Brussels failed to act against US surveillance of EU citizens

European authorities have known since mid-2011 that the US could conduct surveillance on EU citizens. But experts say that European countries had little interest in picking a fight with their ally in Washington.
There has been widespread outrage in Europe over the scope of the National Security Agency’s PRISM surveillance program. European experts, however, are not surprised by American whistleblower Edward Snowden’s revelations.
“What Snowden revealed about PRISM was already known to certain well-connected people for a long time,” Benjamin Bergemann, the author of the German blog netzpolitik.org and a member of the Digitale Gesellschaft (Digital Society) e.V., told DW.
The European Parliament commissioned a report in 2012, which showed that US authorities could theoretically access European citizens’ data since 2008. The report’s authors were hard on European authorities.
In the EU, there was no awareness that mass political surveillance was possible, according to the authors of the study. Incredibly, since 2011 “neither the EU Commission nor the national lawmakers nor the European Parliament had any knowledge of FISAAA 1881a.”
FISAAA 1881a refers to a section of a 2008 amendment to the US Foreign Intelligence Surveillance Act of 1978. That section of the 2008 amendment empowers US spy agencies to collect information stored in American cloud computing providers.
The authors of the EU study warned that US authorities had access to the data of non-US citizens in these so-called data clouds. The EU was neglecting to protect its citizens, according to the report’s devastating conclusion.

Focus on China and Russia

Europeans had long invested their energy in the fight for consumer protection in the Internet and against cyber crime, according to Julien Jeandesboz of the Centre d’Etudes sur les Conflits. Jeandesboz said that the focus in the EU was not on state-sponsored threats to its citizens.
The Europeans debated about hackers, identity theft, and the regulation of Internet companies. And in the rare moments when the discussion did turn to state-sponsored activities, the EU’s attention was focused on China and Russia.
Jeandesboz believes that political motivations explain the EU’s blind eye to US spy activities. The Patriot Act, which gave Washington broad wiretapping authority after the September 11, 2001 attacks, was controversial and publicly discussed in the EU. But while it’s one thing to target cyber criminals, it’s totally different to move against the US government, according to Jeandesboz.
For most European governments, the US is an important ally and trade partner as well as the world’s leading Internet provider.

European intelligence agencies complicit?

According to Britain’s Guardian newspaper, European intelligence agencies may have profited from the Americans’ surveillance activities. The Guardian reported that Britain’s equivalent to the NSA, the GCHQ, appears to have made use of American intelligence gleaned from PRISM.
Every European user of Facebook and Google should be aware that their data may be subject to PRISM, said blogger Benjamin Bergemann.
“One could say, ‘what interest does the US have in me?’ But one should not forget that the European criminal justice systems have an interest in such surveillance and so a coalition of interests could form,” Bergemann said.

EU citizens’ rights violated

While Internet users in Europe can sue in court for the control of their own data, no such legal right exists in the US. And European law is at a loss when it comes to transnational data transfers.
According to Nicolas Hernanz, many laws that are passed in the US now also affect EU citizens. Hernanz, with the Center for European Policy Studies in Brussels, said that Europeans’ legal right to control their own personal data is being “thrown in the garbage can” as a result of US surveillance activities.
US lobbyists have managed numerous times to water down tough data protection provisions in EU treaties, according to Bergemann. He hopes that the importance of data protection and privacy will be reflected in pending EU legislative initiatives.
Jeandesboz believes that if the revelations about PRISM cannot move the EU to act, then nothing can. While experts thought that such sweeping surveillance was possible, it was not considered likely. Jeandesboz said that Europeans need to stand up for their legal tradition in the face of the US. Otherwise, more civil liberties could be sacrificed for security, he continued.
“The fear of terrorism and the preventative security concept have reached their high point,” said blogger Benjamin Bergemann.

Data protection directive

There are many proposals for how the EU can protect its citizens from US surveillance. But there is little unity in the 27-member bloc. A data protection directive, which is supposed to be passed before the 2014 EU elections, has been vigorously debated.
EU parliamentarians have proposed several changes to the directive. One proposal would flag American web services, warning EU users that the site is governed by US law and could be under the control of US authorities. Another proposal would extend protection to the whistleblower Edward Snowden.

Disturbing trends in Europe

At the very least, political pressure could be placed on the US, if Washington was forced to sign a law enforcement treaty with the EU. But not even that exists at the moment. And experts warn that pointing the finger across the pond is not enough.
Within the EU, there has to be a discussion about whether or not data protection should be sacrificed to counterterrorism, the experts say. The concept of preventive security is becoming more prominent in the 27-member bloc, according to Bergemann.
“The telecommunications providers have been forced to set up an electronic interface for the authorities, so that IP addresses can be retrieved,” Bergemann said. “These trends also exist in Europe.”

Deutsche Welle
11.06.2013
Nina Haase

Find this story at 11 June 2013

© 2013 Deutsche Welle

Is CSE metadata-mining Canadian call records?

The recent confirmation that NSA is performing data mining on the telephone records of Americans raises an important question for Canadians, is CSE likewise mining the call records of people in Canada?

The short answer is I don’t know. But there are some telling indications that CSE is interested in undertaking such monitoring and that it may well be doing it to one degree or another.

First, let’s look at the program in the U.S. From the original Guardian report and subsequent revelations (see, for example, Shane Harris, “What We Know About the NSA Metadata Program,” Dead Drop blog, 6 June 2013) we now know quite a lot about the NSA’s domestic phone records monitoring program, including the following features about it:
Current procedures date from 2006, but the program began shortly after 9/11
Entails data mining of nationwide telephone call records
Focus on metadata, not content
Network analysis involved
Undertaken as part of counter-terrorism effort
Now consider this description of data mining research conducted in 2006 by CSE and the Mathematics of Information Technology and Complex Systems (MITACS) project, a Canadian network of academia, industry, and the public sector (originally posted here but subsequently removed; archived version here; first blogged by me here):
As part of ongoing collaborations with the Communications Security Establishment (CSE), we are applying unsupervised and semi-supervised learning methods to understand transactions on large dynamic networks, such as telephone and email networks. When viewed as a graph, the nodes correspond to individuals that send or receive messages, and edges correspond to the messages themselves. The graphs we address can be observed in real-time, include from hundreds to hundreds of thousands of nodes, and feature thousands to millions of transactions. There are two goals associated with this project: firstly, there is the semi-supervised learning task, and rare-target problem, in which we wish to identify certain types of nodes; secondly, there is the unsupervised learning task of detecting anomalous messages. For reasons of efficiency, we have restricted our attention to meta-data of message transactions, such as the time, sender, and recipient, and ignored the contents of messages themselves. In collaboration with CSE, we are studying the problem of counter-terrorism, a semi-supervised problem in which some terrorists in a large network are labeled, but most are not…. Another common feature of counter-terrorism problems is the fact that large volumes of data are often “streamed” through various collection sites, in order to provide maximal information in a timely fashion. A consequence of efficient collection of transactions on very large graphs is that the data itself can only be stored for a short time. This leads to a nonstandard learning problem, since most learning algorithms assume that the full dataset can be accessed for training purposes. Working in conjunction with CSE, we will devise on-line learning algorithms that scale efficiently with increasing volume, and need only use each example once. [Emphasis added.]
Note these features:
Applicable to telephone and email networks
Thousands to millions of transactions
Metadata, not content, examined
Counter-terrorism related

Familiar looking?

Consider also this comment made by then-CSE Chief John Adams to the Standing Senate Committee on National Security and Defence on 30 April 2007:
What is your interpretation of intercept, if I were to ask? If you asked me, it would be if I heard someone talking to someone else or if I read someone’s writing. An intercept would not be to look on the outside of the envelope. That is not an intercept to me. Unfortunately, that is not everyone’s interpretation of intercept, so the suggestion is that we should define that in the legislation…. Intercept is defined in another piece of legislation, and that is where people would probably look if they were searching for a definition of intercept. They are saying that could be troublesome for us, so we had better define it in our act to avoid that problem. That sort of thing has not come up as an issue, but it could.

As I noted in an earlier post, that sounds an awful lot like something you would say if you wanted to collect phone call metadata (number called, duration of call, etc.) and similar addressing information for e-mails and other communications — and felt you already had the legal basis to do so.

Would such monitoring be legal in Canada? I don’t know. (Usual disclaimer about not being a lawyer applies.)

Michael Geist suggests that s. 21 of the CSIS Act might be used to authorize the activity; CSE’s participation would then be based on CSIS’s authority.

Another possibility is that CSE might consider its foreign intelligence mandate (processing the records as part of the hunt for foreign terrorists) sufficient to authorize such monitoring. It is possible that this somewhat cryptic passage in the CSE oversight commissioner’s 2010-11 Annual Report is referring in whole or in part to such activities:

CSEC conducts a number of activities for the purposes of locating new sources of foreign intelligence. When other means have been exhausted, CSEC may use information about Canadians when it has reasonable grounds to believe that using this information may assist in identifying and obtaining foreign intelligence. CSEC conducts these activities infrequently, but they can be a valuable tool in meeting Government of Canada intelligence priorities. CSEC does not require a ministerial authorization to conduct these activities because they do not involve interception of private communications. However, a ministerial directive provides guidance on the conduct of these activities.

In recent years, three reviews have involved some degree of examination of these activities: a Review of CSEC’s foreign intelligence collection in support of the Royal Canadian Mounted Police (RCMP) (Phase II) (2006); a Review of CSEC’s activities carried out under a (different) ministerial directive (2008); and a Review of CSEC’s support to the Canadian Security Intelligence Service (CSIS) (2008).

In his 2006–2007 Annual Report, the late Commissioner Gonthier questioned whether the foreign signals intelligence part of CSEC’s mandate (part (a) of its mandate) was the appropriate authority in all instances for CSEC to provide support to the RCMP in the pursuit of its domestic criminal investigations. In his 2007–2008 Annual Report, Commissioner Gonthier stated that pending a re-examination of the legal issues raised, no assessment would be made of the lawfulness of CSEC’s activities in support of the RCMP under the foreign signals intelligence part of CSEC’s mandate. He also noted that CSEC’s support to CSIS raised similar issues. Commissioner Gonthier emphasized that although he was in agreement with the advice that the Department of Justice had provided to CSEC, he questioned which part of CSEC’s mandate — part (a) or part (c), the assistance part of CSEC’s mandate — should be used as the proper authority for conducting the activities.

Subsequent to these reviews and statements in the annual reports, the Chief of CSEC suspended these activities. CSEC then made significant changes to related policies, procedures and practices.

Review rationale

These activities involve CSEC’s use and analysis of information about Canadians for foreign intelligence purposes. Specific controls are placed on these activities to ensure compliance with legal, ministerial and policy requirements. Major changes to certain policies, procedures and practices have recently occurred. This was the first review of these activities since the Chief of CSEC allowed their resumption under new policies and procedures.

None of the above proves that CSE has been analyzing Canadians’ call records. But with NSA examining U.S. records, you can bet that CSE at the very least has taken a good, hard look at the possibility of doing the same in Canada. And some of the above certainly suggests that they may have gone well beyond just considering the possibility.

When the question of whether CSE was data mining Canadian call records came up in 2006, CSE was quick to make a perhaps carefully worded denial. This time around, not so much (Mitch Potter & Michelle Shephard, “Canadians not safe from U.S. online surveillance, expert says,” Toronto Star, 7 June 2013):

the Toronto Star contacted CSEC for comment Friday about its own metadata collection program, but received a boilerplate statement stressing that the agency is “prohibited by law from directing its activities at Canadians anywhere in the world or at any person in Canada” and “operates within all Canadian laws.”

“The Communications Security Establishment Canada (CSEC) cannot comment on its methods, operations and capabilities. To do so would undermine CSEC’s ability to carry out its mandate. It would also be inappropriate to comment on the activities or capabilities of our allies,” the statement said.

Which doesn’t prove anything either.

[Update 10 June 2013: But it would appear that this article does prove that metadata monitoring is being done: Colin Freeze, “Data-collection program got green light from MacKay in 2011,” Globe and Mail, 10 June 2013.]

Sunday, June 09, 2013

Find this story at 9 June 2013

Prism scandal: Agency to reveal US links ‘shortly’ after claims that thousands of Britons may have been spied on by GCHQ

Disclosure triggers civil liberties storm as the information-sharing agreement had not been made known to Parliament or the public as accusations raise ethical and legal concerns over direct access to ‘millions’ of web users

A report by GCHQ to Parliament’s Intelligence and Security Committee on the listening agency’s links to a secret US spy programme is due shortly.

The Intelligence and Security Committee (ISC) will receive a report on claims that it received material through the secret Prism scheme “very shortly”, according to chairman Sir Malcolm Rifkind.

“The ISC is aware of the allegations surrounding data obtained by GCHQ via the US Prism programme,” Sir Malcolm said.

“The ISC will be receiving a full report from GCHQ very shortly and will decide what further action needs to be taken as soon as it receives that information.”

This development came after allegations that thousands of Britons could have been spied on by GCHQ under a “chilling” link to a secret American operation covertly collecting data from the world’s largest internet companies.

David Cameron and Theresa May, the Home Secretary, faces cross-party demands to spell out details of links between the electronic eavesdropping centre in Cheltenham and the previously-unknown Prism programme operated by the National Security Agency (NSA).

The disclosure triggered a civil liberties storm as the information-sharing agreement had not been made known to Parliament or the public.

Ms May, who is determined to revive her own “snoopers’ charter” plans to require telecoms companies to collect data about people’s internet habits, will be confronted by MPs over the claims in the Commons on Monday.

Under Prism, American agents were able to glean data, including the contents of emails and web-chats, direct from the servers of major providers including Facebook, Google and Yahoo.

It emerged that some of the information had been passed to GCHQ, raising fears that the agency had been sidestepping the usual legal process for requesting intelligence material about UK nationals. The agency insists it operates within a “strict legal and policy framework”.

According to documents, GCHQ received 197 intelligence reports through the Prism system in the 12 months to May 2012, a rise of 137 per cent on the previous year.

Keith Vaz, the chairman of the Commons home affairs select committee, said he was writing to Ms May to demand an explanation.

He said: “I am astonished by these revelations which could involve the data of thousands of Britons. The most chilling aspect is that ordinary American citizens and potentially British citizens too were apparently unaware that their phone and online interactions could be watched. This seems to be the snooper’s charter by the back door.”

The existence of the Prism programme was revealed by the Washington Post and the Guardian, which obtained a copy of a presentation to NSA agents on the extent of its reach.

Further classified documents released yesterday pointed to the British link, noting that “special programmes exist for GCHQ for focused Prism processing”, suggesting the agency may have been making requests for specific information.

A GCHQ spokesman said: “Our work is carried out in accordance with a strict legal and policy framework which ensures that our activities are authorised, necessary and that there is rigorous oversight, including from the Secretary of State, the Interception and Intelligence Services Commissioners and the Intelligence and Security Committee.”

A Government spokesman said he would “neither confirm nor deny” the claims about GCHQ and refused to disclose whether the subject was being discussed with the US authorities.

However, the senior Conservative MP, David Davis, said it was difficult to reconcile GCHQ’s statement that it was subject to proper scrutiny with Parliament’s ignorance of the programme.

He said: “In the absence of parliamentary knowledge approval by a secretary of state is a process of authorisation, not a process of holding to account. Since nobody knew it was happening at all there is no possibility of complaint.”

The Liberal Democrat MP Julian Huppert said he would be tabling a series of parliamentary questions about the GCHQ revelations on Monday and would be calling for a Commons statement from Ms May.

He said: “We have to understand exactly what information they have had and what the safeguards are. It’s deeply, deeply alarming.”

The controversy has added to the pressure on Nick Clegg from Liberal Democrats not to allow Ms May to revive the “snooper’s charter” after the Woolwich terrorist attack. Gareth Epps, co-chair the Social Liberal Forum, said: “Instead of Theresa May forcing through expensive and intrusive legislation, there should be statement by the Government on the purpose and scope of data harvesting of British citizens under Prism.”

Concerns about the disclosures were also raised by the Information Commissioner’s Office. A spokesman said: “There are real issues about the extent to which US law enforcement agencies can access personal data of UK and other European citizens. Aspects of US law under which companies can be compelled to provide information to US agencies potentially conflict with European data protection law, including the UK’s own Data Protection Act.”

Nick Pickles of the civil liberties campaign group Big Brother Watch said questions needed to be asked at the “highest levels” to establish whether British citizens had had their privacy breached “without adherence to the proper legal process or any suspicion of wrongdoing”.

James Blessing, chief technology officer of ISP Keycom, and a council member of the Internet Service Providers’ Association, described the leaked document describing the NSA programme as “really quite scary”.

He said: “If, as this document claims, the NSA has direct access to those servers – unfettered, unbroken access – the NSA can see anything anyone in the UK is doing without any safeguards or controls. It’s been shown that if people have unfettered access they have a propensity to go and look, they can’t help themselves and they will go and find things.”

Whitehall sources said established channels had long been used by GCHQ to request information from the US. However, that the UK service had no direct access to Prism or any similar intelligence gathering systems of the NSA. There were no UK personnel present even as part of any exchange programme when the system may have been used, they claimed.

According to US sources what is called telephone “metadata” gathered from the mobile telephone records of customers of Verizon by the NSA was almost certainly been passed on to GCHQ, although what was released remained at the discretion of the Americans.

Nigel Morris, Kim Sengupta, Ian Burrell
Saturday, 8 June 2013

Find this story at 8 June 2013

© independent.co.uk

UK gathering secret intelligence via covert NSA operation

Exclusive: UK security agency GCHQ gaining information from world’s biggest internet firms through US-run Prism programme

Documents show GCHQ (above) has had access to the NSA’s Prism programme since at least June 2010. Photograph: David Goddard/Getty Images

The UK’s electronic eavesdropping and security agency, GCHQ, has been secretly gathering intelligence from the world’s biggest internet companies through a covertly run operation set up by America’s top spy agency, documents obtained by the Guardian reveal.

The documents show that GCHQ, based in Cheltenham, has had access to the system since at least June 2010, and generated 197 intelligence reports from it last year.

The US-run programme, called Prism, would appear to allow GCHQ to circumvent the formal legal process required to seek personal material such as emails, photos and videos from an internet company based outside the UK.

The use of Prism raises ethical and legal issues about such direct access to potentially millions of internet users, as well as questions about which British ministers knew of the programme.

In a statement to the Guardian, GCHQ, insisted it “takes its obligations under the law very seriously”.

The details of GCHQ’s use of Prism are set out in documents prepared for senior analysts working at America’s National Security Agency, the biggest eavesdropping organisation in the world.

Dated April this year, the papers describe the remarkable scope of a previously undisclosed “snooping” operation which gave the NSA and the FBI easy access to the systems of nine of the world’s biggest internet companies. The group includes Google, Facebook, Microsoft, Apple, Yahoo and Skype.

The documents, which appear in the form of a 41-page PowerPoint presentation, suggest the firms co-operated with the Prism programme. Technology companies denied knowledge of Prism, with Google insisting it “does not have a back door for the government to access private user data”. But the companies acknowledged that they complied with legal orders.

The existence of Prism, though, is not in doubt.

Thanks to changes to US surveillance law introduced under President George W Bush and renewed under Barack Obama in December 2012, Prism was established in December 2007 to provide in-depth surveillance on live communications and stored information about foreigners overseas.

The law allows for the targeting of any customers of participating firms who live outside the US, or those Americans whose communications include people outside the US.

The documents make clear the NSA has been able to obtain unilaterally both stored communications as well as real-time collection of raw data for the last six years, without the knowledge of users, who would assume their correspondence was private.

The NSA describes Prism as “one of the most valuable, unique and productive accesses” of intelligence, and boasts the service has been made available to spy organisations from other countries, including GCHQ.

It says the British agency generated 197 intelligence reports from Prism in the year to May 2012 – marking a 137% increase in the number of reports generated from the year before. Intelligence reports from GCHQ are normally passed to MI5 and MI6.

The documents underline that “special programmes for GCHQ exist for focused Prism processing”, suggesting the agency has been able to receive material from a bespoke part of the programme to suit British interests.

Unless GCHQ has stopped using Prism, the agency has accessed information from the programme for at least three years. It is not mentioned in the latest report from the Interception of Communications Commissioner Office, which scrutinises the way the UK’s three security agencies use the laws covering the interception and retention of data.

Asked to comment on its use of Prism, GCHQ said it “takes its obligations under the law very seriously. Our work is carried out in accordance with a strict legal and policy framework which ensures that our activities are authorised, necessary and proportionate, and that there is rigorous oversight, including from the secretary of state, the interception and intelligence services commissioners and the intelligence and security committee”.

The agency refused to be drawn on how long it had been using Prism, how many intelligence reports it had gleaned from it, or which ministers knew it was being used.

A GCHQ spokesperson added: “We do not comment on intelligence matters.”

The existence and use of Prism reflects concern within the intelligence community about access it has to material held by internet service providers.

Many of the web giants are based in the US and are beyond the jurisdiction of British laws. Very often, the UK agencies have to go through a formal legal process to request information from service providers.

Because the UK has a mutual legal assistance treaty with America, GCHQ can make an application through the US department of justice, which will make the approach on its behalf.

Though the process is used extensively – almost 3,000 requests were made to Google alone last year – it is time consuming. Prism would appear to give GCHQ a chance to bypass the procedure.

In its statement about Prism, Google said it “cares deeply about the security of our users’ data. We disclose user data to government in accordance with the law, and we review all such requests carefully. From time to time, people allege that we have created a government ‘back door’ into our systems, but Google does not have a back door for the government to access private user data”.

Several senior tech executives insisted they had no knowledge of Prism or of any similar scheme. They said they would never have been involved in such a programme.

“If they are doing this, they are doing it without our knowledge,” one said. An Apple spokesman said it had “never heard” of Prism.

In a statement confirming the existence of Prism, James Clapper, the director of national intelligence in the US, said: “Information collected under this programme is among the most important and valuable intelligence information we collect, and is used to protect our nation from a wide variety of threats.”

A senior US administration official said: “The programme is subject to oversight by the foreign intelligence surveillance court, the executive branch, and Congress. It involves extensive procedures, specifically approved by the court, to ensure that only non-US persons outside the US are targeted, and that minimise the acquisition, retention and dissemination of incidentally acquired information about US persons.”

Nick Hopkins
guardian.co.uk, Friday 7 June 2013 14.27 BST

Find this story at 7 June 2013

© 2013 Guardian News and Media Limited or its affiliated companies. All rights reserved.

Phone Records Shared With U.K.

Data on U.S. customers, secretly collected from phone companies, has been shared with British security agencies, writes Eli Lake. Plus, everything you need to know about the NSA Spying Program.

At least one foreign government has gained access to sensitive data collected by the National Security Agency from U.S. telecommunications companies in dragnet court warrants demanding the secret transfer of U.S. customers’ calling records.

The information collected by the NSA, known as “metadata,” does not include the content of the phone calls or the names of the people associated with the accounts. But it does tell the government when calls were made, what numbers were dialed, and the location and duration of those calls. Current and former U.S. intelligence officials familiar with the longstanding program to collect metadata from American telecommunications and Internet companies tell The Daily Beast that, in a few discreet cases, the NSA has shared unedited analysis of these records with its British counterpart, the Government Communications Headquarters (GCHQ).

The Guardian on Friday reported that documents the newspaper obtained showed the GCHQ in 2010 gained access to an NSA metadata collection program known as Prism to secretly tap into the servers of leading internet companies such as Apple and Google. The documents showed the British generated 197 intelligence reports from access to the system in 2012, the Guardian reported.

Late Thursday, James Clapper, the director of national intelligence, issued a statement defending the government’s collection of phone records, which he said protected the privacy of most Americans. For example, Clapper said only specially trained personnel could access the vast database of metadata collected by the government. A secret body known as the Foreign Intelligence Surveillance Court reviews the program every 90 days and only allows the government to query the database “when there is a reasonable suspicion, based on specific facts, that the particular basis for the query is associated with a foreign terrorist organization.”

Clapper was responding to an article The Guardian published Wednesday based on a secret court order that demanded Verizon Business Network Services Inc. hand over to the federal government all “metadata” from its customers between April 25 and July 19. On Thursday the chairmen and ranking members of the House and Senate intelligence committees said the program had been in place since 2006, and the court order disclosed by The Guardian was a routine request by the government for the caller records. The Washington Post on Thursday disclosed that the NSA has also run a separate monitoring program to tap directly into the servers of nine U.S. Internet companies to extract information from users, ranging from video and audio files to emails.

With advances in computer science, intelligence services can now mine vast amounts of data collected by telecom companies, Internet service providers, and social-media sites for patterns that can illuminate terrorist networks and help solve crimes. Rep. Mike Rogers, the Republican chairman of the House Permanent Select Committee on Intelligence, told reporters that he knew of one instance where the NSA metadata program thwarted a domestic terrorist attack.

‘Somebody’s gotta go to jail for something!’ Watch these amateur Internet pundits scold the NSA.
These metadata, these intelligence officers say, reside in vast hard drives that belong to the NSA. Analysts there can then take a phone number or email address and uncover suspected terrorists’ associates, find their locations, and even learn clues about their possible targets.

Peter Wood, the CEO of First Base Technologies, a security firm that works closely with British law enforcement in this area, says this kind of “big data” analysis can be useful to federal law enforcement.

“All emails have headers, which are full of information most people don’t see,” Wood says. “It allows law enforcement to trace the root and source of emails—that gives them the provenance of an email. This allows them to determine the physical origin of threats, if they can be sure the source of the email has not, in turn, been compromised itself.” Wood compared the analysis to how commercial Internet companies use similar data to target ads to individuals based on their search patterns.

“The big open question is what happens to this data when it’s collected.”
Sometimes, the analysis of metadata is shared between allied services, current and retired U.S. intelligence officers say. This is particularly true with the GCHQ, Britain’s equivalent of the NSA.

One former senior U.S. intelligence official with knowledge of the program tells The Daily Beast, “My understanding is if the British had a phone number, we might run the number through the database for them and provide them with the results.”

“I do not know of cases where the U.S. government has shared this kind of metadata with the United Kingdom, but I would be surprised if this never happened,” Wood says. “Both countries cooperate very closely on counterterrorism.”

The U.S. and the U.K. have an agreement to share signal intercepts and electronic intelligence through a pact known as the United Kingdom United States of America Agreement. Over the years, the agreement has been expanded to include Australia, Canada, and New Zealand.

U.S. intelligence officials who spoke to The Daily Beast said that British nationals were not permitted to sit at the actual terminals where NSA analysts mine the metadata collected from phone companies and Internet service providers. But British GCHQ has received unredacted analysis of targeted searches, according to these sources.

A spokeswoman for the NSA declined to comment for this article.

“The whole idea of sharing information that could be of value in a terrorism investigation would be a high priority, especially after 9/11,” says James Bamford, the author of three histories of the NSA, including his most recent book, The Shadow Factory. “If the United States feels it got the information legally, which it does in this case, then from all I know the NSA believes it has the authority to pass the intelligence on to intelligence partners.”

Jameel Jaffer, deputy legal director at the American Civil Liberties Union, says he is worried about what becomes of the records collected by the NSA. “The big open question is what happens to this data when it’s collected,” Jaffer says. “Is it shared amongst agencies? Is it used in law-enforcement investigations? Has it been used in prosecutions? And has it been shared with foreign countries—and which foreign countries has it been shared with and under what conditions?”

The Daily Beast
by Eli Lake Jun 7, 2013 4:45 AM EDT

Find this story at 7 June 2013

© 2013 The Newsweek/Daily Beast Company LLC

Verizon giving US government information about British companies

American telecoms giant Verizon has been handing information about British companies to the US government, putting it on a collision course with UK regulators.
On Verizon’s UK website, the company makes a point of telling customers it will help to defend them against spying by government agencies Photo: AP

The company has found itself at the centre of a major scandal in the US, after it emerged that the National Security Agency (NSA) is collecting the telephone records of millions of customers on an “ongoing, daily basis”, under a top-secret court order issued in April.

The US is also reaching directly into the servers of Facebook, Google and other internet companies to harvest data. The NSA’s classified PRISM programme reportedly allows the government to collect virtually limitless amounts of information from emails, pictures and social media accounts.

Verizon on Thursday battled to prevent a customer backlash by telling them it had no choice in the matter. The Obama administration justified the surveillance, claiming it was a “critical tool in protecting the nation from terrorist threats”.

Two other major American wireless providers, AT&T and Sprint, have also been receiving similar orders, as have credit card companies, sources told the Wall Street Journal.

It is not clear whether Verzion Wireless, the US wireless operator owned by Verizon and Britain’s Vodafone, has received an order. Vodafone, which owns 45pc and has no operational role in the company, had no comment on Friday.
Related Articles
US spy scandal threatens Silicon Valley 11 Jun 2013
US harvests data from Facebook, Google and other web giants 07 Jun 2013
US to declassify secret surveillance documents after uproar 07 Jun 2013
Obama govt secretly collecting US phone records 06 Jun 2013
Analysis: latest leak could devastate Obama 06 Jun 2013
EE to offer shared smartphone and tablet data plans 06 Jun 2013

Verizon’s court order did not just stop at US shores. Washington called for Verizon to hand over all telephone records “for communications between the United States and abroad”, including calls routed via Verizon’s UK subsidiary, based in Reading.

On Verizon’s UK website, the company makes a point of telling customers it will help to defend them against spying by government agencies.

“Whether global or local, [your communications] must be secure because there are many threats to your organisation, from those that want to destroy your reputation and from those that want to take what’s yours,” the company says in a video entitled “2013 data breach”.

“This year’s most talked about threat is espionage… with many [breaches] tracing back to state affiliated culprits, taking months or even years to detect.”

However, the US government’s secret court order instructed Verizon to collect the numbers of the people at either end of each call, information about their location and the time and length of the conversation. It was not asked to record the actual conversations, but it was obliged to hold the information for a minimum of three months.

The Information Commissioner’s Office, the regulator responsible for safeguarding privacy in the UK, is expected to investigate the security breach.

When ordinary customers make calls out of the US, their network will connect them to the UK network they are calling, meaning Verizon has limited information about calls. However, it has comprehensive details about business customers making calls to colleagues across the Atlantic, as their calls are kept within the confines of the same network. Verizon would have pulled the information from its UK servers.

These so-called enterprise systems are theoretically designed to reduce costs and boost security.

Verizon could not be reached for comment.

Unlike the phone tracking programme, where telecom companies are forced to hand over records, PRISM appears to allow the NSA to freely search the tech firms’ networks at any time.

PRISM also allows the government access to the content of online accounts, whereas the phone programme provides data on the time and location of a call but does not tell investigators what was said.

A secret slide show obtained by The Guardian and The Washington Post appear to indicate that the nine companies are willing participants in the programme, beginning with Microsoft in 2007.

However, the Guardian reported that several of the companies claimed to have no knowledge of that their servers were being accessed by the government.

Google said in a statement: “From time to time, people allege that we have created a government ‘back door’ into our systems, but Google does not have a ‘back door’ for the government to access private user data.”

An Apple spokesman said: “We have never heard of PRISM. We do not provide any government agency with direct access to our servers and any agency requesting customer data must get a court order,” he said.

The scale of the operation is detailed in a 41-page slideshow obtained by the two newspapers, which describes PRISM as the single largest source of NSA data.

By Katherine Rushton, US Business Editor

10:30AM BST 07 Jun 2013

Find this story at 7 June 2013

© Copyright of Telegraph Media Group Limited 2013

Eyes and ears wide open; 2000

Sophisticated telecommunication interception capabilities, of the sort that was used to unravel the cricket corruption scandal, are pushing the frontiers of communications intelligence.

IN the age of digital communication, criminals are often better equipped but the line is also increasingly becoming unsafe. So, it appears, is running a large corporation, managing state secrets or just being a political dissident.

Troops on border duties, even those on counter-terrorist duties in Jammu and Kashmir, have long known what Hansie Cronje and his associates evidently did not: no means of electronic communications is safe. Radio silence is maintained during all battle-fr ont operations. In emergencies, soldiers who speak Naga, Malayalam, or other languages, unlikely to be known to Pakistani signals intelligence, are pressed into service. Pakistan troops and irregulars on the Kargil heights last summer used a bewildering mix of Drassi, Shina, and Pushto in order to confuse Indian intelligence personnel, who were then forced to trawl the Kargil area for translators.

Emerging material on interception capabilities of the United States makes clear just what the future might hold. The recently-exposed Project Echelon, for example, allows the U.S. to copy almost every piece of electronic communication worldwide: every fa x transmission, every e-mail messages, every mobile phone call, every other kind of telephone conversation.

Few analysts of the cricket corruption scandal appear to have understood the capabilities of communication intelligence. The latest episode was, in fact, preceded by a series of successful technical telecommunication interception operations. Even as Indi an Airlines Flight IC 814 was on the tarmac in Kandahar last year, Research and Analysis Wing (RAW) officials had a good idea of who had carried out the hijacking, and how – thanks to a series of calls made by the Harkatul Mujahideen’s Mumbai-based opera tive, Abdul Ahmed Latif, during the course of the hijacking. Latif used a mobile telephone, and also a pay phone owned by three brothers from Jogeshwari – Rafiq Sheikh, Javed Sheikh and Muzaffar Sheikh – to remain in contact with his handlers in Karachi.

Among the calls Latif made was one to an Urdu-service staff reporter at the British Broadcasting Corporation headquarters in London, complaining about the Indian negotiators’ intransigence in Kandahar. What Latif did not know was that RAW personnel, who use sophisticated electronic equipment to scan thousands of international and domestic long-distance calls, were listening in. When RAW chief A.S. Dulat visited Jammu two days later to persuade a reluctant Chief Minister Farooq Abdullah to allow the rele ase of prisoners in exchange for the lives of the passengers on IC 814, he was able to promise rapid progress to secure justice. Working with the telephone numbers provided by RAW, Mumbai Crime Branch investigators tracked down Latif and his associates w ithin two days. Their interrogation was crucial in identifying the hijackers.

PAUL BATES / REUTERS

At Menwith Hill in the U.K., one of the data analysis centres under Project Echelon, the world’s most sophisticated intelligence gathering network. The Echelon system allows the U.S. and its associates in the controversial project to monitor almost ev ery piece of electronic communication worldwide.

Other technical operations have also been successful. In the summer of 1998, Punjab Police officials began an electronic communications sweep directed at the renewed activities of the Khalistan Liberation Force (KLF). Among the conversations that they st umbled upon were threat calls directed at affluent businessmen in Ludhiana, made by Dawood Ibrahim’s Nairobi-based associate Abu Salem, and from five unidentified mobile telephones in New Delhi. The numbers were passed on to the Delhi Crime Branch, where Inspector Ishwar Singh, responsible for the Hansie Cronje operation, was assigned charge of the investigation. The Delhi numbers were identified as belonging to the now-notorious Romesh Sharma.

By November, Delhi Police and Intelligence Bureau officials say, they held hours of taped conversations between Sharma, Abu Salem and even top businessmen like Reliance industries chief Dhirubhai Ambani. Ambani, Central Bureau of Investigation (CBI) offi cials now conducting the probe say, was being pressured to meet payments that two high-profile Mumbai stock brokers claimed as their dues. The deal may just have been closed had it not been for a fateful October 20 police raid on Sharma, carried out by c ity South Range officials who had no knowledge of the Crime Branch-Intelligence Bureau surveillance operation. Nothing significant has been heard of the affair since the CBI took charge, perhaps unsurprising given the agency’s track record in cases invol ving political corruption.

Other technical operations have not been quite as high profile, but they have led to significant results in combating terrorism. The five cellphone numbers provided by the Punjab Police in the Romesh Sharma case had also led, earlier that year, to the di scovery of a major arms-running operation run from New Delhi’s maximum security Tihar Jail. Punjab Police officials had begun by investigating reports that the KLF’s Harnek Singh ‘Bhap’ had entered into an alliance with jailed Uttar Pradesh mafia don Om Prakash ‘Babloo’ Shrivastav. The KLF, the force’s informants said, had agreed to provide personnel to execute a series of kidnappings to raise funds, while the Shrivastav gang in turn would be responsible for making available safehouses.

Surveillance led the Crime Branch investigators to some bizarre findings. Mobile phones activate the radio cells nearest to their users’ locations. The five cellphone numbers being monitored activated a single cell, that nearest to Tihar Jail. The Babbar Khalsa International (BKI), it transpired, had already cut a deal with criminals, using phones made available by corrupt prison administration officials, for the delivery of an explosives consignment. Delhi Police officials were waiting for the Haryana- registered truck when it arrived in New Delhi on August 12, 1998. A consignment of RDX or Research Department Explosive, weighing 18 kg, had been hiden in the space between the rim and the boot of the truck, along with four sophisticated electronic timin g devices.

Major breakthroughs based on technical operations came as early as 1996. Shortly after massive blasts occured in New Delhi’s Lajpat Nagar market on May 21, 1996, RAW made available intercepts that led the Srinagar Special Operations Group (SOG) of the Ja mmu and Kashmir Police to Jammu and Kashmir Islamic Front (JKIF) operative Farida Wani. Soon after, her boss, Hilal Baig, was shot dead by the SOG on July 17, 1996. Telephone intercepts also led the Gujarat Police to one of the JKIF’s top associates, Ahm edabad underworld baron and Dawood Ibrahim associate Abdul Rashid Latif. Latif was arrested from New Delhi by a Gujarat Police Anti-Terrorist Squad on October 10, 1996, and was killed later while attempting to escape from custody in Ahmedabad.

Although intelligence officials are unwilling to discuss details, sources say dozens of recent operations targeting the Lashkar-e-Taiba’s activities outside Jammu and Kashmir have been similarly based on communications intelligence. Khalistan terrorists have also been hit through technical means; the January 1999 arrest of a Babbar Khalsa operative who crossed over from Pakistan is one instance. In 1998, Indian intelligence personnel monitoring calls from two U.S.- based Khalistan financiers detected su ccessive calls to a mobile number in Chandigarh. Monitoring led the local police to the gates of the Burail Jail, where, it turned out, Beant Singh assassination-accused Jagtar Singh Hawara had been using the telephone not only to organise a jailbreak bu t to order pizzas, using the convenient address of the Jail Superintendent’s office.

JUST how, then, does communications intelligence work? Contrary to the popular perception, intercepting communications is fairly easy. Scanners can pluck mobile phone signals from the air, and many Western countries have an underground business in fake s ubscriber-identity cards. On August 27 last year, for example, the New York Police arrested three men who were intercepting pager messages meant for the city’s Mayor and Police Commissioner and then selling the contents to media outlets. A conference cal l between U.S. House Speaker Newt Gingrich and his party colleagues was similarly intercepted, and the transcript published in The New York Times. Commercially available equipment even allows remote espionage on the text being typed on a computer screen, or eavesdroppers to listen in to conversations being conducted over a hundred metres away.

Since 1997, however, is a growing body of material on the world’s largest and most sophisticated communications intelligence network, codenamed Echelon. Now the subject of growing controversy following revelations that Echelon was used by the U.S. for co mmercial espionage directed at its North Atlantic Treaty Organisation (NATO) allies, notably France, the organisation emerged from a 1947 United Kingdom-U.S. treaty on sharing intelligence. Canada, Australia and New Zealand later joined the treaty.

Unlike routine espionage operations, Echelon does not target individual electronic communications. It instead gathers vast amounts of traffic on satellites, sub-sea cables, microwave relay stations and high frequency radio. This body of information is su bjected to computer analysis at Echelon centres around the world, notably at Menwith Hill in the U.K., Pine Gap in Australia, Buckley Field near Denver in the U.S., and Bad Aibling in Germany. The computers separate the data gathered into fax, data and v oice communication. This body of material is then subject to searches for certain key words, for example ‘atomic’ or ‘missile’, or for specific telephone numbers and e-mail addresses.

A WELTER of means is available in the Echelon system to monitor almost all long-distance electronic communication. According to a report by expert Duncan Campbell, which formed the core of discussions in the European Parliament in 1998, U.S. Central Inte lligence Agency (CIA) satellites are central to the Echelon system. Satellites of the Magnum, Orion and Rutley class can target very high frequency (VHF) radios, cellular phones, pagers and mobile data links across the globe. Since only a fraction of mic rowave signals in fact arrive at the receiving station, and the rest pass into space, such traffic is also vulnerable. Satellites of the Mercury class target microwave communications, which carry much inter-city traffic. Other satellites intercept traffi c directed at communication satellites, including the Intelsat system.

Embassies and High Commissions form a second important chain in the Echelon system. Foreign missions are located in capital cities and important business centres, which also tend to be the hub for inter-city microwave networks. Since diplomatic premises are not subject to national regulations, most missions install surveillance equipment targeted at their host countries. In some cases, Echelon systems tap directly into the telecommunications infrastructure. Campbell discovered that the Menwith Hill stat ion, for example, taps directly into the British Telecom microwave hub, which receives traffic from sub-sea transatlantic cables. Some media reports have even accused U.S.-based corporations, such as Microsoft of cooperating with their governments to bui ld surveillance mechanisms into software.

Key word searches are just one of the means through which Echelon surveillance works. Since such searches are most effective for text, there has been extensive research on software that can translate voice communications into computer-readable characters . Campbell’s report to the European Parliament suggests that such technology is, at best, of only limited reliability. There has, however, been success in the matter of voice recognition software, which enables computer systems to pick out an individual speaking through the mass of intercepted data. In theory, for example, Echelon systems could detect Osama bin Laden once he initiated a conversation.

The Echelon network is not the world’s only major intelligence gathering operation, although it is by far the world’s most sophisticated. At least 30 countries operate large-scale communications intelligence operations, including India and Pakistan. The largest are outside Echelon is the Russian FAPSI, with some 54,000 employees. China also maintains a large establishment, with two stations directed at Russia in tandem with the U.S. There are no firm figures on Echelon’s budget, but reliable estimates s uggest that over $20 billion is spent worldwide on communication intelligence-related activities. Much of India’s effort has been focussed on military-related signals intelligence, which acquires not only communications but also radar data and details of Army movements.

Nor is it clear whether fighting crime or terrorism is the sole concern of major communications intelligence organisations. The 1998 European Parliament report on electronic espionage claims that U.S. intelligence intercepted conversations between govern ment officials in Brazil and the French firm Thompson-CSF. It used the information to secure a $1.3 billion contract for Thompson-CSF’s U.S. rival, Raytheon. Mike Frost, in his book Spyworld, claims that Canadian agents tapped the U.S. Ambassador’ s conversations to undercut that country’s bid for a $2.5 billion wheat deal. Frost, himself a former operative of the Canadian communication security establishment, claims that British intelligence even invited their counterparts in Canada to place unde r surveillance two politicians suspected by former Prime Minister Margaret Thatcher of political disloyalty.

NEW developments could push the frontiers of communications intelligence even further. In January, U.S. civil rights organisations challenged new rules which would compel telecommunications firms to provide on demand, without a warrant, the exact locatio n of mobile phone users to the Federal Bureau of Investigation (FBI). The new rules, which came about as a result of the Communications Assistance to Law Enforcement Act of 1994, would also mean that companies would have to deliver packet mode communicat ions, those used on the Internet, to the FBI. Echelon had allowed intelligence agencies to bypass laws forbidding unauthorised surveillance of U.S. and U.K. citizens by the simple expedient of asking their alliance counterparts, not bound by such laws, t o carry out the task.

There is little anecdotal material, and even less reliable literature, on the Indian capabilities in this field. It is known, for example, that intelligence agencies compelled pager and mobile phone companies to install surveillance equipment, but only o ther technical means that are at their disposal are not known. Few officials are willing to discuss the subject. Informed sources, however, told Frontline that RAW did have facilities to scan communications for key words, but that both the softwar e and the hardware used left more than a little to be desired. Its voice recognition capabilities too are relatively limited. Police organisations, for their part, have minimal access to such technology, which is limited relatively to simple operations s uch as mobile phone scanning. And while the pending Information Technology Bill of 1999 will give intelligence agencies wide powers to intercept Internet traffic, existing legal restrictions on telephone interception mean that little such evidence can be admitted to have been gathered in the first place, let alone used in trial courts.

When news of the cricket corruption scandal broke, commentators claimed variously that it was impossible to intercept mobile phone conversations or that the Delhi Police had secured a technological feat. Neither was true. Intercepting communications, voi ce or otherwise, is almost industrial in scale, more automated perhaps than any manufacturing process. Be sure when you next send an e-mail out into cyberspace that its recipient might not be the only one to read it with interest.

Volume 17 – Issue 09, Apr. 29 – May 12, 2000

PRAVEEN SWAMI

Find this story at 29 April 2000

Copyrights © 2000, Frontline.

Trade Secrets : Is the U.S.’s most advanced surveillance system feeding economic intelligence to American businesses? 1999

No one is surprised that the United States uses sophisticated electronic spying techniques against its enemies. But Europeans are increasingly worried about allegations that the U.S. uses those same techniques to gather economic intelligence about its allies.

The most extensive claims yet came this spring in a report written for the European Parliament. The report says that the U.S.

National Security Agency, through an electronic surveillance system called Echelon, routinely tracks telephone, fax, and e-mail transmissions from around the world and passes on useful corporate intelligence to American companies.

Among the allegations: that the NSA fed information to Boeing and McDonnell Douglas enabling the companies to beat out European Airbus Industrie for a $ 6 billion contract; and that Raytheon received information that helped it win a $ 1.3 billion contract to provide radar to Brazil, edging out the French company Thomson-CSF. These claims follow previous allegations that the NSA supplied U.S. automakers with information that helped improve their competitiveness with the Japanese (see “Company Spies,” May/June 1994).

Is there truth to these allegations? The NSA is among the most secretive of U.S. intelligence agencies and won’t say much beyond the fact that its mission is “foreign signals intelligence.” The companies involved all refused to comment.

“Since the NSA’s collection capabilities are so grotesquely powerful, it’s difficult to know what’s going on over there,” says John Pike, an analyst at the watchdog group Federation of American Scientists, who has tracked the NSA for years.

This much is known: The NSA owns one of the largest collections of supercomputers in the world, and it’s an open secret–as documented in the European Parliament report–that Echelon vacuums up massive amounts of data from communications satellites and the Internet and then uses its computers to winnow it down. The system scans communications for keywords–“bomb,” for instance–that might tip off analysts to an interesting topic.

Fueling allegations of corporate espionage is the fact that defense contractors and U.S. intelligence agencies are linked extensively through business relationships. Raytheon, for instance, has large contracts to service NSA equipment, according to the European report.

Englishman Glyn Ford, the European Parliament member who initiated the study, wants the NSA to come clean about its activities in Europe. And the Europeans have some leverage on this issue, if they decide to use it. In a drive to improve surveillance, the United States is pressuring European governments to make telephone companies build eavesdropping capabilities into their new systems. But if that’s what the U.S. wants, says Ford, it’s going to have to be open about what information it’s collecting: “If we are going to leave the keys under the doormat for the United States, we want a guarantee that they’re not going to steal the family silver,” he says.

In the meantime, congressional critics have started to wonder if all that high-powered eavesdropping is limited to overseas snooping. In April, Bob Barr (R-Ga.), a member of the House Government Reform Committee, said he was worried by reports that the NSA was engaged in illicit domestic spying.

“We don’t have any direct evidence from the NSA, since they’ve refused to provide any reports, even when asked by the House Intelligence Committee,” Barr says. “But if in fact the NSA is pulling two million transmissions an hour off of these satellites, I don’t think there’s any way they have of limiting them to non-U.S. citizens.”

Last May, after the NSA stonewalled requests to discuss the issue, Congress amended the intelligence appropriations bill to require the agency to submit a report to Congress. (The bill is still in a conference committee.) And the NSA will face more questions when the Government Reform Committee holds hearings on Echelon and other surveillance programs.

“We ought to prevent any agency from the dragnet approach–where they throw out a net and drag anything in,” Barr says.

Kurt Kleiner
Mother Jones November 1, 1999

Find this story at 1 November 1999

Copyright © 2013 Mother Jones and the Foundation for National Progress.

We Call a Top NSA Whistleblower … And Get the REAL SCOOP on Spying

Government Tapping CONTENT, Not Just Metadata … Using Bogus “Secret Interpretation” of Patriot Act

We reported in 2008 that foreign companies have had key roles scooping up Americans’ communications for the NSA:

At least two foreign companies play key roles in processing the information.

Specifically, an Israeli company called Narus processes all of the information tapped by AT &T (AT & T taps, and gives to the NSA, copies of all phone calls it processes), and an Israeli company called Verint processes information tapped by Verizon (Verizon also taps, and gives to the NSA, all of its calls).

Business Insider notes today:

The newest information regarding the NSA domestic spying scandal raises an important question: If America’s tech giants didn’t ‘participate knowingly’ in the dragnet of electronic communication, how does the NSA get all of their data?

One theory: the NSA hired two secretive Israeli companies to wiretap the U.S. telecommunications network.

In April 2012 Wired’s James Bamford — author of the book “The Shadow Factory: The NSA from 9/11 to the Eavesdropping on America” — reported that two companies with extensive links to Israel’s intelligence service provided hardware and software the U.S. telecommunications network for the National Security Agency (NSA).

By doing so, this would imply, companies like Facebook and Google don’t have to explicitly provide the NSA with access to their servers because major Internet Service Providers (ISPs) such as AT&T and Verizon already allows the U.S. signals intelligence agency to eavesdrop on all of their data anyway.

From Bamford (emphasis ours):

“According to a former Verizon employee briefed on the program, Verint, owned by Comverse Technology, taps the communication lines at Verizon…

At AT&T the wiretapping rooms are powered by software and hardware from Narus, now owned by Boeing, a discovery made by AT&T whistleblower Mark Klein in 2004.”

Klein, an engineer, discovered the “secret room” at AT&T central office in San Francisco, through which the NSA actively “vacuumed up Internet and phone-call data from ordinary Americans with the cooperation of AT&T” through the wiretapping rooms, emphasizing that “much of the data sent through AT&T to the NSA was purely domestic.”

NSA whistleblower Thomas Drake corroborated Klein’s assertions, testifying that while the NSA is using Israeli-made NARUS hardware to “seize and save all personal electronic communications.”

Both Verint and Narus were founded in Israel in the 1990s.

***

“Anything that comes through (an internet protocol network), we can record,” Steve Bannerman, marketing vice president of Narus, a Mountain View, California company, said. “We can reconstruct all of their e-mails along with attachments, see what web pages they clicked on, we can reconstruct their (voice over internet protocol) calls.”

With a telecom wiretap the NSA only needs companies like Microsoft, Google, and Apple to passively participate while the agency to intercepts, stores, and analyzes their communication data. The indirect nature of the agreement would provide tech giants with plausible deniability.

And having a foreign contractor bug the telecom grid would mean that the NSA gained access to most of the domestic traffic flowing through the U.S. without technically doing it themselves.

This would provide the NSA, whose official mission is to spy on foreign communications, with plausible deniability regarding domestic snooping.

The reason that Business Insider is speculating about the use of private Israeli companies to thwart the law is that 2 high-ranking members of the Senate Intelligence Committee – Senators Wyden and Udall – have long said that the government has adopted a secret interpretation of section 215 of the Patriot Act which would shock Americans, because it provides a breathtakingly wide program of spying.

Last December, top NSA whistleblower William Binney – a 32-year NSA veteran with the title of senior technical director, who headed the agency’s global digital data gathering program (featured in a New York Times documentary, and the source for much of what we know about NSA spying) – said that the government is using a secret interpretation of Section 215 of the Patriot Act which allows the government to obtain:

Any data in any third party, like any commercial data that’s held about U.S. citizens ….

(relevant quote starts at 4:19).

I called Binney to find out what he meant.

I began by asking Binney if Business Insider’s speculation was correct. Specifically, I asked Binney if the government’s secret interpretation of Section 215 of the Patriot Act was that a foreign company – like Narus, for example – could vacuum up information on Americans, and then the NSA would obtain that data under the excuse of spying on foreign entities … i.e. an Israeli company.

Binney replied no … it was broader than that.

Binney explained that the government is taking the position that it can gather and use any information about American citizens living on U.S. soil if it comes from:

Any service provider … any third party … any commercial company – like a telecom or internet service provider, libraries, medical companies – holding data about anyone, any U.S. citizen or anyone else.

I followed up to make sure I understood what Binney was saying, asking whether the government’s secret interpretation of Section 215 of the Patriot Act was that the government could use any information as long as it came from a private company … foreign or domestic. In other words, the government is using the antiquated, bogus legal argument that it was not using its governmental powers (called “acting under color of law” by judges), but that it was private companies just doing their thing (which the government happened to order all of the private companies to collect and fork over).

Binney confirmed that this was correct. This is what the phone company spying program and the Prism program – the government spying on big Internet companies – is based upon. Since all digital communications go through private company networks, websites or other systems, the government just demands that all of the companies turn them over.

Let’s use an analogy to understand how bogus this interpretation of the Patriot Act is. This argument is analogous to a Congressman hiring a hit man to shoot someone asking too many questions, and loaning him his gun to carry out the deed … and then later saying “I didn’t do it, it was that private citizen!” That wouldn’t pass the laugh test even at an unaccredited, web-based law school offered through a porn site.

I then asked the NSA veteran if the government’s claim that it is only spying on metadata – and not content – was correct. We have extensively documented that the government is likely recording content as well. (And the government has previously admitted to “accidentally” collecting more information on Americans than was legal, and then gagged the judges so they couldn’t disclose the nature or extent of the violations.)

Binney said that was not true; the government is gathering everything, including content.

Binney explained – as he has many times before – that the government is storing everything, and creating a searchable database … to be used whenever it wants, for any purpose it wants (even just going after someone it doesn’t like).

Binney said that former FBI counter-terrorism agent Tim Clemente is correct when he says that no digital data is safe (Clemente says that all digital communications are being recorded).

Binney gave me an idea of how powerful Narus recording systems are. There are probably 18 of them around the country, and they can each record 10 gigabytes of data – the equivalent of a million and a quarter emails with 1,000 characters each – per second.

Binney next confirmed the statement of the author of the Patriot Act – Congressman Jim Sensenbrenner – that the NSA spying programs violate the Patriot Act. After all, the Patriot Act is focused on spying on external threats … not on Americans.

Binney asked rhetorically: “How can an American court [FISA or otherwise] tell telecoms to cough up all domestic data?!”

Update: Binney sent the following clarifying email about content collection:

It’s clear to me that they are collecting most e-mail in full plus other text type data on the web.

As for phone calls, I don’t think they would record/transcribe the approximately 3 billion US-to-US calls every day. It’s more likely that they are recording and transcribing calls made by the 500,000 to 1,000,000 targets in the US and the world.

Posted on June 8, 2013 by WashingtonsBlog

Find this story at 8 June 2013

© 2007 – 2013 Washington’s Blog

Whistle-Blower Outs NSA Spy Room: 2006

AT&T’s central office on Folsom Street in San Francisco houses a secret room that allows the National Security Agency to monitor phone and internet traffic, according to former AT&T technician-cum-whistle-blower Mark Klein. View Slideshow

AT&T provided National Security Agency eavesdroppers with full access to its customers’ phone calls, and shunted its customers’ internet traffic to data-mining equipment installed in a secret room in its San Francisco switching center, according to a former AT&T worker cooperating in the Electronic Frontier Foundation’s lawsuit against the company.

Mark Klein, a retired AT&T communications technician, submitted an affidavit in support of the EFF’s lawsuit this week. That class action lawsuit, filed in federal court in San Francisco last January, alleges that AT&T violated federal and state laws by surreptitiously allowing the government to monitor phone and internet communications of AT&T customers without warrants.

On Wednesday, the EFF asked the court to issue an injunction prohibiting AT&T from continuing the alleged wiretapping, and filed a number of documents under seal, including three AT&T documents that purportedly explain how the wiretapping system works.

According to a statement released by Klein’s attorney, an NSA agent showed up at the San Francisco switching center in 2002 to interview a management-level technician for a special job. In January 2003, Klein observed a new room being built adjacent to the room housing AT&T’s #4ESS switching equipment, which is responsible for routing long distance and international calls.

“I learned that the person whom the NSA interviewed for the secret job was the person working to install equipment in this room,” Klein wrote. “The regular technician work force was not allowed in the room.”

Klein’s job eventually included connecting internet circuits to a splitting cabinet that led to the secret room. During the course of that work, he learned from a co-worker that similar cabinets were being installed in other cities, including Seattle, San Jose, Los Angeles and San Diego.

“While doing my job, I learned that fiber optic cables from the secret room were tapping into the Worldnet (AT&T’s internet service) circuits by splitting off a portion of the light signal,” Klein wrote.

The split circuits included traffic from peering links connecting to other internet backbone providers, meaning that AT&T was also diverting traffic routed from its network to or from other domestic and international providers, according to Klein’s statement.

The secret room also included data-mining equipment called a Narus STA 6400, “known to be used particularly by government intelligence agencies because of its ability to sift through large amounts of data looking for preprogrammed targets,” according to Klein’s statement.

Narus, whose website touts AT&T as a client, sells software to help internet service providers and telecoms monitor and manage their networks, look for intrusions, and wiretap phone calls as mandated by federal law.

Klein said he came forward because he does not believe that the Bush administration is being truthful about the extent of its extrajudicial monitoring of Americans’ communications.

“Despite what we are hearing, and considering the public track record of this administration, I simply do not believe their claims that the NSA’s spying program is really limited to foreign communications or is otherwise consistent with the NSA’s charter or with FISA,” Klein’s wrote. “And unlike the controversy over targeted wiretaps of individuals’ phone calls, this potential spying appears to be applied wholesale to all sorts of internet communications of countless citizens.”

After asking for a preview copy of the documents last week, the government did not object to the EFF filing the paper under seal, although the EFF asked the court Wednesday to make the documents public.

One of the documents is titled “Study Group 3, LGX/Splitter Wiring, San Francisco,” and is dated 2002. The others are allegedly a design document instructing technicians how to wire up the taps, and a document that describes the equipment installed in the secret room.

In a letter to the EFF, AT&T objected to the filing of the documents in any manner, saying that they contain sensitive trade secrets and could be “could be used to ‘hack’ into the AT&T network, compromising its integrity.”

According to court rules, AT&T has until Thursday to file a motion to keep the documents sealed. The government could also step in to the case and request that the documents not be made public, or even that the entire lawsuit be barred under the seldom-used State Secrets Privilege.

AT&T spokesman Walt Sharp declined to comment on the allegations, citing a company policy of not commenting on litigation or matters of national security, but did say that “AT&T follows all laws following requests for assistance from government authorities.”

Ryan Singel 04.07.06

Find this story at 4 July 2006

Wired.com © 2013 Condé Nast

What was the Israeli involvement in collecting U.S. communications intel for NSA?

Israeli high-tech firms Verint and Narus have had connections with U.S. companies and Israeli intelligence in the past, and ties between the countries’ intelligence agencies remain strong.

Were Israeli companies Verint and Narus the ones that collected information from the U.S. communications network for the National Security Agency?

The question arises amid controversy over revelations that the NSA has been collecting the phone records of hundreds of millions of Americans every day, creating a database through which it can learn whether terror suspects have been in contact with people in the United States. It also was disclosed this week that the NSA has been gathering all Internet usage – audio, video, photographs, emails and searches – from nine major U.S. Internet providers, including Microsoft and Google, in hopes of detecting suspicious behavior that begins overseas.

According to an article in the American technology magazine “Wired” from April 2012, two Israeli companies – which the magazine describes as having close connections to the Israeli security community – conduct bugging and wiretapping for the NSA.

Verint, which took over its parent company Comverse Technology earlier this year, is responsible for tapping the communication lines of the American telephone giant Verizon, according to a past Verizon employee sited by James Bamford in Wired. Neither Verint nor Verizon commented on the matter.

Natus, which was acquired in 2010 by the American company Boeing, supplied the software and hardware used at AT&T wiretapping rooms, according to whistleblower Mark Klein, who revealed the information in 2004. Klein, a past technician at AT&T who filed a suit against the company for spying on its customers, revealed a “secret room” in the company’s San Fransisco office, where the NSA collected data on American citizens’ telephone calls and Internet surfing.

Klein’s claims were reinforced by former NSA employee Thomas Drake who testified that the agency uses a program produced by Narus to save the personal electrical communications of AT&T customers.

Both Verint and Narus have ties to the Israeli intelligence agency and the Israel Defense Forces intelligence-gathering unit 8200. Hanan Gefen, a former commander of the 8200 unit, told Forbes magazine in 2007 that Comverse’s technology, which was formerly the parent company of Verint and merged with it this year, was directly influenced by the technology of 8200. Ori Cohen, one of the founders of Narus, told Fortune magazine in 2001 that his partners had done technology work for the Israeli intelligence.

International intel

The question of whether intelligence communities outside the United States were involved has been raised. According to The Guardian, the Government Communications Headquarters (GCHQ), Britain’s intelligence agency, secretly collected intelligence information from the world’s largest Internet companies via the American program PRISM. According to a top secret document obtained by The Guardian, GCHQ had access to PRISM since 2010 and it used the information to prepare 197 intelligence reports last year. In a statement to the Guardian, GCHQ, said it “takes its obligations under the law very seriously.”

According to The Guardian, details of GCHQ’s use of PRISM are set out in a 41-page PowerPoint presentation prepared for senior NSA analysts, and describe a “snooping” operation that gave the NSA and FBI access to the systems of nine Internet giants, including Google, Facebook, Microsoft, Apple, Yahoo and Skype.

Given the close ties between U.S. and Israeli intelligence, the question arises as to whether Israeli intelligence, including the Mossad, was party to the secret.

Obama stands by spies

At turns defensive and defiant, U.S. President Barack Obama stood by the spy programs revealed this week.

He declared Friday that his country is “going to have to make some choices” balancing privacy and security, launching a vigorous defense of formerly secret programs that sweep up an estimated 3 billion phone calls a day and amass Internet data from U.S. providers in an attempt to thwart terror attacks.

Obama also warned that it will be harder to detect threats against the United States now that the two top-secret tools to target terrorists have been so thoroughly publicized.

“Nobody is listening to your telephone calls,” Obama assured the nation after two days of reports that many found unsettling. What the government is doing, he said, is digesting phone numbers and the durations of calls, seeking links that might “identify potential leads with respect to folks who might engage in terrorism.” If there’s a hit, he said, “if the intelligence community then actually wants to listen to a phone call, they’ve got to go back to a federal judge, just like they would in a criminal investigation.”

Tapping thwarted terror attack

While Obama said the aim of the programs is to make America safe, he offered no specifics about how the surveillance programs have done this. House Intelligence Committee Chairman Mike Rogers, R-Mich., on Thursday said the phone records sweeps had thwarted a domestic terror attack, but he also didn’t offer specifics.

U.S. government sources said on Friday that the attack in question was an Islamist militant plot to bomb the New York City subway system in 2009.

Obama asserted his administration had tightened the phone records collection program since it started in the George W. Bush administration and is auditing the programs to ensure that measures to protect Americans’ privacy are heeded – part of what he called efforts to resist a mindset of “you know, `Trust me, we’re doing the right thing. We know who the bad guys are.'”

But again, he provided no details on how the program was tightened or what the audit is looking at.

Obama: 100% privacy is impossible

The furor this week has divided Congress, and led civil liberties advocates and some constitutional scholars to accuse Obama of crossing a line in the name of rooting out terror threats.

Obama, himself a constitutional lawyer, strove to calm Americans’ fears – but also remind them that Congress and the courts had signed off on the surveillance.

“I think the American people understand that there are some trade-offs involved,” Obama said when questioned by reporters at a health care event in San Jose, California.

“It’s important to recognize that you can’t have 100 percent security and also then have 100 percent privacy and zero inconvenience,” he said. “We’re going to have to make some choices as a society. And what I can say is that in evaluating these programs, they make a difference in our capacity to anticipate and prevent possible terrorist activity.”

Obama said U.S. intelligence officials are looking at phone numbers and lengths of calls – not at people’s names – and not listening in.

The two classified surveillance programs were revealed this week in newspaper reports that showed, for the first time, how deeply the National Security Agency dives into telephone and Internet data to look for security threats. The new details were first reported by The Guardian and The Washington Post, and prompted Director of National Intelligence James Clapper to take the unusual and reluctant step of acknowledging the programs’ existence.

Obama echoed intelligence experts – both inside and outside the government – who predicted that potential attackers will find other, secretive ways to communicate now that they know that their phone and Internet records may be targeted.

By TheMarker, Haaretz, The Associated Press and Reuters | Jun.08, 2013 | 12:41 PM | 17

Find this story at 8 June 2013

© Haaretz Daily Newspaper Ltd.

U.S. Collects Vast Data Trove; NSA Monitoring Includes Three Major Phone Companies, as Well as Online Activity

WASHINGTON—The National Security Agency’s monitoring of Americans includes customer records from the three major phone networks as well as emails and Web searches, and the agency also has cataloged credit-card transactions, said people familiar with the agency’s activities.

Jerry Seib explains how the far-reaching data collection conducted by the U.S. government includes phone companies in addition to Verizon, plus Internet service providers and Apple. Photo: Getty Images

The disclosure this week of an order by a secret U.S. court for Verizon Communications Inc.’s phone records set off the latest public discussion of the program. But people familiar with the NSA’s operations said the initiative also encompasses phone-call data from AT&T Inc. and Sprint Nextel Corp., records from Internet-service providers and purchase information from credit-card providers.

The Obama administration says its review of complete phone records of U.S. citizens is a “necessary tool” in protecting the nation from terror threats. Is this the accepted new normal, or has the Obama administration pushed the bounds of civil liberties? Cato Institute Director of Information Policy Studies Jim Harper weighs in. Photo: Getty Images.

The agency is using its secret access to the communications of millions of Americans to target possible terrorists, said people familiar with the effort.

The NSA’s efforts have become institutionalized—yet not so well known to the public—under laws passed in the wake of the Sept. 11, 2001, attacks. Most members of Congress defended them Thursday as a way to root out terrorism, but civil-liberties groups decried the program.
Vote and comment

The National Security Agency is obtaining phone records from all Verizon U.S. customers under a secret court order, according to a newspaper report and ex-officials. WSJ intelligence correspondent Siobhan Gorman joins MoneyBeat. Photo: AP.

“Everyone should just calm down and understand this isn’t anything that is brand new,” said Senate Majority Leader Harry Reid (D., Nev.), who added that the phone-data program has “worked to prevent” terrorist attacks.

Senate Intelligence Chairman Dianne Feinstein (D., Calif.) said the program is lawful and that it must be renewed by the secret U.S. court every three months. She said the revelation about Verizon, reported by the London-based newspaper the Guardian, seemed to coincide with its latest renewal.
All Things D
The Laws That Make It Easy for the Government to Spy on Americans
More
What the NSA Wants to Know About You and Your Phone
Tech Companies’ Data Is Also Tapped
FISA Court in Focus
Obama’s Civil-Liberties Record Questioned
When NSA Calls, Companies Answer
Mixed Reactions on Hill
Lawmakers Push Holder for Briefing on Phone Records | More Reaction
Verizon Says Must Comply with Data Requests
Government Is Tracking Verizon Calls
NSA’s Domestic Spying Grows as Agency Sweeps Up Data (3/10/2008)
NSA Exceeds Legal Limits in Eavesdropping Program (4/16/2009)
U.S. Plans ‘Perfect Citizen’ Cyber Shield for Utilities, Companies (7/8/2010)
NSA Activities Violated Fourth Amendment Rights, Letter Discloses (7/20/2012)

Civil-liberties advocates slammed the NSA’s actions. “The most recent surveillance program is breathtaking. It shows absolutely no effort to narrow or tailor the surveillance of citizens,” said Jonathan Turley, a constitutional law expert at George Washington University.

Meanwhile, the Obama administration acknowledged Thursday a secret NSA program dubbed Prism, which a senior administration official said targets only foreigners and was authorized under U.S. surveillance law. The Washington Post and the Guardian reported earlier Thursday the existence of the previously undisclosed program, which was described as providing the NSA and FBI direct access to server systems operated by tech companies that include Google Inc., Apple Inc., Facebook Inc., Yahoo Inc., Microsoft Corp. and Skype. The newspapers, citing what they said was an internal NSA document, said the agencies received the contents of emails, file transfers and live chats of the companies’ customers as part of their surveillance activities of foreigners whose activity online is routed through the U.S. The companies mentioned denied knowledge or participation in the program.

The arrangement with Verizon, AT&T and Sprint, the country’s three largest phone companies means, that every time the majority of Americans makes a call, NSA gets a record of the location, the number called, the time of the call and the length of the conversation, according to people familiar with the matter. The practice, which evolved out of warrantless wiretapping programs begun after 2001, is now approved by all three branches of the U.S. government.

AT&T has 107.3 million wireless customers and 31.2 million landline customers. Verizon has 98.9 million wireless customers and 22.2 million landline customers while Sprint has 55 million customers in total.

NSA also obtains access to data from Internet service providers on Internet use such as data about email or website visits, several former officials said. NSA has established similar relationships with credit-card companies, three former officials said.

It couldn’t be determined if any of the Internet or credit-card arrangements are ongoing, as are the phone company efforts, or one-shot collection efforts. The credit-card firms, phone companies and NSA declined to comment for this article.
From the Archives

More
Video: U.S. Data Gathering Highlights Carriers’ Balancing Act
Video: U.S. Tracks Verizon Calls: A Lawyer’s Take

Though extensive, the data collection effort doesn’t entail monitoring the content of emails or what is said in phone calls, said people familiar with the matter. Investigators gain access to so-called metadata, telling them who is communicating, through what medium, when, and where they are located.

But the disconnect between the program’s supporters and detractors underscored the difficulty Congress has had navigating new technology, national security and privacy.

The Obama administration, which inherited and embraced the program from the George W. Bush administration, moved Thursday to forcefully defend it. White House spokesman Josh Earnest called it “a critical tool in protecting the nation from terror threats.”

But Sen. Ron Wyden (D., Ore.), said he has warned about the breadth of the program for years, but only obliquely because of classification restrictions.

“When law-abiding Americans call their friends, who they call, when they call, and where they call from is private information,” he said. “Collecting this data about every single phone call that every American makes every day would be a massive invasion of Americans’ privacy.”

In the wake of the Sept. 11 attacks, phone records were collected without a court order as a component of the Bush-era warrantless surveillance program authorized by the 2001 USA Patriot Act, which permitted the collection of business records, former officials said.

The ad hoc nature of the NSA program changed after the Bush administration came under criticism for its handling of a separate, warrantless NSA eavesdropping program.

President Bush acknowledged its existence in late 2005, calling it the Terrorist Surveillance Program, or TSP.

When Democrats retook control of Congress in 2006, promising to investigate the administration’s counterterrorism policies, Bush administration officials moved to formalize court oversight of the NSA programs, according to former U.S. officials.

Congress in 2006 also made changes to the Patriot Act that made it easier for the government to collect phone-subscriber data under the Foreign Intelligence Surveillance Act.

Those changes helped the NSA collection program become institutionalized, rather than one conducted only under the authority of the president, said people familiar with the program.

Along with the TSP, the NSA collection of phone company customer data was put under the jurisdiction of a secret court that oversees the Foreign Intelligence Surveillance Act, according to officials.

David Kris, a former top national security lawyer at the Justice Department, told a congressional hearing in 2009 that the government first used the so-called business records authority in 2004.

At the time he was urging the reauthorization of the business-records provisions, known as Section 215 of the Patriot Act, which Congress later approved.

The phone records allow investigators to establish a database used to run queries when there is “reasonable, articulable suspicion” that the records are relevant and related to terrorist activity, Ms. Feinstein said Thursday.

Director of National Intelligence James Clapper also issued a defense of the phone data surveillance program, saying it is governed by a “robust legal regime.” Under the court order, the data can only “be queried when there is a reasonable suspicion, based on specific facts, that the particular basis for the query is associated with a foreign terrorist organization.” When the data is searched, all information acquired is “subject to strict restrictions on handling” overseen by the Justice Department and the surveillance court, and the program is reviewed roughly every 90 days, he said. Another U.S. official said less than 1% of the records are accessed.

The database allows investigators to “map” individuals connected with that information, said Jeremy Bash, who until recently was chief of staff at the Pentagon and is a former chief counsel to the House Intelligence committee.

“We are trying to find a needle in a haystack, and this is the haystack,” Mr. Bash said, referring to the database.

Sen. Wyden on Thursday questioned whether U.S. officials have been truthful in public descriptions of the program. In March, Mr. Wyden noted, he questioned Mr. Clapper, who said the NSA did not “wittingly” collect any type of data pertaining to millions Americans. Spokesmen for Mr. Clapper didn’t respond to requests for comment.

For civil libertarians, this week’s disclosure of the court authorization for part of the NSA program could offer new avenues for challenges. Federal courts largely have rebuffed efforts that target NSA surveillance programs, in part because no one could prove the information was being collected. The government, under both the Bush and Obama administrations, has successfully used its state-secrets privilege to block such lawsuits.

Jameel Jaffer, the American Civil Liberties Union’s deputy legal director, said the fact the FISA court record has now become public could give phone-company customers standing to bring a lawsuit.

“Now we have a set of people who can show they have been monitored,” he said.

Updated June 7, 2013, 9:25 a.m. ET

By SIOBHAN GORMAN, EVAN PEREZ and JANET HOOK

—Danny Yadron and Jennifer Valentino-DeVries contributed to this article.

Find this story at 7 June 2013

 

Copyright 2012 Dow Jones & Company, Inc. All Rights Reserved

NSA revelations put Booz Allen Hamilton, Carlyle Group in uncomfortable limelight

The Carlyle Group has spent years attempting to shed its image as a well-connected private equity firm leveraging Washington heavyweights in the defense sector. Instead, it nurtured a reputation as a financially sophisticated asset manager that buys and sells everything from railroads to oil refineries.

The recent disclosures involving National Security Agency surveillance on U.S. citizens by an employee of Booz Allen Hamilton, a Virginia consulting firm that is majority owned by Carlyle, has thrust two of Washington’s most prominent corporate entities uncomfortably into the limelight, bound by the thread of turning government secrets into profits.

Booz Allen employee Edward Snowden was fired Tuesday after he confessed to being the source of stories about NSA data collection programs. Federal investigators are examining how Snowden, who worked at an NSA facility in Hawaii and had also worked for the CIA, was able to gain access to sensitive information.

Carlyle declined to comment.

Booz Allen, based in Tysons Corner, has been a local fixture for years, employing thousands and providing management and consulting services to the government, particularly the defense and intelligence agencies. It even sponsored a local golf tournament — the Booz Allen Classic — between 2004 and 2006.

It also became a leader among the contractors supplying tens of thousands of intelligence analysts to the government in recent years, including technologists such as Snowden.

Those government contracts, and thousands more like them, in 2008 made Booz Allen a ripe acquisition target for Carlyle.

It paid $2.54 billion for Booz Allen as a deep recession took hold. Fearing the risks of taking on too much debt in the midst of a financial crisis, Carlyle put up 50 percent cash instead of its normal 30 percent. It borrowed the rest to buy the company, which was then privately held.

Upon the close of the deal, the less profitable international and commercial business was spun off to become Booz & Co., leaving Carlyle with a government-only company.

After the split, the new Booz Allen Hamilton established an incentive-based compensation structure that gave the remaining partners a stake in the firm’s success. In effect, said one person close to the deal who was not authorized to speak publicly, “you got to eat what you killed.”

The incentives helped spur profits.

“Everybody has a responsibility, depending on your title, to bring in a certain amount of business,” said William Loomis, managing director at financial services firm Stifel Nicolaus.

Booz Allen, which employs 24,500, had a net profit of $219 million on revenue of nearly $5.8 billion for the fiscal year ended March 31. For the same period ending in 2010, the year the company went public, the company earned $25 million on $5.1 billion in revenue.

George A. Price Jr., senior equity research analyst for aerospace, defense and government services at BB&T Capital Markets, said “they’ve got a great brand, they’ve focused over time on hiring top people, including bringing on people who have a lot of senior government experience.”

Carlyle has cashed in on the increased demand of Booz Allen’s services. As profits and revenue have grown, Booz Allen has borrowed money to pay dividends to shareholders, including Carlyle.

Carlyle collected nearly $550 million in dividends in 2009 alone. Last year, Booz Allen issued another special shareholder dividend valued at $765 million — most of which went to Carlyle investors.

Booz Allen went public in 2010, and Carlyle now owns 95.66 million shares — around 69 percent of the total shares outstanding — valued at about $1.66 billion at the current stock price.

As government contracting began to wane, Booz Allen has pursued commercial work and opened an office in Abu Dhabi in the United Arab Emirates. The contractor, for instance, is marketing cybersecurity and other services to Middle Eastern companies and governments.

The moves are at least partly in response to federal budget cutting, which has taken a toll on the business.

“We consider ourselves a well-run company, and in the past year we’ve become even better in managing our business in a difficult market for government contracting,” Booz Allen spokesman James Fisher said.

Price, the analyst, said the company has seen revenue and profit declines more recently. “They’re not immune from the current environment,” he said, adding that the cuts the company has made have “blunted” the effect.

Carlyle may ultimately reap as much as $3 billion on its initial nearly $1 billion investment. In the end, Booz Allen is shaping up to be one of the firm’s biggest home runs.

By Thomas Heath and Marjorie Censer, Published: June 12

Find this story at 12 June 2013

© The Washington Post Company

Leak highlights risk of outsourcing US spy work

WASHINGTON: The explosive leak uncovering America’s vast surveillance program highlights the risks Washington takes by entrusting so much of its defense and spy work to private firms, experts said on Monday.

From analyzing intelligence to training new spies, jobs that were once performed by government employees are now carried out by paid contractors, in a dramatic shift that began in the 1990s amid budget pressures.

Edward Snowden, the 29-year-old man whose leak uncovered how spy agencies sift through phone records and Internet traffic, is among a legion of private contractors who make up nearly 30 percent of the workforce in intelligence agencies.

After the attacks of September 11, 2001, the use of contractors boomed, as government agencies turned to private firms in the global hunt for terror suspects, touting it as a cost-effective way to avoid a permanent increase in the number of civil servants.

As a “contractor alley” rose in the suburbs of northern Virginia outside Washington, the increasing reliance on contractors by the Pentagon and spy services has often been criticized as wasteful and possibly corrupt. But some former intelligence officers and experts warn that it also opens up the spy agencies to big security risks.

The contractors who wear a “green badge” to enter government offices may lack the ethos and discretion of career intelligence officers who wear the “blue badge,” according to John Schindler, a former analyst at the National Security Agency and counterintelligence officer. In a series of tweets, Schindler, who now teaches at the Naval War College, heaped scorn on Snowden for spilling secrets.

But he said it was not surprising the disclosure came from a “green badge” holder and suggested sensitive information technology jobs should not be contracted out. “Been telling my CI (counter intelligence) peeps for years that NSA & IC ( intelligence community) only 1 disgruntled, maladjusted IT dork away from disaster (esp IT contractor)…oh well,” he wrote.

Systems administrators are the 21st century equivalent of the Cold War-era “code clerks,” he said, as they may not hold a high rank but have access to vital information.

Most contractors are former military or intelligence officers, and America’s top spy chief, James Clapper, once worked at Booz Allen Hamilton, the same firm that employed Snowden. Another former national intelligence director, Michael McConnell, also worked at the firm before and after holding the director’s post.

Booz Allen has profited heavily from intelligence work, reportedly earning $1.3 billion or 23 percent of its total revenue from contracts with spy agencies. Former CIA director and defense secretary Robert Gates has voiced concern that too much sensitive work has been farmed out to private companies.

“You want somebody who’s really in it for a career because they’re passionate about it and because they care about the country and not just because of the money,” he told the Washington Post in 2010.

A special website lists job openings for those with security credentials, clearancejobs.com, with positions advertised such as “Intelligence Analyst 3/Targeter” for Northrop Grumman.

“The primary function of a Specialized Skills Officer is to collaborate with a team of intelligence professionals in support of HUMINT operations against priority targets,” said the notice for a workplace in McLean, Virgina.

But the threat of damaging leaks may have less to do with a dependence on contractors and more to do with a younger generation’s distrust of Washington, said James Lewis, a former senior official and cyber security expert at the Center for Strategic and International Studies.

Private contracting does not in and itself pose a serious threat to keeping secrets, Lewis told AFP. “It’s a risk because of the differing attitudes of generations,” he said. “People who haven’t been in the federal service for a long time, who have this view of government shaped by the popular culture are probably more inclined to do this.”

He noted that the most extensive leak of US classified documents came not from a contractor but a low-ranking soldier in the US Army, Private Bradley Manning, who is on trial on espionage charges after admitting to handing over hundreds of thousands of secret files to the WikiLeaks website.

AFP Jun 11, 2013, 04.52AM IST

Find this story at 11 June 2013

© 2013 Bennett, Coleman & Co. Ltd.

Boundless Informant NSA data-mining tool – four key slides

The top-secret Boundless Informant tool details and maps by country the voluminous amount of information it collects from computer and telephone networks

guardian.co.uk, Saturday 8 June 2013 20.11 BST

Find this story at 8 June 2013

Boundless Informant: the NSA’s secret tool to track global surveillance data

Revealed: The NSA’s powerful tool for cataloguing global surveillance data – including figures on US collection

The color scheme ranges from green (least subjected to surveillance) through yellow and orange to red (most surveillance). Note the ‘2007’ date in the image relates to the document from which the interactive map derives its top secret classification, not to the map itself.

The National Security Agency has developed a powerful tool for recording and analysing where its intelligence comes from, raising questions about its repeated assurances to Congress that it cannot keep track of all the surveillance it performs on American communications.

The Guardian has acquired top-secret documents about the NSA datamining tool, called Boundless Informant, that details and even maps by country the voluminous amount of information it collects from computer and telephone networks.

The focus of the internal NSA tool is on counting and categorizing the records of communications, known as metadata, rather than the content of an email or instant message.

The Boundless Informant documents show the agency collecting almost 3 billion pieces of intelligence from US computer networks over a 30-day period ending in March 2013. One document says it is designed to give NSA officials answers to questions like, “What type of coverage do we have on country X” in “near real-time by asking the SIGINT [signals intelligence] infrastructure.”

An NSA factsheet about the program, acquired by the Guardian, says: “The tool allows users to select a country on a map and view the metadata volume and select details about the collections against that country.”

Under the heading “Sample use cases”, the factsheet also states the tool shows information including: “How many records (and what type) are collected against a particular country.”

A snapshot of the Boundless Informant data, contained in a top secret NSA “global heat map” seen by the Guardian, shows that in March 2013 the agency collected 97bn pieces of intelligence from computer networks worldwide.
The heat map reveals how much data is being collected from around the world. Note the ‘2007’ date in the image relates to the document from which the interactive map derives its top secret classification, not to the map itself.

Iran was the country where the largest amount of intelligence was gathered, with more than 14bn reports in that period, followed by 13.5bn from Pakistan. Jordan, one of America’s closest Arab allies, came third with 12.7bn, Egypt fourth with 7.6bn and India fifth with 6.3bn.

The heatmap gives each nation a color code based on how extensively it is subjected to NSA surveillance. The color scheme ranges from green (least subjected to surveillance) through yellow and orange to red (most surveillance).

The disclosure of the internal Boundless Informant system comes amid a struggle between the NSA and its overseers in the Senate over whether it can track the intelligence it collects on American communications. The NSA’s position is that it is not technologically feasible to do so.

At a hearing of the Senate intelligence committee In March this year, Democratic senator Ron Wyden asked James Clapper, the director of national intelligence: “Does the NSA collect any type of data at all on millions or hundreds of millions of Americans?”

“No sir,” replied Clapper.

Judith Emmel, an NSA spokeswoman, told the Guardian in a response to the latest disclosures: “NSA has consistently reported – including to Congress – that we do not have the ability to determine with certainty the identity or location of all communicants within a given communication. That remains the case.”

Other documents seen by the Guardian further demonstrate that the NSA does in fact break down its surveillance intercepts which could allow the agency to determine how many of them are from the US. The level of detail includes individual IP addresses.

IP address is not a perfect proxy for someone’s physical location but it is rather close, said Chris Soghoian, the principal technologist with the Speech Privacy and Technology Project of the American Civil Liberties Union. “If you don’t take steps to hide it, the IP address provided by your internet provider will certainly tell you what country, state and, typically, city you are in,” Soghoian said.

That approximation has implications for the ongoing oversight battle between the intelligence agencies and Congress.

On Friday, in his first public response to the Guardian’s disclosures this week on NSA surveillance, Barack Obama said that that congressional oversight was the American peoples’ best guarantee that they were not being spied on.

“These are the folks you all vote for as your representatives in Congress and they are being fully briefed on these programs,” he said. Obama also insisted that any surveillance was “very narrowly circumscribed”.

Senators have expressed their frustration at the NSA’s refusal to supply statistics. In a letter to NSA director General Keith Alexander in October last year, senator Wyden and his Democratic colleague on the Senate intelligence committee, Mark Udall, noted that “the intelligence community has stated repeatedly that it is not possible to provide even a rough estimate of how many American communications have been collected under the Fisa Amendments Act, and has even declined to estimate the scale of this collection.”

At a congressional hearing in March last year, Alexander denied point-blank that the agency had the figures on how many Americans had their electronic communications collected or reviewed. Asked if he had the capability to get them, Alexander said: “No. No. We do not have the technical insights in the United States.” He added that “nor do we do have the equipment in the United States to actually collect that kind of information”.

Soon after, the NSA, through the inspector general of the overall US intelligence community, told the senators that making such a determination would jeopardize US intelligence operations – and might itself violate Americans’ privacy.

“All that senator Udall and I are asking for is a ballpark estimate of how many Americans have been monitored under this law, and it is disappointing that the inspectors general cannot provide it,” Wyden told Wired magazine at the time.

The documents show that the team responsible for Boundless Informant assured its bosses that the tool is on track for upgrades.

The team will “accept user requests for additional functionality or enhancements,” according to the FAQ acquired by the Guardian. “Users are also allowed to vote on which functionality or enhancements are most important to them (as well as add comments). The BOUNDLESSINFORMANT team will periodically review all requests and triage according to level of effort (Easy, Medium, Hard) and mission impact (High, Medium, Low).”

Emmel, the NSA spokeswoman, told the Guardian: “Current technology simply does not permit us to positively identify all of the persons or locations associated with a given communication (for example, it may be possible to say with certainty that a communication traversed a particular path within the internet. It is harder to know the ultimate source or destination, or more particularly the identity of the person represented by the TO:, FROM: or CC: field of an e-mail address or the abstraction of an IP address).

“Thus, we apply rigorous training and technological advancements to combine both our automated and manual (human) processes to characterize communications – ensuring protection of the privacy rights of the American people. This is not just our judgment, but that of the relevant inspectors general, who have also reported this.”

She added: “The continued publication of these allegations about highly classified issues, and other information taken out of context, makes it impossible to conduct a reasonable discussion on the merits of these programs.”

Glenn Greenwald and Ewen MacAskill
guardian.co.uk, Tuesday 11 June 2013 14.00 BST
Additional reporting: James Ball in New York and Spencer Ackerman in Washington

Find this story at 11 June 2013

© 2013 Guardian News and Media Limited or its affiliated companies. All rights reserved.

Sources: NSA sucks in data from 50 companies

Analysts at the National Security Agency can now secretly access real-time user data provided by as many as 50 American companies, ranging from credit rating agencies to internet service providers, two government officials familiar with the arrangements said.

Several of the companies have provided records continuously since 2006, while others have given the agency sporadic access, these officials said. These officials disclosed the number of participating companies in order to provide context for a series of disclosures about the NSA’s domestic collection policies. The officials, contacted independently, repeatedly said that “domestic collection” does not mean that the target is based in the U.S. or is a U.S. citizen; rather, it refers only to the origin of the data.

The Wall Street Journal reported today that U.S. credit card companies had also provided customer information. The officials would not disclose the names of the companies because, they said, doing so would provide U.S. enemies with a list of companies to avoid. They declined to confirm the list of participants in an internet monitoring program revealed by the Washington Post and the Guardian, but both confirmed that the program existed.

“The idea is to create a mosaic. We get a tip. We vet it. Then we mine the data for intelligence,” one of the officials said.

In a statement, Director of National Intelligence James Clapper said that programs collect communications “pursuant to section 702 of the Foreign Intelligence Surveillance Act, ” and “cannot be used to intentionally target any U.S. citizen, any other U.S person, or anyone within the United States.”

He called the leaks “reprehensible” and said the program “is among the most important” sources of “valuable” intelligence information the government takes in.

One of the officials who spoke to me said that because data types are not standardized, the NSA needs several different collection tools, of which PRISM, disclosed today by the Guardian and the Washington Post, is one. PRISM works well because it is able to handle several different types of data streams using different basic encryption methods, the person said. It is a “front end” system, or software, that allows an NSA analyst to search through the data and pull out items of significance, which are then stored in any number of databases. PRISM works with another NSA program to encrypt and remove from the analysts’ screen data that a computer or the analyst deems to be from a U.S. person who is not the subject of the investigation, the person said. A FISA order is required to continue monitoring and analyzing these datasets, although the monitoring can start before an application package is submitted to the Foreign Intelligence Surveillance Court.

From the different types of data, including their credit card purchases, the locations they sign in to the internet from, and even local police arrest logs, the NSA can track people it considers terrorism or espionage suspects in near-real time. An internet geo-location cell is on constant standby to help analysts determine where a subject logs in from. Most of the collection takes place on subjects outside the U.S, but a large chunk of the world’s relevant communication passes through American companies with servers on American soil. So the NSA taps in locally to get at targets globally.

It is not clear how the NSA interfaces with the companies. It cannot use standard law enforcement transmission channels to do, since most use data protocols that are not compatible with that hardware. Several of the companies mentioned in the Post report deny granting access to the NSA, although it is possible that they are lying, or that the NSA’s arrangements with the company are kept so tightly compartmentalized that very few people know about it. Those who do probably have security clearances and are bound by law not to reveal the arrangement.

This arrangement allows the U.S. companies to “stay out of the intelligence business,” one of the officials said. That is, the government bears the responsibility for determining what’s relevant, and the company can plausibly deny that it subjected any particular customer to unlawful government surveillance. Previously, Congressional authors of the FAA said that such a “get out of jail free” card was insisted by corporations after a wave of lawsuits revealed the extent of their cooperation with the government.

It is possible, but not likely, that the NSA clandestinely burrows into servers on American soil, without the knowledge of the company in question, although that would be illegal.

The 2008 FISA Amendments Act allow the NSA to analyze, with court orders, domestic communications of all types for counter-terrorism, counter-espionage, counter-narcotics and counter-proliferation purposes. If the agency believes that both ends of the communication, or the circle of those communicating, are wholly within the U.S., the FBI takes over. If one end of the conversation is outside the U.S., the NSA keeps control of the monitoring. An administration official said that such monitoring is subject to “extensive procedures,” but as the Washington Post reported, however, it is often very difficult to segregate U.S. citizens and residents from incidental contact.

One official likened the NSA’s collection authority to a van full of sealed boxes that are delivered to the agency. A court order, similar to the one revealed by the Guardian, permits the transfer of custody of the “boxes.” But the NSA needs something else, a specific purpose or investigation, in order to open a particular box. The chairman of the Senate intelligence committee, Sen. Dianne Feinstein, said the standard was “a reasonable, articulatable” suspicion, but did not go into details.

Legally, the government can ask companies for some of these records under a provision of the PATRIOT Act called the “business records provision.” Initially, it did so without court cognizance. Now, the FISC signs off on every request.

Armed with what amounts to a rubber stamp court order, however, the NSA can collect and store trillions of bytes of electromagnetic detritus shaken off by American citizens. In the government’s eyes, the data is simply moving from one place to another. It does not become, in the government’s eyes, relevant or protected in any way unless and until it is subject to analysis. Analysis requires that second order.

And the government insists that the rules allowing the NSA or the FBI to analyze anything relating to U.S. persons or corporations are strict, bright-line, and are regularly scrutinized to ensure that innocents don’t get caught up in the mix. The specifics, however, remain classified, as do the oversight mechanisms in place.

The wave of disclosures about the NSA programs have significantly unsettled the intelligence community.

The documents obtained by the two newspapers are marked ORCON, or originator controlled, which generally means that the agency keeps a record of every person who accesses them online and knows exactly who might have printed out or saved or accessed a copy. The NSA in particular has a good record of protecting its documents.

The scope of the least suggest to one former senior intelligence official who now works for a corporation that provides data to the NSA that several people with top-level security clearances had to be involved.

The motive, I suspect, is to punch through the brittle legal and moral foundation that modern domestic surveillance is based upon. Someone, at a very high level, or several people, may have simply found that the agency’s zeal to collect information blinded it to the real-world consequences of such a large and unending program. The minimization procedures might also be well below the threshold that most Americans would expect.

Clapper said in his statement that the disclosures about the program “risk important protections for the security of Americans.”

June 6, 2013, at 8:02 PM

Ambinder is co-author of a new book about government secrecy and surveillance, Deep State: Inside the Government Secrecy Industry.

Find this story at 6 June 2013

© 2013 THE WEEK PUBliCATIONS, INC.

NSA Prism program taps in to user data of Apple, Google and others

A slide depicting the top-secret PRISM program.

The National Security Agency has obtained direct access to the systems of Google, Facebook, Apple and other US internet giants, according to a top secret document obtained by the Guardian.

The NSA access is part of a previously undisclosed program called Prism, which allows officials to collect material including search history, the content of emails, file transfers and live chats, the document says.

The Guardian has verified the authenticity of the document, a 41-slide PowerPoint presentation – classified as top secret with no distribution to foreign allies – which was apparently used to train intelligence operatives on the capabilities of the program. The document claims “collection directly from the servers” of major US service providers.

Although the presentation claims the program is run with the assistance of the companies, all those who responded to a Guardian request for comment on Thursday denied knowledge of any such program.

In a statement, Google said: “Google cares deeply about the security of our users’ data. We disclose user data to government in accordance with the law, and we review all such requests carefully. From time to time, people allege that we have created a government ‘back door’ into our systems, but Google does not have a back door for the government to access private user data.”

Several senior tech executives insisted that they had no knowledge of Prism or of any similar scheme. They said they would never have been involved in such a program. “If they are doing this, they are doing it without our knowledge,” one said.

An Apple spokesman said it had “never heard” of Prism.

The NSA access was enabled by changes to US surveillance law introduced under President Bush and renewed under Obama in December 2012.

The program facilitates extensive, in-depth surveillance on live communications and stored information. The law allows for the targeting of any customers of participating firms who live outside the US, or those Americans whose communications include people outside the US.

It also opens the possibility of communications made entirely within the US being collected without warrants.

Disclosure of the Prism program follows a leak to the Guardian on Wednesday of a top-secret court order compelling telecoms provider Verizon to turn over the telephone records of millions of US customers.

The participation of the internet companies in Prism will add to the debate, ignited by the Verizon revelation, about the scale of surveillance by the intelligence services. Unlike the collection of those call records, this surveillance can include the content of communications and not just the metadata.

Some of the world’s largest internet brands are claimed to be part of the information-sharing program since its introduction in 2007. Microsoft – which is currently running an advertising campaign with the slogan “Your privacy is our priority” – was the first, with collection beginning in December 2007.

It was followed by Yahoo in 2008; Google, Facebook and PalTalk in 2009; YouTube in 2010; Skype and AOL in 2011; and finally Apple, which joined the program in 2012. The program is continuing to expand, with other providers due to come online.

Collectively, the companies cover the vast majority of online email, search, video and communications networks.

The extent and nature of the data collected from each company varies.

Companies are legally obliged to comply with requests for users’ communications under US law, but the Prism program allows the intelligence services direct access to the companies’ servers. The NSA document notes the operations have “assistance of communications providers in the US”.

The revelation also supports concerns raised by several US senators during the renewal of the Fisa Amendments Act in December 2012, who warned about the scale of surveillance the law might enable, and shortcomings in the safeguards it introduces.

When the FAA was first enacted, defenders of the statute argued that a significant check on abuse would be the NSA’s inability to obtain electronic communications without the consent of the telecom and internet companies that control the data. But the Prism program renders that consent unnecessary, as it allows the agency to directly and unilaterally seize the communications off the companies’ servers.

A chart prepared by the NSA, contained within the top-secret document obtained by the Guardian, underscores the breadth of the data it is able to obtain: email, video and voice chat, videos, photos, voice-over-IP (Skype, for example) chats, file transfers, social networking details, and more.

The document is recent, dating to April 2013. Such a leak is extremely rare in the history of the NSA, which prides itself on maintaining a high level of secrecy.

The Prism program allows the NSA, the world’s largest surveillance organisation, to obtain targeted communications without having to request them from the service providers and without having to obtain individual court orders.

With this program, the NSA is able to reach directly into the servers of the participating companies and obtain both stored communications as well as perform real-time collection on targeted users.

The presentation claims Prism was introduced to overcome what the NSA regarded as shortcomings of Fisa warrants in tracking suspected foreign terrorists. It noted that the US has a “home-field advantage” due to housing much of the internet’s architecture. But the presentation claimed “Fisa constraints restricted our home-field advantage” because Fisa required individual warrants and confirmations that both the sender and receiver of a communication were outside the US.

“Fisa was broken because it provided privacy protections to people who were not entitled to them,” the presentation claimed. “It took a Fisa court order to collect on foreigners overseas who were communicating with other foreigners overseas simply because the government was collecting off a wire in the United States. There were too many email accounts to be practical to seek Fisas for all.”

The new measures introduced in the FAA redefines “electronic surveillance” to exclude anyone “reasonably believed” to be outside the USA – a technical change which reduces the bar to initiating surveillance.

The act also gives the director of national intelligence and the attorney general power to permit obtaining intelligence information, and indemnifies internet companies against any actions arising as a result of co-operating with authorities’ requests.

In short, where previously the NSA needed individual authorisations, and confirmation that all parties were outside the USA, they now need only reasonable suspicion that one of the parties was outside the country at the time of the records were collected by the NSA.

The document also shows the FBI acts as an intermediary between other agencies and the tech companies, and stresses its reliance on the participation of US internet firms, claiming “access is 100% dependent on ISP provisioning”.

In the document, the NSA hails the Prism program as “one of the most valuable, unique and productive accesses for NSA”.

It boasts of what it calls “strong growth” in its use of the Prism program to obtain communications. The document highlights the number of obtained communications increased in 2012 by 248% for Skype – leading the notes to remark there was “exponential growth in Skype reporting; looks like the word is getting out about our capability against Skype”. There was also a 131% increase in requests for Facebook data, and 63% for Google.

The NSA document indicates that it is planning to add Dropbox as a PRISM provider. The agency also seeks, in its words, to “expand collection services from existing providers”.

The revelations echo fears raised on the Senate floor last year during the expedited debate on the renewal of the FAA powers which underpin the PRISM program, which occurred just days before the act expired.

Senator Christopher Coons of Delaware specifically warned that the secrecy surrounding the various surveillance programs meant there was no way to know if safeguards within the act were working.

“The problem is: we here in the Senate and the citizens we represent don’t know how well any of these safeguards actually work,” he said.

“The law doesn’t forbid purely domestic information from being collected. We know that at least one Fisa court has ruled that the surveillance program violated the law. Why? Those who know can’t say and average Americans can’t know.”

Other senators also raised concerns. Senator Ron Wyden of Oregon attempted, without success, to find out any information on how many phone calls or emails had been intercepted under the program.

When the law was enacted, defenders of the FAA argued that a significant check on abuse would be the NSA’s inability to obtain electronic communications without the consent of the telecom and internet companies that control the data. But the Prism program renders that consent unnecessary, as it allows the agency to directly and unilaterally seize the communications off the companies’ servers.

When the NSA reviews a communication it believes merits further investigation, it issues what it calls a “report”. According to the NSA, “over 2,000 Prism-based reports” are now issued every month. There were 24,005 in 2012, a 27% increase on the previous year.

In total, more than 77,000 intelligence reports have cited the PRISM program.

Jameel Jaffer, director of the ACLU’s Center for Democracy, that it was astonishing the NSA would even ask technology companies to grant direct access to user data.

“It’s shocking enough just that the NSA is asking companies to do this,” he said. “The NSA is part of the military. The military has been granted unprecedented access to civilian communications.

“This is unprecedented militarisation of domestic communications infrastructure. That’s profoundly troubling to anyone who is concerned about that separation.”

A senior administration official said in a statement: “The Guardian and Washington Post articles refer to collection of communications pursuant to Section 702 of the Foreign Intelligence Surveillance Act. This law does not allow the targeting of any US citizen or of any person located within the United States.

“The program is subject to oversight by the Foreign Intelligence Surveillance Court, the Executive Branch, and Congress. It involves extensive procedures, specifically approved by the court, to ensure that only non-US persons outside the US are targeted, and that minimize the acquisition, retention and dissemination of incidentally acquired information about US persons.

“This program was recently reauthorized by Congress after extensive hearings and debate.

“Information collected under this program is among the most important and valuable intelligence information we collect, and is used to protect our nation from a wide variety of threats.

“The Government may only use Section 702 to acquire foreign intelligence information, which is specifically, and narrowly, defined in the Foreign Intelligence Surveillance Act. This requirement applies across the board, regardless of the nationality of the target.”

Additional reporting by James Ball and Dominic Rushe

Glenn Greenwald and Ewen MacAskill
The Guardian, Friday 7 June 2013

Find this story at 7 June 2013

© 2013 Guardian News and Media Limited or its affiliated companies. All rights reserved.

Verizon order casts spotlight on secretive U.S. surveillance court

(Reuters) – The leak of a document showing the Obama administration asked for millions of phone records has turned a spotlight anew on a secretive U.S. federal court set up 35 years ago to curb intelligence abuses.

Made up of 11 judges who serve staggered seven-year terms, it is called the U.S. Foreign Intelligence Surveillance Court. The judges’ identities are known, along with the name of the person who appoints them: the chief justice, now John Roberts.

In a departure from other courts, all of its rulings are secret and there is no adversarial system. Instead, government lawyers make a request and the judge either approves or rejects it. No other parties are present. The court approves nearly all requests, according to Justice Department data.

In an annual report to Congress that is publicly available, the department said that in 2012 the government made 212 applications for access to business records, which is the same kind of request as that made of Verizon Communications Inc in the present case.

The court denied none of the applications but amended 200 of them, the report said.

The court also oversees applications for electronic surveillance and physical searches. There were 1,856 such applications in 2012, when all were approved except for one, which the government withdrew before the court could rule.

Congress enacted the Foreign Intelligence Surveillance Act setting up the court in 1978 amid concerns about the lack of legal oversight over the intelligence community’s activities.

Activity by the U.S. intelligence community uncovered by congressional investigations included illegal mail-opening programs and the targeting of domestic protesters and political opponents by the Nixon administration.

Now, critics say, the court set up to curb misconduct is rubber-stamping drastically expanded intelligence gathering efforts started after the September 11, 2001, attacks that prompt similar concerns about infringements on civil liberties.

Government authority to obtain records was expanded further by the 2001 USA Patriot Act, which Congress passed with overwhelming bipartisan support in the immediate aftermath of the attacks.

‘ANY TANGIBLE THINGS’

The government cited Section 215 of the Patriot Act in making its request in the Verizon case. This section allows the government to ask the court for “any tangible things” as part of any authorized investigation related to terrorism or intelligence activities.

As the Justice Department wrote in an October 2011 letter to members of Congress, the government must show, among other things, that the information sought is “relevant to an authorized national security investigation.”

At least one president has tried to sidestep the court.

President George W. Bush’s administration chose not to ask the court to approve wiretapping of calls between suspected terrorists until 2007, news accounts of the program’s existence prompted controversy. This incident led to increased concerns among civil liberties advocates that the government effectively had a green light to invade the privacy of Americans.

Among the few who know how the secret court acts are members of Congress. The Obama administration has been keen to highlight how access to orders and opinions issued by the secret court is provided to members of both parties on the intelligence committees in both houses of Congress and on the Senate Judiciary Committee.

The court is comprised of sitting federal judges, appointed for life, who take on the additional responsibility for the seven years of the surveillance court term. The judges are all over the country, although several are in the Washington area.

It is not clear exactly how the chief justice chooses the judges who serve on the court. Some of the judges have a national security background while others do not, according to a source familiar with the court. Further information on how Chief Justice Roberts appoints judges was not immediately available from a U.S. Supreme Court spokeswoman.

WASHINGTON PRESENCE

The court has a physical presence in the U.S. District Court in Washington. The current presiding judge is Reggie Walton, a U.S. district judge in Washington who was appointed by Bush.

The vast majority of judges now on the court are Republican appointees.

The judge who approved the Verizon order, Roger Vinson, is a senior federal district judge in Florida. His term ended at the beginning of May. Vinson, a U.S. Navy veteran, was appointed to the bench by Republican President Ronald Reagan in 1983.

The intelligence court’s workload increased after the September 11 attacks. Between 1978 and 2001, it received 46 emergency requests. In the year after September 11, there were 113, according to a legal textbook on national security by legal experts J. Douglas Wilson and David Kris, who was head of the Justice Department’s national security division from 2009 to 2011.

A former member, U.S. District Judge Royce Lamberth of the District of Columbia, described his experience serving in a 2002 speech in which he denied that the court was a rubber stamp.

“I ask questions. I get into the nitty gritty,” he said. “I know exactly what is going to be done and why. And my questions are answered, in every case, before I approve an application.”

By Lawrence Hurley
WASHINGTON | Thu Jun 6, 2013 6:40pm EDT
(Reporting by Lawrence Hurley; Editing by Howard Goller and Philip Barbara)

Find this story at 6 June 2013

@2013 Thomson Reuters

How Congress unknowingly legalized PRISM in 2007

On Sept. 11, 2007, the National Security Agency signed up Microsoft as its first partner for PRISM, a massive domestic surveillance program whose existence was reported by the Washington Post today. That’s barely a month after Congress passed, and President George W. Bush signed, the Protect America Act.

The Bush Administration portrayed the PAA as a technical fix designed to close a gap in America’s surveillance capabilities that had been opened by a then-recent ruling of the secretive Foreign Intelligence Surveillance Court (FISC). It proved to be much more than that.

While the details are still classified, reports suggested that the FISC had ruled that it was illegal for the government to intercept communications between two foreign endpoints if the communications happened to pass through the United States. Warning that the U.S. would suddenly lose the ability to continue its surveillance of terrorists, the administration pushed the PAA through Congress in a matter of days.

In reality, the PAA represented a sweeping change to American surveillance law. Before conducting surveillance, the PAA only required executive branch officials to “certify” that there were “reasonable procedures” in place for ensuring that surveillance “concerns” persons located outside the United States and that the foreign intelligence is a “significant purpose” of the program. A single certification could cover a broad program intercepting the communications of numerous individuals. And there was no requirement for judicial review of individual surveillance targets within a “certified” program.

Civil liberties groups warned that the PAA’s vague requirements and lack of oversight would give the government a green light to seek indiscriminate access to the private communications of Americans. They predicted that the government would claim that they needed unfettered access to domestic communications to be sure they had gotten all relevant information about suspected terrorists.

It now appears that this is exactly what the government did. Today’s report suggests that the moment the PAA was the law of the land, the NSA started using it to obtain unfettered access to the servers of the nation’s leading online services. To comply with the requirement that the government not target Americans, PRISM searches are reportedly “designed to produce at least 51 percent confidence in a target’s ‘foreignness’” — the lowest conceivable standard. PRISM training materials reportedly instruct users that if searches happen to turn up the private information of Americans, “it’s nothing to worry about.”

The Protect America Act included a short six-month sunset provision, triggering another heated debate in the midst of the 2008 Democratic primary campaign. But that debate focused more on the past than the future. The telecom industry sought retroactive immunity for their participation in warrantless surveillance programs prior to 2007, a request Congress did not grant with the PAA.

Retroactive immunity for telecom companies dominated the 2008 debate, overshadowing the more important issue of the sweeping new powers that Congress had just granted to the executive branch. When Congress finally passed the FISA Amendments Act in July 2008, it included both immunity and a four-year extension of the government’s warrantless spying powers. But few members of Congress realized the breadth of the surveillance powers they were effectively approving.

The FISA Amandments Act was re-authorized for another five years in 2012 with little controversy. It will come up for a vote again in 2017 — though Congress could always choose to revisit it earlier.

By Timothy B. Lee, Updated: June 6, 2013

Find this story at 6 June 2013

© The Washington Post Company

NSA has massive database of Americans’ phone calls: 2006

The National Security Agency has been secretly collecting the phone call records of tens of millions of Americans, using data provided by AT&T, Verizon and BellSouth, people with direct knowledge of the arrangement told USA TODAY.

The NSA program reaches into homes and businesses across the nation by amassing information about the calls of ordinary Americans — most of whom aren’t suspected of any crime. This program does not involve the NSA listening to or recording conversations. But the spy agency is using the data to analyze calling patterns in an effort to detect terrorist activity, sources said in separate interviews.

QUESTIONS AND ANSWERS: The NSA record collection program

“It’s the largest database ever assembled in the world,” said one person, who, like the others who agreed to talk about the NSA’s activities, declined to be identified by name or affiliation. The agency’s goal is “to create a database of every call ever made” within the nation’s borders, this person added.

For the customers of these companies, it means that the government has detailed records of calls they made — across town or across the country — to family members, co-workers, business contacts and others.

The three telecommunications companies are working under contract with the NSA, which launched the program in 2001 shortly after the Sept. 11 terrorist attacks, the sources said. The program is aimed at identifying and tracking suspected terrorists, they said.

The sources would talk only under a guarantee of anonymity because the NSA program is secret.

Air Force Gen. Michael Hayden, nominated Monday by President Bush to become the director of the CIA, headed the NSA from March 1999 to April 2005. In that post, Hayden would have overseen the agency’s domestic call-tracking program. Hayden declined to comment about the program.

The NSA’s domestic program, as described by sources, is far more expansive than what the White House has acknowledged. Last year, Bush said he had authorized the NSA to eavesdrop — without warrants — on international calls and international e-mails of people suspected of having links to terrorists when one party to the communication is in the USA. Warrants have also not been used in the NSA’s efforts to create a national call database.

In defending the previously disclosed program, Bush insisted that the NSA was focused exclusively on international calls. “In other words,” Bush explained, “one end of the communication must be outside the United States.”

As a result, domestic call records — those of calls that originate and terminate within U.S. borders — were believed to be private.

Sources, however, say that is not the case. With access to records of billions of domestic calls, the NSA has gained a secret window into the communications habits of millions of Americans. Customers’ names, street addresses and other personal information are not being handed over as part of NSA’s domestic program, the sources said. But the phone numbers the NSA collects can easily be cross-checked with other databases to obtain that information.

Don Weber, a senior spokesman for the NSA, declined to discuss the agency’s operations. “Given the nature of the work we do, it would be irresponsible to comment on actual or alleged operational issues; therefore, we have no information to provide,” he said. “However, it is important to note that NSA takes its legal responsibilities seriously and operates within the law.”

The White House would not discuss the domestic call-tracking program. “There is no domestic surveillance without court approval,” said Dana Perino, deputy press secretary, referring to actual eavesdropping.

She added that all national intelligence activities undertaken by the federal government “are lawful, necessary and required for the pursuit of al-Qaeda and affiliated terrorists.” All government-sponsored intelligence activities “are carefully reviewed and monitored,” Perino said. She also noted that “all appropriate members of Congress have been briefed on the intelligence efforts of the United States.”

The government is collecting “external” data on domestic phone calls but is not intercepting “internals,” a term for the actual content of the communication, according to a U.S. intelligence official familiar with the program. This kind of data collection from phone companies is not uncommon; it’s been done before, though never on this large a scale, the official said. The data are used for “social network analysis,” the official said, meaning to study how terrorist networks contact each other and how they are tied together.

Carriers uniquely positioned

AT&T recently merged with SBC and kept the AT&T name. Verizon, BellSouth and AT&T are the nation’s three biggest telecommunications companies; they provide local and wireless phone service to more than 200 million customers.

The three carriers control vast networks with the latest communications technologies. They provide an array of services: local and long-distance calling, wireless and high-speed broadband, including video. Their direct access to millions of homes and businesses has them uniquely positioned to help the government keep tabs on the calling habits of Americans.

Among the big telecommunications companies, only Qwest has refused to help the NSA, the sources said. According to multiple sources, Qwest declined to participate because it was uneasy about the legal implications of handing over customer information to the government without warrants.

Qwest’s refusal to participate has left the NSA with a hole in its database. Based in Denver, Qwest provides local phone service to 14 million customers in 14 states in the West and Northwest. But AT&T and Verizon also provide some services — primarily long-distance and wireless — to people who live in Qwest’s region. Therefore, they can provide the NSA with at least some access in that area.

Created by President Truman in 1952, during the Korean War, the NSA is charged with protecting the United States from foreign security threats. The agency was considered so secret that for years the government refused to even confirm its existence. Government insiders used to joke that NSA stood for “No Such Agency.”

In 1975, a congressional investigation revealed that the NSA had been intercepting, without warrants, international communications for more than 20 years at the behest of the CIA and other agencies. The spy campaign, code-named “Shamrock,” led to the Foreign Intelligence Surveillance Act (FISA), which was designed to protect Americans from illegal eavesdropping.

Enacted in 1978, FISA lays out procedures that the U.S. government must follow to conduct electronic surveillance and physical searches of people believed to be engaged in espionage or international terrorism against the United States. A special court, which has 11 members, is responsible for adjudicating requests under FISA.

Over the years, NSA code-cracking techniques have continued to improve along with technology. The agency today is considered expert in the practice of “data mining” — sifting through reams of information in search of patterns. Data mining is just one of many tools NSA analysts and mathematicians use to crack codes and track international communications.

Paul Butler, a former U.S. prosecutor who specialized in terrorism crimes, said FISA approval generally isn’t necessary for government data-mining operations. “FISA does not prohibit the government from doing data mining,” said Butler, now a partner with the law firm Akin Gump Strauss Hauer & Feld in Washington, D.C.

The caveat, he said, is that “personal identifiers” — such as names, Social Security numbers and street addresses — can’t be included as part of the search. “That requires an additional level of probable cause,” he said.

The usefulness of the NSA’s domestic phone-call database as a counterterrorism tool is unclear. Also unclear is whether the database has been used for other purposes.

The NSA’s domestic program raises legal questions. Historically, AT&T and the regional phone companies have required law enforcement agencies to present a court order before they would even consider turning over a customer’s calling data. Part of that owed to the personality of the old Bell Telephone System, out of which those companies grew.

Ma Bell’s bedrock principle — protection of the customer — guided the company for decades, said Gene Kimmelman, senior public policy director of Consumers Union. “No court order, no customer information — period. That’s how it was for decades,” he said.

The concern for the customer was also based on law: Under Section 222 of the Communications Act, first passed in 1934, telephone companies are prohibited from giving out information regarding their customers’ calling habits: whom a person calls, how often and what routes those calls take to reach their final destination. Inbound calls, as well as wireless calls, also are covered.

The financial penalties for violating Section 222, one of many privacy reinforcements that have been added to the law over the years, can be stiff. The Federal Communications Commission, the nation’s top telecommunications regulatory agency, can levy fines of up to $130,000 per day per violation, with a cap of $1.325 million per violation. The FCC has no hard definition of “violation.” In practice, that means a single “violation” could cover one customer or 1 million.

In the case of the NSA’s international call-tracking program, Bush signed an executive order allowing the NSA to engage in eavesdropping without a warrant. The president and his representatives have since argued that an executive order was sufficient for the agency to proceed. Some civil liberties groups, including the American Civil Liberties Union, disagree.

Companies approached

The NSA’s domestic program began soon after the Sept. 11 attacks, according to the sources. Right around that time, they said, NSA representatives approached the nation’s biggest telecommunications companies. The agency made an urgent pitch: National security is at risk, and we need your help to protect the country from attacks.

The agency told the companies that it wanted them to turn over their “call-detail records,” a complete listing of the calling histories of their millions of customers. In addition, the NSA wanted the carriers to provide updates, which would enable the agency to keep tabs on the nation’s calling habits.

The sources said the NSA made clear that it was willing to pay for the cooperation. AT&T, which at the time was headed by C. Michael Armstrong, agreed to help the NSA. So did BellSouth, headed by F. Duane Ackerman; SBC, headed by Ed Whitacre; and Verizon, headed by Ivan Seidenberg.

With that, the NSA’s domestic program began in earnest.

AT&T, when asked about the program, replied with a comment prepared for USA TODAY: “We do not comment on matters of national security, except to say that we only assist law enforcement and government agencies charged with protecting national security in strict accordance with the law.”

In another prepared comment, BellSouth said: “BellSouth does not provide any confidential customer information to the NSA or any governmental agency without proper legal authority.”

Verizon, the USA’s No. 2 telecommunications company behind AT&T, gave this statement: “We do not comment on national security matters, we act in full compliance with the law and we are committed to safeguarding our customers’ privacy.”

Qwest spokesman Robert Charlton said: “We can’t talk about this. It’s a classified situation.”

In December, The New York Times revealed that Bush had authorized the NSA to wiretap, without warrants, international phone calls and e-mails that travel to or from the USA. The following month, the Electronic Frontier Foundation, a civil liberties group, filed a class-action lawsuit against AT&T. The lawsuit accuses the company of helping the NSA spy on U.S. phone customers.

Last month, U.S. Attorney General Alberto Gonzales alluded to that possibility. Appearing at a House Judiciary Committee hearing, Gonzales was asked whether he thought the White House has the legal authority to monitor domestic traffic without a warrant. Gonzales’ reply: “I wouldn’t rule it out.” His comment marked the first time a Bush appointee publicly asserted that the White House might have that authority.

Similarities in programs

The domestic and international call-tracking programs have things in common, according to the sources. Both are being conducted without warrants and without the approval of the FISA court. The Bush administration has argued that FISA’s procedures are too slow in some cases. Officials, including Gonzales, also make the case that the USA Patriot Act gives them broad authority to protect the safety of the nation’s citizens.

The chairman of the Senate Intelligence Committee, Sen. Pat Roberts, R-Kan., would not confirm the existence of the program. In a statement, he said, “I can say generally, however, that our subcommittee has been fully briefed on all aspects of the Terrorist Surveillance Program. … I remain convinced that the program authorized by the president is lawful and absolutely necessary to protect this nation from future attacks.”

The chairman of the House Intelligence Committee, Rep. Pete Hoekstra, R-Mich., declined to comment.

One company differs

One major telecommunications company declined to participate in the program: Qwest.

According to sources familiar with the events, Qwest’s CEO at the time, Joe Nacchio, was deeply troubled by the NSA’s assertion that Qwest didn’t need a court order — or approval under FISA — to proceed. Adding to the tension, Qwest was unclear about who, exactly, would have access to its customers’ information and how that information might be used.

Financial implications were also a concern, the sources said. Carriers that illegally divulge calling information can be subjected to heavy fines. The NSA was asking Qwest to turn over millions of records. The fines, in the aggregate, could have been substantial.

The NSA told Qwest that other government agencies, including the FBI, CIA and DEA, also might have access to the database, the sources said. As a matter of practice, the NSA regularly shares its information — known as “product” in intelligence circles — with other intelligence groups. Even so, Qwest’s lawyers were troubled by the expansiveness of the NSA request, the sources said.

The NSA, which needed Qwest’s participation to completely cover the country, pushed back hard.

Trying to put pressure on Qwest, NSA representatives pointedly told Qwest that it was the lone holdout among the big telecommunications companies. It also tried appealing to Qwest’s patriotic side: In one meeting, an NSA representative suggested that Qwest’s refusal to contribute to the database could compromise national security, one person recalled.

In addition, the agency suggested that Qwest’s foot-dragging might affect its ability to get future classified work with the government. Like other big telecommunications companies, Qwest already had classified contracts and hoped to get more.

Unable to get comfortable with what NSA was proposing, Qwest’s lawyers asked NSA to take its proposal to the FISA court. According to the sources, the agency refused.

The NSA’s explanation did little to satisfy Qwest’s lawyers. “They told (Qwest) they didn’t want to do that because FISA might not agree with them,” one person recalled. For similar reasons, this person said, NSA rejected Qwest’s suggestion of getting a letter of authorization from the U.S. attorney general’s office. A second person confirmed this version of events.

In June 2002, Nacchio resigned amid allegations that he had misled investors about Qwest’s financial health. But Qwest’s legal questions about the NSA request remained.

Unable to reach agreement, Nacchio’s successor, Richard Notebaert, finally pulled the plug on the NSA talks in late 2004, the sources said.

By Leslie Cauley, USA TODAY
Contributing: John Diamond
Posted 5/10/2006 11:16 PM ET
Updated 5/11/2006 10:38 AM ET

Find this story at 5 October 2006

Copyright 2011 USA TODAY

Confirmed: The NSA is Spying on Millions of Americans

Today, the Guardian newspaper confirmed what EFF (and many others) have long claimed: the NSA is conducting widespread, untargeted, domestic surveillance on millions of Americans. This revelation should end, once and for all, the government’s long-discredited secrecy claims about its dragnet domestic surveillance programs. It should spur Congress and the American people to make the President finally tell the truth about the government’s spying on innocent Americans.

In a report by Glenn Greenwald, the paper published an order from the Foreign Intelligence Surveillance Court (or FISC) that directs Verizon to provide “on an ongoing daily basis” all call records for any call “wholly within the United States, including local telephone calls” and any call made “between the United States and abroad.”

In plain language: the order gave the NSA a record of every Verizon customer’s call history — every call made, the location of the phone, the time of the call, the duration of the call, and other “identifying information” for the phone and call — from April 25, 2013 (the date the order was issued) to July 19, 2013. The order does not require content or the name of any subscriber and is issued under 50 USC sec.1861, also known as section 215 of the Patriot Act.

There is no indication that this order to Verizon was unique or novel. It is very likely that business records orders like this exist for every major American telecommunication company, meaning that, if you make calls in the United States, the NSA has those records. And this has been going on for at least 7 years, and probably longer.

This type of untargeted, wholly domestic surveillance is exactly what EFF, and others, have been suing about for years. In 2006, USA Today published a story disclosing that the NSA had compiled a massive database of call records from American telecommunications companies. Our case, Jewel v. NSA, challenging the legality of the NSA’s domestic spying program, has been pending since 2008, but its predecessor, Hepting v. AT&T filed in 2006, alleged the same surveillance. In 2011, on the 10th Anniversary of the Patriot Act, we filed a FOIA lawsuit against the Department of Justice for records about the government’s use of Section 215 – the legal authority the government was relying on to perform this type of untargeted surveillance.

But at each step of the way, the government has tried to hide the truth from the American public: in Hepting, behind telecom immunity; in Jewel, behind the state secrets privilege; in the FOIA case, by claiming the information is classified at the top secret level. In May 2011, Senator Ron Wyden, one of the few courageous voices fighting against the government’s domestic surveillance program, said this in a debate about reauthorizing Section 215:

I want to deliver a warning this afternoon: when the American people find out how their government has secretly interpreted the Patriot Act, they will be stunned and they will be angry.

Today is that day. The American people have confirmed how the government has secretly interpreted Section 215. And we’re angry. It’s time to stop hiding behind legal privileges and to come clean about Section 215 and FISA. It’s time to start the national dialogue about our rights in the digital age. And it’s time to end the NSA’s unconstitutional domestic surveillance program.

June 5, 2013 | By Cindy Cohn and Mark Rumold

Find this story at 5 June 2013

A hidden world, growing beyond control (19 July 2010)

The top-secret world the government created in response to the terrorist attacks of Sept. 11, 2001, has become so large, so unwieldy and so secretive that no one knows how much money it costs, how many people it employs, how many programs exist within it or exactly how many agencies do the same work.

These are some of the findings of a two-year investigation by The Washington Post that discovered what amounts to an alternative geography of the United States, a Top Secret America hidden from public view and lacking in thorough oversight. After nine years of unprecedented spending and growth, the result is that the system put in place to keep the United States safe is so massive that its effectiveness is impossible to determine.

The investigation’s other findings include:

* Some 1,271 government organizations and 1,931 private companies work on programs related to counterterrorism, homeland security and intelligence in about 10,000 locations across the United States.

* An estimated 854,000 people, nearly 1.5 times as many people as live in Washington, D.C., hold top-secret security clearances.

* In Washington and the surrounding area, 33 building complexes for top-secret intelligence work are under construction or have been built since September 2001. Together they occupy the equivalent of almost three Pentagons or 22 U.S. Capitol buildings – about 17 million square feet of space.

* Many security and intelligence agencies do the same work, creating redundancy and waste. For example, 51 federal organizations and military commands, operating in 15 U.S. cities, track the flow of money to and from terrorist networks.

* Analysts who make sense of documents and conversations obtained by foreign and domestic spying share their judgment by publishing 50,000 intelligence reports each year – a volume so large that many are routinely ignored.

These are not academic issues; lack of focus, not lack of resources, was at the heart of the Fort Hood shooting that left 13 dead, as well as the Christmas Day bomb attempt thwarted not by the thousands of analysts employed to find lone terrorists but by an alert airline passenger who saw smoke coming from his seatmate.

They are also issues that greatly concern some of the people in charge of the nation’s security.

“There has been so much growth since 9/11 that getting your arms around that – not just for the CIA, for the secretary of defense – is a challenge,” Defense Secretary Robert M. Gates said in an interview with The Post last week.

In the Department of Defense, where more than two-thirds of the intelligence programs reside, only a handful of senior officials – called Super Users – have the ability to even know about all the department’s activities. But as two of the Super Users indicated in interviews, there is simply no way they can keep up with the nation’s most sensitive work.

“I’m not going to live long enough to be briefed on everything” was how one Super User put it. The other recounted that for his initial briefing, he was escorted into a tiny, dark room, seated at a small table and told he couldn’t take notes. Program after program began flashing on a screen, he said, until he yelled ”Stop!” in frustration.

“I wasn’t remembering any of it,” he said.

Underscoring the seriousness of these issues are the conclusions of retired Army Lt. Gen. John R. Vines, who was asked last year to review the method for tracking the Defense Department’s most sensitive programs. Vines, who once commanded 145,000 troops in Iraq and is familiar with complex problems, was stunned by what he discovered.

“I’m not aware of any agency with the authority, responsibility or a process in place to coordinate all these interagency and commercial activities,” he said in an interview. “The complexity of this system defies description.”

The result, he added, is that it’s impossible to tell whether the country is safer because of all this spending and all these activities. “Because it lacks a synchronizing process, it inevitably results in message dissonance, reduced effectiveness and waste,” Vines said. “We consequently can’t effectively assess whether it is making us more safe.”

The Post’s investigation is based on government documents and contracts, job descriptions, property records, corporate and social networking Web sites, additional records, and hundreds of interviews with intelligence, military and corporate officials and former officials. Most requested anonymity either because they are prohibited from speaking publicly or because, they said, they feared retaliation at work for describing their concerns.

The Post’s online database of government organizations and private companies was built entirely on public records. The investigation focused on top-secret work because the amount classified at the secret level is too large to accurately track.

Today’s article describes the government’s role in this expanding enterprise. Tuesday’s article describes the government’s dependence on private contractors. Wednesday’s is a portrait of one Top Secret America community. On the Web, an extensive, searchable database built by The Post about Top Secret America is available at washingtonpost.com/topsecretamerica.

Defense Secretary Gates, in his interview with The Post, said that he does not believe the system has become too big to manage but that getting precise data is sometimes difficult. Singling out the growth of intelligence units in the Defense Department, he said he intends to review those programs for waste. “Nine years after 9/11, it makes a lot of sense to sort of take a look at this and say, ‘Okay, we’ve built tremendous capability, but do we have more than we need?’ ” he said.

CIA Director Leon Panetta, who was also interviewed by The Post last week, said he’s begun mapping out a five-year plan for his agency because the levels of spending since 9/11 are not sustainable. “Particularly with these deficits, we’re going to hit the wall. I want to be prepared for that,” he said. “Frankly, I think everyone in intelligence ought to be doing that.”

In an interview before he resigned as the director of national intelligence in May, retired Adm. Dennis C. Blair said he did not believe there was overlap and redundancy in the intelligence world. “Much of what appears to be redundancy is, in fact, providing tailored intelligence for many different customers,” he said.

Blair also expressed confidence that subordinates told him what he needed to know. “I have visibility on all the important intelligence programs across the community, and there are processes in place to ensure the different intelligence capabilities are working together where they need to,” he said.

Weeks later, as he sat in the corner of a ballroom at the Willard Hotel waiting to give a speech, he mused about The Post’s findings. “After 9/11, when we decided to attack violent extremism, we did as we so often do in this country,” he said. “The attitude was, if it’s worth doing, it’s probably worth overdoing.”

Outside a gated subdivision of mansions in McLean, a line of cars idles every weekday morning as a new day in Top Secret America gets underway. The drivers wait patiently to turn left, then crawl up a hill and around a bend to a destination that is not on any public map and not announced by any street sign.

Liberty Crossing tries hard to hide from view. But in the winter, leafless trees can’t conceal a mountain of cement and windows the size of five Wal-Mart stores stacked on top of one another rising behind a grassy berm. One step too close without the right badge, and men in black jump out of nowhere, guns at the ready.

Past the armed guards and the hydraulic steel barriers, at least 1,700 federal employees and 1,200 private contractors work at Liberty Crossing, the nickname for the two headquarters of the Office of the Director of National Intelligence and its National Counterterrorism Center. The two share a police force, a canine unit and thousands of parking spaces.

Liberty Crossing is at the center of the collection of U.S. government agencies and corporate contractors that mushroomed after the 2001 attacks. But it is not nearly the biggest, the most costly or even the most secretive part of the 9/11 enterprise.

In an Arlington County office building, the lobby directory doesn’t include the Air Force’s mysteriously named XOIWS unit, but there’s a big “Welcome!” sign in the hallway greeting visitors who know to step off the elevator on the third floor. In Elkridge, Md., a clandestine program hides in a tall concrete structure fitted with false windows to look like a normal office building. In Arnold, Mo., the location is across the street from a Target and a Home Depot. In St. Petersburg, Fla., it’s in a modest brick bungalow in a run-down business park.

Each day at the National Counterterrorism Center in McLean, workers review at least 5,000 pieces of terrorist-related data from intelligence agencies and keep an eye on world events. (Photo by: Melina Mara / The Washington Post)

Every day across the United States, 854,000 civil servants, military personnel and private contractors with top-secret security clearances are scanned into offices protected by electromagnetic locks, retinal cameras and fortified walls that eavesdropping equipment cannot penetrate.

This is not exactly President Dwight D. Eisenhower’s “military-industrial complex,” which emerged with the Cold War and centered on building nuclear weapons to deter the Soviet Union. This is a national security enterprise with a more amorphous mission: defeating transnational violent extremists.

Much of the information about this mission is classified. That is the reason it is so difficult to gauge the success and identify the problems of Top Secret America, including whether money is being spent wisely. The U.S. intelligence budget is vast, publicly announced last year as $75 billion, 21/2 times the size it was on Sept. 10, 2001. But the figure doesn’t include many military activities or domestic counterterrorism programs.

At least 20 percent of the government organizations that exist to fend off terrorist threats were established or refashioned in the wake of 9/11. Many that existed before the attacks grew to historic proportions as the Bush administration and Congress gave agencies more money than they were capable of responsibly spending.

The Pentagon’s Defense Intelligence Agency, for example, has gone from 7,500 employees in 2002 to 16,500 today. The budget of the National Security Agency, which conducts electronic eavesdropping, doubled. Thirty-five FBI Joint Terrorism Task Forces became 106. It was phenomenal growth that began almost as soon as the Sept. 11 attacks ended.

Nine days after the attacks, Congress committed $40 billion beyond what was in the federal budget to fortify domestic defenses and to launch a global offensive against al-Qaeda. It followed that up with an additional $36.5 billion in 2002 and $44 billion in 2003. That was only a beginning.

With the quick infusion of money, military and intelligence agencies multiplied. Twenty-four organizations were created by the end of 2001, including the Office of Homeland Security and the Foreign Terrorist Asset Tracking Task Force. In 2002, 37 more were created to track weapons of mass destruction, collect threat tips and coordinate the new focus on counterterrorism. That was followed the next year by 36 new organizations; and 26 after that; and 31 more; and 32 more; and 20 or more each in 2007, 2008 and 2009.

In all, at least 263 organizations have been created or reorganized as a response to 9/11. Each has required more people, and those people have required more administrative and logistic support: phone operators, secretaries, librarians, architects, carpenters, construction workers, air-conditioning mechanics and, because of where they work, even janitors with top-secret clearances.

With so many more employees, units and organizations, the lines of responsibility began to blur. To remedy this, at the recommendation of the bipartisan 9/11 Commission, the George W. Bush administration and Congress decided to create an agency in 2004 with overarching responsibilities called the Office of the Director of National Intelligence (ODNI) to bring the colossal effort under control.

While that was the idea, Washington has its own ways.

The first problem was that the law passed by Congress did not give the director clear legal or budgetary authority over intelligence matters, which meant he wouldn’t have power over the individual agencies he was supposed to control.

The second problem: Even before the first director, Ambassador John D. Negroponte, was on the job, the turf battles began. The Defense Department shifted billions of dollars out of one budget and into another so that the ODNI could not touch it, according to two senior officials who watched the process. The CIA reclassified some of its most sensitive information at a higher level so the National Counterterrorism Center staff, part of the ODNI, would not be allowed to see it, said former intelligence officers involved.

And then came a problem that continues to this day, which has to do with the ODNI’s rapid expansion.

When it opened in the spring of 2005, Negroponte’s office was all of 11 people stuffed into a secure vault with closet-size rooms a block from the White House. A year later, the budding agency moved to two floors of another building. In April 2008, it moved into its huge permanent home, Liberty Crossing.

Today, many officials who work in the intelligence agencies say they remain unclear about what the ODNI is in charge of. To be sure, the ODNI has made some progress, especially in intelligence-sharing, information technology and budget reform. The DNI and his managers hold interagency meetings every day to promote collaboration. The last director, Blair, doggedly pursued such nitty-gritty issues as procurement reform, compatible computer networks, tradecraft standards and collegiality.

But improvements have been overtaken by volume at the ODNI, as the increased flow of intelligence data overwhelms the system’s ability to analyze and use it. Every day, collection systems at the National Security Agency intercept and store 1.7 billion e-mails, phone calls and other types of communications. The NSA sorts a fraction of those into 70 separate databases. The same problem bedevils every other intelligence agency, none of which have enough analysts and translators for all this work.

The practical effect of this unwieldiness is visible, on a much smaller scale, in the office of Michael Leiter, the director of the National Counterterrorism Center. Leiter spends much of his day flipping among four computer monitors lined up on his desk. Six hard drives sit at his feet. The data flow is enormous, with dozens of databases feeding separate computer networks that cannot interact with one another.

There is a long explanation for why these databases are still not connected, and it amounts to this: It’s too hard, and some agency heads don’t really want to give up the systems they have. But there’s some progress: “All my e-mail on one computer now,” Leiter says. “That’s a big deal.”

To get another view of how sprawling Top Secret America has become, just head west on the toll road toward Dulles International Airport.

As a Michaels craft store and a Books-A-Million give way to the military intelligence giants Northrop Grumman and Lockheed Martin, find the off-ramp and turn left. Those two shimmering-blue five-story ice cubes belong to the National Geospatial-Intelligence Agency, which analyzes images and mapping data of the Earth’s geography. A small sign obscured by a boxwood hedge says so.

Across the street, in the chocolate-brown blocks, is Carahsoft, an intelligence agency contractor specializing in mapping, speech analysis and data harvesting. Nearby is the government’s Underground Facility Analysis Center. It identifies overseas underground command centers associated with weapons of mass destruction and terrorist groups, and advises the military on how to destroy them.

Clusters of top-secret work exist throughout the country, but the Washington region is the capital of Top Secret America.

About half of the post-9/11 enterprise is anchored in an arc stretching from Leesburg south to Quantico, back north through Washington and curving northeast to Linthicum, just north of the Baltimore-Washington International Marshall Airport. Many buildings sit within off-limits government compounds or military bases.

Others occupy business parks or are intermingled with neighborhoods, schools and shopping centers and go unnoticed by most people who live or play nearby.

Many of the newest buildings are not just utilitarian offices but also edifices “on the order of the pyramids,” in the words of one senior military intelligence officer.

Not far from the Dulles Toll Road, the CIA has expanded into two buildings that will increase the agency’s office space by one-third. To the south, Springfield is becoming home to the new $1.8 billion National Geospatial-Intelligence Agency headquarters, which will be the fourth-largest federal building in the area and home to 8,500 employees. Economic stimulus money is paying hundreds of millions of dollars for this kind of federal construction across the region.

Construction for the National Geospatial-Intelligence Agency in Springfield (Photo by: Michael S. Williamson / The Washington Post)

It’s not only the number of buildings that suggests the size and cost of this expansion, it’s also what is inside: banks of television monitors. “Escort-required” badges. X-ray machines and lockers to store cellphones and pagers. Keypad door locks that open special rooms encased in metal or permanent dry wall, impenetrable to eavesdropping tools and protected by alarms and a security force capable of responding within 15 minutes. Every one of these buildings has at least one of these rooms, known as a SCIF, for sensitive compartmented information facility. Some are as small as a closet; others are four times the size of a football field.

SCIF size has become a measure of status in Top Secret America, or at least in the Washington region of it. “In D.C., everyone talks SCIF, SCIF, SCIF,” said Bruce Paquin, who moved to Florida from the Washington region several years ago to start a SCIF construction business. “They’ve got the penis envy thing going. You can’t be a big boy unless you’re a three-letter agency and you have a big SCIF.”

SCIFs are not the only must-have items people pay attention to. Command centers, internal television networks, video walls, armored SUVs and personal security guards have also become the bling of national security.

“You can’t find a four-star general without a security detail,” said one three-star general now posted in Washington after years abroad. “Fear has caused everyone to have stuff. Then comes, ‘If he has one, then I have to have one.’ It’s become a status symbol.”

Among the most important people inside the SCIFs are the low-paid employees carrying their lunches to work to save money. They are the analysts, the 20- and 30-year-olds making $41,000 to $65,000 a year, whose job is at the core of everything Top Secret America tries to do.

At its best, analysis melds cultural understanding with snippets of conversations, coded dialogue, anonymous tips, even scraps of trash, turning them into clues that lead to individuals and groups trying to harm the United States.

Their work is greatly enhanced by computers that sort through and categorize data. But in the end, analysis requires human judgment, and half the analysts are relatively inexperienced, having been hired in the past several years, said a senior ODNI official. Contract analysts are often straight out of college and trained at corporate headquarters.

When hired, a typical analyst knows very little about the priority countries – Iraq, Iran, Afghanistan and Pakistan – and is not fluent in their languages. Still, the number of intelligence reports they produce on these key countries is overwhelming, say current and former intelligence officials who try to cull them every day. The ODNI doesn’t know exactly how many reports are issued each year, but in the process of trying to find out, the chief of analysis discovered 60 classified analytic Web sites still in operation that were supposed to have been closed down for lack of usefulness. “Like a zombie, it keeps on living” is how one official describes the sites.

The problem with many intelligence reports, say officers who read them, is that they simply re-slice the same facts already in circulation. “It’s the soccer ball syndrome. Something happens, and they want to rush to cover it,” said Richard H. Immerman, who was the ODNI’s assistant deputy director of national intelligence for analytic integrity and standards until early 2009. “I saw tremendous overlap.”

Even the analysts at the National Counterterrorism Center (NCTC), which is supposed to be where the most sensitive, most difficult-to-obtain nuggets of information are fused together, get low marks from intelligence officials for not producing reports that are original, or at least better than the reports already written by the CIA, FBI, National Security Agency or Defense Intelligence Agency.

When Maj. Gen. John M. Custer was the director of intelligence at U.S. Central Command, he grew angry at how little helpful information came out of the NCTC. In 2007, he visited its director at the time, retired Vice Adm. John Scott Redd, to tell him so. “I told him that after 41/2 years, this organization had never produced one shred of information that helped me prosecute three wars!” he said loudly, leaning over the table during an interview.

Two years later, Custer, now head of the Army’s intelligence school at Fort Huachuca, Ariz., still gets red-faced recalling that day, which reminds him of his frustration with Washington’s bureaucracy. “Who has the mission of reducing redundancy and ensuring everybody doesn’t gravitate to the lowest-hanging fruit?” he said. “Who orchestrates what is produced so that everybody doesn’t produce the same thing?”

He’s hardly the only one irritated. In a secure office in Washington, a senior intelligence officer was dealing with his own frustration. Seated at his computer, he began scrolling through some of the classified information he is expected to read every day: CIA World Intelligence Review, WIRe-CIA, Spot Intelligence Report, Daily Intelligence Summary, Weekly Intelligence Forecast, Weekly Warning Forecast, IC Terrorist Threat Assessments, NCTC Terrorism Dispatch, NCTC Spotlight . . .

It’s too much, he complained. The inbox on his desk was full, too. He threw up his arms, picked up a thick, glossy intelligence report and waved it around, yelling.

“Jesus! Why does it take so long to produce?”

“Why does it have to be so bulky?”

“Why isn’t it online?”

The overload of hourly, daily, weekly, monthly and annual reports is actually counterproductive, say people who receive them. Some policymakers and senior officials don’t dare delve into the backup clogging their computers. They rely instead on personal briefers, and those briefers usually rely on their own agency’s analysis, re-creating the very problem identified as a main cause of the failure to thwart the attacks: a lack of information-sharing.

A new Defense Department office complex goes up in Alexandria. (Photo by: Michael S. Williamson / The Washington Post)

The ODNI’s analysis office knows this is a problem. Yet its solution was another publication, this one a daily online newspaper, Intelligence Today. Every day, a staff of 22 culls more than two dozen agencies’ reports and 63 Web sites, selects the best information and packages it by originality, topic and region.

Analysis is not the only area where serious overlap appears to be gumming up the national security machinery and blurring the lines of responsibility.

Within the Defense Department alone, 18 commands and agencies conduct information operations, which aspire to manage foreign audiences’ perceptions of U.S. policy and military activities overseas.

And all the major intelligence agencies and at least two major military commands claim a major role in cyber-warfare, the newest and least-defined frontier.

“Frankly, it hasn’t been brought together in a unified approach,” CIA Director Panetta said of the many agencies now involved in cyber-warfare.

“Cyber is tremendously difficult” to coordinate, said Benjamin A. Powell, who served as general counsel for three directors of national intelligence until he left the government last year. “Sometimes there was an unfortunate attitude of bring your knives, your guns, your fists and be fully prepared to defend your turf.” Why? “Because it’s funded, it’s hot and it’s sexy.”

Last fall, U.S. Army Maj. Nidal Malik Hasan allegedly opened fire at Fort Hood, Tex., killing 13 people and wounding 30. In the days after the shootings, information emerged about Hasan’s increasingly strange behavior at Walter Reed Army Medical Center, where he had trained as a psychiatrist and warned commanders that they should allow Muslims to leave the Army or risk “adverse events.” He had also exchanged e-mails with a well-known radical cleric in Yemen being monitored by U.S. intelligence.

But none of this reached the one organization charged with handling counterintelligence investigations within the Army. Just 25 miles up the road from Walter Reed, the Army’s 902nd Military Intelligence Group had been doing little to search the ranks for potential threats. Instead, the 902’s commander had decided to turn the unit’s attention to assessing general terrorist affiliations in the United States, even though the Department of Homeland Security and the FBI’s 106 Joint Terrorism Task Forces were already doing this work in great depth.

The 902nd, working on a program the commander named RITA, for Radical Islamic Threat to the Army, had quietly been gathering information on Hezbollah, Iranian Republican Guard and al-Qaeda student organizations in the United States. The assessment “didn’t tell us anything we didn’t know already,” said the Army’s senior counterintelligence officer at the Pentagon.

Secrecy and lack of coordination have allowed organizations, such as the 902nd in this case, to work on issues others were already tackling rather than take on the much more challenging job of trying to identify potential jihadist sympathizers within the Army itself.

Beyond redundancy, secrecy within the intelligence world hampers effectiveness in other ways, say defense and intelligence officers. For the Defense Department, the root of this problem goes back to an ultra-secret group of programs for which access is extremely limited and monitored by specially trained security officers.

These are called Special Access Programs – or SAPs – and the Pentagon’s list of code names for them runs 300 pages. The intelligence community has hundreds more of its own, and those hundreds have thousands of sub-programs with their own limits on the number of people authorized to know anything about them. All this means that very few people have a complete sense of what’s going on.

“There’s only one entity in the entire universe that has visibility on all SAPs – that’s God,” said James R. Clapper, undersecretary of defense for intelligence and the Obama administration’s nominee to be the next director of national intelligence.

Such secrecy can undermine the normal chain of command when senior officials use it to cut out rivals or when subordinates are ordered to keep secrets from their commanders.

One military officer involved in one such program said he was ordered to sign a document prohibiting him from disclosing it to his four-star commander, with whom he worked closely every day, because the commander was not authorized to know about it. Another senior defense official recalls the day he tried to find out about a program in his budget, only to be rebuffed by a peer. “What do you mean you can’t tell me? I pay for the program,” he recalled saying in a heated exchange.

Another senior intelligence official with wide access to many programs said that secrecy is sometimes used to protect ineffective projects. “I think the secretary of defense ought to direct a look at every single thing to see if it still has value,” he said. “The DNI ought to do something similar.”

The ODNI hasn’t done that yet. The best it can do at the moment is maintain a database of the names of the most sensitive programs in the intelligence community. But the database does not include many important and relevant Pentagon projects.

Because so much is classified, illustrations of what goes on every day in Top Secret America can be hard to ferret out. But every so often, examples emerge. A recent one shows the post-9/11 system at its best and its worst.

Last fall, after eight years of growth and hirings, the enterprise was at full throttle when word emerged that something was seriously amiss inside Yemen. In response, President Obama signed an order sending dozens of secret commandos to that country to target and kill the leaders of an al-Qaeda affiliate.

In Yemen, the commandos set up a joint operations center packed with hard drives, forensic kits and communications gear. They exchanged thousands of intercepts, agent reports, photographic evidence and real-time video surveillance with dozens of top-secret organizations in the United States.

That was the system as it was intended. But when the information reached the National Counterterrorism Center in Washington for analysis, it arrived buried within the 5,000 pieces of general terrorist-related data that are reviewed each day. Analysts had to switch from database to database, from hard drive to hard drive, from screen to screen, just to locate what might be interesting to study further.

As military operations in Yemen intensified and the chatter about a possible terrorist strike increased, the intelligence agencies ramped up their effort. The flood of information into the NCTC became a torrent.

Somewhere in that deluge was even more vital data. Partial names of someone in Yemen. A reference to a Nigerian radical who had gone to Yemen. A report of a father in Nigeria worried about a son who had become interested in radical teachings and had disappeared inside Yemen.

These were all clues to what would happen when a Nigerian named Umar Farouk Abdulmutallab left Yemen and eventually boarded a plane in Amsterdam bound for Detroit. But nobody put them together because, as officials would testify later, the system had gotten so big that the lines of responsibility had become hopelessly blurred.

“There are so many people involved here,” NCTC Director Leiter told Congress.

“Everyone had the dots to connect,” DNI Blair explained to the lawmakers. “But I hadn’t made it clear exactly who had primary responsibility.”

And so Abdulmutallab was able to step aboard Northwest Airlines Flight 253. As it descended toward Detroit, he allegedly tried to ignite explosives hidden in his underwear. It wasn’t the very expensive, very large 9/11 enterprise that prevented disaster. It was a passenger who saw what he was doing and tackled him. “We didn’t follow up and prioritize the stream of intelligence,” White House counterterrorism adviser John O. Brennan explained afterward. “Because no one intelligence entity, or team or task force was assigned responsibility for doing that follow-up investigation.”

Blair acknowledged the problem. His solution: Create yet another team to run down every important lead. But he also told Congress he needed more money and more analysts to prevent another mistake.

More is often the solution proposed by the leaders of the 9/11 enterprise. After the Christmas Day bombing attempt, Leiter also pleaded for more – more analysts to join the 300 or so he already had.

The Department of Homeland Security asked for more air marshals, more body scanners and more analysts, too, even though it can’t find nearly enough qualified people to fill its intelligence unit now. Obama has said he will not freeze spending on national security, making it likely that those requests will be funded.

More building, more expansion of offices continues across the country. A $1.7 billion NSA data-processing center will be under construction soon near Salt Lake City. In Tampa, the U.S. Central Command’s new 270,000-square-foot intelligence office will be matched next year by an equally large headquarters building, and then, the year after that, by a 51,000-square-foot office just for its special operations section.

Just north of Charlottesville, the new Joint-Use Intelligence Analysis Facility will consolidate 1,000 defense intelligence analysts on a secure campus.

Meanwhile, five miles southeast of the White House, the DHS has broken ground for its new headquarters, to be shared with the Coast Guard. DHS, in existence for only seven years, already has its own Special Access Programs, its own research arm, its own command center, its own fleet of armored cars and its own 230,000-person workforce, the third-largest after the departments of Defense and Veterans Affairs.

Soon, on the grounds of the former St. Elizabeths mental hospital in Anacostia, a $3.4 billion showcase of security will rise from the crumbling brick wards. The new headquarters will be the largest government complex built since the Pentagon, a major landmark in the alternative geography of Top Secret America and four times as big as Liberty Crossing.

Staff researcher Julie Tate contributed to this report.

Methodology and credits

Comments

The Top Secret America database was put together by compiling hundreds of thousands of public records of government organizations and private-sector companies over the past two years.

From these records, The Washington Post identified 45 government organizations (for example, the FBI) engaged in top-secret work and determined that those 45 organizations could be broken down into 1,271 sub-units (for example, the Terrorist Screening Center of the FBI). One of the 45 organizations is represented as “unknown”; this category was created as a catchall for companies doing work for a government organization that could not be determined.

At the private-sector level, The Post identified 1,931 companies engaged in top-secret work for the government. Private-sector companies were grouped together and listed by a parent company’s name (for example, General Dynamics), even though one company might contain multiple sub-units (for example, General Dynamics Information Technology).

In a case where a large corporation (for example, Boeing) has a distinctly named sub-unit engaged in top-secret work (for example, Boeing’s Digital Receiver Technology), the name of the sub-unit was used. In the case of large corporations not primarily in the defense industry (for example, AT&T) that have similarly named sub-units that focus on top-secret work (for example, AT&T Government Solutions), the name of the parent company is used and the name of the sub-unit is noted. For every company listed, revenue and employee data and the date of establishment were drawn from public filings, Dun & Bradstreet data and original reporting.

State and local government organizations generally do not work at the top-secret level; that type of clearance is rarely granted to state officials. But the organizations are all part of a secretive domestic intelligence and homeland security world. The Post examined nearly 1,000 threat documents marked “For Official Use Only” and collected information from government Web sites, reports and other documents to identify 4,058 government organizations involved in domestic counterterrorism and homeland security. Of the total, 2,880 are federal organizations that work at the state level, such as the FBI’s Joint Terrorism Task Forces (JTTFs). There are also 818 state and 360 local organizations. Many of these listed themselves in documents as participants in either Joint Terrorism Task Forces, fusion centers or Anti-Terrorism Advisory Councils in 2009 or 2010.

More than 20 journalists worked on the investigation, including investigative reporters, cartography experts, database reporters, video journalists, researchers, interactive graphic designers, digital designers, graphic designers, and graphics editors at The Washington Post:

Stephanie Clark, Ben de la Cruz, Kat Downs, Dan Drinkard, Anne Ferguson-Rohrer, Justin Ferrell, David Finkel, Jennifer Jenkins, Robert Kaiser, Laris Karklis, Jacqueline Kazil, Lauren Keane, Todd Lindeman, Greg Manifold, Jennifer Morehead, Bonnie Jo Mount, Larry Nista, Ryan O’Neil, Sarah Sampsel, Whitney Shefte, Laura Stanton, Julie Tate, Doris Truong, Nathaniel Vaughn Kelso, Michael Williamson, Karen Yourish, Amanda Zamora

One researcher was funded in part by the Center on Law and Security at New York University Law School.

Monday, July 19, 2010; 4:50 PM

Find this story at 19 July 2010

Find the project at

© 2013 The Washington Post Company

 

 

Not just Verizon? Secret NSA effort to gather phone data is years old

WASHINGTON — The massive National Security Agency collection of telephone records disclosed Wednesday was part of a continuing program that has been in effect nonstop since 2006, according to the two top leaders of the Senate Intelligence Committee.

“As far as I know, this is the exact three-month renewal of what has been in place for the past seven years,” Sen. Dianne Feinstein (D-Calif.) told reporters Thursday. The surveillance “is lawful” and Congress has been fully briefed on the practice, she added.

Her Republican counterpart, Saxby Chambliss, concurred: “This is nothing new. This has been going on for seven years,” he said. “Every member of the United States Senate has been advised of this. To my knowledge there has not been any citizen who has registered a complaint. It has proved meritorious because we have collected significant information on bad guys, but only on bad guys, over the years.”

The statements by the two senators, whose committee positions give them wide access to classified data, appeared to rule out the possibility that the court order directing Verizon to turn over telephone records was related to the Boston Marathon bombings. The order was effective as of April 19, shortly after the bombings, which had sparked speculation about a link.

Instead, the surveillance, which was revealed Wednesday by Britain’s Guardian newspaper, appears to have been of far longer duration. Although the senators did not specify the scope of the surveillance, the fact that it has been in place since 2006 also suggests that it is not limited to any one phone carrier.

The Obama administration defended the program Thursday, saying the data collection “has been a critical tool in protecting the nation from terrorist threats to the United States.”

A senior administration official released a statement which did not confirm the existence of the court order authorizing the surveillance, which, according to the copy released by the Guardian, is marked “Top Secret.” It was issued in late April by the Foreign Intelligence Surveillance Court, a secret court that meets in Washington, and allowed the government to collect the bulk data until July 19.

“The information acquired does not include the content of any communications or the name of any subscriber,” the official said. “It relates exclusively to metadata, such as a telephone number or the length of a call.

The court order was authorized under a provision of the Foreign Intelligence Surveillance Act that allows the government to collect business records in bulk if its requests are approved by the court.

The official said telephone data allow “counterterrorism personnel to discover whether known or suspected terrorists have been in contact with other persons who may be engaged in terrorist activities, particularly people located inside the United States.”

The official requested anonymity to discuss the counterterrorism program.

In defending the data collection program, the administration official sought to spread responsibility, noting that “all three branches” of government were tasked with review and oversight of surveillance.

“There is a robust legal regime in place governing all activities conducted pursuant to the Foreign Intelligence Surveillance Act,” the official said. He said that involves oversight by the Department of Justice, the Office of the Director of National Intelligence and the FISA court.

Separately, the Justice Department released a letter defending the administration’s handling of the FISA law that they had sent in 2011 to two senators who had objected to it.

“We do not believe the Executive Branch is operating pursuant to ‘secret law’ or ‘secret opinions of the Department of Justice,’ “ said the letter, signed by Assistant Atty. Gen. Ronald Weich. The “Intelligence Community is conducting court-authorized intelligence activities pursuant to a public statute, with the knowledge and oversight of Congress and the Intelligence Communities of both Houses.”

“Many other collection activities are classified,” Weich added, saying that “this is necessary because public disclosure of the activities they discuss would harm national security and impede the effectiveness of the intelligence tools that Congress has approved.”

Weich further defended the program by saying intelligence officials have “determined that public disclosure of the classified use” of the law “would expose sensitive sources and methods to our adversaries and therefore harm national security.”

He said collection of records, as now underway with Verizon phone logs, was different than material obtained through grand jury subpoenas. Grand jury subpoenas, he said, can be obtained by prosecutors without court approval. In contrast, he said, the intelligence collections can be done only with approval from a federal judge sitting on the Foreign Intelligence Surveillance Court.

Most importantly, he noted that FISA courts require a showing by officials that the records sought “are relevant to an authorized national security investigation.”

The Weich letter was sent to Sen. Ron Wyden (D-0re.).

Atty. Gen. Eric H. Holder Jr. is testifying Thursday morning before the Senate Appropriations Committee, and is expected to address the matter further.

By Richard A. Serrano and Kathleen Hennessey

8:54 AM PDT, June 6, 2013Advertisement

Find this story at 6 June 2013

Copyright © 2013, Los Angeles Times

Verizon forced to hand over telephone data – full court ruling

The US government is collecting the phone records of millions of US customers of Verizon under a top secret court order. Read the Foreign Intelligence Surveillance Court order

Find this story at 6 June 2013

guardian.co.uk, Thursday 6 June 2013 00.04 BST

NSA collecting phone records of millions of Verizon customers daily

Exclusive: Top secret court order requiring Verizon to hand over all call data shows scale of domestic surveillance under Obama

Under the terms of the order, the numbers of both parties on a call are handed over, as is location data and the time and duration of all calls. Photograph: Matt Rourke/AP

The National Security Agency is currently collecting the telephone records of millions of US customers of Verizon, one of America’s largest telecoms providers, under a top secret court order issued in April.

The order, a copy of which has been obtained by the Guardian, requires Verizon on an “ongoing, daily basis” to give the NSA information on all telephone calls in its systems, both within the US and between the US and other countries.

The document shows for the first time that under the Obama administration the communication records of millions of US citizens are being collected indiscriminately and in bulk – regardless of whether they are suspected of any wrongdoing.

The secret Foreign Intelligence Surveillance Court (Fisa) granted the order to the FBI on April 25, giving the government unlimited authority to obtain the data for a specified three-month period ending on July 19.

Under the terms of the blanket order, the numbers of both parties on a call are handed over, as is location data, call duration, unique identifiers, and the time and duration of all calls. The contents of the conversation itself are not covered.

The disclosure is likely to reignite longstanding debates in the US over the proper extent of the government’s domestic spying powers.

Under the Bush administration, officials in security agencies had disclosed to reporters the large-scale collection of call records data by the NSA, but this is the first time significant and top-secret documents have revealed the continuation of the practice on a massive scale under President Obama.

The unlimited nature of the records being handed over to the NSA is extremely unusual. Fisa court orders typically direct the production of records pertaining to a specific named target who is suspected of being an agent of a terrorist group or foreign state, or a finite set of individually named targets.

The Guardian approached the National Security Agency, the White House and the Department of Justice for comment in advance of publication on Wednesday. All declined. The agencies were also offered the opportunity to raise specific security concerns regarding the publication of the court order.

The court order expressly bars Verizon from disclosing to the public either the existence of the FBI’s request for its customers’ records, or the court order itself.

“We decline comment,” said Ed McFadden, a Washington-based Verizon spokesman.

The order, signed by Judge Roger Vinson, compels Verizon to produce to the NSA electronic copies of “all call detail records or ’telephony metadata’ created by Verizon for communications between the United States and abroad” or “wholly within the United States, including local telephone calls”.

The order directs Verizon to “continue production on an ongoing daily basis thereafter for the duration of this order”. It specifies that the records to be produced include “session identifying information”, such as “originating and terminating number”, the duration of each call, telephone calling card numbers, trunk identifiers, International Mobile Subscriber Identity (IMSI) number, and “comprehensive communication routing information”.

The information is classed as “metadata”, or transactional information, rather than communications, and so does not require individual warrants to access. The document also specifies that such “metadata” is not limited to the aforementioned items. A 2005 court ruling judged that cell site location data – the nearest cell tower a phone was connected to – was also transactional data, and so could potentially fall under the scope of the order.

While the order itself does not include either the contents of messages or the personal information of the subscriber of any particular cell number, its collection would allow the NSA to build easily a comprehensive picture of who any individual contacted, how and when, and possibly from where, retrospectively.

It is not known whether Verizon is the only cell-phone provider to be targeted with such an order, although previous reporting has suggested the NSA has collected cell records from all major mobile networks. It is also unclear from the leaked document whether the three-month order was a one-off, or the latest in a series of similar orders.

The court order appears to explain the numerous cryptic public warnings by two US senators, Ron Wyden and Mark Udall, about the scope of the Obama administration’s surveillance activities.

For roughly two years, the two Democrats have been stridently advising the public that the US government is relying on “secret legal interpretations” to claim surveillance powers so broad that the American public would be “stunned” to learn of the kind of domestic spying being conducted.

Because those activities are classified, the senators, both members of the Senate intelligence committee, have been prevented from specifying which domestic surveillance programs they find so alarming. But the information they have been able to disclose in their public warnings perfectly tracks both the specific law cited by the April 25 court order as well as the vast scope of record-gathering it authorized.

Julian Sanchez, a surveillance expert with the Cato Institute, explained: “We’ve certainly seen the government increasingly strain the bounds of ‘relevance’ to collect large numbers of records at once — everyone at one or two degrees of separation from a target — but vacuuming all metadata up indiscriminately would be an extraordinary repudiation of any pretence of constraint or particularized suspicion.” The April order requested by the FBI and NSA does precisely that.

The law on which the order explicitly relies is the so-called “business records” provision of the Patriot Act, 50 USC section 1861. That is the provision which Wyden and Udall have repeatedly cited when warning the public of what they believe is the Obama administration’s extreme interpretation of the law to engage in excessive domestic surveillance.

In a letter to attorney general Eric Holder last year, they argued that “there is now a significant gap between what most Americans think the law allows and what the government secretly claims the law allows.”

“We believe,” they wrote, “that most Americans would be stunned to learn the details of how these secret court opinions have interpreted” the “business records” provision of the Patriot Act.

Privacy advocates have long warned that allowing the government to collect and store unlimited “metadata” is a highly invasive form of surveillance of citizens’ communications activities. Those records enable the government to know the identity of every person with whom an individual communicates electronically, how long they spoke, and their location at the time of the communication.

Such metadata is what the US government has long attempted to obtain in order to discover an individual’s network of associations and communication patterns. The request for the bulk collection of all Verizon domestic telephone records indicates that the agency is continuing some version of the data-mining program begun by the Bush administration in the immediate aftermath of the 9/11 attack.

The NSA, as part of a program secretly authorized by President Bush on 4 October 2001, implemented a bulk collection program of domestic telephone, internet and email records. A furore erupted in 2006 when USA Today reported that the NSA had “been secretly collecting the phone call records of tens of millions of Americans, using data provided by AT&T, Verizon and BellSouth” and was “using the data to analyze calling patterns in an effort to detect terrorist activity.” Until now, there has been no indication that the Obama administration implemented a similar program.

These recent events reflect how profoundly the NSA’s mission has transformed from an agency exclusively devoted to foreign intelligence gathering, into one that focuses increasingly on domestic communications. A 30-year employee of the NSA, William Binney, resigned from the agency shortly after 9/11 in protest at the agency’s focus on domestic activities.

In the mid-1970s, Congress, for the first time, investigated the surveillance activities of the US government. Back then, the mandate of the NSA was that it would never direct its surveillance apparatus domestically.

At the conclusion of that investigation, Frank Church, the Democratic senator from Idaho who chaired the investigative committee, warned: “The NSA’s capability at any time could be turned around on the American people, and no American would have any privacy left, such is the capability to monitor everything: telephone conversations, telegrams, it doesn’t matter.”

Additional reporting by Ewen MacAskill and Spencer Ackerman

The Guardian, Thursday 6 June 2013

Find this story at 6 June 2013

© 2013 Guardian News and Media Limited or its affiliated companies. All rights reserved.

Editor of The Progressive Calls for Eric Holder to Resign over Spying on Press, Occupy Protesters

As the Obama administration faces criticism for the Justice Department’s spying on journalists and the IRS targeting of right-wing organizations, newly released documents show how the FBI, the Department of Homeland Security and local police forces partnered with corporations to spy on Occupy protesters in 2011 and 2012. Detailed in thousands of pages of records from counter terrorism and law enforcement agencies, the spying monitored the activists’ online usage and led to infiltration of their meetings. One document shows an undercover officer was dispatched in Arizona to infiltrate activists organizing protests around the American Legislative Exchange Council (ALEC), the secretive group that helps corporate America propose and draft legislation for states across the country. We’re joined by Matt Rothschild of The Progressive, who tackles the surveillance in his latest article, “Spying on Occupy Activists: How Cops and Homeland Security Help Wall Street.”

Watch Part Two of interview here
Transcript

This is a rush transcript. Copy may not be in its final form.

NERMEEN SHAIKH: We end our show with a look at newly revealed documents showing how police partnered with corporations to monitor the Occupy Wall Street movement. DBA Press and the Center for Media and Democracy have obtained thousands of pages of records from counterterrorism and law enforcement agencies that detail how so-called “fusion centers” monitored the Occupy Wall Street movement over the course of 2011 and 2012. These fusion centers are comprised of employees from municipal, county and federal counterterrorism and homeland security entities, as well as local police departments, the FBI and the Department of Homeland Security.

The documents show how fusion center personnel spied on Occupy protesters, monitored their Facebook accounts, and infiltrated their meetings. One document showed how the Arizona fusion center dispatched an undercover officer to infiltrate activist groups organizing protests around the American Legislative Exchange Council, or ALEC, the secretive group that helps corporate America propose and draft legislation for states across the country. The undercover officer apparently worked for the benefit of the private entity ALEC despite being on the public payroll.

AMY GOODMAN: Democracy Now! reached out to the Phoenix Police Department to join us on the show, but they declined our request. Sergeant Trent Crump in the media relations department said in an email, quote, “Occupy Phoenix presented itself with a great deal of civil unrest over a long period of time. We monitored available Intel all the time, as it is used for Intel-driven policing. Intel dictated resources and response tactics to address, mitigate, and manage this ongoing activity which was very fluid and changing day-to-day. This approach ensured that citizens can exercise their civil rights, while we protect the community at the same time,” they said.

Well, for more, we go to Matt Rothschild, editor and publisher of The Progressive magazine, wrote the cover story for the June issue of the magazine, “Spying on Occupy Activists: How Cops and Homeland Security Help Wall Street,” the piece drawing heavily on the documents obtained by the Center for Media and Democracy and DBA Press. Matt Rothschild is also the author of You Have No Rights: Stories of America in an Age of Repression.

Matt, welcome to Democracy Now! Just lay out what you have found.

MATTHEW ROTHSCHILD: Hey, Amy. Thanks for having me on.

Yeah, I mean, these documents from the Center for Media and Democracy and DBA Press show that law enforcement and Homeland Security have equated protesters, left-wing protesters, as terrorists. They have diverted enormous amounts of resources from counterterrorism efforts to spy on these local protesters, and then they’ve collaborated with the private sector, some of the very institutions—banks—that these protesters were aiming at. And as you read in that statement from the Phoenix Police Department, the effort was to mitigate these protests. I mean, why is law enforcement, why is Homeland Security, in the business of mitigating protests?

NERMEEN SHAIKH: Well, I want to go to a response that we received from the Phoenix Police Department when we reached them for comment. And they said that they were not treating Occupy protesters as potential terrorists. They said, “[W]e are an all hazards incident management team, we have gathered information at all types of events [such as] Superbowl, World Series, SB 1070 protest etc.” So can you say how it is that their monitoring of Occupy protesters differed qualitatively from the other events that the Phoenix Police Department named?

MATTHEW ROTHSCHILD: Sure. Well, they’re using resources from the Arizona Counter Terrorism Information Center, the Arizona fusion center, and they’re using Homeland Defense personnel in the Phoenix Police Department to track Occupy activists. So, it’s a little disingenuous of them to say they’re not treating these protesters as terrorists when they’re using their own anti-terrorist personnel to spend a lot of time simply tracking these activists. One of the police officers who was on the Homeland Defense Bureau of the Phoenix Police Department said she was primarily spending her time tracking Occupy activists on social media.

AMY GOODMAN: We also asked the Phoenix police if law enforcement is infiltrating Occupy meetings. And he replied, quote, “Infiltrate? No. Attend open meetings? Yes.” Democracy Now! also asked Trent Crump if law enforcement tracked Occupy activists online. He replied, “Yes, we gather intel on a number of social media sites regularly.” So, what about this? And also, this issue of law enforcement monitoring the protests against ALEC, the American Legislative Exchange Council, when we asked him this, he said, “Yes, public safety.” Your response?

MATTHEW ROTHSCHILD: Well, they not only monitored the ALEC protests in late November 2011, but they also sent a face sheet to the security personnel for ALEC, a face sheet of the faces and names and identities of Occupy protesters who have been doing some activism in the Phoenix area, to make the ALEC security personnel aware of who may be coming to their protests. They were also tracking—

AMY GOODMAN: So the police are working with the companies and the organizations.

MATTHEW ROTHSCHILD: Absolutely. Yeah, they were working with security for the American Legislative Exchange Council. They were also letting security know when Jesse Jackson was going to be in town to join an Occupy protest and an ALEC protest. Is that really their job to be passing information on to these private entities?

And then, with some of the bank protests that Occupy Phoenix was planning, they were giving downtown banks all sorts of information. “Give downtown banks everything they need.” That was one internal memo from the Phoenix Police Department, when it was a day of protest against these banks and Occupy was urging the bank customers to cut up their credit cards from these banks. And which banks are we talking about? We’re talking about Bank of America, Wells Fargo, Chase—some of the very targets that Occupy had been protesting against. So, the question is: Who are the police department working for? Are they working for citizens? Are they working for the private sector? Are they working for the banks?

NERMEEN SHAIKH: Can you put—Matt Rothschild, can you put this in a wider historical context? Is this kind of surveillance unprecedented in the U.S.? And what accounts for its occurrence during Occupy in the way that you describe?

MATTHEW ROTHSCHILD: Well, unfortunately, it’s not unprecedented. There’s a terrible history of law enforcement and the FBI spying on left-wing activists, going back to the COINTELPRO program of the FBI in the ’60s and ’70s, where they infiltrated the Black Panther movement and the American Indian Movement. But interestingly, after those revelations came out, there were guidelines imposed by the Justice Department itself, the so-called Levi guidelines. Edward Levi was the attorney general under the Ford administration who said you can’t go spying on and infiltrating activist groups in this country unless there’s a predicate of criminal activity. Well, after 9/11, the Bush administration and Ashcroft, his attorney general, completely destroyed the Levi guidelines and let law enforcement do any kind of infiltration they want, without any necessity for any hint of criminal activity on the part of the activists.

AMY GOODMAN: Matt Rothschild, you’ve called for the resignation of Attorney General Eric Holder. Why?

MATTHEW ROTHSCHILD: Well, for a number of reasons, Amy, first of all, for this scandal about investigating reporters. I think that’s outrageous. We had more than a hundred AP reporters and editors that the Justice Department was gathering information on, and now we have the revelation about the Fox News reporter James Rosen, who was being accused of being a co-conspirator under the Espionage Act of 1917 simply for doing his reporting job. Also, the attorney general has been essentially waging war on whistleblowers under the Espionage Act.

And on top of that, let’s remember, this attorney general, Eric Holder, has been rationalizing the assassination program that the Obama administration has been engaging in, saying that a drone can drop a bomb on a U.S. citizen anywhere in the world, and that U.S. citizen will already have had due process simply because the Obama administration itself or the president or the secretary of defense calls that person a terrorist. Now, that’s not due process, and that’s not what the Justice Department should be doing. Certainly the attorney general, the chief law enforcement officer of this country, should know better than that.

AMY GOODMAN: Matthew Rothschild, isn’t he just carrying out President Obama’s policies?

MATTHEW ROTHSCHILD: Well, he very well might be, and then we have a more serious problem. We have a serious problem at the very top with a president of the United States, again, like George W. Bush, engaging in illegal activity.

AMY GOODMAN: We want to thank you for being with us. We’re going to do part two of the interview and post it at democracynow.org. Matt Rothschild, editor and publisher of The Progressive magazine, wrote the cover story for the June issue, “Spying on Occupy Activists: How Cops and Homeland Security Help Wall Street.”

Wednesday, May 22, 2013

Find this story at 22 May 2013

SPYING ON AMERICANS: Obama’s Backdoor “Cybersecurity” Wiretap Bill Threatens Political and Private Rights; Spying on Social Media

Under the guise of “cybersecurity,” the new all-purpose bogeyman to increase the secret state’s already-formidable reach, the Obama administration and their congressional allies are crafting legislation that will open new backdoors for even more intrusive government surveillance: portals into our lives that will never be shut.

As Antifascist Calling has frequently warned, with the endless “War on Terror” as a backdrop the federal government, most notably the 16 agencies that comprise the so-called “Intelligence Community” (IC), have been constructing vast centralized databases that scoop-up and store all things digital–from financial and medical records to the totality of our electronic communications online–and do so without benefit of a warrant or probable cause.

The shredding of constitutional protections afforded by the Fourth Amendment, granted to the Executive Branch by congressional passage of the Authorization for Use of Military Force (AUMF) after the 9/11 attacks, followed shortly thereafter by the oxymoronic USA Patriot Act set the stage for today’s depredations.

Under provisions of multiple bills under consideration by the House and Senate, federal officials will be given broad authority over private networks that will almost certainly hand security officials wide latitude over what is euphemistically called “information-sharing” amongst corporate and government securocrats.

As The Washington Post reported in February, the National Security Agency “has pushed repeatedly over the past year to expand its role in protecting private-sector computer networks from cyberattacks” but has allegedly “been rebuffed by the White House, largely because of privacy concerns.”

“The most contentious issue,” Post reporter Ellen Nakashima wrote, “was a legislative proposal last year that would have required hundreds of companies that provide such critical services as electricity generation to allow their Internet traffic to be continuously scanned using computer threat data provided by the spy agency. The companies would have been expected to turn over evidence of potential cyberattacks to the government.”

Both the White House and Justice Department have argued, according to the Post, that the “proposal would permit unprecedented government monitoring of routine civilian Internet activity.”

National Security Agency chief General Keith Alexander, the dual-hatted commander of NSA and U.S. Cyber Command (USCYBERCOM), the Pentagon satrapy that wages offensive cyberwar, was warned to “restrain his public comments after speeches in which he argued that more expansive legal authority was necessary to defend the nation against cyberattacks.”

While we can take White House “objections” with a proverbial grain of salt, they do reveal however that NSA, the largest and most well-funded of the secret state’s intel shops will use their formidable surveillance assets to increase their power while undermining civilian control over the military in cahoots with shadowy security corporations who do their bidding. (Readers are well-advised to peruse The Surveillance Catalog posted by The Wall Street Journal as part of their excellent What They Know series for insight into the burgeoning Surveillance-Industrial Complex).

As investigative journalist James Bamford pointed out recently in Wired Magazine, “the exponential growth in the amount of intelligence data being produced every day by the eavesdropping sensors of the NSA and other intelligence agencies” is “truly staggering.”

In a follow-up piece for Wired, Bamford informed us that when questioned by Congress, Alexander stonewalled a congressional subcommittee when asked whether NSA “has the capability of monitoring the communications of Americans, he never denies it–he simply says, time and again, that NSA can’t do it ‘in the United States.’ In other words it can monitor those communications from satellites in space, undersea cables, or from one of its partner countries, such as Canada or Britain, all of which it has done in the past.”

Call it Echelon on steroids, the massive, secret surveillance program first exposed by journalists Duncan Campbell and Nicky Hager.

And with the eavesdropping agency angling for increased authority to monitor the electronic communications of Americans, the latest front in the secret state’s ongoing war against privacy is “cybersecurity” and “infrastructure protection.”

‘Information Sharing’ or Blanket Surveillance?

Among the four bills currently competing for attention, the most egregious threat to civil liberties is the Cyber Intelligence Sharing and Protection Act of 2011 (CISPA, H.R. 3523).

Introduced by Mike Rogers (R-MI) and Dutch Ruppersberger (D-MD), the bill amends the National Security Act of 1947, adding language concerning so-called “cyber threat intelligence and information sharing.”

“Cyber threat intelligence” is described as “information in the possession of an element of the intelligence community directly pertaining to a vulnerability of, or threat to, a system or network of a government or private entity, including information pertaining to the protection of a system or network from: (1) efforts to degrade, disrupt, or destroy such system or network; or (2) theft or misappropriation of private or government information, intellectual property, or personally identifiable information.”

In keeping with other “openness” mandates of our Transparency Administration™ the Rogers bill will require the Director of National Intelligence (DNI) to establish procedures that permit IC elements to “share cyber threat intelligence with private-sector entities, and (2) encourage the sharing of such intelligence.”

These measures however, will not protect the public at large from attacks by groups of organized cyber criminals since such intelligence is only “shared with certified entities or a person with an appropriate security clearance,” gatekeepers empowered by the state who ensure that access to information is “consistent with the need to protect U.S. national security, and used in a manner that protects such intelligence from unauthorized disclosure.”

In other words, should “cleared” cyber spooks be directed by their corporate or government masters to install state-approved malware on private networks as we discovered last year as a result of the HBGary hack by Anonymous, it would be a crime punishable by years in a federal gulag if official lawbreaking were disclosed.

The bill authorizes “a cybersecurity provider (a non-governmental entity that provides goods or services intended to be used for cybersecurity purposes),” i.e., an outsourced contractor from any one of thousands of spooky “cybersecurity” firms, to use “cybersecurity systems to identify and obtain cyber threat information in order to protect the rights and property of the protected entity; and share cyber threat information with any other entity designated by the protected entity, including the federal government.”

Furthermore, the legislation aims to regulate “the use and protection of shared information, including prohibiting the use of such information to gain a competitive advantage and, if shared with the federal government, exempts such information from public disclosure.”

And should the public object to the government or private entities trolling through their personal data in the interest of “keeping us safe” well, there’s an app for that too! The bill “prohibits a civil or criminal cause of action against a protected entity, a self-protected entity (an entity that provides goods or services for cybersecurity purposes to itself), or a cybersecurity provider acting in good faith under the above circumstances.”

One no longer need wait until constitutional violations are uncovered, the Rogers bill comes with a get-out-of-jail-free card already in place for state-approved scofflaws.

Additionally, the bill also “preempts any state statute that restricts or otherwise regulates an activity authorized by the Act.” In other words, in states like California where residents have “an inalienable right to privacy” under Article 1, Section 1 of the State Constitution, the Rogers bill would be abolish that right and effectively “legalize” unaccountable snooping by the federal government or other “self-protected,” i.e., private entities deputized to do so by the secret state.

Social Media Spying

How would this play out in the real world? As Government Computer News reported, hyped-up threats of an impending “cyber-armageddon” have spawned a host of new actors constellating America’s Surveillance-Industrial Complex: the social media analyst.

“Companies and government agencies alike are using tools to sweep the Internet–blogs, websites, and social media such as Facebook and Twitter feeds–to find out what people are saying about, well, just about anything.”

Indeed, as researchers Jerry Brito and Tate Watkins pointed out last year in Loving the Cyber Bomb?, “An industrial complex reminiscent of the Cold War’s may be emerging in cybersecurity today.”

Brito and Watkins averred that “the military-industrial complex was born out of exaggerated Soviet threats, a defense industry closely allied with the military and Department of Defense, and politicians striving to bring pork and jobs home to constituents. A similar cyber-industrial complex may be emerging today, and its players call for government involvement that may be superfluous and definitely allows for rent seeking and pork barreling.”

Enter social media analysis and the private firms out to make a buck–at our expense.

“Not surprisingly,” GCN’s Patrick Marshall wrote, “intelligence agencies have already been looking at social media as a source of information. The Homeland Security Department has been analyzing traffic on social networks for at least the past three years.”

While DHS claims it does not routinely monitor Facebook or Twitter, and only responds when it receives a “tip,” such assertions are demonstrably false.

Ginger McCall, the director of the Electronic Electronic Privacy Information Center’s Open Government Program told GCN that the department is “explicitly monitoring for criticism of the government, for reports that reflect adversely on the agency, for public reaction to policy proposals.”

But DHS isn’t the only agency monitoring social media sites such as Facebook and Google+.

As Antifascist Calling reported back in 2009, according to New Scientist the National Security Agency “is funding research into the mass harvesting of the information that people post about themselves on social networks.”

Not to be outdone, the CIA’s venture capital investment arm, In-Q-Tel, has poured millions of dollars into Visible Technologies, a Bellevue, Washington-based firm specializing in “integrated marketing, social servicing, digital experience management, and consumer intelligence.”

According to In-Q-Tel “Visible Technologies has developed TruCast®, which takes an innovative and holistic approach to social media management. TruCast has been architected as an enterprise-level solution that provides the ability to track, analyze, and respond to social media from a single, Web-based platform.”

Along similar lines, the CIA has heavily invested in Recorded Future, a firm which “extracts time and event information from the web. The company offers users new ways to analyze the past, present, and the predicted future.”

The firm’s defense and intelligence analytics division promises to “help analysts understand trends in big data, and foresee what may happen in the future. Groundbreaking algorithms extract temporal and predictive signals from unstructured text. Recorded Future organizes this information, delineates results over interactive timelines, visualizes past trends, and maps future events–all while providing traceability back to sources. From OSINT to classified data, Recorded Future offers innovative, massively scalable solutions.”

As Government Computer News pointed out, in January the FBI “put out a request for vendors to provide information about available technologies for monitoring and analyzing social media.” Accordingly, the Bureau is seeking the ability to:

• Detect specific, credible threats or monitor adversarial situations.

• Geospatially locate bad actors or groups and analyze their movements, vulnerabilities, limitations, and possible adverse actions.

• Predict likely developments in the situation or future actions taken by bad actors (by conducting trend, pattern, association, and timeline analysis).

• Detect instances of deception in intent or action by bad actors for the explicit purpose of misleading law enforcement.

• Develop domain assessments for the area of interest (more so for routine scenarios and special events).

So much for privacy in our Orwellian New World Order!

Backdoor Official Secrets Act

Social media “harvesting” by private firms hot-wired into the state’s Surveillance-Industrial Complex will be protected from challenges under provisions of CISPA.

As the Electronic Frontier Foundation (EFF) pointed out, “a company that protects itself or other companies against ‘cybersecurity threats’ can ‘use cybersecurity systems to identify and obtain cyber threat information to protect the rights and property’ of the company under threat. But because ‘us[ing] cybersecurity systems’ is incredibly vague, it could be interpreted to mean monitoring email, filtering content, or even blocking access to sites. A company acting on a ‘cybersecurity threat’ would be able to bypass all existing laws, including laws prohibiting telcos from routinely monitoring communications, so long as it acted in ‘good faith’.”

And as EFF’s Rainey Reitman and Lee Tien aver, the “broad language” concerning what constitutes a cybersecurity “threat,” is an invitation for the secret state and their private “partners” to include “theft or misappropriation of private or government information, intellectual property, or personally identifiable information.”

“Yes,” Reitman and Tien wrote, “intellectual property. It’s a little piece of SOPA wrapped up in a bill that’s supposedly designed to facilitate detection of and defense against cybersecurity threats. The language is so vague that an ISP could use it to monitor communications of subscribers for potential infringement of intellectual property. An ISP could even interpret this bill as allowing them to block accounts believed to be infringing, block access to websites like The Pirate Bay believed to carry infringing content, or take other measures provided they claimed it was motivated by cybersecurity concerns.”

More troubling, “the government and Internet companies could use this language to block sites like WikiLeaks and NewYorkTimes.com, both of which have published classified information.”

Should CISPA pass muster it could serve as the basis for establishing an American “Official Secrets Act.” In the United Kingdom, the Act has been used against whistleblowers to prohibit disclosure of government crimes. But it does more than that. The state can also issue restrictive “D-Notices” that “advise” editors not to publish material on subjects deemed sensitive to the “national security.”

EFF warns that “online publishers like WikiLeaks are currently afforded protection under the First Amendment; receiving and publishing classified documents from a whistleblower is a common journalistic practice. While there’s uncertainty about whether the Espionage Act could be brought to bear against WikiLeaks, it is difficult to imagine a situation where the Espionage Act would apply to WikiLeaks without equally applying to the New York Times, the Washington Post, and in fact everyone who reads about the cablegate releases.”

And with the Obama regime’s crusade to prosecute and punish whistleblowers, as the recent indictment of former CIA officer John Kiriakou for alleged violations of the Espionage Act and the Intelligence Identities Protection Act for disclosing information on the CIA’s torture programs, we have yet another sterling example of administration “transparency”! While Kiriakou faces 30 years in prison, the former head of the CIA’s Directorate of Operations, Jose A. Rodriguez Jr., who was responsible for the destruction of 92 torture videotapes held by the Agency, was not charged by the government and was given a free pass by the Justice Department.

As the World Socialist Web Site points out: “More fundamentally, the prosecution of Kiriakou is part of a policy of state secrecy and repression that pervades the US government under Obama, who came into office promising ‘the most transparent administration in history.’”

Critic Bill Van Auken observed that Kiriakou’s prosecution “marks the sixth government whistleblower to be charged by the Obama administration under the Espionage Act, twice as many such prosecutions as have been brought by all preceding administrations combined. Prominent among them is Private Bradley Manning, who is alleged to have leaked documents exposing US war crimes to WikiLeaks. He has been held under conditions tantamount to torture and faces a possible death penalty.”

“In all of these cases,” the World Socialist Web Site noted, “the World War I-era Espionage Act is being used to punish not spying on behalf of a foreign government, but exposing the US government’s own crimes to the American people. The utter lawlessness of US foreign policy goes hand in hand with the collapse of democracy at home.”

The current crop of “cybersecurity” bills are sure to hasten that collapse.

Under Rogers’ legislation, “the government would have new, powerful tools to go after WikiLeaks,” or anyone else who challenges the lies of the U.S. government by publishing classified information that contradicts the dominant narrative.

…

By Tom Burghardt
Global Research, April 10, 2012

Find this story at 10 April 2013

Copyright © 2005-2013 GlobalResearch.ca

Use These Secret NSA Google Search Tips to Become Your Own Spy Agency

There’s so much data available on the internet that even government cyberspies need a little help now and then to sift through it all. So to assist them, the National Security Agency produced a book to help its spies uncover intelligence hiding on the web.

The 643-page tome, called Untangling the Web: A Guide to Internet Research (.pdf), was just released by the NSA following a FOIA request filed in April by MuckRock, a site that charges fees to process public records for activists and others.

The book was published by the Center for Digital Content of the National Security Agency, and is filled with advice for using search engines, the Internet Archive and other online tools. But the most interesting is the chapter titled “Google Hacking.”

Say you’re a cyberspy for the NSA and you want sensitive inside information on companies in South Africa. What do you do?

Search for confidential Excel spreadsheets the company inadvertently posted online by typing “filetype:xls site:za confidential” into Google, the book notes.

Want to find spreadsheets full of passwords in Russia? Type “filetype:xls site:ru login.” Even on websites written in non-English languages the terms “login,” “userid,” and “password” are generally written in English, the authors helpfully point out.

Misconfigured web servers “that list the contents of directories not intended to be on the web often offer a rich load of information to Google hackers,” the authors write, then offer a command to exploit these vulnerabilities — intitle: “index of” site:kr password.

“Nothing I am going to describe to you is illegal, nor does it in any way involve accessing unauthorized data,” the authors assert in their book. Instead it “involves using publicly available search engines to access publicly available information that almost certainly was not intended for public distribution.” You know, sort of like the “hacking” for which Andrew “weev” Aurenheimer was recently sentenced to 3.5 years in prison for obtaining publicly accessible information from AT&T’s website.

Stealing intelligence on the internet that others don’t want you to have might not be illegal, but it does come with other risks, the authors note: “It is critical that you handle all Microsoft file types on the internet with extreme care. Never open a Microsoft file type on the internet. Instead, use one of the techniques described here,” they write in a footnote. The word “here” is hyperlinked, but since the document is a PDF the link is inaccessible. No word about the dangers that Adobe PDFs pose. But the version of the manual the NSA released was last updated in 2007, so let’s hope later versions cover it.

…

By Kim Zetter05.08.132:37 PM

Find this story at 8 May 2013

Untangling the Web: A Guide to Internet Research

Wired.com © 2013 Condé Nast.

Secret US court approved every single domestic spying request in 2012

The United States Foreign Intelligence Surveillance Court quietly rubber stamped nearly 2,000 government requests to search or electronically monitor people in the United States last year, according to a Justice Department report published this week.

The agency, which oversees requests for surveillance warrants against suspected foreign intelligence agents on US soil, released the report to Senate majority leader Harry Reid (D-Nevada), showing that by approving the 1,856 inquiries “for foreign intelligence purposes,” it had granted every single government request in 2012. The FISC’s approval rating actually jumped by five per cent from 2011 – when it also approved every application.

The FISC was instituted as part of the US Foreign Intelligence Surveillance Act (FISA) in 1978, expanded under the George W. Bush administration, and then reauthorized by Congress for another five years in December of 2012.
The act, commonly referred to act the “warrantless wiretapping” law, authorizes the government to monitor US citizens’ phone calls and emails without first proving probable cause as long as they’re believed to be corresponding with an individual overseas.

“The 1,856 applications include applications made solely for electronic surveillance, applications made solely for physical search, and combined applications requesting authority for electronic surveillance and physical search,” the report read. “Of these, 1,789 applications included requests for authority to conduct electronic surveillance.”

David Kris, a former top anti-terrorism attorney at the Justice Department, wrote in the 2012 edition of National Security Investigations and Prosecutions that the FISA Amendments Act also gives the government domestic spying power while stripping away accountability.

Reuters / Jeremy Papasso

“For example, an authorization targeting Al-Qaeda – which is a non-US person located abroad – could allow the government to wiretap any telephone that it believes will yield information from or about Al-Qaeda, either because the telephone is registered to a person whom the government believes is affiliated with Al-Qaeda, or because the government believes that the person communicates with others who are affiliated with Al-Qaeda, regardless of the location of the telephone,” Kris wrote, as quoted by Wired.

…

Published time: May 02, 2013 22:57
Reuters / Jessica Rinaldi

Find this story at 2 May 2013

© Autonomous Nonprofit Organization “TV-Novosti”, 2005–2013

Telecoms firm hails ‘significant victory’ as judge blocks FBI’s data demands

Credo Mobile speaks out after judge orders US government to stop issuing ‘national security letters’ to access citizens’ data

Judge Susan Illston declared the NSLs unconstitutional as they breached the first amendment rights of the parties being served the orders. Photograph: Frank Polich/Reuters

The Californian telecoms company thought to be behind a stunning court victory that has blown a hole in the FBI’s highly secretive system for collecting US citizens’ private data has hailed the “significant” legal breakthrough.

Credo, based in San Francisco, spoke out after a federal judge ordered the US government to stop issuing what are called “national security letters” – demands for data that contain in-built gagging clauses that prevent the recipients disclosing even the existence of the orders or their own identity.

In a carefully worded release, the firm fell short of revealing itself as the instigator of the legal action that resulted in Friday’s development. But it is understood by the Guardian that the telecommunications firm was indeed the unnamed litigant behind the action.

Michael Kieschnick, chief executive of Credo Mobile, hailed the judge’s order as “the most significant court victory for our constitutional rights since the dark day when George W Bush signed the Patriot Act”.

It is extremely rare for a telecoms company to challenge the system of national security letters, or NSLs, which have mushroomed since 9/11 under the Patriot Act. Credo, a subsidiary of Working Assets Inc, that directs some of its profits to support civil liberties groups, has been a long-standing advocate for reform of the NSL.

It is believed to be the company behind a May 2011 lawsuit in which the FBI was sued for breach of its rights after the company was served with a federal demand for private data belonging to its customers. The FBI shot back by counter-suing the company.

The lawsuit was made anonymously, with the name of the company redacted from court papers made available to the media. But last July the Wall Street Journal conducted an analysis of the likely telecoms companies that could have brought the legal action, and concluded that the litigant was probably Credo.

In her ruling, Judge Susan Illston declared the NSLs unconstitutional as they breached the first amendment rights of the parties being served the orders.

Kieschnick said: “This decision is notable for its clarity and depth. From this day forward, the US government’s unconstitutional practice of using national security letters to obtain private information without court oversight and its denial of the first amendment rights of national security letter recipients have finally been stopped by our courts.”

NSLs have been an increasingly important part of the US government’s approach to counter-terrorism, though their growing use has been matched by mounting unease on the party of civil libertarians.

Last year the FBI sent out more than 16,000 of the letters relating to the private data – mainly financial, internet or phone records – of more than 7,000 Americans.

Previous court action has led to the FBI being accused of abusing its powers under the NSL statute by issuing the letters far more extensively than in the limited counter-terrorism situations for which they were devised.

The letters are among the most secretive tools of any deployed by the US state. The demand for data comes with a gagging order attached – meaning that the recipient of the NSL is not allowed even to discuss the letter in public.

…

• This article has been amended since publication.

Ed Pilkington in New York
guardian.co.uk, Saturday 16 March 2013 19.30 GMT

Find this story at 16 March 2013

© 2013 Guardian News and Media Limited or its affiliated companies. All rights reserved.

How Facebook could get you arrested

Smart technology and the sort of big data available to social networking sites are helping police target crime before it happens. But is this ethical?

Companies such as Facebook have begun using algorithms and historical data to predict which of their users might commit crimes. Illustration: Noma Bar

The police have a very bright future ahead of them – and not just because they can now look up potential suspects on Google. As they embrace the latest technologies, their work is bound to become easier and more effective, raising thorny questions about privacy, civil liberties, and due process.

For one, policing is in a good position to profit from “big data”. As the costs of recording devices keep falling, it’s now possible to spot and react to crimes in real time. Consider a city like Oakland in California. Like many other American cities, today it is covered with hundreds of hidden microphones and sensors, part of a system known as ShotSpotter, which not only alerts the police to the sound of gunshots but also triangulates their location. On verifying that the noises are actual gunshots, a human operator then informs the police.

It’s not hard to imagine ways to improve a system like ShotSpotter. Gunshot-detection systems are, in principle, reactive; they might help to thwart or quickly respond to crime, but they won’t root it out. The decreasing costs of computing, considerable advances in sensor technology, and the ability to tap into vast online databases allow us to move from identifying crime as it happens – which is what the ShotSpotter does now – to predicting it before it happens.

Instead of detecting gunshots, new and smarter systems can focus on detecting the sounds that have preceded gunshots in the past. This is where the techniques and ideologies of big data make another appearance, promising that a greater, deeper analysis of data about past crimes, combined with sophisticated algorithms, can predict – and prevent – future ones. This is a practice known as “predictive policing”, and even though it’s just a few years old, many tout it as a revolution in how police work is done. It’s the epitome of solutionism; there is hardly a better example of how technology and big data can be put to work to solve the problem of crime by simply eliminating crime altogether. It all seems too easy and logical; who wouldn’t want to prevent crime before it happens?

Police in America are particularly excited about what predictive policing – one of Time magazine’s best inventions of 2011 – has to offer; Europeans are slowly catching up as well, with Britain in the lead. Take the Los Angeles Police Department (LAPD), which is using software called PredPol. The software analyses years of previously published statistics about property crimes such as burglary and automobile theft, breaks the patrol map into 500 sq ft zones, calculates the historical distribution and frequency of actual crimes across them, and then tells officers which zones to police more vigorously.

It’s much better – and potentially cheaper – to prevent a crime before it happens than to come late and investigate it. So while patrolling officers might not catch a criminal in action, their presence in the right place at the right time still helps to deter criminal activity. Occasionally, though, the police might indeed disrupt an ongoing crime. In June 2012 the Associated Press reported on an LAPD captain who wasn’t so sure that sending officers into a grid zone on the edge of his coverage area – following PredPol’s recommendation – was such a good idea. His officers, as the captain expected, found nothing; however, when they returned several nights later, they caught someone breaking a window. Score one for PredPol?

Trials of PredPol and similar software began too recently to speak of any conclusive results. Still, the intermediate results look quite impressive. In Los Angeles, five LAPD divisions that use it in patrolling territory populated by roughly 1.3m people have seen crime decline by 13%. The city of Santa Cruz, which now also uses PredPol, has seen its burglaries decline by nearly 30%. Similar uplifting statistics can be found in many other police departments across America.

Other powerful systems that are currently being built can also be easily reconfigured to suit more predictive demands. Consider the New York Police Department’s latest innovation – the so-called Domain Awareness System – which syncs the city’s 3,000 closed-circuit camera feeds with arrest records, 911 calls, licence plate recognition technology, and radiation detectors. It can monitor a situation in real time and draw on a lot of data to understand what’s happening. The leap from here to predicting what might happen is not so great.

If PredPol’s “prediction” sounds familiar, that’s because its methods were inspired by those of prominent internet companies. Writing in The Police Chief magazine in 2009, a senior LAPD officer lauded Amazon’s ability to “understand the unique groups in their customer base and to characterise their purchasing patterns”, which allows the company “not only to anticipate but also to promote or otherwise shape future behaviour”. Thus, just as Amazon’s algorithms make it possible to predict what books you are likely to buy next, similar algorithms might tell the police how often – and where – certain crimes might happen again. Ever stolen a bicycle? Then you might also be interested in robbing a grocery store.

Here we run into the perennial problem of algorithms: their presumed objectivity and quite real lack of transparency. We can’t examine Amazon’s algorithms; they are completely opaque and have not been subject to outside scrutiny. Amazon claims, perhaps correctly, that secrecy allows it to stay competitive. But can the same logic be applied to policing? If no one can examine the algorithms – which is likely to be the case as predictive-policing software will be built by private companies – we won’t know what biases and discriminatory practices are built into them. And algorithms increasingly dominate many other parts of our legal system; for example, they are also used to predict how likely a certain criminal, once on parole or probation, is to kill or be killed. Developed by a University of Pennsylvania professor, this algorithm has been tested in Baltimore, Philadelphia and Washington DC. Such probabilistic information can then influence sentencing recommendations and bail amounts, so it’s hardly trivial.
Los Angeles police arrest a man. The force is using predictive software to direct its patrols. Photograph: Robert Nickelsberg/Getty Images

But how do we know that the algorithms used for prediction do not reflect the biases of their authors? For example, crime tends to happen in poor and racially diverse areas. Might algorithms – with their presumed objectivity – sanction even greater racial profiling? In most democratic regimes today, police need probable cause – some evidence and not just guesswork – to stop people in the street and search them. But armed with such software, can the police simply say that the algorithms told them to do it? And if so, how will the algorithms testify in court? Techno-utopians will probably overlook such questions and focus on the abstract benefits that algorithmic policing has to offer; techno-sceptics, who start with some basic knowledge of the problems, constraints and biases that already pervade modern policing, will likely be more critical.

Legal scholar Andrew Guthrie Ferguson has studied predictive policing in detail. Ferguson cautions against putting too much faith in the algorithms and succumbing to information reductionism. “Predictive algorithms are not magic boxes that divine future crime, but instead probability models of future events based on current environmental vulnerabilities,” he notes.

But why do they work? Ferguson points out that there will be future crime not because there was past crime but because “the environmental vulnerability that encouraged the first crime is still unaddressed”. When the police, having read their gloomy forecast about yet another planned car theft, see an individual carrying a screwdriver in one of the predicted zones, this might provide reasonable suspicion for a stop. But, as Ferguson notes, if the police arrested the gang responsible for prior crimes the day before, but the model does not yet reflect this information, then prediction should be irrelevant, and the police will need some other reasonable ground for stopping the individual. If they do make the stop, then they shouldn’t be able to say in court, “The model told us to.” This, however, may not be obvious to the person they have stopped, who has no familiarity with the software and its algorithms.

Then there’s the problem of under-reported crimes. While most homicides are reported, many rapes and home break-ins are not. Even in the absence of such reports, local police still develop ways of knowing when something odd is happening in their neighbourhoods. Predictive policing, on the other hand, might replace such intuitive knowledge with a naive belief in the comprehensive power of statistics. If only data about reported crimes are used to predict future crimes and guide police work, some types of crime might be left unstudied – and thus unpursued.

What to do about the algorithms then? It is a rare thing to say these days but there is much to learn from the financial sector in this regard. For example, after a couple of disasters caused by algorithmic trading in August 2012, financial authorities in Hong Kong and Australia drafted proposals to establish regular independent audits of the design, development and modification of the computer systems used for algorithmic trading. Thus, just as financial auditors could attest to a company’s balance sheet, algorithmic auditors could verify if its algorithms are in order.

As algorithms are further incorporated into our daily lives – from Google’s Autocomplete to PredPol – it seems prudent to subject them to regular investigations by qualified and ideally public-spirited third parties. One advantage of the auditing solution is that it won’t require the audited companies publicly to disclose their trade secrets, which has been the principal objection – voiced, of course, by software companies – to increasing the transparency of their algorithms.

The police are also finding powerful allies in Silicon Valley. Companies such as Facebook have begun using algorithms and historical data to predict which of their users might commit crimes using their services. Here is how it works: Facebook’s own predictive systems can flag certain users as suspicious by studying certain behavioural cues: the user only writes messages to others under 18; most of the user’s contacts are female; the user is typing keywords like “sex” or “date.” Staffers can then examine each case and report users to the police as necessary. Facebook’s concern with its own brand here is straightforward: no one should think that the platform is harbouring criminals.

In 2011 Facebook began using PhotoDNA, a Microsoft service that allows it to scan every uploaded picture and compare it with child-porn images from the FBI’s National Crime Information Centre. Since then it has expanded its analysis beyond pictures as well. In mid-2012 Reuters reported on how Facebook, armed with its predictive algorithms, apprehended a middle-aged man chatting about sex with a 13-year-old girl, arranging to meet her the day after. The police contacted the teen, took over her computer, and caught the man.

Facebook is at the cutting edge of algorithmic surveillance here: just like police departments that draw on earlier crime statistics, Facebook draws on archives of real chats that preceded real sex assaults. Curiously, Facebook justifies its use of algorithms by claiming that they tend to be less intrusive than humans. “We’ve never wanted to set up an environment where we have employees looking at private communications, so it’s really important that we use technology that has a very low false-positive rate,” Facebook’s chief of security told Reuters.

It’s difficult to question the application of such methods to catching sexual predators who prey on children (not to mention that Facebook may have little choice here, as current US child-protection laws require online platforms used by teens to be vigilant about predators). But should Facebook be allowed to predict any other crimes? After all, it can easily engage in many other kinds of similar police work: detecting potential drug dealers, identifying potential copyright violators (Facebook already prevents its users from sharing links to many file-sharing sites), and, especially in the wake of the 2011 riots in the UK, predicting the next generation of troublemakers. And as such data becomes available, the temptation to use it becomes almost irresistible.

That temptation was on full display following the rampage in a Colorado movie theatre in June 2012, when an isolated gunman went on a killing spree, murdering 12 people. A headline that appeared in the Wall Street Journal soon after the shooting says it all: “Can Data Mining Stop the Killing?” It won’t take long for this question to be answered in the affirmative.

In many respects, internet companies are in a much better position to predict crime than police. Where the latter need a warrant to assess someone’s private data, the likes of Facebook can look up their users’ data whenever they want. From the perspective of police, it might actually be advantageous to have Facebook do all this dirty work, because Facebook’s own investigations don’t have to go through the court system.

While Facebook probably feels too financially secure to turn this into a business – it would rather play up its role as a good citizen – smaller companies might not resist the temptation to make a quick buck. In 2011 TomTom, a Dutch satellite-navigation company that has now licensed some of its almighty technology to Apple, found itself in the middle of a privacy scandal when it emerged that it had been selling GPS driving data collected from customers to the police. Privacy advocate Chris Soghoian has likewise documented the easy-to-use “pay-and-wiretap” interfaces that various internet and mobile companies have established for law enforcement agencies.

Publicly available information is up for grabs too. Thus, police are already studying social-networking sites for signs of unrest, often with the help of private companies. The title of a recent brochure from Accenture urges law enforcement agencies to “tap the power of social media to drive better policing outcomes”. Plenty of companies are eager to help. ECM Universe, a start-up from Virginia, US, touts its system, called Rapid Content Analysis for Law Enforcement, which is described as “a social media surveillance solution providing real-time monitoring of Twitter, Facebook, Google groups, and many other communities where users express themselves freely”.

“The solution,” notes the ECM brochure, “employs text analytics to correlate threatening language to surveillance subjects, and alert investigators of warning signs.” What kind of warning signs? A recent article in the Washington Post notes that ECM Universe helped authorities in Fort Lupton, Colorado, identify a man who was tweeting such menacing things as “kill people” and “burn [expletive] school”. This seems straightforward enough but what if it was just “harm people” or “police suck”?

As companies like ECM Universe accumulate extensive archives of tweets and Facebook updates sent by actual criminals, they will also be able to predict the kinds of non-threatening verbal cues that tend to precede criminal acts. Thus, even tweeting that you don’t like your yoghurt might bring police to your door, especially if someone who tweeted the same thing three years before ended up shooting someone in the face later in the day.

However, unlike Facebook, neither police nor outside companies see the whole picture of what users do on social media platforms: private communications and “silent” actions – clicking links and opening pages – are invisible to them. But Facebook, Twitter, Google and similar companies surely know all of this – so their predictive power is much greater than the police’s. They can even rank users based on how likely they are to commit certain acts.

An apt illustration of how such a system can be abused comes from The Silicon Jungle, ostensibly a work of fiction written by a Google data-mining engineer and published by Princeton University Press – not usually a fiction publisher – in 2010. The novel is set in the data-mining operation of Ubatoo – a search engine that bears a striking resemblance to Google – where a summer intern develops Terrorist-o-Meter, a sort of universal score of terrorism aptitude that the company could assign to all its users. Those unhappy with their scores would, of course, get a chance to correct them – by submitting even more details about themselves. This might seem like a crazy idea but – in perhaps another allusion to Google – Ubatoo’s corporate culture is so obsessed with innovation that its interns are allowed to roam free, so the project goes ahead.

To build Terrorist-o-Meter, the intern takes a list of “interesting” books that indicate a potential interest in subversive activities and looks up the names of the customers who have bought them from one of Ubatoo’s online shops. Then he finds the websites that those customers frequent and uses the URLs to find even more people – and so on until he hits the magic number of 5,000. The intern soon finds himself pursued by both an al-Qaida-like terrorist group that wants those 5,000 names to boost its recruitment campaign, as well as various defence and intelligence agencies that can’t wait to preemptively ship those 5,000 people to Guantánamo.

…

Evgeny Morozov
The Observer, Saturday 9 March 2013 19.20 GMT

Find this story at 9 March 2013

© 2013 Guardian News and Media Limited or its affiliated companies. All rights reserved.

Police software mines social media

Police scan your Facebook comments.Photo / File

Police have developed a specialist software tool which mines social media for information.

The Signal tool was developed for high-profile public events and emergencies and works by scanning public-facing material on social media networks such as Facebook and Twitter.

Police director of intelligence Mark Evans said it was “not typically” used as an evidence gathering or investigative tool although it could be.

Social media use by law enforcement around the world has grown with the International Association of Police Chiefs finding 77 per cent of agencies used it most commonly to investigate crime. The survey of 600 agencies across the United States found it had helped solve crimes.

Mr Evans said the tool was developed as part of preparations for the Rugby World Cup because police “wanted the ability to scan social media comments in and around the stadiums in real time”.

Since then, it had been used for royal visits, Waitangi Day and during the Auckland cyclone. Mr Evans said Signal was not used to crawl random postings. Instead, police would set a geographical area and put in key words.

As an example, he said a large sporting event could see “protest”, “traffic”, “accident” or “delays”.

He said the strength of Signal was its ability to help police “identify and analyse social media feeds relevant to crime and public safety” at a specific time and place.

In doing so, Mr Evans said police were able to judge the impact of an event which had happened or stop a problem escalating. It also helped target people and resources where they were needed, he said.

During the Rugby World Cup, it allowed police to detect a boy racer convoy heading from Auckland to Hamilton.

The drivers “felt they would be able to get away with dangerous behaviour on the roads because they believed police resources would be busy elsewhere”, he said.

…

Signal was developed as part of a $60,000 emergency management tool.

Global police use of social media

53 per cent – Created a fake profile or undercover identity
48 per cent – Posted surveillance video or images
86 per cent – Viewed profiles of suspects
49 per cent – Viewed profiles of victims

Source: IACP Social Media Survey 2012

By David Fisher @@DFisherJourno
5:30 AM Saturday Feb 23, 2013

Find this story at 23 February 2013

© Copyright 2013, APN Holdings NZ Limited

Spam vom Staat

Er gilt als der böseste Deutsche im Internet: Martin Münch liefert Polizei und Geheimdiensten Überwachungs-Software. Auch Diktatoren drangsalieren mit den Programmen ihre Bürger.

Im Disney-Film “Mulan” ist alles so einfach. Die Heldin kämpft zusammen mit lauter Männern im chinesischen Militär gegen die Hunnen. Der Film zeichnet Mulans Gegner als schattige, gesichtslose Wesen. Die feindliche Reiterarmee verdunkelt den Horizont. Gut gegen Böse – ein Klassiker.

Martin Münch lebt in einem Disney-Film. Er weiß, wer die Bösen sind. Er weiß, dass er zu den Guten gehört. Es gibt nur ein Problem: Alle anderen wissen es nicht. Für sie steht Münch auf der falschen Seite des arabischen Frühlings, auf der Seite der Unterdrücker. Menschenrechtler prangern an, er liefere Überwachungssoftware an Diktaturen, willentlich oder leichtfertig.

Münch, 31, entwickelt Spähsoftware für Computer und Handys. Sie infiziert das digitale Gedächtnis, sie schnüffelt in der virtuellen Intimsphäre. Polizei und Geheimdienst können dank ihr sehen, welche Krankheitssymptome der Überwachte im Web googelt. Sie hören, was er mit der Mutter über das Internet-Telefon-Programm Skype bespricht. Sie lesen seinen Einkaufszettel auf dem Smartphone. Der Trojaner, der das alles kann, heißt Finfisher. Trojaner wird diese Art Software genannt, weil die Spionagefunktionen eingeschmuggelt werden in einer harmlosen Hülle.
Bild vergrößern

Martin Münchs Firma Gamma entwickelt den Trojaner Finfisher. (Foto: Robert Haas)

Seit kurzem testet auch das Bundeskriminalamt, ob Finfisher als Bundestrojaner taugt. Auf sein Produkt ist Münch stolz. Zum ersten Mal zeigte er jetzt deutschen Journalisten, dem NDR und der Süddeutschen Zeitung, wie Finfisher funktioniert. Bisher durften Medien nicht in die Entwicklerbüros in Obersendling in München.

Auf den Glastüren steht der Firmenname: Gamma Group. Ein Dutzend Mitarbeiter sitzt vor Bildschirmen, die Programmierer gleich vor mehreren. Hinter dem Bürostuhl des Chefs Münch hängt eine Aluminiumplatte mit dem Firmenlogo. Er teilt sich seinen Schreibtisch mit dem Kollegen, der den IT-Notruf betreut. Ihm gegenüber klingelt also das Telefon, wenn irgendwo auf der Welt die Strafverfolgung klemmt. Er ist also sehr nah dran an den Ermittlern, auch sprachlich. “Wenn wir Pädophile verhaften, haben wir ein Problem: Die sperren ihre Rechner automatisch”, sagt Münch, als fahre er bei den Einsätzen mit, und präsentiert schwungvoll die Lösung: einen USB-Stick von Gamma in den PC, und die Daten sind gerichtsfest gesichert.

Münch kann so technisches Spielzeug gut erklären. Vielleicht, weil er sich das alles selbst beigebracht hat. Er hat keine Fachausbildung, er hat nicht Informatik studiert, nur drei Semester Jazzklavier und Gitarre. Er war mit einer Band auf Deutschlandtournee, trat als Bassist einer Casting-Girlband bei “Popstars” auf. Steht er dagegen heute auf der Bühne, zeigt er auf Sicherheitskonferenzen, wie man Rechner infiziert. Für die Ermittler ist Münch ein bisschen wie Mushu, der kleine Drache aus “Mulan”, dem Disney-Film von 1998. Er ist der coole Helfer, der Mulan bei der Armeeausbildung und im Kampf beisteht. Münch hat eine Firma, über die er 15 Prozent der Anteile der Gamma International GmbH hält. Er hat sie Mushun genannt, nach dem Drachen aus dem Film, nur mit einem zusätzlichen “n” am Ende, sagt er. Dann lacht er verlegen. Doch ist er nicht nur Miteigentümer, sondern auch Geschäftsführer bei Gamma.

Mit Medien hat Münch noch nicht viel Erfahrung. Der Süddeutschen Zeitung und dem britischen Guardian liegen Dokumente vor, die zeigen, dass die Gamma-Gruppe eine Firma im Steuerparadies Britische Jungferninseln besitzt. Darauf angesprochen, bestritt Münch vor einigen Wochen erst vehement, dass die Gesellschaft überhaupt existiert. Als der Guardian dann Belege schickte, entschuldigte er sich. Er habe gedacht, dass die Tochter wirklich nicht existiert, schrieb er nach London. Auch nun beantwortet Geschäftsführer Münch Fragen zum Geschäft immer wieder ausweichend. Zahlen, Firmenpartner kenne er nicht. “Ich bin ein kleiner Techniker”, sagt Münch. Die strategischen Entscheidungen in der Firma treffe aber trotzdem er.
Bild vergrößern

So bewirbt der Gamma-Prospekt den Trojaner für Handys namens Finspy Mobile.

Gammas Bestseller aus der Finfisher-Familie heißt Finspy. Münch beugt sich über den Apple-Laptop und zeigt, was das Programm kann. Er steckt das Internetkabel in den Rechner und tippt “mjm” in das Feld für den Benutzernamen, für Martin Johannes Münch. Zuerst wählt der Nutzer das Betriebssystem aus, das er angreifen will: ein iPhone von Apple, ein Handy mit Googles Betriebssystem Android oder einen PC mit Windows oder dem kostenlosen System Linux? Der Ermittler kann eingeben, über wie viele Server in verschiedenen Ländern der Trojaner Haken schlägt, bis auch technisch versierte Opfer nicht mehr nachvollziehen können, wer sie da eigentlich überwacht. Der Trojaner kann ein Sterbedatum bekommen, an dem er sich selbst löscht. Genehmigt ein Richter später eine längere Überwachung, kann das Datum nach hinten geschoben werden.

Dann darf der Ermittler auswählen, wie fies der Trojaner werden soll, was er können darf: das Mikrofon als Wanze benutzen. Gespeicherte Dateien sichten und sichern, wenn sie gelöscht oder geändert werden. Mitlesen, welche Buchstaben der Nutzer auf der Tastatur drückt. Den Bildschirm abfilmen. Skype-Telefonate mitschneiden. Die Kamera des Rechners anschalten und sehen, wo das Gerät steht. Handys über die GPS-Ortungsfunktion zum Peilsender machen. Finspy präsentiert die überwachten Geräte als Liste. Flaggen zeigen, in welchem Land sich das Ziel befindet. Ein Doppelklick, und der Ermittler ist auf dem Rechner.

Der Trojaner ist so mächtig, als würde jemand dem Computernutzer über die Schulter gucken. Deswegen kommen Ermittler so auch Verdächtigen auf die Schliche, die ihre Festplatte mit einem Passwort sichern und nur verschlüsselt kommunizieren. Der Trojaner liest einfach das Passwort mit. Doch die meisten Funktionen von Finspy sind in Deutschland illegal.

Und Finspy kostet. Der Preis geht bei etwa 150.000 Euro los und kann ins siebenstellige gehen, sagt Münch. Denn Gamma baut für jeden Kunden eine eigene Version des Trojaners, die mit dem Recht des Landes konform sein soll. Für jeden überwachten Computer müssen Ermittler eine Lizenz von Gamma kaufen. Die meisten Behörden würden fünf Lizenzen erwerben, sagt Münch, manchmal vielleicht auch zwanzig. “Ziel sind einzelne Straftäter.” Ein “mutmaßlich” benutzt er nicht, im Gespräch verwendet er die Worte “Kriminelle” und “Straftäter”, als seien es Synonyme für “Verdächtige” und “Zielperson”.

Alaa Shehabi ist so eine Zielperson. Ihr Vergehen: Sie kritisierte die Regierung ihres Landes. Die junge Frau ist in Bahrain geboren, einem Inselstaat im Persischen Golf, etwa so groß wie das Stadtgebiet von Hamburg. Ein Königreich – und ein Polizeistaat. Der sunnitische Regent Hamad Ben Isa al-Khalifa herrscht über eine schiitische Bevölkerungsmehrheit. Als der arabische Frühling vor zwei Jahren auch in sein Land schwappte und Shehabi mit Tausend anderen Reformen forderte, rief der König die Armee von Saudi-Arabien zur Hilfe. Fotos und Videos im Internet zeigen geschundene Körper, von Tränengas verätzte Augen und von Schrotkugeln durchlöcherte Leiber. Es sind die Bilder eines blutig niedergeschlagenen Protestes.
Bild vergrößern

Die Polizei greift mit Tränengas an: Bei Protesten starben Demonstranten (Foto: Getty Images)

Die Formel-1-Veranstalter sahen darin kein Problem und luden vergangenen April zum Großen Preis von Manama, einem glitzernden Großereignis mitten in einem gebeutelten Land. König Khalifa wollte zeigen, wie weltoffen Bahrain sei. Die Opposition hingegen versuchte, zumindest einigen angereisten Journalisten die Wahrheit zu berichten. Auch Shehabi, die ihre dunklen Haare unter einem Schleier verbirgt, traf sich mit Reportern. Sie erzählte von der Polizeigewalt, von den Verletzten, den Toten. Sie brach ein Tabu.

Shehabi war vorsichtig, achtete darauf, dass niemand sie beobachtete, schaltete während des Interviews ihr Handy aus. Trotzdem besuchten Polizisten sie wenig später. Sie fragten, was sie den Journalisten erzählt habe, und warnten sie, so etwas nie wieder zu tun. Die Beamten ließen sie laufen, doch dann kam die erste E-Mail. Im Betreff stand “torture report on Nabeel Rajab”, im Anhang angeblich Fotos des gefolterten Rajab. Er ist ein Freund Shehabis, ein Oppositioneller wie sie. Shehabi versuchte, die Datei zu öffnen. Es ging nicht. Gut für sie: Denn im Anhang war ein Trojaner von Gamma versteckt. Shehabis E-Mails sollten mitgelesen, ihre Telefonate abgehört werden. Der Polizeistaat Bahrain hatte sie im Visier, und Martin Münchs Software half dabei. Auch andere Oppositionelle berichten von ominösen E-Mails. Mal lockten sie ihre Opfer damit, dass der König zum Dialog bereit sei, mal mit vermeintlichen Folterfotos.

Selbst im Ausland haben Exil-Bahrainer diesen Regierungs-Spam bekommen. Husain Abdulla etwa, der im US-Bundesstaat Alabama eine Tankstelle betreibt und in Washington Lobbyarbeit für Bahrains Opposition macht. Das Königshaus hat ihm deswegen die Staatsbürgerschaft entzogen, wollte ihn aber trotzdem überwachen und schickte ihm einen Trojaner. Die bahrainische Regierung versuchte also, auf US-Boden einen US-Bürger auszuspähen. Gamma macht’s möglich: “Wenn Finspy Mobile auf einem Handy installiert ist, kann es aus der Ferne überwacht werden, wo auch immer sich das Ziel in der Welt befindet”, heißt es dazu in einem Prospekt.

Die Universität von Toronto in Kanada hat die EMails an Shehabi und Abdulla untersucht. An ihrem Forschungsinstitut Citizen Lab entschlüsselte Morgan Marquis-Boire, Software-Ingenieur bei Google, das Spähprogramm. Er baut einen virtuellen Sandkasten, setzt einen Computer in die Mitte und lässt den Trojaner auf das abgegrenzte Spielfeld. Dann protokolliert Marquis-Boire, wie das Programm den PC kapert, Passwörter kopiert, Skype-Gespräche aufzeichnet, den Bildschirm abfotografiert. Die gesammelten Daten funkt der Trojaner an einen Server in Bahrain. Marquis-Boire entdeckt im Programmcode das Kürzel “finspyv2” – die zweite Version von Finspy. Auch “Martin Muench” steht da. Münch schreibt seinen Namen seit Jahren mit “ue”.
Citizen Lab fand Münchs Namen im Code des Trojaners. (Foto: Citizen Lab)

Schnüffelsoftware für einen Polizeistaat? Auf die Vorwürfe reagiert Gamma merkwürdig. Münch verschickt eine Pressemitteilung, in der steht, dass eine Demoversion für Kunden gestohlen worden sei. Eine klare Aussage zu Bahrain gibt es nicht. Münch sagt nicht, wer Gammas Kunden sind. Er sagt auch nicht, wer nicht Kunde ist. Alles ganz geheim. So muss die Firma damit leben, dass Reporter ohne Grenzen und andere Menschenrechtsaktivisten in dieser Woche eine offizielle Beschwerde beim Bundeswirtschaftsministerium einlegten. Sie verlangen schärfere Kontrollen, wohin Gamma exportiert, und berufen sich dabei auf – allerdings freiwillige – Empfehlungen der Organisation für wirtschaftliche Zusammenarbeit und Entwicklung (OECD). Nimmt das Ministerium die Beschwerde an, könnten als nächster Schritt Gamma und die Aktivisten versuchen, hinter verschlossenen Türen im Ministerium eine Einigung zu finden.

Münch wiederholt bei jeder Gelegenheit, dass seine Firma die Exportgesetze in Deutschland einhält. Das soll vorbildlich wirken, aber in Wirklichkeit werden aus München gar keine Finfisher-Produkte verschickt. Das geschieht von England aus. In Andover, nicht weit von Stonehenge, sitzt die Muttergesellschaft von Gamma International, die Gamma Group. Gründer und neben Münch Mehrheitseigentümer ist Louthean Nelson; die Gruppe beschäftigt 85 Mitarbeiter.

In Großbritannien und Deutschland gilt allerdings dieselbe EU-Verordnung über den Export von Überwachungstechnik. Überwachungstechnologien sind im Sinne dieses Gesetzes keine Waffen, sondern Güter, die sowohl zivil als auch militärisch genutzt werden können. Fachwort: dual use. Dementsprechend sind die Auflagen deutlich harmloser als für Panzerverkäufe. Am Ende läuft es darauf hinaus, dass Gamma vom Kunden ein Zertifikat bekommt, demzufolge Finfisher wirklich beim richtigen Adressaten installiert wurde, gestempelt vom Staat selbst. Das Papier heftet Gamma ab. Wie oft und genau das Bundesamt für Ausfuhrkontrolle Gamma prüft, wollen weder Münch noch das dafür zuständige Bundeswirtschaftsministerium sagen.

Wie viele Diktaturen Gamma-Kunden sind, ist nicht bekannt. Das Institut Citizen Lab aus Toronto hat in vielen Ländern Server mit Spuren von Finfisher gefunden. Brunei, Äthiopien, Turkmenistan, die Vereinigten Arabischen Emirate – klingt wie das Kellerduell im Demokratie-Ranking. Doch auch in Staaten wie Tschechien und den Niederlanden fanden die Informatiker Gamma-Server. All diese Länder müssen aber nicht Kunden sein. Jeder Geheimdienst könne schließlich die Daten seines Finfisher-Trojaners durch diese Staaten umleiten, um sich zu tarnen, erklärt Münch. Solche Aussagen können Externe technisch nicht überprüfen.

In der ungeliebten Öffentlichkeit steht Gamma seit dem arabischen Frühling. Ägyptische Protestler fanden in einer Behörde ein Angebot der Firma an ihre gestürzte Regierung, einen Kostenvoranschlag für Software, Hardware, Training, 287.137 Euro. Eine Lieferung habe es nie gegeben, behauptet Münch.

Für Andy Müller-Maguhn ist Gamma trotzdem ein “Software-Waffenlieferant”. Er hat eine Webseite zu dem Thema aufgesetzt mit dem Namen buggedplanet.info. Dort protokolliert er Unternehmensdaten, Presseberichte, verwickelte Personen. Müller-Maguhn war früher Sprecher des Chaos Computer Clubs. Ein Video auf Youtube zeigt, wie er sein Projekt 2011 auf der Jahreskonferenz des deutschen Hackervereins präsentiert. Müller-Maguhn ruft seine Seite über Münch auf; die erscheint auf einer Leinwand, mit Geburtsdatum, Privatadresse und Foto von Münch. Der steigt da gerade aus einer Cessna, mit Sonnenbrille und Fliegerjacke, und sieht ein bisschen proletenmäßig aus. Müller-Maguhns Zuschauer lachen.

Seine Webseite ist auch ein Pranger. “Dass ihre privaten Details in der Öffentlichkeit diskutiert wurden, halte ich für sehr fair, wenn man sich anschaut, was die mit den Leben anderer gemacht haben”, sagt Müller-Maguhn auf der Bühne. “Ich glaube, das ist ein Weg, damit die Leute über Privatsphäre nachdenken.” Applaus und Jubel sind kurz lauter als seine Stimme. Er zuckt mit den Schultern. “Sie wollten nicht am öffentlichen Diskurs teilnehmen. Das wäre vielleicht die Alternative.”

Seit seine Adresse bekannt ist, bekommt Münch Postkarten, auf denen nur steht: “Ich habe ein Recht auf Privatsphäre.” Kein Absender.

Spricht Münch über seine Kritiker, klingt er ehrlich entrüstet: “Wir haben immer dieses Bad-Boy-Image. Ist aber kein schönes Gefühl.” Zumal es unverdient sei: “Manche Leute sagen: ,Das mag ich nicht, das geht ins Privatleben.’ Aber die Tatsache, dass sie es nicht mögen, heißt nicht, dass wir etwas Illegales machen.” Er selbst finde zum Beispiel die Fernsehsendung Deutschland sucht den Superstar “scheiße”, aber deswegen sei die nicht illegal.

…

Quelle: SZ vom 09.02.2013/bbr

9. Februar 2013 10:46 Finfisher-Entwickler Gamma
Von Bastian Brinkmann, Jasmin Klofta und Frederik Obermaier

Find this story at 9 February 2013

Copyright: Süddeutsche Zeitung Digitale Medien GmbH / Süddeutsche Zeitung GmbH

Software that tracks people on social media created by defence firm

Exclusive: Raytheon’s Riot program mines social network data like a ‘Google for spies’, drawing ire from civil rights groups

A multinational security firm has secretly developed software capable of tracking people’s movements and predicting future behaviour by mining data from social networking websites.

A video obtained by the Guardian reveals how an “extreme-scale analytics” system created by Raytheon, the world’s fifth largest defence contractor, can gather vast amounts of information about people from websites including Facebook, Twitter and Foursquare.

Raytheon says it has not sold the software – named Riot, or Rapid Information Overlay Technology – to any clients.

But the Massachusetts-based company has acknowledged the technology was shared with US government and industry as part of a joint research and development effort, in 2010, to help build a national security system capable of analysing “trillions of entities” from cyberspace.

The power of Riot to harness popular websites for surveillance offers a rare insight into controversial techniques that have attracted interest from intelligence and national security agencies, at the same time prompting civil liberties and online privacy concerns.

The sophisticated technology demonstrates how the same social networks that helped propel the Arab Spring revolutions can be transformed into a “Google for spies” and tapped as a means of monitoring and control.

Using Riot it is possible to gain an entire snapshot of a person’s life – their friends, the places they visit charted on a map – in little more than a few clicks of a button.

In the video obtained by the Guardian, it is explained by Raytheon’s “principal investigator” Brian Urch that photographs users post on social networks sometimes contain latitude and longitude details – automatically embedded by smartphones within “exif header data.”

Riot pulls out this information, showing not only the photographs posted onto social networks by individuals, but also the location at which the photographs were taken.

“We’re going to track one of our own employees,” Urch says in the video, before bringing up pictures of “Nick,” a Raytheon staff member used as an example target. With information gathered from social networks, Riot quickly reveals Nick frequently visits Washington Nationals Park, where on one occasion he snapped a photograph of himself posing with a blonde haired woman.

“We know where Nick’s going, we know what Nick looks like,” Urch explains, “now we want to try to predict where he may be in the future.”

Riot can display on a spider diagram the associations and relationships between individuals online by looking at who they have communicated with over Twitter. It can also mine data from Facebook and sift GPS location information from Foursquare, a mobile phone app used by more than 25 million people to alert friends of their whereabouts. The Foursquare data can be used to display, in graph form, the top 10 places visited by tracked individuals and the times at which they visited them.

The video shows that Nick, who posts his location regularly on Foursquare, visits a gym frequently at 6am early each week. Urch quips: “So if you ever did want to try to get hold of Nick, or maybe get hold of his laptop, you might want to visit the gym at 6am on a Monday.”

Mining from public websites for law enforcement is considered legal in most countries. In February last year, for instance, the FBI requested help to develop a social-media mining application for monitoring “bad actors or groups”.

However, Ginger McCall, an attorney at the Washington-based Electronic Privacy Information Centre, said the Raytheon technology raised concerns about how troves of user data could be covertly collected without oversight or regulation.

“Social networking sites are often not transparent about what information is shared and how it is shared,” McCall said. “Users may be posting information that they believe will be viewed only by their friends, but instead, it is being viewed by government officials or pulled in by data collection services like the Riot search.”

Raytheon, which made sales worth an estimated $25bn (£16bn) in 2012, did not want its Riot demonstration video to be revealed on the grounds that it says it shows a “proof of concept” product that has not been sold to any clients.

Jared Adams, a spokesman for Raytheon’s intelligence and information systems department, said in an email: “Riot is a big data analytics system design we are working on with industry, national labs and commercial partners to help turn massive amounts of data into useable information to help meet our nation’s rapidly changing security needs.

…

Ryan Gallagher
The Guardian, Sunday 10 February 2013 15.20 GMT

Find this story at 10 February 2013

© 2013 Guardian News and Media Limited or its affiliated companies. All rights reserved.

Raytheon’s “Riot” Social-Network Data Mining Software

A video touting software created by Raytheon to mine data from social networks has been attracting an increasing amount of attention in the past few days, since it was uncovered by Ryan Gallagher at the Guardian.

As best as I can tell from the video and Gallagher’s reporting, Raytheon’s “Riot” software gathers up only publicly available information from companies like Facebook, Twitter, and Foursquare. In that respect, it appears to be a conceptually unremarkable, fairly unimaginative piece of work. At the same time, by aspiring to carry out “large-scale analytics” on Americans’ social networking data—and to do so, apparently, on behalf of national security and law enforcement agencies—the project raises a number of red flags.

In the video, we see a demonstration of how social networking data—such as Foursquare checkins—is used to predict the schedule of a sample subject, “Nick.” The host of the video concludes,

Six a.m. appears to be the most frequently visited time at the gym. So if you ever did want to try to get ahold of Nick—or maybe get ahold of his laptop—you might want to visit the gym at 6:00 a.m. on Monday.

(The reference to the laptop is certainly jarring. Remember, this is an application apparently targeted at law enforcement and national security agencies, not at ordinary individuals. Given this, it sounds to me like the video is suggesting that Riot could be used as a way to schedule a black-bag job to plant spyware on someone’s laptop.)

At the end of the video, there’s also a brief visual showing how Riot can use such data to carry out a link analysis of a subject. In link analysis, people’s communications and other connections to each other are mapped out and analyzed. It first came to the attention of many people in and out of government via an influential 2002 slide presentation by data mining expert Jeff Jonas showing how the 9/11 hijackers might have easily been linked together had the government focused on the two who were already wanted by the authorities. As Jonas later emphasized in the face of attempts to make too much of this:

Both Nawaf Alhamzi and Khalid Al-Midhar were already known to the US government to be very bad men. They should have never been let into the US, yet they were living in the US and were hiding in plain sight—using their real names…. The whole point of my 9/11 analysis was that the government did not need mounds of data, did not need new technology, and in fact did not need any new laws to unravel this event!

Nevertheless, link analysis appears to have been wholeheartedly embraced by the national security establishment, especially the NSA, and to be justifying unconstitutionally large amounts of data collection on innocent people.

We don’t know that Raytheon’s software will ever play any such role—it just appears to aspire to do so. As with any tool, everything depends on how it’s used. But the fact is, we’re living in an age where disparate pieces of information about us are being aggressively mined and aggregated to discover new things about us. When we post something online, it’s all too natural to feel as though our audience is just our friends—even when we know intellectually that it’s really the whole world. Various institutions are gleefully exploiting that gap between our felt and actual audiences (a gap that is all too often worsened by online companies that don’t make it clear enough to their users who the full audience for their information is). Individuals need to be aware of this and take steps to compensate, such as double-checking their privacy settings and being aware of the full ramifications of data that they post.

At the same time, the government has no business rooting around people’s social network postings—even those that are voluntarily publicly posted—unless it has specific, individualized suspicion that a person is involved in wrongdoing. Among the many problems with government “large-scale analytics” of social network information is the prospect that government agencies will blunderingly use these techniques to tag, target and watchlist people coughed up by programs such as Riot, or to target them for further invasions of privacy based on incorrect inferences. The chilling effects of such activities, while perhaps gradual, would be tremendous.

Finally, let me just make the same point we’ve made with regards to privacy-invading technologies such as drones and cellphone and GPS tracking: these kinds of tools should be developed transparently. We don’t really know what Riot can do. And while we at the ACLU don’t think the government should be rummaging around individuals’ social network data without good reason, even a person who might disagree with us on that question could agree that it’s a question that should not be decided in secret. The balance between the intrusive potential of new technologies and government power is one that should be decided openly and democratically.

By Jay Stanley, Senior Policy Analyst, ACLU Speech, Privacy and Technology Project at 2:08pm

Find this story at 12 February 2013

© ACLU

‘Google for spies’ software mines social networks to track users’ movements and could even predict what you’ll do next

Raytheon’s Riot software sifts through data from suspects’ online accounts
Critics say it will be used for monitoring citizens’ online lives
Similar to Geotime software bought by London’s Met police two years ago

New software which mines data from social networks to track people’s movements and even predict future behaviour poses a ‘very real threat to personal freedom’, civil rights groups warned today.

Multinational defence contractor Raytheon has developed the ‘extreme-scale analytics’ software which can sift through vast quantities of data from services like Facebook, Twitter and Google.

Critics have already dubbed it a ‘Google for spies’ and say it is likely to be used by governments as a means of monitoring and tracking people online to detect signs of dissent.

‘Google for spies’: A screengrab of a video demonstrating Raytheon’s Riot software, which mines the personal data from social networking websites to track people’s movements and even predict their future behaviour

Raytheon claims it has not yet sold the software – known as Rapid Information Overlay Technology, or Riot – to any clients but admitted it had shared the technology with the U.S. government in 2010.

However, it is similar to another social tracking software known as Geotime which the U.S. military already uses and was in recent years purchased for trials by London’s Metropolitan Police.

Such tools are likely to form the backbone of future surveillance systems which will exploit the information we share online to automatically monitor citizens’ behaviour.

Val Swain, from the Network for Police Monitoring, told MailOnline that police had already publicly indicated they want to use ‘advanced analytical software’ to keep tabs on social media.

‘The HMIC report ‘rules of engagement’ on the policing of the riots included a recommendation for the development of a ‘data-mining engine’ to scan across publicly available social media,’ she said.

‘Technologically advanced methods now exist that make this possible.

‘This [kind of] software is extremely powerful, able to identify and monitor people who are ‘of interest to the police”, even if they have committed no criminal activity.

‘The software identifies ‘people, organisations and concepts’ and even sentiments, as the software is able to automatically pick up on ‘emotional states’.

‘It was also recommended that this software be used as part of a vast “intelligence hub” to be developed by the new National Crime Agency.’

There’s nowhere to hide: The software aggregates data from suspects’ social media profiles to build a detailed picture of their movements, their current whereabouts and where they are likely to go next

A restricted video put together by Raytheon as a ‘proof of concept’ demonstration to potential buyers was obtained by British daily the Guardian and published on its website today.

It shows an executive for the security firm, Brian Urch, explaining how photos posted on social media from smartphones frequently contain metadata revealing the precise location where they were taken.

As an example, Mr Urch demonstrates how this information can be used to track a Raytheon worker called ‘Nick’, whose social media profiles reveal he frequently visits Washington National Park.

Nick is pictured on one occasion posing with a blonde woman, revealing to any agency using Riot what he looks like.

‘Now we want to predict where he may be in the future,’ Mr Urch said. He demonstrates how Riot can display a diagram of the relationships between individuals online by looking at their Twitter communications.

We know your friends: As an example, the video shows how a Raytheon worker called Nick can be tracked. This is an image he posted onto a social network, which can be analysed to reveal the location it was taken

The software is also able to mine information from Facebook and track GPS location data from Foursquare, which over 25million people use on their smartphones to share their whereabouts with friends.

This Foursquare data can be analysed to show the top 10 locations visited by individuals using the service, and also at what times they went there.

Nick, for example, frequently checks into Foursquare at a particular gym at 6am.

‘So if you ever did want to try to get hold of Nick, or maybe get hold of his laptop, you might want to visit the gym at 6am on a Monday,’ says Mr Urch.

Riot’s features are similar to that of Geotime, which MailOnline revealed two years ago had been bought by the Met Police.

Geotime aggregates information gathered from social networking sites, GPS devices like the iPhone, mobile phones, financial transactions and IP network logs to build a detailed picture of an individual’s movements.

The Met, Britain’s largest police force, confirmed at the time that it had purchased the software and refused to rule out its use in investigating public order disturbances.

Open book: This pie chart reveals the top 10 places that Nick has visited, as harvested from his Foursquare account

How to find Nick: This graphic breaks down the details of the times and dates that Nick has visited the gym

The effectiveness of both Riot and Geotime would be multiplied by plans by the UK government to install ‘black box’ spy devices on Britain’s internet and mobile infrastructure to track all communications traffic.

Those plans, part of the Data Communications Bill, have been stalled by opposition from some Liberal Democrats, but an influential committee of MPs last week revealed that British spy agencies were keen for them to go ahead.

The spy network would rely on a technology known as Deep Packet Inspection to log data from communications ranging from online services like Facebook and Twitter, Skype calls with family members and visits to pornographic websites.

The government argues that swift access to communications data is critical to the fight against terrorism, paedophilia and other high-level crime, but it has been delayed after the Liberal Democrats dropped support for the bill.

Already in use: Two years ago London’s Metropolitan Police confirmed it had purchased Geotime, another program with similar online tracking functions to that of Raytheon’s Riot software

If it were to go ahead, such a spy network would offer a wealth of easily accessible data for software such as Riot and Geotime to work with.
HOW RIOT COULD BE PART OF THE GOVERNMENT’S SPYING PLANS

Social media tracking software like Riot and Geotime could have their effectiveness multiplied by plans to install ‘black box’ surveillance devices across the UK’s internet and mobile communications infrastructure.

At the moment spy agencies rely on communications providers willingly revealing personal information from users’ accounts to investigate suspects’ communications.

But a report by an influential committee of MPs has revealed such agencies are keen to implement a nationwide surveillance regime that would give them automatic access to the data.

The network will rely on a technology known as Deep Packet Inspection to log data from communications ranging from online services like Facebook and Twitter, to Skype calls with family members and visits to pornographic websites.

Authorities say swift access to communications is critical to the fight against terrorism and other high-level crime, but civil liberties have reacted with outrage, saying that the technology will give the government a greater surveillance capability than has ever been seen before.

MI5 chief Jonathan Evans told the committee: ‘Access to communications data of one sort or another is very important indeed. It’s part of the backbone of the way in which we would approach investigations.

‘I think I would be accurate in saying there are no significant investigations that we undertake across the service that don’t use communications data because of its ability to tell you the who and the when and the where of your target’s activities.’

A key part of security agencies’ plans is a ‘filter’ which would make the data collected easily searchable – a function that could be carried out by software like Riot.

Jim Killock, executive director of the Open Rights Group, explained that this would work as a kind of search engine for everyone’s private data, linking it together from the various online and telecoms accounts people use to communicate.

‘This would put data from your mobile phone, email, web history and phones together, so the police can tell who your friends are, what your opinions are, where you’ve been and with who,’ he said.

‘It could make instant surveillance of everything you do possible at the click of a button.’

Either program could form the backbone of the government’s planned ‘filter’, a kind of search engine for personal data described by the report from Parliament’s Intelligence and Security Committee published last week.

Jim Killock, executive director of the Open Rights Group, which campaigns for freedom online, explained: ‘This would put data from your mobile phone, email, web history and phones together, so the police can tell who your friends are, what your opinions are, where you’ve been and with who.

‘It could make instant surveillance of everything you do possible at the click of a button.’

Ms Swain revealed that Raytheon is just one company which is developing this kind of software for sale to governments and domestic spy agencies.

‘IBM are also marketing analytic software which has this functionality, and there are a number of others,’ she said.

‘It is being used by companies who want to identify, understand and influence existing and potential customers, and it is extremely expensive.

‘The police will use this, not just to investigate crime, but to identify and stop crime and disorder, even before it happens.

‘Some may consider that a good thing – but the level of social control involved poses a very real threat to individual freedom.

‘The software will inevitably be used to monitor political dissent and activity, as well as crime and disorder. Surveillance already exercises a ‘chilling effect’ over basic freedoms – this can only make things a great deal worse.’

Her sentiments were echoed by Nick Pickles, director of privacy and civil liberties campaign group Big Brother Watch.

He said: ‘Privacy as we know it is being slowly eroded and it’s not just our friends that are looking at what we share.

‘A wide range of companies are trying to develop tools that capture data online and analyse it in difference ways, exploiting the growing amount of information we share online and the wider opportunities to track us.

‘If the only barrier is the amount of computing power at your disposal, clearly Governments have the potential to use these tools to profile and analyse their populations in ways never before possible.

‘This kind of tool joins the dots of our online lives, exploiting data for whatever purpose the user wants.

‘The best way to protect yourself is to control the data you share, but Governments around the world need to be clear with their citizens how they are using these kinds of tools and if they are trying to search for criminals before they have committed a crime.’

…

By Damien Gayle

PUBLISHED: 10:19 GMT, 11 February 2013 | UPDATED: 12:13 GMT, 11 February 2013

Find this story at 11 February 2013

© Associated Newspapers Ltd

AIVD: we lezen niet elke e-mail

De Algemene Inlichtingen- en Veiligheidsdienst (AIVD) leest niet elke e-mail die wordt verstuurd, ook al is dit een hardnekkige mythe die blijft bestaan, zo liet de dienst onlangs weten. Toch wordt mogelijk dit jaar de wet aangepast waardoor de AIVD meer bevoegdheden krijgt om internetverkeer te onderscheppen.

Tijdens de NCSC Conferentie in Den Haag sprak Sebastian Reyn van de AIVD over de rol die de inlichtingendiensten op internet spelen en welke risico’s Nederland bedreigen. Dit om meer inzicht in de werking van de diensten te geven en waar die zich mee bezighouden, voor zover het grote publiek dit mag weten.

“Ik kan jullie niets over onze bronnen, werkwijze en huidige informatiepositie vertellen. Dit vereist geen verdere uitleg”, liet Reyn de zaal weten. Hij begon met het ontzenuwen van populaire mythes, zoals de mythe dat de AIVD al het e-mailverkeer zou afluisteren. “Dat is niet het geval.”

Dreigingen
“Het is belangrijk dat burgers begrijpen wat we doen en waarom wat we doen van belang is voor hun veiligheid.” Volgens Reyn zijn cybercrime en cyberspionage in dat licht twee van de grootste dreigingen voor de nationale veiligheid. “Er is geen twijfel dat cyberspionage, samen met cybercrime, de grootste dreiging is waar we in het cyberdomein mee te maken hebben.”

Vanwege de omvang van de dreiging is het belangrijk dat partijen samenwerken. “Deze dreiging is te groot om alleen aan te pakken.” Daarin spelen ook internetgebruikers een rol. Volgens Reyn gedragen veel mensen zich nog altijd op onveilige wijzen en zijn zich niet van de risico’s bewust. Zo wordt software niet gepatcht, worden wachtwoorden nauwelijks gewijzigd en laat men overal persoonlijke informatie op het web slingeren.

Voorbeelden hiervan verschijnen dagelijks in de media. Het probleem met cyberspionage is dat het onzichtbaar is. “Het is een feit dat buitenlandse inlichtingendiensten op geheime wijze toegang tot belangrijke informatiesystemen proberen te krijgen.” Veel van deze aanvallen worden door bestaande beveiligingssystemen nauwelijks gedetecteerd.

E-mail
“We zijn niet geinteresseerd in elke e-mail of verstuurd sms-bericht, of elk cyberincident. Onze focus ligt bij dreigingen voor de nationale veiligheid.” Cyberspionage en cybercrime ziet de AIVD als serieuze dreigingen, dat geldt echter niet voor cyberterrorisme. Cyberterroristen vormen nog geen grote bedreiging voor de nationale veiligheid, aldus Reyn. “De mogelijkheden die cyberterroristen hebben zijn op dit moment beperkt.”

Terroristen zouden dan ook nog niet bij grote cyberaanvallen betrokken of hiervoor verantwoordelijk zijn geweest. Ook voor hacktivisten is Reyn niet bang. Hij vergeleek ze met het digitale equivalent van demonstrerende mensen.

De grootste dreiging komt dan ook van andere staten. Reyn stelt dat in veel landen het de juridische taak van de overheid is om andere landen te bespioneren om hun eigen positie in de wereld te versterken. “Elke dag proberen duizenden mensen die voor legio inlichtingendiensten werken toegang tot de informatie van andere landen te krijgen. En je kunt ervan uitgaan dat een aantal in Nederland is geinteresseerd.”

En Nederland is voor deze landen een interessant doelwit op zowel economisch, technologisch als wetenschappelijk gebied. Volgens Reyn is er nog een te groot vertrouwen in de veiligheid van ICT-systemen.

Spionage
Cyberspionage is voor veel landen aantrekkelijk, ging Reyn verder. “Het is een goedkope manier om in korte tijd een grote hoeveelheid data te verzamelen en is voor een groot aantal doelen te gebruiken. Daarnaast is het risico op detectie klein en is ‘attributie’ lastig.” Het is bijna onmogelijk voor aangevallen landen om te bewijzen wie de dader is. “Landen zoeken bewust naar lekken in software en systemen”, stelt Reyn.

Volgens Reyn worden soms agenten gebruikt die USB-sticks op systemen aansluiten die niet op het internet zijn aangesloten. Daarnaast worden ook bekendere tactieken toegepast. “We zien vaak valse e-mails met verborgen malware.” Om ervoor dat te zorgen dat het slachtoffer deze e-mails ook opent, gebruiken staten klassieke spionagetactieken. “Ze zoeken naar menselijke kwetsbaarheden.”

Aftappen
Aan het eind van de lezing stelde Simone Halink van digitale burgerrechtenbeweging Bits of Freedom nog een vraag over de transparantie en openheid die de AIVD wil uitdragen, terwijl de bevoegdheden waaronder de dienst opereert mogelijk verder worden uitgebreid. Daardoor kan de dienst wel elke e-mail onderscheppen, zowel van Nederlandse als buitenlandse internetgebruikers.

Nederlandse veiligheidsdiensten hebben op dit moment de bevoegdheid om “ongericht” communicatie te onderscheppen. Ze mogen onder bepaalde voorwaarden de recorder aanzetten. Het gaat dan om “ongericht ontvangen en opnemen van niet-kabelgebonden telecommunicatie”.

Op dit moment is er een wijzigingsvoorstel voor de Wet op de Inlichtingen- en Veiligheidsdiensten (Wiv) in de maak, waardoor die bevoegdheid wordt uitgebreid naar het aftappen van communicatie via kabels.

“De wet is in 2002 gemaakt en sindsdien heeft de technologie zich verder ontwikkeld. De meeste communicatie verloopt tegenwoordig via de kabel. Het is belangrijk dat de wet de spelregels beschrijft waar de inlichtingendiensten aan moeten voldoen, maar dat de wet zelf niet afhankelijk van technologie is”, aldus Reyn.

…

Vrijdag,11:38 doorRedactie

Find this story at 01 February 2013

© 2001-2013 Security.nl – The Security Council

Random afluisteren in India

In het voorjaar van 2010 was India een paar weken in de ban van een afluisterschandaal, maar vervolgens verdween dat in de vergetelheid. Dit is opmerkelijk gezien de staat van dienst van de inlichtingenwereld in India. Schandalen die gewone Indiërs raken, maar ook corruptie, slecht management, verkeerde technologie en apparatuur en bovenal incompetentie lijken de boventoon te voeren bij de NTRO, die verantwoordelijk wordt gehouden voor het schandaal. NTRO, National Technical Research Organisation, gebruikt IMSI Catchers om voor lange tijd en op grote schaal politici, ambtenaren, zakenmensen, beroemdheden en gewone Indiërs af te luisteren.

Find this story at 20 April 2011

 

Israeli security ‘read’ tourists’ private emails

How would you feel if when you arrived at your holiday destination, security staff demanded to read your personal emails and look at your Facebook account?

Israel’s attorney general has been asked to look into claims that security officials have been doing just that – threatening to refuse entry to the country unless such private information is divulged by some tourists. Keith Wallace reports.

Find this story at 31 July 2012

Get in touch with Fast Track via email or Facebook. And follow us on Pinterest.

Watch Fast Track on the BBC World News channel on Saturdays at 04:30, 13:30 and 19:30 GMT or Sundays at 06:30 GMT.