Posts

Levitation: Inspire-Ing Work from CSE

/4 Comments/in /by

Screen shot 2015-01-29 at 11.33.43 AMThe Intercept and CBC have a joint story on a Canadian Security Establishment project called Levitation that seems to confirm suspicions I’ve had since before the Snowden leaks. It targets people based on their web behavior (the story focuses on downloads from free file upload sites, but one page of the PPT makes it clear they’re also tracking web search terms and other behaviors), and once it finds behavior of suspicion (such as accessing bomb-making instructions; it calls these “events”) it uses SIGINT tools, including NSA’s MARINA, to work backwards off those accessing those materials to get IPs, cookies, facebook IDs, and the like to identify a suspect.

The PPT is the most detailed explanation that I’ve seen of how the SIGINT agencies do “correlations” — a function about which I believe ODNI continues to hide an August 20, 2008 FISC opinion. It appears to do so in two ways: first, by tracking known correlations. But also, by analyzing similar activities from around the same time from the same IP, then coming up with other identifiers that, with varying degrees of probability, are probably the same user. This serves, in part, to come up with new identifiers to track.

I’ve argued the NSA does similar analysis using known codes tied to Inspire (not the URL, necessarily, but possibly the encryption code included in each Inspire edition) on upstream collection, which would basically identify the people within the US who had downloaded AQAP’s propaganda magazine. One reason I’m so confident NSA does this is because of the high number of FBI sting operations that seem to arise from some 20-year old downloading Inspire, which them appears to get sent out to a local FBI office for further research into online activities and ultimately approaches by a paid informant or undercover officer.

Screen shot 2015-01-29 at 11.46.15 AMIn other words, this kind of analysis seems to lie at the heart of a lot of the stings FBI initiates.

But as the “Scoreboard” slide in this presentation makes clear, what this process gives you is not validated IDs, but rather probabilistic matches (which FISC appears to deal with using minimization procedures, suggesting they let NSA collect on these probabilistic matches with the understanding they have to treat the data in some certain way if it ends up being a false positive).

That’s important not just for the young men whom FBI decides might make worthwhile targets (even if they’re being targeted, largely, on their First Amendment activities).

It’s important, too, for the false negatives, by far the most important of which I believe to be the Tsarnaev brothers, both of whom reportedly had downloaded multiple episodes of Inspire, as well as other similar jihadist material, and on whom NSA had collected data it never accessed until after the attack, but neither of whom got targeted off this correlation process before they attacked the Boston Marathon.

That is, this really important possible false negative, just as much as the dubious positives that end up getting unbalanced young men targeted by the FBI, may say as much about the reliability of this process as anything else.

This CSE PPT is not yet proof that my suspicions are entirely accurate (though my claims here about correlations are based on officially released documents). But they strongly suggest my suspicions have been correct.

And — particularly given ODNI’s refusal to release what appears to be a key opinion describing the terms on which FISC permits the use of these correlations — this ought to elicit far more conversations about how NSA and its Five Eye partners “correlate” identities and how those correlations get used.

DOJ Doesn’t Want You to Know about Any Inspire-related FISA Surveillance Programs

/10 Comments/in /by

I have written repeatedly about the case of Adel Daoud (see these two posts). The FBI caught him in a sting in 2012 where they had him perform bombing a night club. He was 18 at the time he caught.

While the government immediately informed Daoud they would use evidence derived from FISA against him, subsequent information — both comments Dianne Feinstein made during the debate about renewing the FISA Amendments Act and in further details we’ve gotten about back door searches — have suggested there might be something exotic about his targeting. (I have speculated he got identified via a back door search off a traditional FISA tap on someone — or something — else.)

On Monday, the government submitted its appeal of Judge Sharon Coleman’s decision.

DOJ complains that Judge Sharon Coleman did not reveal the classified things she finds so problematic about this case

Hilariously, key to their appeal is that Coleman didn’t lay out what it was she saw in the FISA materials she reviewed that led her to grant Daoud’s lawyer review of the underlying application materials.

Rather than address the specific facts of this case, the district court ordered disclosure because it believed that resolving the legality of the FISA collection is “best made in this case as part of an adversarial proceeding.” Id. at 5; SA 5. The court noted that “the adversarial process is integral to safeguarding the rights of all citizens” and quoted the Supreme Court’s language that the Sixth Amendment “right to the effective assistance of counsel is thus the right of the accused to require the prosecution’s case to survive the crucible of meaningful adversarial testing.” Id.

[snip]

For FISA and its procedures to have meaning, the need for disclosure must stem from unique, case-specific facts, and not a general preference that would apply to all FISA litigation. After all, the statute mandates that courts review the FISA applications and orders in camera and ex parte before even contemplating disclosure. Thus, a court cannot order disclosure of FISA materials unless it concludes, based on facts specific to the FISA applications in that case, that it cannot accurately resolve the legality of the collection without such disclosure.

The legislative history of FISA reinforces the conclusion that disclosure cannot be “necessary” absent a case-specific reason that would justify a departure from the default ex parte process.

Think about this. The government is arguing Coleman was wrong to grant Daoud’s lawyers review — which would effectively allow a lawyer to conduct a secret review of the FISA application — without explaining in a court opinion what is so unique about this case that it merits such a review.

To do so, she’d either have to reveal the secrets the government says Daoud’s lawyers can’t review, even in secret. Or she’d have to issue a partially classified opinion that would deprive Daoud’s lawyers of an opportunity to support her decision on appeal.

DOJ complains that Coleman did not think their secret declarations they insist are persuasive are persuasive

DOJ is also angry that Coleman was not sufficiently impressed by their plea of national security, insisting that their sworn declarations were “persuasive” even though she obviously was not persuaded.

The “need-to-know” prerequisite matters all the more here because, as persuasively articulated in the sworn declarations from the Attorney General of the United States and the FBI’s Acting Assistant Director for Counterterrorism, these FISA applications deal with exceptionally sensitive issues with profound national security implications.

[CLASSIFIED MATERIAL REDACTED]

The district court’s order ignored these declarations and brushed aside the considered judgment of two senior executive branch officials who carefully concluded—based on the particular facts of this case—that disclosure may lead to an unacceptable risk of compromising the intelligence gathering process and undercut the FBI’s ongoing ability to pursue national security investigations. If permitted to stand, the district court’s order would impose upon the government a lose-lose dilemma: disclose sensitive classified information to defense counsel—an option unlikely to be sanctioned by the owners of that information—or forfeit all FISA-derived evidence against the defendant, which in many cases may be critical evidence for the government.

In other words, in spite of FISA’s clear provision allowing for review in certain circumstances, DOJ maintains that judges must accept whatever classified declarations they submit even if — as Coleman said — they’re not at all persuasive.

And while the government’s complaints are, in significant part, about ensuring that allowing defendants to review these applications doesn’t begin to happen more frequently, this is also a bid to ensure that any Title III review of FISA warrants remains narrowly limited to whether,

  • FISA rightly found probable cause that the target of the FISA warrant was an agent of a foreign power
  • The certifications submitted in support of the warrant complied with FISA’s requirements
  • FISA information was appropriately minimized

The last bullet, which I suspect is the most important one in this case, will measure not whether minimization meets the standards required under the Fourth Amendment, but whether DOJ (or rather NSA and/or FBI) followed the rules approved by FISA. And limiting the review to whether the government met the minimization procedures approved by FISA brackets off the question of whether this use of FISA abided the Fourth Amendment.

Elsewhere, DOJ describes the case they need to make differently.

A court reviewing the applications would have no difficulty determining that they established probable cause to believe that the target was an agent of a foreign power and that a significant purpose of the collection was to obtain foreign intelligence information.

That’s significant because if this does involve a back door search, it raises questions about the degree to which the government collects this data, at this point, just to find young Muslim men to catch in stings.

More bread-crumbs pointing to targeting off Inspire

Which is particularly important given the bread-crumbs in the opinion pointing to the targeting of Daoud off some kind of collection targeted at Inspire, AQAP’s magazine.

Read more →

Would We Have Accepted the Dragnet if NSA Had to Admit It Could Have Prevented 9/11?

/8 Comments/in /by

Screen shot 2014-02-18 at 10.16.30 AMI’m going to return to Glenn Greenwald’s latest showing details of how the NSA treated WikiLeaks and, to a lesser degree, Anonymous (as well as Alexa O’Brien’s update on the investigation into WikiLeaks) later.

If GCHQ does this kind of tracking, how did Five Eyes miss the Tsarnaev brothers?

But for now I want to look at one slide covering GCHQ’s AntiCrisis monitoring approach (see slide 34), which in this case is focused on WikiLeaks. It shows how GCHQ has the ability — and had it in 2012 — to monitor particular websites. It shows GCHQ can monitor the visitors of a particular website, where they’re coming from, what kind of browsers they use. None of that is, in the least surprising. But given those capabilities, it would be shocking if GCHQ weren’t doing similar monitoring of AQAP’s online magazine Inspire, with the added benefit that certain text strings in each Inspire magazine would make it very easy to track copies of it as it was downloaded, even domestically via upstream collection. And for the UK, this isn’t even controversial; even possessing Inspire in the UK can get you imprisoned.

Given that that’s the case, why didn’t GCHQ and NSA find the Tsarnaev brothers who — the FBI has claimed but provided no proof — learned to make a bomb from the Inspire release that GCHQ or NSA hacked? Why isn’t NSA reviewing why it didn’t find the brothers based on cross-referencing likely NSA tracking of Inspire with its FBI reporting on Tamerlan Tsarnaev?

I used to not believe NSA should have found the Tsarneavs. But now that I’ve seen all the nifty tools we’ve learned NSA and, especially, GCHQ have, they really do owe us an explanation for why they didn’t find the Tsarnaev brothers, one of whom was already in an FBI database, and who was allegedly learning to make a pressure cooker bomb from a document that surely gets tracked by the NSA and its partners.

Speaking of NSA failures…

Which brings me back to James Clapper’s interview with Eli Lake.

Clapper said the problems facing the U.S. intelligence community over its collection of phone records could have been avoided. “I probably shouldn’t say this, but I will. Had we been transparent about this from the outset right after 9/11—which is the genesis of the 215 program—and said both to the American people and to their elected representatives, we need to cover this gap, we need to make sure this never happens to us again, so here is what we are going to set up, here is how it’s going to work, and why we have to do it, and here are the safeguards… We wouldn’t have had the problem we had,” Clapper said.

“What did us in here, what worked against us was this shocking revelation,” he said, referring to the first disclosures from Snowden. If the program had been publicly introduced in the wake of the 9/11 attacks, most Americans would probably have supported it. “I don’t think it would be of any greater concern to most Americans than fingerprints

Now, I’ll have to review the latest declarations in Jewel, but I think Clapper’s statement — that the genesis of today’s phone dragnet dates to 9/11 —  goes slightly beyond what has been admitted, because it ties today’s phone dragnet program back to the PSP phone dragnet program. Ron Wyden has tried to make the tie between the illegal program and the current one clear for months. Clapper has now inched closer to doing so.

But I also want to take issue with Clapper’s claim that if NSA had presented a “gap” to Members of Congress and the public after 9/11 we would have loved the dragnet.

Had we known of the errors and territorialism that permitted 9/11, would we have agreed to any of this?

I do so, in part, because the claim there was a “gap” is erroneous and has been proven to be erroneous over and over. Moreover, that myth dates not to the days after 9/11, but to misrepresentations about the content of the 9/11 Commission report 3 years later. Note, too, that (as has happened with Inspector Generals reviews of the Boston Marathon attack) the Commission got almost no visibility into what NSA had against al Qaeda.

More importantly, had NSA gone to the public with claims about gaps it did and didn’t have before 9/11, we would likely have talked not about providing NSA more authority to collect dragnets, but instead, about the responsibility of those who sat on intelligence that might have prevented 9/11.

As Thomas Drake and the other NSA whistleblowers have made clear, the NSA had not shared intelligence reports that might have helped prevent 9/11.

I found the pre- and post-9/11 intelligence from NSA monitoring of some of the hijackers as they planned the attacks of 9/11 had not been shared outside NSA. Read more →

Still No Answer on How Minh Quang Pham Materially Supported Terror While in Custody

/1 Comment/in /by

The WaPo has an interesting story about US intelligence efforts to disrupt the most recent release of Inspire magazine. While the confirmation that the US was responsible for the recent disrupted release is not surprising, I find this rather interesting.

“You can make it hard for them to distribute it, or you can mess with the content. And you can mess with the content in a way that is obvious or in ways that are not obvious,” said one intelligence official, who, like others, spoke on condition of anonymity to discuss sensitive internal debates.

WaPo’s sources are now bragging that they’ve altered the content of Inspire, in addition to delaying its release.

While the article focuses on this most recent sabotage, it rather bizarrely makes no mention that the first installment of Inspire was hacked in very similar way (purportedly by the Brits).

In the case of Inspire, the debate stretches back three years. The first issue contained a recipe for making a bomb using common materials, such as nails and a pressure cooker like the ones used in Boston. The title of the article was “Make a Bomb in the Kitchen of Your Mom.”

There was also a threat to Molly Norris, a Seattle cartoonist who published a satirical cartoon about the prophet Muhammad. “She should be taken as a prime target of assassination,” wrote Anwar al-Awlaki, the American-born cleric who was killed in a U.S. drone strike.

Though it does quote Keith Alexander making the case for sabotage.

“It’s obvious if people are calling for crazies to murder a U.S. citizen, why wouldn’t you stop it?” said one former official, recalling the debate in which National Security Agency Director Gen. Keith B. Alexander argued on behalf of disruption.

In that case, the administration decided against action, in part because the CIA preferred to use the site to gather intelligence. In subsequent debates, the danger of an imminent threat “really made the difference” in terms of whether to disrupt issues of the magazine, according to a former administration official.

DOD and CIA have, according to public reports without details, had significant deconfliction issues in the past on cyber operations. Are we so convinced DOD didn’t help the Brits insert cupcake recipes in that first installment?

And this article doesn’t mention something I’ve been tracking for a while: the case of Vietnamese-English Minh Quang Pham graphic artist, whom the US charged with materially support Al Qaeda in the Arabian Peninsula last year. Of note, when they charged him, they called for him to forfeit any means he had to influence AQAP.

As a result of planning and perpetuating Federal crimes of terrorism against the United States … defendant [] shall forfeit … all right, title, and interest in all assets, foreign and domestic, affording a source of influence over al Shabaab and AQAP.

Which is all the more interesting still considering the period for which the US charged Pham for material support includes five months — from July to December 2011 — during which a great deal of evidence suggests he was in British custody.

I suppose it might make it easier to hack Inspire if you had their graphic artist in secret custody.

Does This Explain Why Minh Quang Pham Is Languishing Away?

/in , , /by

TBIJ has a troubling report (see also this Independent story) on a number of British citizens who have been stripped of their citizenship so they can be targeted by drones or rendered here to the US. I described the fate of one of them — Mahdi Hashi — here. Another was the Russian spy Anna Chapman, though that happened after her arrest here.

I’m particularly interested, however, in this entry in TBIJ’s report.

B2
Deprived December 2011. Successfully challenged. Government now appealing.

This is one of three known cases where notice has been served on an individual while they were still in the UK. B2 came to the UK as a child with his refugee Vietnamese parents. He became a UK citizen in 1995, and later converted to Islam. In 2010 he reportedly traveled to Yemen, where MI5 alleges he trained with al Qaeda in the Arabian Peninsula (AQAP). He apparently returned to the UK in July 2011 and the Home Secretary informed him he would lose his British citizenship that December. B2 appealed, saying the decision would make him stateless. The Vietnamese government agreed that he was not its citizen, and the order was overturned. However the Home Office told the Bureau it is appealing. B2 is thought still to be in the UK.

These details make B2 sound like Minh Quang Pham, whom I wrote about here and here. Though here’s the timeline DOJ offered when they conspicuously announced Pham’s arrest last May, with a few additional details from Pham’s docket included.

December 2010: Pham travels from the UK to Yemen.

March 2011: Pham’s military training in Yemen begins.

March and April 2011: Pham carries a Kalashnikov.

April 2011: Pham works with Samir Khan and meets Anwar al-Awlaki.

July 2011: End date for military training in Yemen.

September 27, 2011: AQAP releases Inspire, Issue 7.

September 30, 2011: Khan and Awlaki killed in drone strike.

December 2011: End date of material support charges.

May 24, 2012: Pham indicted in NY.

June 29, 2012: Pham “arrested,” while still being held by British authorities in immigration custody. Indictment publicly released by DOJ.

August 23, 2012: Pham’s indictment officially unsealed.

Compare that to these dates regarding the UK’s efforts to strip B2’s citizenship.

February 9, 1983: B2 born in Vietnam.

August 1989: B2 travels with parents to UK, where they are granted asylum.

1995: B2 and his family get British citizenship.

December 2010: B2 travels to Yemen.

July 25, 2011: B2 leaves Yemen.

December 20, 2011: British Secretary of State decides to strip B2 of his citizenship.

December 22, 2011: British SoS provides notice and strips B2 of citizenship.

January 13, 2012: B2 appeals decision based on claim he would be stateless if he lost British citizenship.

June 13-14, 2012: B2’s citizenship hearing.

June 29, 2012: B2’s appeal succeeds.

Much of this lines up perfectly: The December 2010 departure for Yemen, the July 2011 end to military training, and the December 2011 immigration detention.

More important still, note that the British court released its decision about B2 on the same day — June 29, 2012 — that DOJ hastily announced Pham’s arrest, though without formally unsealing his indictment (note, DOJ’s original press release, though not FBI’s version, got disappeared, though can still be accessed via Internet Archive; see also this screen cap showing the press release missing).

The only discrepancy — and it may not be one — is B2’s claim he left Yemen on July 25, 2011. While DOJ’s military training charges end in July 2011, its material support charges continue until December 2011. Though note this Telegraph article says Pham was arrested when he arrived in Heathrow on July 27, 2011.

In short, unless there are a whole lot more Vietnamese refugees to Britain wandering back and forth from Yemen on the very same days, B2 is Pham.

Not only that, but it’s clear his “arrest” appears to be nothing more than an attempt to establish a fall-back position if and when holding him in immigration detention becomes impossible because he gets his citizenship restored. Barring that, they may well leave Pham in immigration custody in the UK indefinitely.

The most curious aspect of all this, though, is that material support charge that continues while, at least according to the Telegraph, Pham was in custody. Maybe the Telegraph is wrong, but if not, it means — according to the US — Pham continued to materially support AQAP while in British custody.

Some Data Points on Minh Qhang Pham, AQAP’s Graphic Artist of Mass Destruction

/8 Comments/in , , /by

On Friday, the government indicted Minh Quang Pham for material support of al Qaeda in the Arabian Peninsula. The indictment and the press release make it clear (though don’t say explicitly–though this report confirms it) that Pham’s primary alleged crime was helping Samir Khan produce Inspire magazine.

In or about April 2011, PHAM worked with a United States citizen (“American CC-1”) to create online propaganda for Al Qaeda in the Arabian Peninsula.

[snip]

[Pham] facilitated communications between al Qa’ida in the Arabian Peninsula and supporters; and provided expert advice and assistance in photography and graphic design of media for al Qa’ida in the Arabian Peninsula.

Meaning CC-2 is Anwar al-Awlaki.

In or about April 2011, PHAM met with a United States citizen (“American CC-2”) in Yemen.

Given the centrality of Pham’s alleged association with Khan and Awlaki, consider the following chronology and the additional details below.

December 2010: Pham travels from the UK to Yemen.

March and April 2011: Pham carries a Kalashnikov.

April 2011: Pham works with Samir Khan and meets Anwar al-Awlaki.

“About” May 2011: UndieBomb infiltrator travels from UK to Yemen.

September 27, 2011: AQAP releases Inspire, Issue 7.

September 30, 2011: Khan and Awlaki killed in drone strike

December 2011: Pham returns to the UK; “Prior to his arrest [June 29, 2012], PHAM was held by British authorities in immigration custody.”

Around April 20, 2012: UndieBomb 2.0 and his handler removed from Yemen.

May 3, 2012: AQAP releases Inspire Issues 8 and 9.

May 7, 2012: UndieBomb 2.0 revealed.

May 11, 2012: British role in recruiting UndieBomb 2.0 revealed.

May 26, 2012: False AQAP statement released.

June 29, 2012: Pham arrested (presumably in Britain); indicted in US.

First, note that some of alleged acts–notably carrying a Kalashnikov–might require an inside source to learn.

Then consider you had someone coming from the UK to Yemen not long before the UndieBomb 2.0 infiltrator. Unlike UndieBomb 2.0, Pham appears to have decided to leave after his partner in propaganda, Khan, got killed. But then he appears to have been held in immigration custody for 6 months–which happens to cover the time UndieBomb 2.0 infiltrator and his handler were still in Yemen.

How interesting, too, that Pham is being tried here in the US, not in the UK (where the crimes are slightly different but where terrorist propaganda is even more criminalized than here, if I understand the law correctly). Why do you suppose they’re trying him here and not in the UK, where he has just been held for 6 months?

Meanwhile, I’ve always been intrigued that the latest versions of Inspire were released between the time when UndieBomb 2.0 was whisked out of Yemen and the time first the purported plot, then UndieBomb 2.0’s role it, was revealed. Then, several weeks later, someone released a false AQAP announcement claiming AQAP had been infiltrated. Pham would have been in British custody during this period.

Finally, there’s this rather interesting language. As a lot of indictments that fall under the federal terrorism statute do, this one has language on forfeiture under 18 USC 981. But note the way it phases this language on forfeiture.

As a result of planning and perpetuating Federal crimes of terrorism against the United States … defendant [] shall forfeit … all right, title, and interest in all assets, foreign and domestic, affording a source of influence over al Shabaab and AQAP.

This guy, presumably, doesn’t have a whole lot of financial goods to forfeit. Nevertheless, the government is going to the trouble of seizing all his interest in assets affording Pham influence over al Shabaab and AQAP.

Those are, mind you, just data points. But some fairly intriguing ones.