

Rosenstein was tight-lipped as he entered and emerged from a secure facility Thursday on Capitol Hill, where he huddled with Senate Intelligence Committee Chairman Richard Burr (R-N.C.) and Vice Chairman Mark R. Warner (D-Va.). The senators said the meeting had been scheduled before Comey’s ouster to discuss “deconfliction” — keeping the FBI’s and committee’s investigations of alleged ties between the Trump campaign and the Russian government from stepping on each other’s toes.

According to reports, the meeting was scheduled before the Jim Comey ouster, so it should reflect the scope of what he was investigating, and therefore presumably resembles the scope of what Robert Mueller will investigate.

But there are three reasons why Whitehouse might be justified in worrying that Congress might fuck up what DOJ is investigating.

Obviously, the first is Mueller: the Comey firing might have reflected some new investigative approach (including Flynn immunity), or Mueller, because of the firing, might be scoping the investigation differently.

A second is jurisdiction. Whitehouse and Lindsey Graham have assumed jurisdiction over the Russia investigation for their subcommittee — and the Senate Judiciary Committee obviously should oversee the FBI. So it may be that former US Attorney Sheldon Whitehouse wants to have a deconflicting conversation for himself, because he knows how investigations work (and for all we know is getting tips from DOJ).

The other is another announcement from this afternoon: that the Senate Intelligence Committee had voted to give Chair Richard Burr and Vice Chair Mark Warner the ability to issue subpoenas themselves going forward, without consulting the committee.

The leaders of the Senate Intelligence Committee now have broad authority to issue subpoenas in the Russia investigation without a full committee vote, Chairman Richard Burr (R-N.C.) said Thursday.

The panel voted unanimously to give Burr and Vice Chairman Mark Warner (D-Va.) the blanket authority for the duration of the investigation into Russia’s election meddling and possible collusion with President Trump’s campaign.

The two Senate leaders must be in agreement in order to issue an order.

Now, as the article notes, thus far, the committee has asked for documents, not testimony. My suspicion is this might have more to do with ensuring Comey’s testimony — promised after Memorial Day — is “compelled” in such a way that DOJ can’t object.

Nevertheless, the power to subpoena does grant someone (like former Trump National Security Advisor Richard Burr) the ability to fuck with the DOJ investigation by potentially working at cross-purposes. To grant immunity (and therefore to fuck up the investigation as happened in Iran-Contra), I think Burr would still need the support of the committee.

Still, this still gives Burr far more power to thwart the investigation, with only Mark Warner (who unlike Whitehouse has never been a prosecutor) to prevent it.

In theory, I think Whitehouse is just pushing for jurisdiction (and for the ability to demand the same kind of deconfliction conversation Burr and Warner have gotten).

But upon reflection, I don’t think his concerns are entirely unjustified.

In any case, I trust Whitehouse (with whatever leftover ties he has to DOJ) to do this review more than Mark Warner.

Update: Burr told Bloomberg he has had a deconfliction conversation with Mueller.

Senate Intelligence Chairman Richard Burr, a Republican from North Carolina, said he has contacted Mueller to discuss their parallel probes of Russian meddling.

Even (Especially?) the FBI Is Susceptible to Fake News

/18 Comments/in /by

The WaPo has an utterly dispiriting story providing more detail on a document first revealed in this big NYT story on Jim Comey. Here’s how the NYT described it:

During Russia’s hacking campaign against the United States, intelligence agencies could peer, at times, into Russian networks and see what had been taken. Early last year, F.B.I. agents received a batch of hacked documents, and one caught their attention.

The document, which has been described as both a memo and an email, was written by a Democratic operative who expressed confidence that Ms. Lynch would keep the Clinton investigation from going too far, according to several former officials familiar with the document.

Read one way, it was standard Washington political chatter. Read another way, it suggested that a political operative might have insight into Ms. Lynch’s thinking.

[snip]

The document complicated that calculation, according to officials. If Ms. Lynch announced that the case was closed, and Russia leaked the document, Mr. Comey believed it would raise doubts about the independence of the investigation.

But as the WaPo reveals, the document was not an email, but rather a Russian document purportedly reporting on email. And while in August the FBI deemed the document a hoax, it took five months — covering the all important July announcement ending the Hillary investigation — to get to that point.

The document, obtained by the FBI, was a piece of purported analysis by Russian intelligence, the people said. It referred to an email supposedly written by the then-chair of the Democratic National Committee, Rep. Debbie Wasserman Schultz (D-Fla.), and sent to Leonard Benardo, an official with the Open Society Foundations, an organization founded by billionaire George Soros and dedicated to promoting democracy.

The Russian document did not contain a copy of the email, but it described some of the contents of the purported message.

[snip]

Comey had little choice, these people have said, because he feared that if Lynch announced no charges against Clinton, and then the secret document leaked, the legitimacy of the entire case would be questioned.

From the moment the bureau received the document from a source in early March 2016, its veracity was the subject of an internal debate at the FBI. Several people familiar with the matter said the bureau’s doubts about the document hardened in August when officials became more certain that there was nothing to substantiate the claims in the Russian document. FBI officials knew the bureau never had the underlying email with the explosive allegation, if it ever existed.

Yet senior officials at the bureau continued to rely on the document as part of their justification for how they handled the case before and after the election.

As the WaPo lays out, the FBI hadn’t even asked Loretta Lynch, much less the other participants in the alleged emails, about them before Comey used the document to justify his July statement on the investigation into Hillary’s emails. They simply relied on it, in spite of the way a Debbie Wasserman Schultz and George Soros screams of the worst kind of fevered misinformation that circulated last year. Or, at a minimum, they acted based on the assumption that they couldn’t combat evidently fake news were it to leak.

We talk a lot about dumb ordinary voters who can’t sort through PizzaGate and Seth Rich conspiracies on their own.

But even the FBI, with all the investigative tools you can imagine, was unable to sort through fake news. And that had a role in one of the most significant events in last year’s election.

WannaCry Attribution: Missing the Sarcasm Tag

/8 Comments/in , , /by

Parts of the security community have decided that Lazarus, a hacking group associated with North Korea, is behind WannaCry, including the global ransomware attack from a few weeks back. That’s based on significant reuse of code from earlier Lazarus activities.

But to explain certain aspects of the attack — notably, why Lazarus would become incompetent at ransomware after having been perfectly competent at it in the past — proponents of this theory are adopting some curious theories. For example, this — in Symantec’s report on the code reuse — doesn’t make any sense at all.

The small number of Bitcoin wallets used by first version of WannaCry, and its limited spread, indicates that this was not a tool that was shared across cyber crime groups. This provides further evidence that both versions of WannaCry were operated by a single group.

It’s effectively the equivalent of saying, “using just three bitcoin wallets doesn’t make sense [it doesn’t, if your goal is actual ransomware], so we’ll just claim that’s further proof that there must be few people involved.” In interviews, Symantec’s technical director has explained away other inconsistencies in this story by hackers working for a brutal dictator with a penchant for executing those who cross them by suggesting they were moonlighting when they blew up Lazarus’ ransomware by misdeploying it with Eternal Blue.

At the same time, flaws in the WannaCry code, its wide spread, and its demands for payment in the electronic bitcoin before files are decrypted suggest that the hackers were not working for North Korean government objectives in this case, said Vikram Thakur, Symantec’s security response technical director.

“Our confidence is very high that this is the work of people associated with the Lazarus Group, because they had to have source code access,” Thakur said in an interview.

But he added: “We don’t think that this is an operation run by a nation-state.”

With WannaCry, Thakur said, Lazarus Group members could have been moonlighting to make extra money, or they could have left government service, or they could have been contractors without direct obligations to serve only the government.

Krypt3ia has a post making fun of the nonsense theories out there.

  • LAZARUS code snippets found in WANNACRY samples
  • LAZARUS has been active in stealing large sums of money from banks, as this attack was about ransom and money… well… UNDERPANTS GNOMES AND PROFIT!
  • LAZARUS aka Un, would likely love to sow terror by unleashing the digital hounds with malware attacks like this to prove a point, that they are out there and to be afraid.
  • LAZARUS aka Un, might have done this not only to sow fear but also to say to President CRAZYPANTS (Official USSS code name btw) “FEAR US AND OUR CYBER PROWESS“
  • LAZARUS aka Un, is poor and needs funds so ransoming hospitals and in the end gathering about $100k is so gonna fill the coffers!
  • LAZARUS aka UNIT 108 players are “Freelancing” and using TTP’s from work to make MO’ MONEY MO’ MONEY MO’ MONEY (No! Someone actually really floated that idea!)
  • LAZARUS is a top flight spooky as shit hacking group that needed to STEAL code from RiskSense (lookit that IPC$ from the pcap yo) to make their shit work.. Huh?

Note the last bullet is a reference to another post he did, where he showed another piece of code in WannaCry was taken from folks working to reverse engineer Eternal Blue for Metasploit. That piece of borrowed code doesn’t permit you to blame the Evil Hermit Kingdom, though, so no one is talking about it.

Perhaps the oddest piece of evidence presented relating the claim North Korea did WannaCry comes from CNBC.

Analysts have been weighing in with various theories on the identity of those behind WannaCry, and some early evidence had pointed to North Korea. The Shadow Brokers endorsed that theory, perhaps to take heat off their own government backers for the disaster.

CNBC must be referring to this passage from Shadow Brokers’ latest screed.

In May, No dumps, theshadowbrokers is eating popcorn and watching “Your Fired” and WannaCry. Is being very strange behavior for crimeware? Killswitch? Crimeware is caring about target country? The oracle is telling theshadowbrokers North Korea is being responsible for the global cyber attack Wanna Cry. Nukes and cyber attacks, America has to go to war, no other choices! (Sarcasm) No new ZeroDays.

As part of a narrative of how reasonable it was to release all these files after they’ve been patched (all the while threatening far more damaging leaks), Shadow Brokers comments on WannaCry. Importantly, it lays out one detail — the kill switches — that doesn’t make sense if the goal was true ransomware, as well as another detail — “caring about target country”? — that I don’t understand. (Russia was hit badly in the attack, the US very lightly, and there were reports that Arabic speaking countries weren’t hard hit, which I find interesting since it is the one Microsoft supported language that for which a ransomware note was not included.)

But the part that CNBC has read to mean Shadow Brokers endorsed this theory instead does nothing of the sort; if anything, it does the opposite. I read it as a comment about how quickly we go from dodgy attribution to calling for war. And it comes with a sarcasm tag!

Moreover, why would you take Shadow Brokers’ endorsement for anything? Either they did WannaCry (which actually seems to be what CNBC suggests; Krypt3ia makes fun of that possibility, too), in which case any endorsement might be disinformation, or they didn’t do it, and they’d have no more clue who did than the rest of us.

The entire exercise in attribution with WannaCry is particularly odd given the assumptions that it is what it looks like, traditional ransomware, in spite of all the evidence to suggest it is not. And so we’ll just ignore obvious tags, like a “sarcasm” tag, because accounting for such details gets very confusing.