Boing Boing » leaks

NSA leaks forcing more official transparency

Xeni Jardin — Tue, 18 Jun 2013 17:25:51 +0000

Trevor Timm wrote a piece for Freedom of the Press Foundation about how much more we're learning not just from the NSA leaks themselves, but from the response to those leaks. "Both companies and the government have been forced into a corner where their only move is to release more information they previously fought to keep secret," Trevor says.

Glenn Greenwald's keynote at Freedom to Connect 2013

Cory Doctorow — Sat, 15 Jun 2013 03:23:43 +0000

Joly sez, "On March 4-5 2013 the Internet Society's North America Bureau webcast the Freedom to Connect 2013 conference in Washington DC. One keynote speaker was Glenn Greenwald, who has recently come to international attention as the journalist who broke the NSA surveillance story. In his hour long speech, he talks about Aaron Swartz, the imbalance of justice, the growth of the surveillance state, the nature of power in the digital age, and its implications for Internet freedom. There are a couple of small glitches in the recording, for which we apologize."

VIDEO: Glenn Greenwald keynote at Freedom to Connect 2013 #f2c #netfreedom #prism (Thanks, Joly!)

UK: Edward Snowden not welcome here

Cory Doctorow — Fri, 14 Jun 2013 17:03:22 +0000

The UK Home Office has sent letters to the world's airlines, warning them not to let NSA whistleblower Edward Snowden board a plane for the UK, because "the individual is highly likely to be refused entry to the UK."

Jack Shafer: Edward Snowden and the selective targeting of leaks

Xeni Jardin — Thu, 13 Jun 2013 02:52:48 +0000

"The willingness of the government to punish leakers is inversely proportional to the leakers’ rank and status, which is bad news for someone so lacking in those attributes as Edward Snowden," writes media critic Jack Shafer at Reuters. As the US moves to prosecute Snowden, Shafer says we should ask "Why Snowden is singled out for punishment when he’s essentially done what the insider dissenters did when they spoke with Risen and Lichtblau in 2005 about an invasive NSA program. He deserves the same justice and the same punishment they received."

Roundup of responses to the Snowden/NSA leaks

Cory Doctorow — Wed, 12 Jun 2013 14:41:34 +0000

In the Guardian, an excellent roundup of the US and EU responses to the revelations from Edward Snowden's leaks about the extent of NSA dragnet spying on the Internet and phone networks:

The congressional fury came at the end of a day of fast-moving developments.
• In a lawsuit filed in New York, the American Civil Liberties Union accused the US government of a process that was "akin to snatching every American's address book".
• On Capitol Hill, a group of US senators introduced a bill aimed at forcing the US federal government to disclose the opinions of a secretive surveillance court that determines the scope of the eavesdropping on Americans' phone records and internet communications.
• A leading member of the Senate intelligence committee, Ron Wyden, came close to saying that James Clapper, the US director of national intelligence, misled him on the scope of government surveillance during a March hearing. Clapper admitted earlier this week that he gave the "least untruthful" answer possible to a question by Wyden.

NSA surveillance: anger mounts in Congress at 'spying on Americans' [Dan Roberts, Spencer Ackerman and Alan Travis/The Guardian]

How Snowden orchestrated a blockbuster story: NYT ticktock on NSA Prism leaks

Xeni Jardin — Wed, 12 Jun 2013 00:38:36 +0000

In the New York Times, Charlie Savage and Mark Mazzetti explain how Edward J. Snowden instructed three journalists, Glenn Greenwald and Ewen MacAskill of the Guardian and documentary filmmaker Laura Poitras, to fly to Hong Kong about 12 days ago to "visit a particular out-of-the-way corner of a certain hotel, and ask — loudly — for directions to another part of the hotel. If all seemed well, the source would walk past holding a Rubik’s Cube."

They followed his directions, and encountered a man with a Rubik’s Cube. That man was Snowden.

In related news, NYT columnist David Brooks is an idiot: "He betrayed our privacy," Brooks writes about the man who leaked evidence of the NSA's secret and sweeping surveillance program. You have got to be kidding me.

Another Top Secret leak: Obama's cyber-war hit-list

Cory Doctorow — Sat, 08 Jun 2013 08:19:03 +0000

Glenn Greenwald and the Guardian have published details of another Top Secret US surveillance/security document. This one is a presidential order from Obama to his top spies directing them to draw up a hit-list of "cyber war" targets to be attacked by American military hacking operations.

The 18-page Presidential Policy Directive 20, issued in October last year but never published, states that what it calls Offensive Cyber Effects Operations (OCEO) "can offer unique and unconventional capabilities to advance US national objectives around the world with little or no warning to the adversary or target and with potential effects ranging from subtle to severely damaging".
It says the government will "identify potential targets of national importance where OCEO can offer a favorable balance of effectiveness and risk as compared with other instruments of national power".
The directive also contemplates the possible use of cyber actions inside the US, though it specifies that no such domestic operations can be conducted without the prior order of the president, except in cases of emergency.

The document further contemplates preemptive first strikes on foreign targets.

As Greenwald points out, this document has been published on the eve of a meeting between Obama and the Chinese Premier Xi Jinping. China has been publicly accused by the USA of carrying out electronic attacks on American infrastructure, and Xi has rebutted by saying that the US has engaged in aggressive "cyber-war" attacks on Chinese infrastructure. This document lends credence to Xi's claim.

Obama orders US to draw up overseas target list for cyber-attacks

UK spies have access to NSA Prism, which has "direct access" to world's largest Internet companies' servers

Cory Doctorow — Fri, 07 Jun 2013 14:16:28 +0000

A report by Nick Hopkins in the Guardian accuses the UK spy agency GCHQ of making use of the American NSA's Prism program, which was revealed in leaked documents earlier today -- a slide presentation claiming that the NSA had direct access to the servers at Google, Microsoft, Apple, and many other Internet giants.

According to Hopkins, GCHQ has been able to access Prism since Jun 2010. This is based on information from the same leaked slide deck, apparently:

Unless GCHQ has stopped using Prism, the agency has accessed information from the programme for at least three years. It is not mentioned in the latest report from the Interception of Communications Commissioner Office, which scrutinises the way the UK's three security agencies use the laws covering the interception and retention of data.
Asked to comment on its use of Prism, GCHQ said it "takes its obligations under the law very seriously. Our work is carried out in accordance with a strict legal and policy framework which ensures that our activities are authorised, necessary and proportionate, and that there is rigorous oversight, including from the secretary of state, the interception and intelligence services commissioners and the intelligence and security committee".
The agency refused to be drawn on how long it had been using Prism, how many intelligence reports it had gleaned from it, or which ministers knew it was being used.
A GCHQ spokesperson added: "We do not comment on intelligence matters."

UK gathering secret intelligence via covert NSA operation

Portraits of "Americans who tell the truth"

Xeni Jardin — Fri, 25 Jan 2013 18:28:52 +0000

Artist Robert Shetterly's ongoing series of portraits of "Americans Who Tell The Truth" includes a recently-unveiled painting of John Kiriakou, the former CIA agent and counterterrorism adviser who became a torture whistleblower and was sentenced today to 30 months in prison:

Even if torture works, it cannot be tolerated -- not in one case or a thousand or a million. If their efficacy becomes the measure of abhorrent acts, all sorts of unspeakable crimes somehow become acceptable. I may have found myself on the wrong side of government on torture. But I’m on the right side of history. …There are things we should not do, even in the name of national security. One of them, I now firmly believe, is torture.

There's a book, too. More about the project here. Bradley Manning is among the more recent news figures who is also included in the series.

Ex-CIA officer Kiriakou, who fought torture, sentenced in leak case

Xeni Jardin — Fri, 25 Jan 2013 18:14:55 +0000

John C. Kiriakou, a former CIA officer whom the government spent five years trying to convict for disclosing classified information, was today sentenced to 30 months in jail.

He is the first CIA officer in history to face prison for a leak.

From the NYT report by Michael S. Schmidt:

The judge, Leonie M. Brinkema, said that in approving the sentence, she would respect the terms of a plea agreement between the former C.I.A. agent, John C. Kiriakou, and prosecutors, but “I think 30 months is way too light.”
The judge said “this is not a case of a whistle-blower.” She went on to describe the damage that Mr. Kiriakou had created for the intelligence agency and an agent whose cover was disclosed by Mr. Kiriakou. Before issuing the sentence she asked Mr. Kiriakou if he had anything to say. When he declined, Judge Brinkema, said, “Perhaps you have already spoken too much.”

And the Justice Department's War on Whistleblowers steamrolls ever forward.

On the support website for Kiriakou, who has also worked as a consultant for CBS News, a statement explaining the guilty plea:

Last month I decided to plead guilty to one count of violating the Intelligence Identities Protection Act in exchange for the government dropping all other charges against me. The decision to plead guilty was the most difficult decision of my life. I am glad to now have the certainty of being home with my children in 30 months. Thank you for your support at this difficult time for me and for my family. I wish I could thank each and every one of you individually, as your support has meant the world to me. Knowing I had supporters like you saved me at the most difficult times.

Ex-Officer for C.I.A. Is Sentenced in Leak Case - NYTimes.com (HT: @kgosztola.)

NYT profile of John Kiriakou: first CIA officer to face prison for leaks

NYT profile of John Kiriakou: first CIA officer to face prison for classified leak

Xeni Jardin — Wed, 09 Jan 2013 20:58:40 +0000

A long-read you may have missed in the New York Times by Scott Shane, on the story of John Kiriakou, a former CIA analyst and case officer who is scheduled to be sentenced on Jan. 25 to 30 months in prison for leaking classified government info to a reporter. With this sentencing, the Obama administration reaffirms its role as one of the most staunchly anti-leak administrations in history.

The imminent sentencing, writes Shane, is part of "a plea deal in which he admitted violating the Intelligence Identities Protection Act by e-mailing the name of a covert C.I.A. officer to a freelance reporter, who did not publish it."

That law was passed 20 years ago, in response to "radical publications that deliberately sought to out undercover agents, exposing their secret work and endangering their lives."

Other CIA officers may have been responsible for killing innocent civilians in drone attacks, or torturing detainees, but those crimes aren't crimes our nation considers worth pursuing. Disclosing classified information to a reporter is.

Read the rest of the story here.

Attorney Jesselyn Radack, who represents Kiriakou, writes here about "what's left out."

A NYT op-ed by Ted Gup responding to the Shane piece is here.

Steven Aftergood's Project on Government Secrecy site has a collection of case files here. A "Defend John K" site maintained by Kiriakou and his supporters is here. There's a petition to Obama here, to commute or pardon. You can follow Kiriakou on Twitter.

Funny how the CIA official who evidently leaked info to the "Zero Dark Thirty" filmmakers won't be in any trouble.

John Cusack and Jonathan Turley in conversation: the future of leaks, and of Wikileaks

Xeni Jardin — Wed, 02 Jan 2013 20:58:09 +0000

At the Huffington Post, actor and activist John Cusack has a conversation with George Washington Law School professor and constitutional scholar Jonathan Turley, and Kevin McCabe, a pal of Cusack. The three discuss "WikiLeaks' impact on transparency, the government's response, and the comparison to the Pentagon Papers whistleblower Daniel Ellsberg."

By way of background: Cusack, Ellsberg, and I are on the board of the Freedom of the Press Foundation, a new organization that helps crowd-fund independent journalism outlets working for transparency and accountability in government. The first group of four beneficiary organizations includes the National Security Archive, MuckRock News, and The UpTake and WikiLeaks; more will follow in subsequent rounds.

"WikiLeaks was extralegally cut off from funding after two Congressmen successfully pressured Visa, Mastercard and PayPal into refusing to do business with the journalism organization in late 2010," writes Cusack. "We hope that the Freedom of the Press Foundation will become a bulwark against these types of unofficial censorship tactics in the future."

In their HuffPo roundtable, Cusack and Turley explore some of the legal principles and historic precedents related to the Wikileaks case.

"What Assange did was a massive release of material that showed the breathtaking dishonesty by the US government and governments around the world," says Turley. Is this, or should it be, a crime?

Leaked: ITU's secret Internet surveillance standard discussion draft

Cory Doctorow — Thu, 06 Dec 2012 07:54:23 +0000

Yesterday morning, I wrote about the closed-door International Telecommunications Union meeting where they were working on standardizing "deep packet inspection" -- a technology crucial to mass Internet surveillance. Other standards bodies have refused to touch DPI because of the risk to Internet users that arises from making it easier to spy on them. But not the ITU.

The ITU standardization effort has been conducted in secret, without public scrutiny. Now, Asher Wolf writes,

I publicly asked (via Twitter) if anyone could give me access to documents relating to the ITU's DPI recommendations, now endorsed by the U.N. The ITU's senior communications officer, Toby Johnson, emailed me a copy of their unpublished policy recommendations.
OOOPS!
5 hours later, they emailed, asking me not to publish it, in part or in whole, and that it was for my eyes only.
Please publish it (credit me for sending it to you.)
Also note:
1. The recommendations *NEVER* discuss the impact of DPI.
2. A FEW EXAMPLES OF POTENTIAL DPI USE CITED BY THE ITU:
"I.9.2 DPI engine use case: Simple fixed string matching for BitTorrent"
"II.3.4 Example “Forwarding copy right protected audio content”"
"II.3.6 Example “Detection of a specific transferred file from a particular user”"
"II.4.2 Example “Security check – Block SIP messages (across entire SIP traffic) with specific content types”"
"II.4.5 Example “Identify particular host by evaluating all RTCP SDES packets”"
"II.4.6 Example “Measure Spanish Jabber traffic”"
"II.4.7 Example “Blocking of dedicated games”"
"II.4.11 Example “Identify uploading BitTorrent users”"
"II.4.13 Example “Blocking Peer-to-Peer VoIP telephony
with proprietary end-to-end application control protocols”"
"II.5.1 Example “Detecting a specific Peer-to-Peer VoIP telephony with proprietary end-to-end application control protocols”"

Hit the jump for more of Asher's analysis and the download link:

3. Security threats against DPI entities is listed as:
- Destruction of DPI-related information;
- Corruption or modification of DPI-related information;
- Theft, removal or loss of DPI-related information;
- Disclosure of DPI-related information;
- Interruption of services (specifically mentions DoS.)

DRAFT NEW RECOMMENDATION ITU-T Y.2770 PROPOSED FOR APPROVAL AT THE WORLD TELECOMMUNICATION STANDARDIZATION CONFERENCE (WTSA-12) [ZIPped DOCX file]

DRAFT NEW RECOMMENDATION ITU-T Y.2770 PROPOSED FOR APPROVAL AT THE WORLD TELECOMMUNICATION STANDARDIZATION CONFERENCE (WTSA-12) [ZIPped DOCX file] CoralCache mirror

(Thanks, Asher!)

Spam kingpin chatter

Cory Doctorow — Sat, 01 Dec 2012 14:00:10 +0000

Security researcher Brian Krebs picks out some choice exchanges out of a dump from an elite Russian spammer message-board, and suggests that this contains clues to the identities of the world's most prolific spammers.

“Everything is all right with John. We drank with him recently in Europe. He is getting married soon. He is no longer spamming stocks. He got squeezed [arrested/questioned] once very badly some time ago. Now he is all clean. His friend – SP – screwed him and also is not working with stocks now. Rin is in total shit. He is going to be in jail (or he is going to be hiding) for a long time. He calls me pretty often, so he is alive so far. I am helping his wife with money from time to time.”
The two exchange recommendations about their favorite nightclubs in St. Petersburg, Russia. Tarelka inquires how Severa is doing, which elicits the following reply:
“I am okay. Damn, where to find sponsors? I am sure I can spin off stocks even in the current market. Are there any more contacts? Maybe I will ask Apple. Maybe he can give me some referrals. Who could think two years ago that this “theme” would die, huh? Give my regards to Igor [possibly Igor Gusev, the co-curator of SpamIt]. I wish you luck and patience.”
Tarelka says he tried to convince John/Apple that there was still money to be made in stock spam, but that John insisted the market was dead, and that no one was coming forward to pay spammers to send pump-and-dump spam anymore.

A Closer Look at Two Bigtime Botmasters

US goes after bloggers for writing about imaginary laser weapon that could set insurgents’ clothes on fire

Xeni Jardin — Wed, 08 Aug 2012 02:08:07 +0000

A number of journalists I know believe the Obama administration is the most secretive administration yet.

When I read news like this, I am inclined to believe them: the Naval Criminal Investigative Service is going after our pals at Danger Room, over a 5-year-old leak about a weapon that was never built.

"Federal agents are also chasing a leaker who gave Danger Room a document asking for a futuristic laser weapon that could set insurgents’ clothes on fire from nine miles away."

Total bullshit.

MPAA seeks UK sock-puppets to help them screw over TVShack's likable, innocent owner

Cory Doctorow — Tue, 07 Aug 2012 00:58:26 +0000

Richard O'Dwyer, creator of the legal UK website TVShack, faces extradition to the USA (even though TVShack is probably legal in the USA too). As usual, the MPAA has managed to get lawmakers to do their bidding so well that it has made them look like the villainous corporate scumbags everyone suspects them of being. A freshly leaked memo described by TorrentFreak documents Big Content's strategy for winning hearts and minds:

“The overall media coverage has been and will continue to be challenging,” the MPAA writes.
They mention the petition of Wikipedia founder jimmy Wales, the Demand Progress campaign, and note that a recent survey showed that 95% of the public does not support the extradition. According to the MPAA, public opinion is skewed because people are being led to believe that TVShack was operating perfectly legal in the UK.
“To counter these assertions, the MPAA and its allies need a coordinated effort to focus more on the criminal activity involved in the operation of TVShack and other similar linking sites,” the MPAA notes...
“Ideally, this would be done through third parties – but finding third parties – especially in the United Kingdom – has been very difficult so far, so the MPAA must be prepared to respond to media requests on the issue and set the record straight to counter the misinformation campaign by our opponents.”

MPAA Recruits “Surrogates” to Support Extradition of UK Student

Leaked climate-change denial lobby docs came from water scientist

Cory Doctorow — Tue, 21 Feb 2012 15:00:16 +0000

Water scientist Peter Gleick admitted that he was the source for the anonymous leak of documents from the climate-change-denying Heartland Institute. The documents -- obtained under a false name, and then leaked -- showed Heartland's budget, corporate donors (Koch Industries and Philip Morris featured heavily), and a plan to produce deliberately confusing materials about climate change for use in middle school curriculum.

It is clear from the documents that Heartland advocates against responsible climate mitigation and then uses that advocacy to raise money from oil companies and "other corporations whose interests are threatened by climate policies." Heartland particularly celebrates the funding that it receives from the fossil fuel fortune being the Charles G. Koch Foundation.
Heartland also continues to collect money from Philip Morris parent company Altria as well as from the tobacco giant Reynolds American, while maintaining ongoing advocacy against policies related to smoking and health.
Heartland's policy positions, strategies and budget distinguish it clear as a lobby firm that is misrepresenting itself as a "think tank" - it budgets $4.1 million of its $6.4 million in projected expenditures for Editorial, Government Relations, Communications, Fundraising, and Publications, and the only activity it plans that could vaguely be considered policy development is the writing of a curriculum package for use in confusing high schoolers about climate change.

Leaked Heartland documents

Heartland Insider Exposes Institute's Budget and Strategy (notes on the leaked documents)

The Guardian on Gleick's admission

Croatian transparency activists publish enormous database of government procurements, pointing the way to detecting corruption and fraud

Cory Doctorow — Thu, 01 Dec 2011 07:36:10 +0000

Marko Rakar, leader of a kind of Croatian version of Wikileaks, has once again made a stir in Croatia. Previously, Rakar published a database showing rampant voter-fraud (this triggered a constitutional crisis and reform effort).

Now, Rakar's latest project is a database of "All the public procurement data for government spending since July 1, 2009, in easily searchable form." Though the data is all from publicly accessible government sites, Rakar's structuring of it in searchable form allows Croatians to find interconnections between elected officials and the companies they give contracts to, revealing potential fraud and corruption in the system, which is widely believed to be mired in fraud

First it is easy to use the tool to understand how much money each agency spent and where (this site covers not only government and ministries, but also agencies, municipalities, public utility companies and basically all entities which are by law obliged to follow public procurement law). Furthermore, it is easy to track and identify "winners" in the public procurement field and it is really easy to spot highly unusual contractors; for example companies which do business with a single government entity, companies with a huge amount of their turnover that only do business with government, or companies which have unusually high profit rates.
We have found a number of companies which appear to be founded only to service a single government contract. Journalists have already found a number of companies which have a number of multimillion contracts and are at the same time huge donors to the ruling party. We have found a horse farm which bid on and won a contract to lay underground power cable, we have found a company which is related to the Speaker of the House which reports unusually high profit rates (50% and above) worth millions (both in Croatian and US currency) and which primarily deals with advertising in public spaces (schools, hospitals and similar). We have found one company which belonged to the Minister of Interior which also received multimillion security related contracts with the government (while he is still in the office).

Rakar and I had a chat a few months ago, and he had hilarious -- and frightening -- stories of police seizure of his equipment, and of having to give technical support to the police forensics team, who couldn't figure out his dual-boot setup. He was thinking of replacing his keyboards with Das Keyboards without any key-labels, just to watch the investigation team try to touch-type on them (Croatian forensic procedure prohibits connecting third-party equipment to seized computers, lest they taint the evidence).

Croatian Transparency Activist Marko Rakar Making Waves Again

(Image: Marko Rakar 2, a Creative Commons Attribution Share-Alike (2.0) image from 57152978@N08's photostream)