Skip to main content

Home/ Socialism and the End of the American Dream/ Group items tagged coded

Rss Feed Group items tagged

Filter: All | Bookmarks | Topics Simple Middle
Paul Merrell

Google Chrome Listening In To Your Room Shows The Importance Of Privacy Defense In Depth - 0 views

www.privateinternetaccess.com/...ce-of-privacy-defense-in-depth

surveillance state Google-Chrome Chromium audio-surveillance digital-surveillance

shared by Paul Merrell on 23 Jun 15 - No Cached
  • Yesterday, news broke that Google has been stealth downloading audio listeners onto every computer that runs Chrome, and transmits audio data back to Google. Effectively, this means that Google had taken itself the right to listen to every conversation in every room that runs Chrome somewhere, without any kind of consent from the people eavesdropped on. In official statements, Google shrugged off the practice with what amounts to “we can do that”.It looked like just another bug report. "When I start Chromium, it downloads something." Followed by strange status information that notably included the lines "Microphone: Yes" and "Audio Capture Allowed: Yes".
  • Without consent, Google’s code had downloaded a black box of code that – according to itself – had turned on the microphone and was actively listening to your room.A brief explanation of the Open-source / Free-software philosophy is needed here. When you’re installing a version of GNU/Linux like Debian or Ubuntu onto a fresh computer, thousands of really smart people have analyzed every line of human-readable source code before that operating system was built into computer-executable binary code, to make it common and open knowledge what the machine actually does instead of trusting corporate statements on what it’s supposed to be doing. Therefore, you don’t install black boxes onto a Debian or Ubuntu system; you use software repositories that have gone through this source-code audit-then-build process. Maintainers of operating systems like Debian and Ubuntu use many so-called “upstreams” of source code to build the final product.Chromium, the open-source version of Google Chrome, had abused its position as trusted upstream to insert lines of source code that bypassed this audit-then-build process, and which downloaded and installed a black box of unverifiable executable code directly onto computers, essentially rendering them compromised. We don’t know and can’t know what this black box does. But we see reports that the microphone has been activated, and that Chromium considers audio capture permitted.
  • This was supposedly to enable the “Ok, Google” behavior – that when you say certain words, a search function is activated. Certainly a useful feature. Certainly something that enables eavesdropping of every conversation in the entire room, too.Obviously, your own computer isn’t the one to analyze the actual search command. Google’s servers do. Which means that your computer had been stealth configured to send what was being said in your room to somebody else, to a private company in another country, without your consent or knowledge, an audio transmission triggered by… an unknown and unverifiable set of conditions.Google had two responses to this. The first was to introduce a practically-undocumented switch to opt out of this behavior, which is not a fix: the default install will still wiretap your room without your consent, unless you opt out, and more importantly, know that you need to opt out, which is nowhere a reasonable requirement. But the second was more of an official statement following technical discussions on Hacker News and other places. That official statement amounted to three parts (paraphrased, of course):
  • ...4 more annotations...
  • 1) Yes, we’re downloading and installing a wiretapping black-box to your computer. But we’re not actually activating it. We did take advantage of our position as trusted upstream to stealth-insert code into open-source software that installed this black box onto millions of computers, but we would never abuse the same trust in the same way to insert code that activates the eavesdropping-blackbox we already downloaded and installed onto your computer without your consent or knowledge. You can look at the code as it looks right now to see that the code doesn’t do this right now.2) Yes, Chromium is bypassing the entire source code auditing process by downloading a pre-built black box onto people’s computers. But that’s not something we care about, really. We’re concerned with building Google Chrome, the product from Google. As part of that, we provide the source code for others to package if they like. Anybody who uses our code for their own purpose takes responsibility for it. When this happens in a Debian installation, it is not Google Chrome’s behavior, this is Debian Chromium’s behavior. It’s Debian’s responsibility entirely.3) Yes, we deliberately hid this listening module from the users, but that’s because we consider this behavior to be part of the basic Google Chrome experience. We don’t want to show all modules that we install ourselves.
  • If you think this is an excusable and responsible statement, raise your hand now.Now, it should be noted that this was Chromium, the open-source version of Chrome. If somebody downloads the Google product Google Chrome, as in the prepackaged binary, you don’t even get a theoretical choice. You’re already downloading a black box from a vendor. In Google Chrome, this is all included from the start.This episode highlights the need for hard, not soft, switches to all devices – webcams, microphones – that can be used for surveillance. A software on/off switch for a webcam is no longer enough, a hard shield in front of the lens is required. A software on/off switch for a microphone is no longer enough, a physical switch that breaks its electrical connection is required. That’s how you defend against this in depth.
  • Of course, people were quick to downplay the alarm. “It only listens when you say ‘Ok, Google’.” (Ok, so how does it know to start listening just before I’m about to say ‘Ok, Google?’) “It’s no big deal.” (A company stealth installs an audio listener that listens to every room in the world it can, and transmits audio data to the mothership when it encounters an unknown, possibly individually tailored, list of keywords – and it’s no big deal!?) “You can opt out. It’s in the Terms of Service.” (No. Just no. This is not something that is the slightest amount of permissible just because it’s hidden in legalese.) “It’s opt-in. It won’t really listen unless you check that box.” (Perhaps. We don’t know, Google just downloaded a black box onto my computer. And it may not be the same black box as was downloaded onto yours. )Early last decade, privacy activists practically yelled and screamed that the NSA’s taps of various points of the Internet and telecom networks had the technical potential for enormous abuse against privacy. Everybody else dismissed those points as basically tinfoilhattery – until the Snowden files came out, and it was revealed that precisely everybody involved had abused their technical capability for invasion of privacy as far as was possible.Perhaps it would be wise to not repeat that exact mistake. Nobody, and I really mean nobody, is to be trusted with a technical capability to listen to every room in the world, with listening profiles customizable at the identified-individual level, on the mere basis of “trust us”.
  • Privacy remains your own responsibility.
  • Paul Merrell on 23 Jun 15
     
    And of course, Google would never succumb to a subpoena requiring it to turn over the audio stream to the NSA. The Tor Browser just keeps looking better and better. https://www.torproject.org/projects/torbrowser.html.en
Paul Merrell

FBI Admits It Controlled Tor Servers Behind Mass Malware Attack | Threat Level | Wired.com - 0 views

www.wired.com/...freedom-hosting-fbi

surveillance state FBI Tor NSA

shared by Paul Merrell on 05 Oct 13 - No Cached
  • It wasn’t ever seriously in doubt, but the FBI yesterday acknowledged that it secretly took control of Freedom Hosting last July, days before the servers of the largest provider of ultra-anonymous hosting were found to be serving custom malware designed to identify visitors. Freedom Hosting’s operator, Eric Eoin Marques, had rented the servers from an unnamed commercial hosting provider in France, and paid for them from a bank account in Las Vegas. It’s not clear how the FBI took over the servers in late July, but the bureau was temporarily thwarted when Marques somehow regained access and changed the passwords, briefly locking out the FBI until it gained back control. The new details emerged in local press reports from a Thursday bail hearing in Dublin, Ireland, where Marques, 28, is fighting extradition to America on charges that Freedom Hosting facilitated child pornography on a massive scale. He was denied bail today for the second time since his arrest in July. Freedom Hosting was a provider of turnkey “Tor hidden service” sites — special sites, with addresses ending in .onion, that hide their geographic location behind layers of routing, and can be reached only over the Tor anonymity network. Tor hidden services are used by sites that need to evade surveillance or protect users’ privacy to an extraordinary degree – including human rights groups and journalists. But they also appeal to serious criminal elements, child-pornography traders among them.
  • On August 4, all the sites hosted by Freedom Hosting — some with no connection to child porn — began serving an error message with hidden code embedded in the page. Security researchers dissected the code and found it exploited a security hole in Firefox to identify users of the Tor Browser Bundle, reporting back to a mysterious server in Northern Virginia. The FBI was the obvious suspect, but declined to comment on the incident. The FBI also didn’t respond to inquiries from WIRED today. But FBI Supervisory Special Agent J. Brooke Donahue was more forthcoming when he appeared in the Irish court yesterday to bolster the case for keeping Marques behind bars, according to local press reports. Among the many arguments Donahue and an Irish police inspector offered was that Marques might reestablish contact with co-conspirators, and further complicate the FBI probe. In addition to the wrestling match over Freedom Hosting’s servers, Marques allegedly dove for his laptop when the police raided him, in an effort to shut it down.
  • The apparent FBI-malware attack was first noticed on August 4, when all of the hidden service sites hosted by Freedom Hosting began displaying a “Down for Maintenance” message. That included at least some lawful websites, such as the secure email provider TorMail. Some visitors looking at the source code of the maintenance page realized that it included a hidden iframe tag that loaded a mysterious clump of Javascript code from a Verizon Business internet address. By midday, the code was being circulated and dissected all over the net. Mozilla confirmed the code exploited a critical memory management vulnerability in Firefox that was publicly reported on June 25, and is fixed in the latest version of the browser. Though many older revisions of Firefox were vulnerable to that bug, the malware only targeted Firefox 17 ESR, the version of Firefox that forms the basis of the Tor Browser Bundle – the easiest, most user-friendly package for using the Tor anonymity network. That made it clear early on that the attack was focused specifically on de-anonymizing Tor users. Tor Browser Bundle users who installed or manually updated after June 26 were safe from the exploit, according to the Tor Project’s security advisory on the hack.
  • ...2 more annotations...
  • Perhaps the strongest evidence that the attack was a law enforcement or intelligence operation was the limited functionality of the malware. The heart of the malicious Javascript was a tiny Windows executable hidden in a variable named “Magneto.” A traditional virus would use that executable to download and install a full-featured backdoor, so the hacker could come in later and steal passwords, enlist the computer in a DDoS botnet, and generally do all the other nasty things that happen to a hacked Windows box. But the Magneto code didn’t download anything. It looked up the victim’s MAC address — a unique hardware identifier for the computer’s network or Wi-Fi card — and the victim’s Windows hostname. Then it sent it to a server in Northern Virginia server, bypassing Tor, to expose the user’s real IP address, coding the transmission as a standard HTTP web request.
  • The official IP allocation records maintained by the American Registry for Internet Numbers show the two Magneto-related IP addresses were part of a ghost block of eight addresses that have no organization listed. Those addresses trace no further than the Verizon Business data center in Ashburn, Virginia, 20 miles northwest of the Capital Beltway. The code’s behavior, and the command-and-control server’s Virginia placement, is also consistent with what’s known about the FBI’s “computer and internet protocol address verifier,” or CIPAV, the law enforcement spyware first reported by WIRED in 2007. Court documents and FBI files released under the FOIA have described the CIPAV as software the FBI can deliver through a browser exploit to gather information from the target’s machine and send it to an FBI server in Virginia. The FBI has been using the CIPAV since 2002 against hackers, online sexual predators, extortionists, and others, primarily to identify suspects who are disguising their location using proxy servers or anonymity services, like Tor. Prior to the Freedom Hosting attack, the code had been used sparingly, which kept it from leaking out and being analyzed.
  • Paul Merrell on 05 Oct 13
     
    Taking down the entire Freedom Hosting service because some content was kiddie porn is reminiscent of the U.S. government's proxy take-down of Mega-Upload in New Zealand. Such actions that disable legitimate users or deny access to their data are in my opinion violative of the 1st and 4th Amendments.  It suppresses the Freedom of Speech and seizes more than the 4th Amendment allows.  That our own government would use malware for surveillance purposes under any circumstance is just plain chilling.
Paul Merrell

It's Time to Rewrite the Internet to Give Us Better Privacy, and Security - The Daily B... - 0 views

www.thedailybeast.com/...tter-privacy-and-security.html

surveillance state lessig surveillance-blocking

shared by Paul Merrell on 22 Jun 13 - No Cached
  • Almost 15 years ago, as I was just finishing a book about the relationship between the Net (we called it “cyberspace” then) and civil liberties, a few ideas seemed so obvious as to be banal: First, life would move to the Net. Second, the Net would change as it did so. Gone would be simple privacy, the relatively anonymous default infrastructure for unmonitored communication; in its place would be a perpetually monitored, perfectly traceable system supporting both commerce and the government. That, at least, was the future that then seemed most likely, as business raced to make commerce possible and government scrambled to protect us (or our kids) from pornographers, and then pirates, and now terrorists. But another future was also possible, and this was my third, and only important point: Recognizing these obvious trends, we just might get smart about how code (my shorthand for the technology of the Internet) regulates us, and just possibly might begin thinking smartly about how we could embed in that code the protections that the Constitution guarantees us. Because—and here was the punchline, the single slogan that all 724 people who read that book remember—code is law. And if code is law, then we need to be as smart about how code regulates us as we are about how the law does so.
  • There is, after all, something hopeful about a future that was smart about encoding our civil liberties. It could, in theory at least, be better. Better at protecting us from future Nixons, better at securing privacy, and better at identifying those keen to commit crime.
  • But what astonishes me is that today, more than a decade into the 21st century, the world has remained mostly oblivious to these obvious points about the relationship between law and code. That’s the bit in the Edward Snowden interview that is, to me, the most shocking. As he explained to Glenn Greenwald: The NSA specially targets the communications of everyone. It ingests them by default. It collects them in its system, and it filters them and it analyzes them and it measures them and it stores them for periods of time simply because that’s the easiest and the most efficient and most valuable way to achieve these ends ... Not all analysts have the ability to target everything. But I sitting at my desk certainly had the authority to wiretap anyone—from you [the reporter, Glenn Greenwald], to your accountant, to a federal judge, to even the president if I had a personal email. We don’t know yet whether Snowden is telling the truth. Lots of people have denied specifics, and though his interview is compelling, just now, we literally don’t know. But what we do know are the questions that ought to be asked in response to his claims. And specifically, this: Is it really the case that the government has entrusted our privacy to the good judgment of private analysts? Are there really no code-based controls for assuring that specific surveillance is specifically justified? And what is the technology for assuring that rogues paid by our government can’t use data collected by our government for purposes that none within our government would openly and publicly defend?
  • ...1 more annotation...
  • Because the fact is that there is technology that could be deployed that would give many the confidence that none of us now have. “Trust us” does not compute. But trust and verify, with high-quality encryption, could. And there are companies, such as Palantir, developing technologies that could give us, and more importantly, reviewing courts, a very high level of confidence that data collected or surveilled was not collected or used in an improper way. Think of it as a massive audit log, recording how and who used what data for what purpose. We could code the Net in a string of obvious ways to give us even better privacy, while also enabling better security. But we don’t, or haven’t, obviously. Maybe because of stupidity. How many congressmen could even describe how encryption works? Maybe because of cupidity. Who within our system can resist large and lucrative contracts to private companies, especially when bundled with generous campaign funding packages? Or maybe because the “permanent war” that Obama told us we were not in has actually convinced all within government that old ideas are dead and we just need to “get over it”—ideas like privacy, and due process, and fundamental proportionality. These ideas may be dead, for now. And they will stay dead, in the future. At least until we finally learn how liberty can live in the digital age. And here’s the hint: not through law alone, but through law that demands code that even the Electronic Frontier Foundation could trust.
  • Paul Merrell on 22 Jun 13
     
    As the most prominent among law professors concerned with online civil liberties and now specializing in government corruption, if Lawrence Lessig says there are technical solutions for protecting us from online government snooping, I'm all years. He directs attention to technology being developed by Palantir, http://www.palantir.com/
Gary Edwards

Tax Code Tweak Might Make CNG for Vehicles More Available | RedState - 0 views

www.redstate.com/...ng-for-vehicles-more-available

William-Cassidy Natural-gas CNG Energy

shared by Gary Edwards on 08 May 12 - No Cached
  • Gary Edwards on 08 May 12
     
    Representative Dr. William Cassidy (R-LA) has put forward a common sense change to the tax code that will jump the economy of the USA forward, making use of plentiful and comparatively inexpensive natural gas. excerpt: The recent natural gas boom in the United States has been so wide-spread and profound that it has dropped natural gas prices to historical lows. These prices are so low that producers have begun to scale back operations as extraction has almost become uneconomical. We should be focused on exploring new commercial markets for natural gas to take advantage of such a low-cost energy source. Because technology and supply is currently available to sell the natural gas equivalent for about $1.50 a gallon compared with the current price of gasoline, it would seem natural for consumers to begin making the switch to compressed natural gas CNG (Compressed Natural Gas) vehicles. So if the technology is already available and we have at least a 100-year supply of natural gas right here in America, why aren't we all driving CNG cars? Unfortunately, the main obstacle is a lack of natural gas fuel infrastructure in our country. Currently in the United States, there are only 449 CNG fueling stations accessible to the public, which is dwarfed by the more than 157,000 gasoline stations. There are a number of proposals to spur natural gas infrastructure development in Washington. Not surprisingly, when it comes to Congress, the most talked about option involves subsidies for both natural gas vehicles and for the actual CNG fuel itself. While we should be using all of our available natural resources to aid in lowering the costs of transportation, the reality is that our country has neither the money to subsidize development nor the expertise to pick winners and losers in the energy and transportation sectors. As opposed to subsidies, I believe that a simple change to our tax code would help those companies that develop natural gas look at domestic retail infrastruc
Gary Edwards

MF Global: Where's the Cash? -- Part II | ZeroHedge - 0 views

www.zerohedge.com/...mf-global-wheres-cash-part-ii

Banksters Bankruptcy MF-Global Corzine

shared by Gary Edwards on 16 Feb 12 - No Cached
  • Gary Edwards on 16 Feb 12
     
    It's complicated.  The bottom line is that we know where the $1.6 Billion in customer assets, squandered and "lost" by Corzine, is.  JP Morgan is holding the bulk of it, and due to recent changes in the 546(e) section of the Federal Bankruptcy code, JP Morgan and the other big banksters will be able to keep that money from it's rightful owners.  Oh, yeah.  One other thing.  The big banksters now running off with the assets of investors are the very same people who lobbied hard and heavy ($$$) to have the changes in the code pushed through by their unwitting stooges in Congress. excerpt: This week in The Institutional Risk Analyst we published a comment on the ongoing financial genocide at MF Global, "MF Global: Where's the Cash?"  http://us1.irabankratings.com/pub/IRAstory.asp?tag=515 The comment correctly identifies the location of the "missing" $1.6 billion as JP Morgan Chase and other bank custodians of MF Global.  The trouble is that even though we now know where the missing customer money has gone, namely JPMorgan, there is little chance that the defrauded customers of Jon Corzine will ever recover a dime. Here's the link to a video by William Rochelle of Bloomberg News explaining how the safe harbor in Section 546(e) of the Bankruptcy Code likely will prevent MF Global customers from ever getting their $1.6 billion back -- even when it's located, as it has been evidently. ... (MONEY SHOT) The problem here is that the existing laws against pillaging customer accounts and other acts of fraud are in conflict with the bankruptcy statute designed to make the world safe for large banks and over-the-counter derivatives.  Specifically, the post 2005 bankruptcy laws prohibit trustees from clawing back the $1.6 billion in stolen customer funds.  Indeed, the Bankruptcy Court and trustee are precluded from pursuing the banks just as the trustee in the Madoff fraud has likewise been stymied.    In addition to the clients of MF Global who were ap
Gary Edwards

The American Spectator : Obamacare: Still a Threat to Your Life - 0 views

spectator.org/...obamacare-still-a-threat-to-yo

obamacare obammunism healthcare american-spectator

shared by Gary Edwards on 03 Mar 10 - Cached
  • Gary Edwards on 03 Mar 10
     
    The decimation of our health care system under Obamacare begins with government mandates, regulations, bureaucracies, and controls. The House and Senate health care bills that President Obama and the Democrats refuse to take off the table create close to 100 new health care bureaucracies, boards, commissions and programs. This is the government takeover of health care. These new authorities arrogate to the government the power to decide "what works" in health care, and what doesn't. The code words they use include "best practices" -- a government bureaucracy in Washington is going to decide what are the "best practices" in providing health care for you and your children, not you and your doctor. Another code phrase is "reward doctors for quality not quantity." Government bureaucracies in Washington do not know how to do this. But they will make a huge mess out of your health care in trying to. These government bureaucracies will also have the power to cut off your health care when they decide it is no longer worth the money. We have already seen a glimpse of this in the declaration by a bureaucracy, to be expanded with more powers under Obamacare, that women over 72 should not have mammograms. What they are saying here is that if you are over 72 and get breast cancer, they don't want to know about it. Just take the painkiller and go home, to paraphrase President Obama. They believe they can buy more votes taking the money for your care and spending it somewhere else. This is called "cost effectiveness." The destruction of the health care system is then expanded through the payment system. Among the code words here are "pay for performance" and "accountable care." This is how the bureaucracy will enforce its dictates concerning what works and what doesn't, best practices, cost effectiveness, and termination of health care no longer deemed worthy. Doctors and hospitals will be rewarded through payments if they follow the centralized bureaucracy's dictates; they will b
Paul Merrell

Russia Hysteria Infects WashPost Again: False Story About Hacking U.S. Electric Grid - 0 views

theintercept.com/...bout-hacking-u-s-electric-grid

war & peace U.S.-foreign-policy Russophobia fake-news WaPo electrical-grid-hack MSM-propaganda

shared by Paul Merrell on 03 Jan 17 - No Cached
  • The Washington Post on Friday reported a genuinely alarming event: Russian hackers have penetrated the U.S. power system through an electrical grid in Vermont. The Post headline conveyed the seriousness of the threat: The first sentence of the article directly linked this cyberattack to alleged Russian hacking of the email accounts of the DNC and John Podesta — what is now routinely referred to as “Russian hacking of our election” — by referencing the code name revealed on Wednesday by the Obama administration when it announced sanctions on Russian officials: “A code associated with the Russian hacking operation dubbed Grizzly Steppe by the Obama administration has been detected within the system of a Vermont utility, according to U.S. officials.” The Post article contained grave statements from Vermont officials of the type politicians love to issue after a terrorist attack to show they are tough and in control. The state’s Democratic governor, Peter Shumlin, said: Vermonters and all Americans should be both alarmed and outraged that one of the world’s leading thugs, Vladimir Putin, has been attempting to hack our electric grid, which we rely upon to support our quality of life, economy, health, and safety. This episode should highlight the urgent need for our federal government to vigorously pursue and put an end to this sort of Russian meddling.
  • Vermont Sen. Patrick Leahy issued a statement warning: “This is beyond hackers having electronic joy rides — this is now about trying to access utilities to potentially manipulate the grid and shut it down in the middle of winter. That is a direct threat to Vermont and we do not take it lightly.” The article went on and on in that vein, with all the standard tactics used by the U.S. media for such stories: quoting anonymous national security officials, reviewing past acts of Russian treachery, and drawing the scariest possible conclusions (“‘The question remains: Are they in other systems and what was the intent?’ a U.S. official said”).  The media reactions, as Alex Pfeiffer documents, were exactly what one would expect: hysterical, alarmist proclamations of Putin’s menacing evil: Our Russian "friend" Putin attacked the U.S. power grid. https://t.co/iAneRgbuhF — Brent Staples (@BrentNYT) December 31, 2016
  • The Post’s story also predictably and very rapidly infected other large media outlets. Reuters thus told its readers around the world: “A malware code associated with Russian hackers has reportedly been detected within the system of a Vermont electric utility.”   What’s the problem here? It did not happen. There was no “penetration of the U.S. electricity grid.” The truth was undramatic and banal. Burlington Electric, after receiving a Homeland Security notice sent to all U.S. utility companies about the malware code found in the DNC system, searched all its computers and found the code in a single laptop that was not connected to the electric grid. Apparently, the Post did not even bother to contact the company before running its wildly sensationalistic claims, so Burlington Electric had to issue its own statement to the Burlington Free Press, which debunked the Post’s central claim (emphasis in original): “We detected the malware in a single Burlington Electric Department laptop not connected to our organization’s grid systems.” So the key scary claim of the Post story — that Russian hackers had penetrated the U.S. electric grid — was false. All the alarmist tough-guy statements issued by political officials who believed the Post’s claim were based on fiction.
  • ...2 more annotations...
  • UPDATE: Just as The Guardian had to do just two days ago regarding its claim about WikiLeaks and Putin, the Washington Post has now added an editor’s note to its story acknowledging that its key claim was false:
  • Is it not very clear that journalistic standards are being casually dispensed with when the subject is Russia?
Paul Merrell

Your Computer May Already be Hacked - NSA Inside? | Steve Blank - 1 views

steveblank.com/...y-already-be-hacked-nsa-inside

surveillance state NSA NSA-targets NSA-backdoors CPU-backdoors

shared by Paul Merrell on 22 Dec 13 - No Cached
  • But while the interviewer focused on the Skype revelation, I thought the most interesting part was the other claim, “that the National Security Agency already had pre-encryption stage access to email on Outlook.”  Say what??  They can see the plaintext on my computer before I encrypt it? That defeats any/all encryption methods. How could they do that? Bypass Encryption While most outside observers think the NSA’s job is cracking encrypted messages, as the Prism disclosures have shown, the actual mission is simply to read all communications. Cracking codes is a last resort.
  • The NSA has a history of figuring out how to get to messages before or after they are encrypted. Whether it was by putting keyloggers on keyboards and recording the keystrokes or detecting the images of the characters as they were being drawn on a CRT. Today every desktop and laptop computer has another way for the NSA to get inside. Intel Inside It’s inevitable that complex microprocessors have bugs in them when they ship. When the first microprocessors shipped the only thing you could hope is that the bug didn’t crash your computer. The only way the chip vendor could fix the problem was to physically revise the chip and put out a new version. But computer manufacturers and users were stuck if you had an old chip. After a particularly embarrassing math bug in 1994 that cost Intel $475 million, the company decided to fix the problem by allowing it’s microprocessors to load fixes automatically when your computer starts.
  • Starting in 1996 with the Intel P6 (Pentium Pro) to today’s P7 chips (Core i7) these processors contain instructions that are reprogrammable in what is called microcode. Intel can fix bugs on the chips by reprogramming a microprocessors microcode with a patch. This patch, called a microcode update, can be loaded into a processor by using special CPU instructions reserved for this purpose. These updates are not permanent, which means each time you turn the computer on, its microprocessor is reset to its built-in microcode, and the update needs to be applied again (through a computer’s BIOS.). Since 2000, Intel has put out 29 microcode updates to their processors. The microcode is distributed by 1) Intel or by 2) Microsoft integrated into a BIOS or 3) as part of a Windows update. Unfortunately, the microcode update format is undocumented and the code is encrypted. This allows Intel to make sure that 3rd parties can’t make unauthorized add-ons to their chips. But it also means that no one can look inside to understand the microcode, which makes it is impossible to know whether anyone is loading a backdoor into your computer.
  • ...3 more annotations...
  • A few months ago these kind of discussions would have been theory at best, if not paranoia.
  • Or perhaps the NSA, working with Intel and/or Microsoft, have wittingly have put backdoors in the microcode updates. A backdoor is is a way of gaining illegal remote access to a computer by getting around the normal security built-in to the computer. Typically someone trying to sneak malicious software on to a computer would try to install a rootkit (software that tries to conceal the malicious code.) A rootkit tries to hide itself and its code, but security conscious sites can discover rootkits by tools that check kernel code and data for changes. But what if you could use the configuration and state of microprocessor hardware in order to hide? You’d be invisible to all rootkit detection techniques that checks the operating system. Or what if you can make the microprocessor random number generator (the basis of encryption) not so random for a particular machine? (The NSA’s biggest coup was inserting backdoors in crypto equipment the Swiss sold to other countries.) Rather than risk getting caught messing with everyone’s updates, my bet is that the NSA has compromised the microcode update signing keys  giving the NSA the ability to selectively target specific computers. (Your operating system ensures security of updates by checking downloaded update packages against the signing key.) The NSA then can send out backdoors disguised as a Windows update for “security.” (Ironic but possible.) That means you don’t need backdoors baked in the hardware, don’t need Intel’s buy-in, don’t have discoverable rootkits, and you can target specific systems without impacting the public at large.
  • The Prism disclosures prove otherwise – the National Security Agency has decided it needs the ability to capture all communications in all forms. Getting inside of a target computer and weakening its encryption or having access to the plaintext of encrypted communication seems likely. Given the technical sophistication of the other parts of their surveillance net, the surprise would be if they haven’t implemented a microcode backdoor. The downside is that 1) backdoors can be hijacked by others with even worse intent. So if NSA has a microcode backdoor – who else is using it? and 2) What other pieces of our infrastructure, (routers, smartphones, military computers, satellites, etc) use processors with uploadable microcode? —— And that may be why the Russian president is now using a typewriter rather than a personal computer.
Paul Merrell

Protocols of the Hackers of Zion? « LobeLog - 0 views

www.lobelog.com/otocols-of-the-hackers-of-zion

surveillance state Israel cyber-spying Iran-negotiations

shared by Paul Merrell on 12 Jun 15 - No Cached
  • When Israeli Prime Minister Benjamin Netanyahu met with Google chairman Eric Schmidt on Tuesday afternoon, he boasted about Israel’s “robust hi-tech and cyber industries.” According to The Jerusalem Post, “Netanyahu also noted that ‘Israel was making great efforts to diversify the markets with which it is trading in the technological field.'” Just how diversified and developed Israeli hi-tech innovation has become was revealed the very next morning, when the Russian cyber-security firm Kaspersky Labs, which claims more than 400 million users internationally, announced that sophisticated spyware with the hallmarks of Israeli origin (although no country was explicitly identified) had targeted three European hotels that had been venues for negotiations over Iran’s nuclear program.
  • Wednesday’s Wall Street Journal, one of the first news sources to break the story, reported that Kaspersky itself had been hacked by malware whose code was remarkably similar to that of a virus attributed to Israel. Code-named “Duqu” because it used the letters DQ in the names of the files it created, the malware had first been detected in 2011. On Thursday, Symantec, another cyber-security firm, announced it too had discovered Duqu 2 on its global network, striking undisclosed telecommunication sites in Europe, North Africa, Hong Kong, and  Southeast Asia. It said that Duqu 2 is much more difficult to detect that its predecessor because it lives exclusively in the memory of the computers it infects, rather than writing files to a drive or disk. The original Duqu shared coding with — and was written on the same platform as — Stuxnet, the computer worm  that partially disabled enrichment centrifuges in Iranian nuclear power plants, according to a 2012 report in The New York Times. Intelligence and military experts said that Stuxnet was first tested at Dimona, a nuclear-reactor complex in the Negev desert that houses Israel’s own clandestine nuclear weapons program. While Stuxnet is widely believed to have been a joint Israeli-U.S. operation, Israel seems to have developed and implemented Duqu on its own.
  • Coding of the spyware that targeted two Swiss hotels and one in Vienna—both sites where talks were held between the P5+1 and Iran—so closely resembled that of Duqu that Kaspersky has dubbed it “Duqu 2.” A Kaspersky report contends that the new and improved Duqu would have been almost impossible to create without access to the original Duqu code. Duqu 2’s one hundred “modules” enabled the cyber attackers to commandeer infected computers, compress video feeds  (including those from hotel surveillance cameras), monitor and disrupt telephone service and Wi-Fi, and steal electronic files. The hackers’ penetration of computers used by the front desk would have allowed them to determine the room numbers of negotiators and delegation members. Duqu 2 also gave the hackers the ability to operate two-way microphones in the hotels’ elevators and control their alarm systems.
Paul Merrell

Lavabit To Release Code As Open Source, As It Creates Dark Mail Alliance To Create Even... - 0 views

www.techdirt.com/...surveillance-proof-email.shtml

surveillance state NSA Dark Mail Alliance NSA-blowback

shared by Paul Merrell on 31 Oct 13 - No Cached
  • This whole morning, while all these stories of the NSA hacking directly into Google and Yahoo's network have been popping up, I've been at the Inbox Love conference, all about the future of email. The "keynote" that just concluded, was Ladar Levison from Lavabit (with an assist from Mike Janke from Silent Circle), talking about the just announced Dark Mail Alliance, between Lavabit and Silent Circle -- the other "security" focused communications company who shut down its email offering after Lavabit was forced to shut down. Levison joked that they went with "Dark Mail" because "Black Mail" might have negative connotations. Perhaps just as interesting, Levison is going to be releasing the Lavabit source code (and doing a Kickstarter project to support this), with the hope that many others can set up their own secure email using Lavabit's code, combined with the new Dark Mail Alliance secure technology which will be available next year. As noted, the Alliance is working on trying to create truly secure and surveillance-proof email. Of course, nothing is ever 100% surveillance proof -- and both members of the alliance have previously claimed that it was almost impossible to do surveillance-proof email. However, they're claiming they've had a "breakthrough" that will help.
  • The newly developed technology has been designed to look just like ordinary email, with an interface that includes all the usual folders—inbox, sent mail, and drafts. But where it differs is that it will automatically deploy peer-to-peer encryption, so that users of the Dark Mail technology will be able to communicate securely. The encryption, based on a Silent Circle instant messaging protocol called SCIMP, will apply to both content and metadata of the message and attachments. And the secret keys generated to encrypt the communications will be ephemeral, meaning they are deleted after each exchange of messages. For the NSA and similar surveillance agencies across the world, it will sound like a nightmare. The technology will thwart attempts to sift emails directly from Internet cables as part of so-called “upstream” collection programs and limit the ability to collect messages directly from Internet companies through court orders. Covertly monitoring encrypted Dark Mail emails would likely have to be done by deploying Trojan spyware on a targeted user. If every email provider in the world adopted this technology for all their users, it would render dragnet interception of email messages and email metadata virtually impossible.
  • Importantly, they're not asking everyone to just trust them to be secure -- even though both companies have the right pedigree to deserve some level of trust. Instead, they're going to release the source code for public scrutiny and audits, and they're hoping that other email providers will join the alliance. At the conference, Levison recounted much of what's happened over the last few months (with quite a bit of humor), joking about how he tried to be "nice" in giving the feds Lavabit's private keys printed out, by noting that he included line numbers to help (leaving unsaid that this would make OCR'ing the keys even more difficult). He also admitted that giving them the paper version was really just a way to buy time to shut down Lavabit.
  • ...1 more annotation...
  • Janke came up on stage to talk about the importance of changing the 40-year-old architecture of email, because it's just not designed for secure communications. The hope is that as many other email providers as possible will join the Alliance and that this new setup becomes the de facto standard for end-to-end secure email, which is where Levison's open sourcing of his code gets more interesting. In theory, if it all works out, it could be a lot easier for lots of companies to set up their own "dark mail" email providers. Either way, I would imagine that this development can't make the NSA all that happy.
  • Paul Merrell on 31 Oct 13
     
    Oh, Goody!
Paul Merrell

New Cyber-Spying Discovery Points to NSA and the "Five Eyes" - WhoWhatWhy - 0 views

whowhatwhy.org/...discovery-points-nsa-five-eyes

surveillance state NSA 5-Eyes Regin cyberwar cyber-spying

shared by Paul Merrell on 01 Feb 15 - No Cached
  • here’s yet another tantalizing clue that the National Security Agency and its “Five Eyes” allies are behind a poweful cyber-espionage tool called Regin, used to spy on friend and enemy alike. That’s the conclusion Russian cybersecurity firm Kaspersky drew after examining the source code of Regin and an innocuously-named spying tool called QWERTY. It’s an appropriate monicker. The malware, known as a keylogger,  vacuums up anything typed on a computer keyboard and sends it back to the programmer controlling it. The crucial clue Kaspersky found is that QWERTY “can only operate as part of the Regin platform.” After tracking Regin across 14 countries for years, Kaspersky and technology firm Symantec identified it in November 2014.  At the time, Symantec said Regin’s “capabilities and the level of resources behind [it] indicate that it is one of the main cyberespionage tools used by a nation state.” 
  • Though neither company said it, suspicion immediately arose that the NSA and its allies had created Regin. It immediately drew comparisons with Stuxnet, the joint U.S.-Israeli computer worm used to damage Iranian nuclear centrifuges in Natanz in 2009. Unlike Stuxnet’s narrow mission of sabotage, Regin is designed for spying in a wide set of environments. It hides in plain sight, disguised as ordinary Microsoft software.
  • The new evidence further points to the Five Eyes. The German news magazine Der Spiegel has a trove of documents from NSA whistleblower Edward Snowden, which included the source code. Der Spiegel gave Kaspersky the code to examine: The new analysis provides clear proof that Regin is in fact the cyber-attack platform belonging to the Five Eyes alliance, which includes the U.S., Britain, Canada, Australia and New Zealand. Neither Kaspersky nor Symantec commented directly on the likely creator of Regin. But there can be little room left for doubt regarding the malware’s origin. Der Spiegel pointed to five elements they believe suggest Five Eyes authorship: the presence of QWERTY in Snowden’s files, its use in the Belgacom hack by Britain’s GCHQ, references to the sport of cricket in the code, structural similarities to tools outlined in other Snowden documents, and targets consistent with other Five Eyes tools and campaigns.
  • ...1 more annotation...
  • Regin has been used to spy on telecom providers, financial institutions, energy companies, airlines, research institutes and the hospitality industry, and on European Union officials. The 14 countries found to have been penetrated include Russia, Malaysia, Afghanistan, and Fiji. Even though the trail is hot now, security experts say that Regin is still out there committing wholesale espionage. That’s because parts of it like QWERTY help mask other components. Like any good spy, it’s constantly changing disguises.
Paul Merrell

NSA targets the privacy-conscious (Seite 1)| Das Erste - Panorama - Meldungen - 0 views

daserste.ndr.de/...nsa230_page-1.html

surveillance state NSA XKeyscore Tor Tails

shared by Paul Merrell on 04 Jul 14 - No Cached
  • The investigation discloses the following: Two servers in Germany - in Berlin and Nuremberg - are under surveillance by the NSA. Merely searching the web for the privacy-enhancing software tools outlined in the XKeyscore rules causes the NSA to mark and track the IP address of the person doing the search. Not only are German privacy software users tracked, but the source code shows that privacy software users worldwide are tracked by the NSA.Among the NSA's targets is the Tor network funded primarily by the US government to aid democracy advocates in authoritarian states.  The XKeyscore rules reveal that the NSA tracks all connections to a server that hosts part of an anonymous email service at the MIT Computer Science and Artificial Intelligence Laboratory (CSAIL) in Cambridge, Massachusetts. It also records details about visits to a popular internet journal for Linux operating system users called "the Linux Journal - the Original Magazine of the Linux Community", and calls it an "extremist forum".
  • Three authors of this investigation have personal and professional ties to the Tor Project, an American company mentioned within the following investigation.
  • Teil 1: NSA targets the privacy-conscious Teil 2: The Tor Project - anathema to the NSA Teil 3: Servers in Germany targeted Teil 4: Simple web searches are suspicious Teil 5: NSA: In strict accordance with the rule of law
  • ...3 more annotations...
  • von J. Appelbaum, A. Gibson, J. Goetz, V. Kabisch, L. Kampf, L. Ryge The investigation discloses the following: Two servers in Germany - in Berlin and Nuremberg - are under surveillance by the NSA. Merely searching the web for the privacy-enhancing software tools outlined in the XKeyscore rules causes the NSA to mark and track the IP address of the person doing the search. Not only are German privacy software users tracked, but the source code shows that privacy software users worldwide are tracked by the NSA.Among the NSA's targets is the Tor network funded primarily by the US government to aid democracy advocates in authoritarian states.  The XKeyscore rules reveal that the NSA tracks all connections to a server that hosts part of an anonymous email service at the MIT Computer Science and Artificial Intelligence Laboratory (CSAIL) in Cambridge, Massachusetts. It also records details about visits to a popular internet journal for Linux operating system users called "the Linux Journal - the Original Magazine of the Linux Community", and calls it an "extremist forum".
  • Downloads XKeyscore rules Read/download the XKeyscore rules here  | download
  • Yet despite these efforts, one of the servers is targeted by the NSA. The IP address 212.212.245.170 is explicitly specified in the rules of the powerful and invasive spy software program XKeyscore. The code is published here exclusively for the first time. After a year of NSA revelations based on documents that focus on program names and high-level Powerpoint presentations, NDR and WDR are revealing NSA source code that shows how these programs function and how they are implemented in Germany and around the world. Months of investigation by the German public television broadcasters NDR and WDR, drawing on exclusive access to top secret NSA source code, interviews with former NSA employees, and the review of secret documents of the German government reveal that not only is the server in Nuremberg under observation by the NSA, but so is virtually anyone who has taken an interest in several well-known privacy software systems.
Paul Merrell

Congress Votes to Give Jihadists Anti-Aircraft Missiles | Global Research - Centre for ... - 0 views

www.globalresearch.ca/...5562564

war & peace U.S.-foreign-policy Syria MANPADs legislation Obama

shared by Paul Merrell on 19 Dec 16 - No Cached
  • On Thursday, the Senate passed a bill that puts every American who travels by plane at risk.  It is among the stupidest pieces of legislation ever written and it explains– to a great extent– why the US Congress has a public approval rating of 13 percent and is among the most loathed institutions in America. The 2017 National Defense Authorization Act (NDAA) passed the House last Friday in a 375-34 vote. On Thursday, it cleared the senate with a 92 to 7 margin.  The bill will now be sent to Obama where it is expected to be signed into law. According to an article on SOFREP titled  “Congress authorizes anti-aircraft missiles for Syrian opposition”: Congress for the first time authorized the Department of Defense to provide vetted-Syrian rebels with anti-aircraft missiles. The provision is contained within the $619 billion Fiscal Year 2017 National Defense Authorization Act, which passed the Senate on Dec. 8 and the House on Dec. 2. Under the bill, the Secretaries of Defense and State must submit a report to Congress explaining why they determined Syrian groups need man-portable air defense systems (MANPADS). (SOFREP: Trusted News and Intelligence From Spec Ops Veterans, “Congress authorizes anti-aircraft missiles for Syrian opposition”)
  • You read that right, Congress just passed a bill that will provide shoulder-launched ground-to-air missiles to lunatic jihadists who will undoubtedly use them to take down American or Israeli jetliners. The argument that these Islamic militants are fully vetted is complete nonsense as both the New York Times and the Wall Street Journal have repeatedly shown. According to a recent article in the New York Times, rebel groups supported by the USG  “have entered into battlefield alliances with the affiliate of al Qaida in Syria formerly known as al Nusra.”  The Wall Street Journal reports that rebel groups are “doubling-down on their alliance with al Qaida. This alliance has rendered the phrase ‘moderate rebels’ meaningless.” Everyone who has followed developments on the ground in Syria knows that the distinction between the “good” terrorists and the “bad” terrorists is pure bunkum. The various militias are merely the many heads of the same homicidal anti-government hydra that has killed over 400,000 Syrians and decimated a large part of the country. The CIA should not be assisting any of these madmen let alone providing them with lethal state-of the-art weapons that will inevitably be used to take down US aircraft.  Here’s more from the same article: The inclusion of the provision represents a departure from previous versions of the NDAA. The original House bill specifically prohibited the transfer of MANPADS to “any entity” in Syria, while the Senate bill did not address it. So, the original bill forbid “the transfer of MANPADS” to Syrian militants because it was considered too dangerous. But now that Obama’s proxy-army is getting pulverized in Aleppo,  Congress has taken off the gloves and gone into full-revenge mode.  Isn’t that what’s really going on?
  • And it looks like Obama has already given this crazy policy a big thumbs up. Check out this “Presidential Determination and Waiver ….on the Arms Export Control Act to Support U.S. Special Operations to Combat Terrorism in Syria” that the White House issued late Thursday: By the authority vested in me as President by the Constitution and the laws of the United States, including section 2249a of title 10, United States Code, sections 40 and 40A of the Arms Export Control Act (AECA) (22 U.S.C. 2780 and 2781), and section 301 of title 3, United States Code, I hereby: determine that the transaction, encompassing the provision of defense articles and services to foreign forces, irregular forces, groups, or individuals engaged in supporting or facilitating ongoing U.S. military operations to counter terrorism in Syria, is essential to the national security interests of the United States.(Presidential Determination and Waiver) It looks to me like our Nobel prize-winning president just gave Congress’s idiot plan his ringing endorsement.
  • Paul Merrell on 19 Dec 16
     
    Mike Whitney eloquently expresses my anger.
Paul Merrell

DOJ's Motion to Dismiss in Smith v. Obama, the case challenging the legality of the war... - 0 views

www.justsecurity.org/...-challenging-legality-war-isil

war & peace Smith_v._Obama war-powers-resolution Iraq Syria litigation

shared by Paul Merrell on 15 Jul 16 - No Cached
  • As I noted in an earlier post, Nathan Smith, a U.S. Army captain deployed to Kuwait as part of the campaign against ISIL, Operation Inherent Resolve, has sued the President, seeking a declaration that Congress has not authorized the hostilities in Iraq and Syria and that therefore the War Powers Resolution requires the President to remove U.S. forces from hostilities in those nations. On Tuesday, the Department of Justice filed a motion to dismiss the case. Its brief in support of the motion includes one argument that I think is correct (albeit not for all the reasons the government offers) — namely, that Smith lacks standing to sue. That ought to be sufficient to have the case dismissed. The brief also includes an argument on the merits (albeit not designated as such) that is very interesting and potentially important — an account of how Congress has allegedly authorized Inherent Resolve in three ways: (i) in the 2001 AUMF; (ii) in the 2002 AUMF; and (iii) in current appropriations statutes. The heart of the brief, however, is devoted to a third argument — that Judge Koller-Kotelly must dismiss the case on the basis of the political question doctrine — that is not only wrong, but that simply ignores the Supreme Court’s recent (and repeated) repudiation of that very argument.
  • On page 39 of its 45-page brief, the government finally gets around to the reason why the court should dismiss the complaint: Smith lacks standing. Importantly, Smith’s theory of standing is not that he — an Army captain deployed to perform intelligence services in Kuwait — is more likely to be injured or killed by virtue of the President’s decision to deploy troops into hostilities in Iraq and Syria. It is, instead, that the President’s alleged failure to comply with the War Powers Act results in Captain Smith’s own violation of his officer’s oath to “support and defend” the Constitution “against all enemies, foreign and domestic,” and to “bear true faith and allegiance” to the Constitution.
  • The government’s standing argument begins (p. 35) by suggesting that “[p]laintiff’s claim that he is being forced to betray his oath is insufficient to establish standing because the violation of an oath, by itself, is not an injury in fact.” The cases the government cites for that proposition, however, do not say that a forced oath violation would not be an injury in fact — and that’s not a question the judge needs to resolve. What the cases establish, instead, is the point the government finally argues at page 39 — namely, that a government officer does not violate his oath by complying with superiors’ orders, even if it turns out that the law prohibits the military operation in which those orders are issued. Indeed, Smith would not violate his oath of office even if his superiors’ orders themselves were unauthorized, or if the intelligence activities he is ordered to performed were unauthorized. But he does not allege even those things (as I discuss below, he does not, for instance, alleged that he is being ordered to do anything unlawful). Instead, he merely argues that because President Obama should have withdrawn troops from Syria and Iraq 60 days after their deployment, Smith himself is violating his oath to “bear true faith and allegiance to the Constitution.” This is a non sequitur: Even if Smith is right that the continuation of Operation Inherent Resolve is unlawful, that would not mean that he is acting in violation of his oath. (Much more on this in my earlier post.) And that simple fact is reason enough for Judge Koller-Kotelly to dismiss the case.
  • ...8 more annotations...
  • One of Smith’s counsel, Professor Bruce Ackerman, argues that this reason for rejecting the oath-based theory of standing ignores the Supreme Court’s 1804 decision in Little v. Barreme. Little, however, is not on point. In that case, Navy Captain Little was sued by the owners of a Danish ship for damages caused when Little seized that neutral ship. The Court held that Little could be liable, notwithstanding the fact that he was following orders, because the capture violated a implicit statutory prohibition on the military’s seizure of ships sailing from France to the United States. In this case, however, Captain Smith has not argued — nor could he — that he has been ordered to do anything unlawful (in violation of a statute), let alone that he has been ordered to do something that would subject him to possible liability for damages. He is, instead, arguing that President Obama violated a statute. That is not enough to establish Smith’s standing to sue.
  • The government’s main argument, to which it devotes far too many pages, is that the judge must dismiss the case because it raises a “political question” that courts cannot answer. This is flatly wrong — and it ignores several controlling precedents, including the Supreme Court’s recent 8-1 rejection of virtually the same government argument in Zivotofsky v. Clinton.
  • The most interesting thing about the government’s brief — and by far the most important aspect of it, for public purposes apart from the lawsuit itself — is that, in the section ostensibly arguing that the case is nonjusticiable (see pp. 25-30, and also pp. 4-14), DOJ actually offers the Executive branch’s most detailed defense yet about why Operation Inherent Resolve is congressionally authorized. As some of us predicted, the government relies on three arguable authorizations, any one of which would be sufficient to defeat Smith’s WPR claim if the courts were to reach the merits. In this post I’m not going to assess the merits of the three arguments. For now, my purpose is only to describe them, and to raise one issue with respect to the third. i. First, the government argues that the 2001 AUMF authorizes the operation against ISIL.
  • Second, the government argues that the 2002 AUMF also authorizes Operation Inherent Resolve, just as it authorized operations in Iraq against AQI (which became ISIL) from 2003 to 2011, after the Hussain regime fell.
  • Finally, and most interestingly (in part because the government has not previously made this argument), DOJ argues that a recent “unbroken stream” of appropriations statutes not only confirm the authorities allegedly conferred by the 2001 and 2002 AUMFs, but also offer their own, independent congressional authorization.
  • Two things are fairly clear from this: The members of Congress approve of Operation Inherent Resolve — indeed, there’s virtually no opposition. And Congress has (most likely) appropriated funds to pay for it. The operative question, however, is whether Congress’s appropriations also serve as an authorization that would supersede the requirement of WPR section 5(b). The government brief alludes to one important argument that the plaintiff will undoubtedly raise: Section 8(a)(1) of the WPR provides that, for purposes of tolling the 60-day clock of section 5(b), “[a]uthority to introduce United States Armed Forces into hostilities or into situations wherein involvement in hostilities is clearly indicated by the circumstances shall not be inferred (1) from any provision of law . . . including any provision contained in any appropriations Act, unless such provision specifically authorizes the introduction of United States Armed Forces into hostilities or into such situations and states that it is intended to constitute specific statutory authorization within the meaning of this chapter.” Obviously, the 2016 Act does not satisfy that requirement. Is that fatal to the appropriations-as-authorization argument?
  • As the Office of Legal Counsel 50 U.S.C. 1542 and 1543). These provisions might be read simply to convey that the executive must continue to comply with the consultation and reporting requirements of WPR sections 3 and 4, even after the 2016 Act authorizes the introduction of troops into hostilities in Iraq and Syria. Or they might alternatively be construed to also specify that the Act is not providing the authority that section 5(b) of the WPR calls for.
  • Not surprisingly, DOJ argues for the former view (pp. 27-28 of the brief): “[I]n the few provisions in which Congress did reference the War Powers Resolution, to clarify that no funds made available for Operation Inherent Resolve are to be used ‘in contravention’ of the Resolution, Congress signaled its agreement that the President’s counter-ISIL military actions were authorized by simultaneously funding Operation Inherent Resolve. If Congress believed that the United States had been conducting airstrikes and other counter-ISIL military activities ‘in contravention of the War Powers Resolution,’ it would have made no sense for Congress to use the ‘in contravention’ proviso in the same laws that make funds available for the express purpose of continuing those military activities.” That’s not a bad argument, at least at first glance; but it’s not a slam-dunk, either, in part because appropriations provisions do not necessarily establish authorizations. It’ll be interesting to see how Captain Smith’s lawyers respond to this particular aspect of the merits argument. I doubt Judge Koller-Kotelly will reach it, however, because she is likely to dismiss the case for want of standing.
  • Paul Merrell on 15 Jul 16
     
    I've read the brief. I don't think the implied partial repeal of the War Powers Resolution argument should fly. The relevant provision establishes a rule of interpretation of later statutes and the appropriations bills neither reject the rule of interpretation nor specifically provide authorization for use of military force. They just authorize funding. On the standing issue, I think the DoJ position is correct; the oath of office applies only to senior officers who make the decision to initiate a war. But DoJ may have opened the door to a more compelling standing argument by arguing that the war does not constitute a war crime, a crime against peace, or a crime against humanity under international law. DoJ did not need to make that argument because Smith had not alleged in his complaint that he was being ordered to commit such crimes, but by doing so DoJ waives any argument that such issues are beyond the scope of Smith's standing and the evidence that the Iraq and Syrian wars are illegal under international law is, to say the least, strong.
Gary Edwards

NSA Whistleblower William Binney Explains NSA Surveillance - Business Insider - 0 views

www.businessinsider.com/plains-nsa-surveillance-2012-8

NSA William-Binney Treason electronic-surveillance

shared by Gary Edwards on 25 Aug 12 - No Cached
  • Gary Edwards on 25 Aug 12
     
    Wow.  I watched this short film and listened carefully to what William Binney had to say.  This is incredible stuff and his explanation of how it cam to be is easy enough to follow.  I hope Americans will pay attention and in the ground swell to take back our country will forcefully oppose the requthorization of NSA in December 2012.  Just a month after elections. excerpt: "National Security Agency whistleblower William Binney explains how the secretive agency run its pervasive domestic spying apparatus in a new piece by Laura Poitras in The New York TImes. Binney-one of the best mathematicians and code breakers in NSA history-worked for the Defense Department's foreign signals intelligence agency for 32 years before resigning in late 2001 because he "could not stay after the NSA began purposefully violating the Constitution." In a short video called "The Program," Binney explains how the agency took part of one of the programs he built and started using it to spy on virtually every U.S. citizen without warrants under the code-name Stellar Wind. Binney details how the top-secret surveillance program, the scope of which has never been made public, can track electronic activities-phone calls, emails, banking and travel records, social media-and map them to collect "all the attributes that any individual has" in every type of activity and build a profile based on that data."
Paul Merrell

Code words used in intercepted al Qaeda messages, US source says - 0 views

www.abc15.com/...-qaeda-messages-us-source-says

surveillance state embassy-closures NSA lies

shared by Paul Merrell on 17 Aug 13 - No Cached
  • The intercepted al Qaeda communications that sparked the closure of U.S. embassies in the Middle East and North Africa contained specific words that American intelligence interpreted as a coded message for what they believed signaled a potentially imminent attack, CNN has learned.
  • A U.S. official declined to discuss specific code words on the intercepts but told CNN "there was a sense of imminence, a sense of the overall area at risk and the known actors. There was great concern." Members of Congress have indicated that National Security Agency surveillance programs played a role in intercepting and monitoring recent al Qaeda communications. The programs were defended by Secretary of State John Kerry on Tuesday. "A number of groups in the world have individually targeted not just American interests but free interests in the world," Kerry said during press conference in Brasilia, Brazil. "There have been bombings in many places in the world. Innocent people have lost their lives. And what the United States has been trying to do is prevent these things from happening beforehand by knowing what others might be plotting."
  • Paul Merrell on 17 Aug 13
     
    Kerry's quote is significant because it links the State Dept. embassy closures in Arab nations to Obama Administration advocacy for NSA surveillance programs. 
Paul Merrell

Obama Lets N.S.A. Exploit Some Internet Flaws, Officials Say - NYTimes.com - 0 views

www.nytimes.com/...ernet-flaws-officials-say.html

surveillance state Obama NSA NSA-backdoors exploits must-read Iranian-nukes-myth Stuxnet

shared by Paul Merrell on 13 Apr 14 - No Cached
  • Stepping into a heated debate within the nation’s intelligence agencies, President Obama has decided that when the National Security Agency discovers major flaws in Internet security, it should — in most circumstances — reveal them to assure that they will be fixed, rather than keep mum so that the flaws can be used in espionage or cyberattacks, senior administration officials said Saturday.But Mr. Obama carved a broad exception for “a clear national security or law enforcement need,” the officials said, a loophole that is likely to allow the N.S.A. to continue to exploit security flaws both to crack encryption on the Internet and to design cyberweapons.
  • elements of the decision became evident on Friday, when the White House denied that it had any prior knowledge of the Heartbleed bug, a newly known hole in Internet security that sent Americans scrambling last week to change their online passwords. The White House statement said that when such flaws are discovered, there is now a “bias” in the government to share that knowledge with computer and software manufacturers so a remedy can be created and distributed to industry and consumers.Caitlin Hayden, the spokeswoman for the National Security Council, said the review of the recommendations was now complete, and it had resulted in a “reinvigorated” process to weigh the value of disclosure when a security flaw is discovered, against the value of keeping the discovery secret for later use by the intelligence community.“This process is biased toward responsibly disclosing such vulnerabilities,” she said.
  • The N.S.A. made use of four “zero day” vulnerabilities in its attack on Iran’s nuclear enrichment sites. That operation, code-named “Olympic Games,” managed to damage roughly 1,000 Iranian centrifuges, and by some accounts helped drive the country to the negotiating table.Not surprisingly, officials at the N.S.A. and at its military partner, the United States Cyber Command, warned that giving up the capability to exploit undisclosed vulnerabilities would amount to “unilateral disarmament” — a phrase taken from the battles over whether and how far to cut America’s nuclear arsenal.“We don’t eliminate nuclear weapons until the Russians do,” one senior intelligence official said recently. “You are not going to see the Chinese give up on ‘zero days’ just because we do.” Even a senior White House official who was sympathetic to broad reforms after the N.S.A. disclosures said last month, “I can’t imagine the president — any president — entirely giving up a technology that might enable him some day to take a covert action that could avoid a shooting war.”
  • ...2 more annotations...
  • One recommendation urged the N.S.A. to get out of the business of weakening commercial encryption systems or trying to build in “back doors” that would make it far easier for the agency to crack the communications of America’s adversaries. Tempting as it was to create easy ways to break codes — the reason the N.S.A. was established by Harry S. Truman 62 years ago — the committee concluded that the practice would undercut trust in American software and hardware products. In recent months, Silicon Valley companies have urged the United States to abandon such practices, while Germany and Brazil, among other nations, have said they were considering shunning American-made equipment and software. Their motives were hardly pure: Foreign companies see the N.S.A. disclosures as a way to bar American competitors.Continue reading the main story Continue reading the main story AdvertisementAnother recommendation urged the government to make only the most limited, temporary use of what hackers call “zero days,” the coding flaws in software like Microsoft Windows that can give an attacker access to a computer — and to any business, government agency or network connected to it. The flaws get their name from the fact that, when identified, the computer user has “zero days” to fix them before hackers can exploit the accidental vulnerability.
  • But documents released by Edward J. Snowden, the former N.S.A. contractor, make it clear that two years before Heartbleed became known, the N.S.A. was looking at ways to accomplish exactly what the flaw did by accident. A program code-named Bullrun, apparently named for the site of two Civil War battles just outside Washington, was part of a decade-long effort to crack or circumvent encryption on the web. The documents do not make clear how well it succeeded, but it may well have been more effective than exploiting Heartbleed would be at enabling access to secret data.The government has become one of the biggest developers and purchasers of information identifying “zero days,” officials acknowledge. Those flaws are big business — Microsoft pays up to $150,000 to those who find them and bring them to the company to fix — and other countries are gathering them so avidly that something of a modern-day arms race has broken out. Chief among the nations seeking them are China and Russia, though Iran and North Korea are in the market as well.
  • Paul Merrell on 13 Apr 14
     
    Note that this is only an elastic policy, not law. Also notice that NYT is now reporting as *fact* that the NSA did the cyber attack on the Iranian enrichment centrifuges. By any legal measure, if true that was an act of war, a war of aggression.  So why wasn't the American public informed that we were at war with Iran? 
Gary Edwards

Security, the Edward Snowden Way - Datamation - 0 views

www.datamation.com/...-the-edward-snowden-way-1.html

security Edward-Snowden

shared by Gary Edwards on 25 Jul 14 - No Cached
  • NoScript NoScript is a free extension for Mozilla-based web browsers, including Firefox. It blocks executable web content by default. This blocking includes JavaScript, Java, Flash and Silverlight. You can whitelist sites if you want to use such content on a site-by-site basis. Or, if you choose, you can make all sites active by default and choose to blacklist sites you think might be dangerous. A visual button tells you if active content has been blocked on the current site.
  • PGP In the first chapter of his book “No Place to Hide,” journalist Glenn Greenwald wrote that Edward Snowden contacted him using the alias “Cincinnatus,” and said he would tell Greenwald some highly newsworthy facts, but only if he installed Pretty Good Privacy (PGP) first. (Greenwald didn’t know the magnitude of the scoop being offered to him and didn’t get around to installing PGP for months, thus delaying the leak.) PGP, of course, is a 23-year-old encryption program that can be used for email, as well as files and other things.
  • Tor Tor is a free application that routes your Internet traffic through a global volunteer network of thousands of relays that play a shell game with your data so your location and Internet travels are concealed. Tor, which used to stand for “The Onion router” in a reference to layers of encryption, encrypts data in multiple layers that prevents snoops from being able to figure out any details about your web travels, such as where you are or what you’re looking at. Tor was developed in part by US government funding as a way to enable citizens in repressive countries to communicate safely. And the NSA has a lot of respect for it. But in a recent controversy, two Carnegie Mellon researchers said they would give a talk at the Black Hat USA 2014 conference next month telling how to identify Tor users inexpensively (for only $3,000). The session was cut from the lineup because university lawyers didn’t approve it. The institute that the researchers work for is funded by the Pentagon, but the Department of Homeland Security said they did not request that the talk be cancelled.
  • Gary Edwards on 25 Jul 14
     
    "Whether you think NSA whistleblower Edward Snowden is a hero or a traitor, you have to admit: The guy knows how to keep his information secure. The fact that Snowden isn't sitting in Guantanamo right now with ankle cuffs and a bag over his head demonstrates his ability to avoid detection. Snowden spoke at the Hope X conference in New York this month via a Google+ Hangout from Russia, and called on developers to build privacy and security into everyday products. He also hinted that he planned to work on building such technology. If you look into the details of what's been happening with tracking, surveillance, spying, hacking and global cyber industrial espionage, you can see that Snowden is right. We all need a lot better protection from snoops of all stripes. But how does the non-expert get started? One option is to listen to Snowden himself. Over the past year, Snowden has in one format or another, made specific product recommendations. Here are the products Snowden has explicitly recommended since the trove of documents on the NSA has been publicly revealed. (The list is in alphabetical order.) Ghostery Ghostery, made by a company called Evidon, is a browser extension for Chrome, Firefox, Safari and Internet Explorer. It exists for two purposes. The first is to block tracking code, which makes browsing the web both more private and also faster. The second purpose is, somewhat contradictory -- Evidon collects data from you to help advertisers avoid being blocked. It also enables website owners to gain insights into the tracking code deployed on their site by third-party advertising companies. Note that Snowden recommended Ghostery some time ago. But this month, the Electronic Frontier Foundation launched a competing product that I would imagine Snowden would recommend called Privacy Badger."
  • Paul Merrell on 26 Jul 14
     
    I'd back Snowden in 2016 as a write-in candidate for President.
Paul Merrell

New Snowden Docs Indicate Scope of NSA Preparations for Cyber Battle - SPIEGEL ONLINE - 0 views

www.spiegel.de/...or-cyber-battle-a-1013409.html

surveillance state war & peace cyberwar Snowden NSA-docs

shared by Paul Merrell on 20 Jan 15 - No Cached
  • The NSA's mass surveillance is just the beginning. Documents from Edward Snowden show that the intelligence agency is arming America for future digital wars -- a struggle for control of the Internet that is already well underway.
  • The Birth of D Weapons According to top secret documents from the archive of NSA whistleblower Edward Snowden seen exclusively by SPIEGEL, they are planning for wars of the future in which the Internet will play a critical role, with the aim of being able to use the net to paralyze computer networks and, by doing so, potentially all the infrastructure they control, including power and water supplies, factories, airports or the flow of money.
  • From a military perspective, surveillance of the Internet is merely "Phase 0" in the US digital war strategy. Internal NSA documents indicate that it is the prerequisite for everything that follows. They show that the aim of the surveillance is to detect vulnerabilities in enemy systems. Once "stealthy implants" have been placed to infiltrate enemy systems, thus allowing "permanent accesses," then Phase Three has been achieved -- a phase headed by the word "dominate" in the documents. This enables them to "control/destroy critical systems & networks at will through pre-positioned accesses (laid in Phase 0)." Critical infrastructure is considered by the agency to be anything that is important in keeping a society running: energy, communications and transportation. The internal documents state that the ultimate goal is "real time controlled escalation". One NSA presentation proclaims that "the next major conflict will start in cyberspace." To that end, the US government is currently undertaking a massive effort to digitally arm itself for network warfare. For the 2013 secret intelligence budget, the NSA projected it would need around $1 billion in order to increase the strength of its computer network attack operations. The budget included an increase of some $32 million for "unconventional solutions" alone.
  • ...5 more annotations...
  • NSA Docs on Network Attacks and ExploitationExcerpt from the secret NSA budget on computer network operations / Code word GENIE Document about the expansion of the Remote Operations Center (ROC) on endpoint operations Document explaining the role of the Remote Operations Center (ROC) Interview with an employee of NSA's department for Tailored Access Operations about his field of work Supply-chain interdiction / Stealthy techniques can crack some of SIGINT's hardest targets Classification guide for computer network exploitation (CNE) NSA training course material on computer network operations Overview of methods for NSA integrated cyber operations NSA project description to recognize and process data that comes from third party attacks on computers Exploring and exploiting leaky mobile apps with BADASS Overview of projects of the TAO/ATO department such as the remote destruction of network cards iPhone target analysis and exploitation with Apple's unique device identifiers (UDID) Report of an NSA Employee about a Backdoor in the OpenSSH Daemon NSA document on QUANTUMSHOOTER, an implant to remote-control computers with good network connections from unknown third parties
  • NSA Docs on Malware and ImplantsCSEC document about the recognition of trojans and other "network based anomaly" The formalized process through which analysts choose their data requirement and then get to know the tools that can do the job QUANTUMTHEORY is a set of technologies allowing man-on-the-side interference attacks on TCP/IP connections (includes STRAIGHTBIZARRE and DAREDEVIL) Sample code of a malware program from the Five Eyes alliance
  • NSA Docs on ExfiltrationExplanation of the APEX method of combining passive with active methods to exfiltrate data from networks attacked Explanation of APEX shaping to put exfiltrating network traffic into patterns that allow plausible deniability Presentation on the FASHIONCLEFT protocol that the NSA uses to exfiltrate data from trojans and implants to the NSA Methods to exfiltrate data even from devices which are supposed to be offline Document detailing SPINALTAP, an NSA project to combine data from active operations and passive signals intelligence Technical description of the FASHIONCLEFT protocol the NSA uses to exfiltrate data from Trojans and implants to the NSA
  • Part 2: How the NSA Reads Over Shoulders of Other Spies
  • According to top secret documents from the archive of NSA whistleblower Edward Snowden seen exclusively by SPIEGEL, they are planning for wars of the future in which the Internet will play a critical role, with the aim of being able to use the net to paralyze computer networks and, by doing so, potentially all the infrastructure they control, including power and water supplies, factories, airports or the flow of money. During the 20th century, scientists developed so-called ABC weapons -- atomic, biological and chemical. It took decades before their deployment could be regulated and, at least partly, outlawed. New digital weapons have now been developed for the war on the Internet. But there are almost no international conventions or supervisory authorities for these D weapons, and the only law that applies is the survival of the fittest. Canadian media theorist Marshall McLuhan foresaw these developments decades ago. In 1970, he wrote, "World War III is a guerrilla information war with no division between military and civilian participation." That's precisely the reality that spies are preparing for today.
  • Paul Merrell on 20 Jan 15
     
    Major dump of new Snowden NSA docs by Der Spiegel, with an article by a large team of reporters and computer security experts. Topic: Cyberwar capabilities, now and in the near future. 
Paul Merrell

Hamid Karzai International Airport - Wikipedia, the free encyclopedia - 0 views

en.wikipedia.org/...d_Karzai_International_Airport

war & peace Afghanistan Kabul Airport Dubai air-routes

shared by Paul Merrell on 29 Oct 15 - No Cached
  • Hamid Karzai International Airport (Persian: میدان هوائی بین المللی حامدکرزی‎‎, Pashto: د حامدکرزی نړيوال هوائي ډګر‎, IATA: KBL, ICAO: OAKB), also known as Kabul International Airport (real name Kabul Khwaja Rawash International Airport), is located 5 kilometers (3.1 mi) from the city center of Kabul in Afghanistan. It serves as one of the nation's main international airports and as one of the largest military bases, capable of housing over one hundred aircraft. It was given the new name in October 2014 in honor of former President Hamid Karzai. The decision was made by the National Assembly of Afghanistan and the Cabinet of President Ashraf Ghani.[2] The airport has been expanded and modernized in the last decade. A new international terminal (which has free wi-fi) was added and the older terminal is now used for domestic flights. A number of military bases were also built around the airport, which are used by the United States Armed Forces and NATO's International Security Assistance Force (ISAF). The military of Afghanistan also has a base there, while the Afghan National Police provide security inside the passenger terminals. As of March 2015 the most frequently serviced destination from the airport was Dubai-International with no less than five passenger airlines flying the route, some with multiple daily flights.
  • Hamid Karzai International Airport (Persian: میدان هوائی بین المللی حامدکرزی‎‎, Pashto: د حامدکرزی نړيوال هوائي ډګر‎, IATA: KBL, ICAO: OAKB), also known as Kabul International Airport (real name Kabul Khwaja Rawash International Airport), is located 5 kilometers (3.1 mi) from the city center of Kabul in Afghanistan. It serves as one of the nation's main international airports and as one of the largest military bases, capable of housing over one hundred aircraft. It was given the new name in October 2014 in honor of former President Hamid Karzai. The decision was made by the National Assembly of Afghanistan and the Cabinet of President Ashraf Ghani.[2] The airport has been expanded and modernized in the last decade. A new international terminal (which has free wi-fi) was added and the older terminal is now used for domestic flights. A number of military bases were also built around the airport, which are used by the United States Armed Forces and NATO's International Security Assistance Force (ISAF). The military of Afghanistan also has a base there, while the Afghan National Police provide security inside the passenger terminals. As of March 2015 the most frequently serviced destination from the airport was Dubai-International with no less than five passenger airlines flying the route, some with multiple daily flights.
  • 3 Airlines and destinations 3.1 Passenger 3.2 Cargo
  • Paul Merrell on 29 Oct 15
     
    Interesting factoid to remember: "As of March 2015 the most frequently serviced destination from the airport was Dubai-International with no less than five passenger airlines flying the route, some with multiple daily flights." Also two cargo routes, according to the fine print. Dubai is the largest city in United Arab Emirates. Any reason that route should get flown so much other than Dubai being a travel hub?
1 - 20 of 200 Next › Last »
Showing 20▼ items per page