Matthew Ferry's List: NSA

• “America’s capabilities are unique,” Mr. Obama said. “And the power of new technologies means that there are fewer and fewer technical constraints on what we can do. That places a special obligation on us to ask tough questions about what we should do.”
• Invoking lofty principles and then going into a highly technical discussion of the N.S.A.’s procedures, Mr. Obama said he would require prior court approval each time an agency analyst wants access to calling records, except in emergencies. He also said he had forbidden eavesdropping on the leaders of allied countries, after the disclosure of such activities ignited a diplomatic firestorm with Germany, Brazil and other countries.
• For example, Mr. Obama did not accept one of the most far-reaching recommendations of his own advisory panel on surveillance practices: requiring court approval for so-called national security letters, a kind of subpoena allowing the F.B.I. to obtain information about people from their banks, cellphone providers and other companies.
• Mr. Obama’s stated intent to get the government out of the business of warehousing Americans’ calling data in bulk may prove easier said than done. The phone companies have resisted taking on that role, which raises an array of difficulties, as Mr. Obama acknowledged in his speech.
• The president gave Attorney General Eric H. Holder Jr. 60 days to come back with recommendations; the government, for the time being, will continue to collect the data until Congress decides where ultimately it should be held.
• For analysts working at the N.S.A., Mr. Obama’s changes will have two immediate effects. They will be able to scrutinize phone calls that are only two steps removed from a number associated with a terrorism suspect, rather than three.
• Mr. Obama also said he was taking the “unprecedented step” of extending privacy safeguards to non-Americans, including requiring that data collected abroad be deleted after a certain period and limiting its use to specific security requirements, like counterterrorism and cybersecurity.
• The president did not specify which foreign leaders would be on the no-spying list. But, he said, “Heads of state and government with whom we work closely, and on whose cooperation we depend, should feel confident that we are treating them as real partners.”
• Modifying a proposal from his advisory group, Mr. Obama proposed a panel of advocates on privacy and technology issues that would appear before the Foreign Intelligence Surveillance Court. But the panel, composed of part-time lawyers, would be called on only in “novel” cases, rather than in every case. Left unclear was who would decide which cases are novel.

7 more annotations...

• judges in Oregon on Tuesday upheld a 2008 law permitting warrantless surveillance but struck down a key aspect of the so-called no-fly list that blocks people suspected of terrorism ties from boarding planes.

• Analysts working for the NSA refer to this behaviour as LOVEINT – a play on existing surveillance parlance such as HUMINT (‘human intelligence’) and SIGINT (‘signals intelligence’).

• The new guidelines allow individuals to be designated as representatives of terror organizations without any evidence they are actually connected to such organizations, and it gives a single White House official the unilateral authority to place entire “categories” of people the government is tracking onto the no fly and selectee lists. It broadens the authority of government officials to “nominate” people to the watchlists based on what is vaguely described as “fragmentary information.” It also allows for dead people to be watchlisted.
• Because the government tracks “suspected terrorists” as well as “known terrorists,” individuals can be watchlisted if they are suspected of being a suspected terrorist, or if they are suspected of associating with people who are suspected of terrorism activity.
• In addition to expected crimes, such as assassination or hostage-taking, the guidelines also define destruction of government property and damaging computers used by financial institutions as activities meriting placement on a list. They also define as terrorism any act that is “dangerous” to property and intended to influence government policy through intimidation.
• In 2012 Tim Healy, the former director of the FBI’s Terrorist Screening Center, described to CBS News how watchlists are used by police officers. “So if you are speeding, you get pulled over, they’ll query that name,” he said. “And if they are encountering a known or suspected terrorist, it will pop up and say call the Terrorist Screening Center…. So now the officer on the street knows he may be dealing with a known or suspected terrorist.” Of course, the problem is that the “known or suspected terrorist” might just be an ordinary citizen who should not be treated as a menace to public safety.
• And in 2009, after a Nigerian terrorist was able to board a passenger flight to Detroit and nearly detonated a bomb sewn into his underwear despite his name having been placed on the TIDE list, President Obama admitted that there had been a “systemic failure.”

• “In determining whether a REASONABLE SUSPICION exists, due weight should be given to the specific reasonable inferences that a NOMINATOR is entitled to draw from the facts in light of his/her experience and not on unfounded suspicions or hunches. Although irrefutable evidence or concrete facts are not necessary, to be reasonable, suspicion should be as clear and as fully developed as circumstances permit.”

   

• Americans and foreigners can be nominated for the watchlists if they are associated with a terrorist group, even if that group has not been designated as a terrorist organization by the U.S. government. They can also be treated as “representatives” of a terrorist group even if they have “neither membership in nor association with the organization.” The guidelines do helpfully note that certain associations, such as providing janitorial services or delivering packages, are not grounds for being watchlisted.

   

• In a recent court filing, the government disclosed that there were 468,749 KST nominations in 2013, of which only 4,915 were rejected–a rate of about one percent. The rulebook appears to invert the legal principle of due process, defining nominations as “presumptively valid.”

   

  

   
• Screeners are also instructed to collect data on any “pocket litter,” scuba gear, EZ Passes, library cards, and the titles of any books, along with information about their condition—”e.g., new, dog-eared, annotated, unopened.” Business cards and conference materials are also targeted, as well as “anything with an account number” and information about any gold or jewelry worn by the watchlisted individual. Even “animal information”—details about pets from veterinarians or tracking chips—is requested. The rulebook also encourages the collection of biometric or biographical data about the travel partners of watchlisted individuals.
• If a U.S. citizen is placed on the no fly list while abroad and is turned away from a flight bound for the U.S., the guidelines say they should be referred to the nearest U.S. embassy or consulate, which is prohibited from informing them why they were blocked from flying.
• According to the rules, these individuals can be granted a “One-Time Waiver” to fly, though they will not be told that they are traveling on a waiver. Back in the United States, they will be unable to board another flight.

9 more annotations...

• In 2013, the U.S. State Department reported that “Ministry of Interior officials sometimes subjected prisoners and detainees to torture and other physical abuse,” specifically mentioning a 2011 episode in which MOI agents allegedly “poured an antiseptic cleaning liquid down [the] throat” of one human rights activist. The report also notes the MOI’s use of invasive surveillance targeted at political and religious dissidents.

• The NSA’s formal “Third Party” relationship with the Saudis involves arming the MOI with highly advanced surveillance technology. The NSA “provides technical advice on SIGINT topics such as data exploitation and target development to TAD,” the memo says, “as well as a sensitive source collection capability.”

   

• Beyond their own surveillance programs, the American and British surveillance agencies rely on U.S.-supported Arab regimes, including the Jordanian monarchy and even the Palestinian Authority Security Forces, to provide vital spying services regarding Palestinian targets.

• “The United States has been trying to broker peace in the Middle East for the past 20 years,” wrote the liberal commentator Kevin Drum in Mother Jones, last Tuesday. The following day, CNN reported that the Obama administration ”agreed to Israel’s request to resupply it with several types of ammunition … Among the items being bought are 120mm mortar rounds and 40mm ammunition for grenade launchers.”

   

• To begin with, Recorded Future, the outfit that produced the government-affirming report, is anything but independent. To the contrary, it is funded by the CIA and U.S. intelligence community with millions of dollars. Back in 2010, it also filed forms to become a vendor for the NSA.
• One document found in the GCHQ archive provided by Snowden is a 45-page, single-spaced manual that the British spy agency calls a “Jihadist Handbook.” Though undated, the content suggests it was originally written in 2002 or 2003: more than 10 years before the Snowden reporting began.

• Metadata reveals information about a communication—such as the “to” and “from” parts of an email, and the time and date it was sent, or the phone numbers someone called and when they called—but not the content of the message or audio of the call.
• To allow government agents to sift through the masses of records on ICREACH, engineers designed a simple “Google-like” search interface. This enabled analysts to run searches against particular “selectors” associated with a person of interest—such as an email address or phone number—and receive a page of results displaying, for instance, a list of phone calls made and received by a suspect over a month-long period. The documents suggest these results can be used reveal the “social network” of the person of interest—in other words, those that they communicate with, such as friends, family, and other associates.
• A top-secret PowerPoint presentation from May 2007 illustrated how ICREACH would work—revealing its “Google-like” search interface and showing how the NSA planned to link it to the DEA, DIA, CIA, and the FBI. Each agency would access and input data through a secret data “broker”—a sort of digital letterbox—linked to the central NSA system. ICREACH, according to the presentation, would also receive metadata from the Five Eyes allies.
• The intelligence community’s top-secret “Black Budget” for 2013, also obtained by Snowden, shows that the NSA recently sought new funding to upgrade ICREACH to “provide IC analysts with access to a wider set of shareable data.”

2 more annotations...

• Researchers also claimed they had successfully modified the OS X updater, a program used to deliver updates to laptop and desktop computers, to install a “keylogger.”

   
• The Jamboree was held at a Lockheed Martin facility inside an executive office park in northern Virginia.
• The company is akin to a privatized wing of the U.S. national security state — more than 80 percent of its total revenue comes from the U.S. government.
• A WARRIOR PRIDE plugin called NOSEY SMURF allowed spies to remotely and secretly activate a phone’s microphone. Another plugin, DREAMY SMURF, allowed intelligence agents to manage the power system on a phone and thus avoid detection. PARANOID SMURF was designed to conceal the malware in other ways. TRACKER SMURF allowed ultra-precise geolocating of an individual phone. “[If] its [sic] on the phone, we can get it,” the spies boasted in a secret GCHQ document describing the targeting of the iPhone.
• “If U.S. government-funded researchers can discover these flaws, it is quite likely that Chinese, Russian and Israeli researchers can discover them, too. By quietly exploiting these flaws rather than notifying Apple, the U.S. government leaves Apple’s customers vulnerable to other sophisticated governments.”
• In that case, spy agencies penetrated Gemalto’s internal networks and cyberstalked its employees to steal mass quantities of keys used to encrypt mobile phone communications.

• At the 2011 Jamboree conference, there were two separate presentations on hacking the GID key on Apple’s processors. One was focused on non-invasively obtaining it by studying the electromagnetic emissions of — and the amount of power used by — the iPhone’s processor while encryption is being performed. Careful analysis of that information could be used to extract the encryption key. Such a tactic is known as a “side channel” attack. The second focused on a “method to physically extract the GID key.”

   
• In 2014, the company dramatically broadened the types of data stored on iPhones that are encrypted, and it incorporated encryption by default into its desktop and laptop operating system. This resulted in criticism from leading law enforcement officials, including the FBI director.
• But now, because Apple claims it can no longer extract customer data stored on iPhones, because it is encrypted with a key the company does not know, the U.S. government can be locked out too — even with a search warrant.
• Researchers at the CIA conference in 2010 boasted about the ability to extract the encryption keys used by BitLocker and thus decrypt private data stored on the computer.
• British Prime Minister David Cameron has suggested that if he is re-elected, he may seek to ban encrypted chat programs that do not provide backdoor access to law enforcement. “Are we going to allow a means of communications which it simply isn’t possible to read?” Cameron said in a speech in England earlier this year. “My answer to that question is: ‘No, we must not.’”

9 more annotations...

• Skynet uses phone location and call metadata from bulk phone call records to detect suspicious patterns in the physical movements of suspects and their communication habits, according to a 2012 government presentation The Intercept obtained from Edward Snowden.
• The presentation indicates that Skynet looks for terrorist connections based on questions such as “who has traveled from Peshawar to Faisalabad or Lahore (and back) in the past month? Who does the traveler call when he arrives?” It also looks for suspicious behaviors such as someone who engages in “excessive SIM or handset swapping” or receives “incoming calls only.”

• Under the bipartisan bill, which passed, the Patriot Act would be changed to prohibit bulk collection by the National Security Agency of metadata charting telephone calls made by Americans.
• In addition, the legislation would bar permitting bulk collection of records using other tools like so-called national security letters, which are a kind of administrative subpoena.
• The debate over the issue, which intensified after the surveillance efforts were exposed by Edward J. Snowden, was complicated by a federal appeals court ruling last week that found the National Security Agency’s bulk collection of phone records illegal, and an impending expiration of the Patriot Act the end of the month.

1 more annotation...