The Ooga Booga* Continues to Wear Off

/8 Comments/in , , /by

Two and a half years ago, I noted how TSA head John Pistole pointed to a plot the FBI created while he was still its Deputy Director to justify the use of VIPR teams to stop people on non-aviation public transportation.

A couple of weeks back, I pointed to John Pistole’s testimony that directly justified the expansion of VIPR checkpoints to mass transport locations by pointing to a recent FBI-entrapment facilitated arrest.

Another recent case highlights the importance of mass transit security. On October 27, the Federal Bureau of Investigation (FBI) arrested a Pakistan-born naturalized U.S. citizen for attempting to assist others whom he believed to be members of al Qaida in planning multiple bombings at Metrorail stations in the Washington, D.C., area. During a sting operation, Farooque Ahmed allegedly conducted surveillance of the Arlington National Cemetery, Courthouse, and Pentagon City Metro stations, indicated that he would travel overseas for jihad, and agreed to donate $10,000 to terrorist causes. A federal grand jury in Alexandria, Virginia, returned a three-count indictment against Ahmed, charging him with attempting to provide material support to a designated terrorist organization, collecting information to assist in planning a terrorist attack on a transit facility, and attempting to provide material support to help carry out multiple bombings to cause mass casualties at D.C.-area Metrorail stations.

While the public was never in danger, Ahmed’s intentions provide a reminder of the terrorist attacks on other mass transit systems: Madrid in March 2004, London in July 2005, and Moscow earlier this year. Our ability to protect mass transit and other surface transportation venues from evolving threats of terrorism requires us to explore ways to improve the partnerships between TSA and state, local, tribal, and territorial law enforcement, and other mass transit stakeholders. These partnerships include measures such as Visible Intermodal Prevention and Response (VIPR) teams we have put in place with the support of the Congress. [my emphasis]

Now to be clear, as with Mohamed Mohamud’s alleged plot, Ahmed’s plot never existed except as it was performed by FBI undercover employees. In fact, at the time the FBI invented this plot, now TSA-head Pistole was the Deputy Director of FBI, so in some ways, Ahmed’s plot is Pistole’s plot. Nevertheless, Pistole had no problem pointing to a plot invented by his then-subordinates at the FBI to justify increased VIPR surveillance on “mass transit and other surface transportation venues.” As if the fake FBI plot represented a real threat.

Today, a NYT piece raises questions about VIPR’s efficacy (without, however, noting how TSA has pointed to FBI-generated plots to justify it).

T.S.A. and local law enforcement officials say the teams are a critical component of the nation’s counterterrorism efforts, but some members of Congress, auditors at the Department of Homeland Security and civil liberties groups are sounding alarms. The teams are also raising hackles among passengers who call them unnecessary and intrusive.

“Our mandate is to provide security and counterterrorism operations for all high-risk transportation targets, not just airports and aviation,” said John S. Pistole, the administrator of the agency. “The VIPR teams are a big part of that.”

Some in Congress, however, say the T.S.A. has not demonstrated that the teams are effective. Auditors at the Department of Homeland Security are asking questions about whether the teams are properly trained and deployed based on actual security threats.

It’d really be nice if NYT had named the “some” in Congress who had raised concerns. Read more →

Did Yemen Evacuation Cover Staging of JSOC Troops, Equipment for Attack?

/8 Comments/in /by
A C-17 configured to carry troops being redeployed out of Bagram. (DVIDS)

A C-17 configured to carry troops being redeployed out of Bagram. (DVIDS)

Earlier this morning, a tweet from Joshua Foust alerted me to this BBC article, where it appears that some observers suspect that the US may be preparing a JSOC strike within Yemen:

Amid the escalating tensions, sources also told BBC Newsnight that the US was preparing special operations forces for possible strike operations against al-Qaeda in Yemen.

Although the US has previously sent special forces to train counter-terrorist units, there are now suggestions that the Joint Special Operations Command (JSOC), may be preparing units for strike operations, the sources said.

This information prompted me to remember that I had noticed someone mention that yesterday’s evacuation of personnel from Yemen was described as having employed an Air Force C-17. The C-17 is a highly versatile aircraft and can be rapidly reconfigured between transporting passengers and heavy equipment:

The design of the cargo compartment allows the C-17 to carry a wide range of vehicles, palleted cargo, paratroops, air-drop loads and aeromedical evacuees.

The cargo compartment has a sufficiently large cross-section to transport large wheeled and tracked vehicles, tanks, helicopters (such as the AH-64 Apache), artillery and weapons such as the Patriot missile system. Three Bradley armoured vehicles comprise one deployment load on the C-17. The US Army M1A1 main battle tank can be carried with other vehicles.

The maximum payload is 170,900lb (77,519kg) with 18 pallet positions, including four on the ramp. Airdrop capabilities include: a single load of up to 60,000lb (27,216kg), sequential loads of up to 110,000lb (49,895kg), Container Delivery System (CDS) airdrop up to 40 containers, 2,350lb (1,066kg) each, up to 102 paratroops.

Here is how the use of a C-17 in the evacuation was described:

Almost 100 U.S. government personnel were evacuated from Yemen at dawn Tuesday as the State Department urged all Americans in the country to leave “immediately” because of an “extremely high” threat of a terrorist attack — even as a U.S. drone attack killed four suspected terrorists.

U.S. officials said the “non-emergency evacuation” of “just under a hundred” personnel was carried out by an US Air Force C-17 which took off from the Yemeni capital, Sana’a, bound for Ramstein air base in Germany. Some essential embassy staff stayed behind.

And so that story would have us believe that as the C-17 left Sana’a for Ramstein, the inside looked somewhat like the photo above, but with the embassy personnel in civilian clothing instead of uniforms. But I wonder what the inside of the C-17 looked like as it landed in Sana’a. Something like this, maybe, with a number of Special Forces soldiers? (Not that tank would be the heavy equipment of choice, but you get the idea.)

A C-17 configured to carry heavy equipment. (Wikimedia Commons)

A C-17 configured to carry heavy equipment. (Wikimedia Commons)

Note also that the NBC story states the evacuation flight left at dawn. That means the C-17 would have arrived and possibly been unloaded under cover of darkness. Also note that Foust’s first assumption was that the usual course of action would have been for the US to utilize a commercial charter for the evacuation. Use of the C-17 instead of a commercial charter opens up more possibilities on what the US may have been up to with these flights.

What If the Tor Takedown Relates to the Yemeni Alert?

/32 Comments/in , /by

Eli Lake and Josh Rogin reveal that the intercept between Ayman al-Zawahiri and Nasir al-Wuhayshi was actually a conference call between those two and affiliates all over the region.

The Daily Beast has learned that the discussion between the two al Qaeda leaders happened in a conference call that included the leaders or representatives of the top leadership of al Qaeda and its affiliates calling in from different locations, according to three U.S. officials familiar with the intelligence. All told, said one U.S. intelligence official, more than 20 al Qaeda operatives were on the call.

To be sure, the CIA had been tracking the threat posed by Wuhayshi for months. An earlier communication between Zawahiri and Wuhayshi delivered through a courier was picked up last month, according to three U.S. intelligence officials. But the conference call provided a new sense of urgency for the U.S. government, the sources said.

The fact that al Qaeda would be able to have such conference calls in this day and age is stunning. The fact that US and Yemeni sources would expose that they knew about it is equally mind-boggling.

But one thing would make it make more sense.

On Sunday, Tor users first discovered the FBI had compromised a bunch of onion sites and introduced malware into FireFox browsers accessing the system. Since then, we’ve learned the malware was in place by Friday, the day the US first announced this alert (though the exploit in FireFox has been known since June).

The owner of an Irish company, Freedom Hosting, has allegedly been providing turnkey hosting services for the Darknet, or Deep Web, which is “hidden” and only accessible through Tor .onion and the Firefox browser. The FBI reportedly called Eric Eoin Marques “the largest facilitator of child porn on the planet” and wants to extradite the 28-year-old man. About that time, Freedom Hosting went down; Tor users discovered that someone had used a Firefox zero-day to deliver drive-by-downloads to anyone who accessed a site hosted by Freedom Hosting. Ofir David, of Israeli cybersecurity firm Cyberhat, told Krebs on Security, “Whoever is running this exploit can match any Tor user to his true Internet address, and therefore track down the Tor user.”

If you’ve never visited the Hidden Wiki, then you should be fully aware that if you do, you will see things that can never be unseen. Freedom Hosting maintained servers for “TorMail, long considered the most secure anonymous email operation online,” wrote Daily Dot. “Major hacking and fraud forums such as HackBB; large money laundering operations; and the Hidden Wiki, which, until recently, was the de facto encyclopedia of the Dark Net; and virtually all of the most popular child pornography websites on the planet.”

But if you use Tor Browser Bundle with Firefox 17, you accessed a Freedom Hosting hidden service site since August 2, and you have JavaScript enabled, then experts suggest it’s likely your machine has been compromised. In fact, E Hacking News claimed that almost half of all Tor sites have been compromised by the FBI. [my emphasis]

So what if this takedown was only secondarily about child porn, and primarily about disabling a system al Qaeda has used to carry out fairly brazen centralized communications? Once the malware was in place, the communications between al Qaeda would be useless in any case (and I could see the government doing that to undermine the current planning efforts).

The timing would all line up — and it would explain (though not excuse) why the government is boasting about compromising the communications. And it would explain why Keith Alexander gave this speech at BlackHat.

terrorists … terrorism … terrorist attacks … counterterrorism … counterterrorism … terrorists … counterterrorism … terrorist organizations … terrorist activities … terrorist … terrorist activities … counterterrorism nexus … terrorist actor … terrorist? … terrorism … terrorist … terrorists … imminent terrorist attack … terrorist … terrorist-related actor … another terrorist … terrorist-related activities … terrorist activities … stopping terrorism … future terrorist attacks … terrorist plots … terrorist associations

[snip]

Sitting among you are people who mean us harm

Just one thing doesn’t make sense.

Once NSA/FBI compromised Tor, they’d have a way to identify the location of users. That might explain the uptick in drone strikes in Yemen in the last 12 days. But why would you both alert Tor users and — with this leak — Al Qaeda that you had broken the system and could ID their location? Why not roll up the network first, and then take down the Irish child porn guy who is the likely target?

I’m not sure I understand the Tor exploit well enough to say, but the timing does line up remarkably well.

Update: Some re-evaluation of what really happened with the exploit.

Researchers who claimed they found a link between the Internet addresses used as part of malware that attacked Freedom Hosting’s “hidden service” websites last week and the National Security Agency (NSA) have backed off substantially from their original assertions. After the findings were criticized by others who analyzed Domain Name System (DNS) and American Registry for Internet Numbers (ARIN) data associated with the addresses in question, Baneki Privacy Labs and Cryptocloud admitted that analysis of the ownership of the IP addresses was flawed. However, they believe the data that they used to make the connection between the address and the NSA may have changed between their first observation.

Update: On Twitter, Lake clarifies that this conference call was not telephone-based communications.

Who Will the Government Scapegoat Now on the Wuhayshi Leak?

/2 Comments/in /by

Yesterday, I noted that McClatchy, the first outlet to publish (though probably not the first outlet to get the leak) the news that the big terror alert stems from an intercepted communication between Ayman al-Zawahiri and Nasir al-Wuhayshi, clearly labeled its source as a Yemeni official.

HuffPo not only confirmed this, but got McClatchy’s editor James Asher to provide a little lesson in journalism.

Our story was based on reporting in Yemen and we did not contact the administration to ask permission to use the information. In fact, our reporter tells me that the intercept was pretty much common knowledge in Yemen.
On your larger question about the administration’s request, I’m not surprised. It is not unusual for CNN or the NYT to agree not to publish something because the White House asked them. And frankly, our Democracy isn’t well served when journalists agree to censor their work.

As I’ve told our readers in the past: McClatchy journalists will report fairly and independently. We will not make deals with those in power, regardless of party or philosophy.

Now, predictably, some of the same people who generated the outrage over UndieBomb 2.0 have squawked about the danger of this leak (which, if it is what has been described, must be damaging).

“I’m very worried about leaks to the media of classified information because it warns the enemy,” Sen. John McCain, R-Ariz., told Ward. “That’ll be the last intercept of that kind, of means of communication that we intercept.”

Added Sen. Lindsey Graham, R-S.C., “If we compromise our ability to find out what these guys are up to and stop them before they act, we’ll pay a heavy price. They’re not deterred by dying. They embrace dying. They just want to take me and you with ’em.”

Frankly, McCain and Lindsey are right this time around. This feels like a politicized leak, and if the underlying intelligence was what the reports say, it may well badly damage our legitimate SIGINT efforts.

All that said, I confess I popped a little popcorn when I read this last night. Because it’s clear the Yemenis weren’t the only ones leaking like a sieve. Someone in the Administration (NYT’s sources)  It’ll be hard for the Administration to target McClatchy given that they’ve already made clear where their source is (though I can’t help to suspect McClatchy’s sharp response to relates to the reported treatment of McClatchy freelancer Jon Stephenson). So who are they going to scapegoat this time?

Was It NSA or a Yemeni “Ally” Leaking the “Clear Orders” from Zawahiri to Wuhayshi?

/26 Comments/in , /by

Apparently, it wasn’t enough for someone to leak this information to the NYT (which said that it withheld some information at the request from the government).

The United States intercepted electronic communications this week among senior operatives of Al Qaeda, in which the terrorists discussed attacks against American interests in the Middle East and North Africa, American officials said Friday.

The intercepts and a subsequent analysis of them by American intelligence agencies prompted the United States to issue an unusual global travel alert to American citizens on Friday, warning of the potential for terrorist attacks by operatives of Al Qaeda and their associates beginning Sunday through the end of August.

Then someone apparently in Sanaa leaked this to McClatchy.

An official who’d been briefed on the matter in Sanaa, the Yemeni capital, told McClatchy that the embassy closings and travel advisory were the result of an intercepted communication between Nasir al-Wuhayshi, the head of the Yemen-based Al Qaida in the Arabian Peninsula, and al Qaida leader Ayman al Zawahiri in which Zawahiri gave “clear orders” to al-Wuhaysi, who was recently named al Qaida’s general manager, to carry out an attack.

The official, however, said he could not divulge details of the plot. AQAP’s last major attack in Sanaa took place in May 2012 when a suicide bomber killed more than 100 military cadets at a rehearsal for a military parade. [my emphasis]

Which the WaPo has now reported too.

Al-Qaeda leader Ayman al-Zawahiri ordered the head of the terrorist group’s Yemen affiliate to carry out an attack, according to intercepted communications that have led to the closure of U.S. embassies and a global travel alert, said a person briefed on the case.

In one communication, Zawahiri, who succeeded Osama bin Laden, gave “clear orders” to Nasir al-Wuhayshi, the founder of al-Qaeda in the Arabian Peninsula, to undertake an attack, the source said. McClatchy newspapers first reported the exchange on Sunday. [my emphasis]

In a follow-up story, McClatchy attributes their information to a Yemeni official.

U.S. officials have been secretive about what precise information led to the worldwide travel advisory and embassy closings, but a Yemeni official told McClatchy on Sunday that authorities had intercepted “clear orders” from al Qaida leader Ayman Zawahiri to Nasir al Wuhayshi, the head of the affiliate in Yemen, to carry out an attack.

Remember, Saudis and Yemeni sources have a well-established history of leaking sensitive intelligence about our thwarted plots. But in this case, the original source (to the NYT) seems to be American, with a Yemeni first providing the really remarkable level of detail.

And thus far, no one from the government has called for the NYT, McClatchy, and WaPo sources to be jailed. How … telling.

Perhaps just as interesting, the US has used a C-17 to evacuate what State is calling emergency personnel from Yemen.

Pentagon officials said a U.S. Air Force C-17 transport plane carrying some American government personnel had taken off from Yemen. They said the State Department had ordered non-essential personnel to leave the country.

An unknown number of U.S. Embassy personnel remain in Sanaa.

Pentagon Press Secretary George Little said the Defense Department “continues to have personnel on the ground in Yemen to support the U.S. State Department and monitor the security situation.”

But someone wants Andrea Mitchell not to report this as an evacuation; whatever it is, almost 100 people have been, um, evacuated.

Are these “emergency personnel” people whose identity has been leaked?

Now, as a threshold level, the news that the US has collections of whatever presumably well-protected communication channel exist(ed) between Zawahiri and Wuhayshi sure seems to undermine government claims that Edward Snowden has ruined their collections, given that two of our very sharpest targets are still using communications accessible to US targeting.

Consider one more thing. If our collections are that good that we have a bead on either Zawahiri or Wuhayshi, why don’t we have their location?

We’ve launched 4 drone strikes in 10 days in Yemen. If we did have means of intercepting Wuhayshi’s communications and are clearly on a drone strike binge, then what does it mean that sources — including at least one Yemeni official — are leaking news that we have those intercepts?

Update: And here’s Michael Hayden, who for weeks has been arguing that Edward Snowden should be made an example of, suggesting this alert is good because it lets the bad guys know we’re onto them.

“The announcement itself may also be designed to interrupt Al Qaeda planning, to put them off stride,” Michael V. Hayden, a former C.I.A. director, said on “Fox News Sunday.” “To put them on the back foot, to let them know that we’re alert and that we’re on at least to a portion of this plotline.”

Pakistan Deploys Troops to Beef Up Security at Jail Housing Shakeel Afridi, Key Taliban Figures

/3 Comments/in /by

As we await word on why the airlines’ SABRE reservation system would go down at exactly the time the US is warning that Undie 3.0 could be underway and the US is evacuating our personnel from Yemen, there are interesting developments on the related world trend of prison breaks.

Recall that one of the large prison breaks of al Qaeda figures took place in Dera Ismail Khan, Pakistan on July 29, with about 250 prisoners escaping. It would appear that Pakistan had very specific advance warning on this attack, but the security personnel who were present did not do their jobs once the attack started. Today, we learn from Dawn that Pakistani Army troops have been dispatched to at least two more jails to beef up security as there appears to be a new intelligence warning addressing all jails in the province of Khyber Pakhtunkhwa:

Amid security threats of militant attacks, Army troops were deployed on Tuesday at Central Jail Peshawar, which holds Dr Shakil Afridi and other high profile Taliban inmates, and Haripur jail.

The military sources confirmed that the troops took over the jail security on the request of the civil administration .

The source added that the deployment would not be for a long period and that the troops would be present at the prisons only to strengthen the security cordon.

/snip/

Other sources said that though security warning was issued for all the jails in Khyber Pakhtunkhwa (KPK) province but Central Jail Peshawar could be the prime target as Dr Shakil Afridi who was convicted of assisting the Central Intelligence Agency (CIA) in obtaining DNA samples of Osama Bin Laden through a fake vaccination campaign was also held in the said prison.

Moreover the founder chief of the outlawed Tehrik Nifaz Sharia-i-Muhammadi (TNSM), Mualana Sufi Mohammad, the former Taliban spokesman Muslim Khan, and a number of other key commanders belinging [sic] to the Swat and Bajaur chapter of the Taliban are also jailed in the Peshawar Central Prison.

Recall that it was pointed out over a year ago that Afridi is under considerable risk being housed in a jail with such high-profile Taliban figures. Despite that risk, though, Afridi managed to be interviewed by Fox News from inside the jail, with the interview published just one day before Benghazi Day. Both Afridi and a number of guards were then retaliated against for allowing the interview to happen.

If an attack occurs on Peshawar Central Jail, it seems likely that Afridi would have a very low prospect of surviving, as both militants inside the jail and those who launch the attack from outside would be highly motivated to see him killed. It would seem to me that Pakistan could stabilize the situation somewhat by moving Afridi to an undisclosed more secure location and then making it known that he has been moved.

Shut Down CyberCommand — US CyberCommander Keith Alexander Doesn’t Think It’s Important

/13 Comments/in , , , /by

Back on March 12 — in the same hearing where he lied to Ron Wyden about whether the intelligence community collects data on millions of Americans — James Clapper also implied that “cyber” was the biggest threat to the United States.

So when it comes to the distinct threat areas, our statement this year leads with cyber. And it’s hard to overemphasize its significance. Increasingly, state and non-state actors are gaining and using cyber expertise. They apply cyber techniques and capabilities to achieve strategic objectives by gathering sensitive information from public- and private sector entities, controlling the content and flow of information, and challenging perceived adversaries in cyberspace.

That was the big takeaway from Clapper’s Worldwide Threat Assessment. Not that he had lied to Wyden, but that that cyber had become a bigger threat than terrorism.

How strange, then, that the US CyberCommander (and Director of National Security) Keith Alexander mentioned cyber threats just once when he keynoted BlackHat the other day.

But this information and the way our country has put it together is something that we should also put forward as an example for the rest of the world, because what comes out is we’re collecting everything. That is not true. What we’re doing is for foreign intelligence purposes to go after counterterrorism, counterproliferation, cyberattacks. And it’s focused. [my emphasis]

That was it.

The sole mention of the threat his boss had suggested was the biggest threat to the US less than 5 months earlier. “Counterterrorism, counterproliferation, cyberattacks. and it’s focused.”

The sole mention of the threat that his audience of computer security professionals are uniquely qualified to help with.

Compare that to his 27 mentions of “terror” (one — the one with the question mark — may have been a mistranscription):

terrorists … terrorism … terrorist attacks … counterterrorism … counterterrorism … terrorists … counterterrorism … terrorist organizations … terrorist activities … terrorist … terrorist activities … counterterrorism nexus … terrorist actor … terrorist? … terrorism … terrorist … terrorists … imminent terrorist attack … terrorist … terrorist-related actor … another terrorist … terrorist-related activities … terrorist activities … stopping terrorism … future terrorist attacks … terrorist plots … terrorist associations

That was the speech the US CyberCommander chose to deliver to one of the premiere group of cybersecurity professionals in the world.

Terror terror terror.

Sitting among you are people who mean us harm

… US CyberCommander Alexander also said.

Apparently, Alexander and Clapper’s previous intense focus on stopping hacktavists and cyberattacks and cybertheft and cyber espionage have all been preempted by the necessity of scaring people into accepting the various dragnets that NSA has deployed against Americans.

Which, I guess, shows us the true seriousness of the cyber threat.

To be fair to our CyberCommander, he told a slightly different story back on June 27, when he addressed the Armed Forces Communications and Electronics Association International Cyber Symposium.

Sure, he started by addressing Edwards Snowden’s leaks.

But then he talked about a debate he was prepared to have.

I do think it’s important to put that on the table, because as we go into cyber and look at–for cyber in the future, we’ve got to have this debate with our country. How are we going to protect the nation in cyberspace? And I think this is a debate that is going to have all the key elements of the executive branch–that’s DHS, FBI, DOD, Cyber Command, NSA and other partners–with our allies and with industry. We’ve got to figure how we’re going to work together.

How are we going to protect the nation in cyberspace? he asked a bunch of Military Intelligence Industrial Complex types.

At his cyber speech, Alexander also described his plan to build, train, and field one-third of the force by September 30 — something you might think he would have mentioned at BlackHat.

Not a hint of that.

Our US CyberCommander said — to a bunch of industry types — that we need to have a debate about how to protect the nation in cyberspace.

But then, a month later, with the group who are probably most fit to debate him on precisely those issues, he was all but silent.

Just terror terror terror.

On Same Day Alexander Tells BlackHat, “Their Intent Is to Find the Terrorist That Walks Among Us,” We See NSA Considers Encryption Evidence of Terrorism

/19 Comments/in , , , /by

Screen shot 2013-08-01 at 9.34.18 AM

Thirty minutes into his speech at BlackHat yesterday, Keith Alexander said,

Remember: their intent is not to go after our communications. Their intent is to find the terrorist walks among us.

He said that to a room full of computer security experts, the group of Americans probably most likely to encrypt their communications, even hiding their location data.

At about the same time Alexander made that claim, the Guardian posted the full slide deck from the XKeyscore program it reported yesterday.

How do I find a cell of terrorists that has no connection to known strong-selectors?

Answer: Look for anomalous events

Among other things, the slide considers this an anomalous event indicating a potential cell of terrorists:

  • Someone who is using encryption

Meanwhile, note something else about Alexander’s speech.

13:42 into his speech, Alexander admits the Section 702 collection (this is true of XKeyscore too — but not the Section 215 dragnet, except in its use on Iran) also supports counter-proliferation and cybersecurity.

That is the sole mention in the entire speech of anything besides terrorism. The rest of it focused exclusively on terror terror terror.

Except, of course, yesterday it became clear that the NSA considers encryption evidence of terrorism.

Increasingly, this infrastructure is focused intensively on cybersecurity, not terrorism. That’s logical; after all, that’s where the US is under increasing attack (in part in retaliation for attacks we’ve launched on others). But it’s high time the government stopped screaming terrorism to justify programs that increasing serve a cybersecurity purpose. Especially when addressing a convention full of computer security experts.

But maybe Alexander implicitly admits that. At 47:12, Alexander explains that the government needs to keep all this classified because (as he points into his audience),

Sitting among you are people who mean us harm.

(Note after 52:00 a heckler notes the government might consider BlackHat organizer Trey Ford a terrorist, which Alexander brushes off with a joke.)

It’s at that level, where the government considers legal hacker behavior evidence of terrorism, that all reassurances start to break down.

Update: fixed XKeystroke for XKeyscore–thanks to Myndrage. Also, Marc Ambinder reported on it in his book.

Update: NSA has now posted its transcript of Alexander’s speech. It is 12 pages long; in that he mentioned “terror” 27 times. He mentions “cyber” just once.

Well, at Least DOJ Promised Not to Mine Journalists’ Metadata Going Forward

/5 Comments/in , , , /by

When I read this passage from DOJ’s new News Media Policy, it caused me as much concern as relief.

The Department’s policies will be revised to provide formal safeguards regarding the proper use and handling of communications records of members of the news media. Among other things, the revisions will provide that with respect to information obtained pursuant to the Department’s news media policy: (i) access to records will be limited to Department personnel who are working on the investigation and have a need to know the information; (ii) the records will be used solely in connection with the investigation and related judicial proceedings; (iii) the records will not be shared with any other organization or individual inside or outside of the government, except as part of the investigation or as required in the course of judicial proceedings; and(iv) at the conclusion of all proceedings related to or arising from the investigation, other than information disclosed in the course of judicial proceedings or as required by law, only one copy of records will be maintained in a secure, segregated repository that is not searchable.

It is nice for the subset of journalists treated as members of news media whose calls get treated under these new policies and not — as still seems possible — under the apparently more permissive guidelines in the FBI’s Domestic Investigations and Operations Guide that when their call and other business records are collected, some of that information will ultimately be segregated in a non-searchable collection. Though why not destroy it entirely, given that the information used for the investigation and court proceedings will not be segregated?

Moreover, this passage represents a revision of previous existing policy.

Which means data from members of the news media may not have been segregated in the past.

When you consider that one of the abuses that led to these new policies included the collection of 20 phone lines worth of data from the AP — far, far more than would be warranted by the investigation at hand — it raises the possibility that DOJ used to do more with the data it had grabbed from journalists than just try to find isolated sources.

Like the two to three hop analysis they conduct on the Section 215 dragnet data.

It’s with that in mind that I’ve been reading the reports that Kiwi troops were wandering around Kabul with records of McClatchy freelancer Jon Stephenson’s phone metadata.

The Sunday Star-Times has learned that New Zealand Defence Force personnel had copies of intercepted phone “metadata” for Stephenson, the type of intelligence publicised by US intelligence whistleblower Edward Snowden. The intelligence reports showed who Stephenson had phoned and then who those people had phoned, creating what the sources called a “tree” of the journalist’s associates.

New Zealand SAS troops in Kabul had access to the reports and were using them in active investigations into Stephenson.

The sources believed the phone monitoring was being done to try to identify Stephenson’s journalistic contacts and sources. They drew a picture of a metadata tree the Defence Force had obtained, which included Stephenson and named contacts in the Afghan government and military.

The sources who described the monitoring of Stephenson’s phone calls in Afghanistan said that the NZSIS has an officer based in Kabul who was known to be involved in the Stephenson investigations.

Last year, when this happened, Stephenson was on the Green-on-Blue beat, He published a story that a massacre in Pashtun lands had been retaliation for the killing of Taliban. He reported on another NATO massacre of civilians. He reported that a minister accused of torture and other abuses would be named Hamid Karzai’s intelligence chief. Earlier last year he had reported on the negotiations over prisoner transfers from the US to Afghan custody.

Now, the original report made a both a credibility and factual error when it said Stephenson’s metadata had been “intercepted.” That has provided the Kiwi military with a talking point on which to hang a non-denial denial — a point Jonathan Landay notes in his coverage of the claims.

Maj. Gen. Tim Keating, the acting chief of New Zealand’s military, said in a statement that no military personnel had undertaken “unlawful interception of private communications.”

“I have asked the officers responsible for our operations in Afghanistan whether they have conducted monitoring of Mr Stephenson . . . and they have assured me that they have not.”

The statement, however, did not address whether metadata, which includes the location from where a call is made, the number and location of the person who is being called and the duration of the call, was collected for Stephenson’s phones. Such data are generally considered business records of a cell phone provider and are obtained without intercepting or real-time monitoring of calls. In the United States, for example, the Foreign Intelligence Surveillance Court has ordered Verizon to deliver such records of all its customers to the National Security Agency on a daily basis.

While under contract to McClatchy, Stephenson used McClatchy cell phones and was in frequent contact with McClatchy editors and other reporters and correspondents. [my emphasis]

Indeed, higher ranking New Zealand politicians are trying to insinuate that Stephenson’s call records would only be collected if he was communicating with terrorists — even while admitting the government did have a document treating investigative journalists like terrorists.

Prime Minister John Key said it’s theoretically possible that reporters could get caught in surveillance nets when the U.S. spies on enemy combatants.

[snip]

Also Monday, New Zealand Defense Minister Jonathan Coleman acknowledged the existence of an embarrassing confidential order that lists investigative journalists alongside spies and terrorists as potential threats to New Zealand’s military. That document was leaked to Hager, who provided a copy to The Associated Press. Coleman said the order will be modified to remove references to journalists.

Finally, New Zealand officials seem to be getting close to blaming this on the US.

“The collection of metadata on behalf of the NZDF by the U.S. would not be a legitimate practice, when practiced on a New Zealand citizen,” Coleman said. “It wouldn’t be something I would support as the minister, and I’d be very concerned if that had actually been the case.”

Thus far, the coverage of the Stephenson tracking has focused on the Kiwi role in all of it. But as Landay notes, Stephenson would have been using McClatchy-provided cell phones at the time, suggesting the US got the records themselves, not by intercepting anything, but simply by asking the carrier, as they did with the AP.

Ultimately, no one is issuing a direct denial that some entity tied to ISAF — whether that be American or New Zealand forces — collected the phone records of a journalist reporting for a US-based outlet to try to identify his non-friendly sources.

So what other journalists have US allies likened to terrorists because they actually reported using both friendly and unfriendly sources?

70% of Pew’s Respondents More Attentive than Pew?

/2 Comments/in , , /by

Screen shot 2013-07-29 at 7.53.58 AMYou may have seen that a Pew poll shows, for the first time, more people think the government has gone too far in restricting civil liberties than think it has not gone far enough to protect the country. (Another poll had a similar finding just after the Boston Marathon attack.)

That said, even with concerns about civil liberties, 50% of those polled approve of the collection in the name of terrorism, while 44% disapprove.

While I’m heartened that the country has finally started expressing some concern about civil liberties, I think a detail of the Pew poll is worth noting.

A big chunk of Pew’s readers seem to have a more accurate understanding of the program than Pew’s pollsters.

Screen shot 2013-07-29 at 7.58.50 AMConsider two of its three headline findings: that 70% use data for purposes other than terrorism and that 63% believe the government is collecting more than metadata.

The first question was asked like this:

Do you think this government data collection effort is only being used to investigate terrorism, or do you think the government uses this data for purposes other than terrorism investigations?

The second question was phrased like this:

Just your impression, does this government program only collect data such as phone numbers and e-mail addresses, or is it also collecting what’s actually being said in the calls and e-mails?

The thing is, both of these questions are true: The government collects content under Section 702, including the incidentally collected content of Americans (which they can go back and search on later). And the 702 program collects information for counter-proliferation, cybersecurity, and other foreign intelligence purposes (the metadata program is reportedly limited to terrorism … if you believe all of Iran is a terrorist organization).

That said, only some of the “other purposes” Pew readers cited — such as gathering information for other crimes, and for national security — match the ones the government admits to. They also name political targeting and general control.

But Pew’s report suggests those who thing the government is collecting content are wrong.

And despite the insistence by the president and other senior officials that only “metadata,” such as phone numbers and email addresses, is being collected, 63% think the government is also gathering information about the content of communications – with 27% believing the government has listened to or read their phone calls and emails.

No. They haven’t insisted they’re collecting only metadata. They’ve insisted they’ve only used Section 215 dragnet to collect metadata.

Perhaps the headline of this study ought to be, 70% of Pew’s respondents not snookered by the metadata claim, unlike Pew?