Did Wikileaks Do US Intelligence Bidding in Publishing the Syria Files?

Consider this nutty data point: between CNN’s Reliable Sources and NBC’s Meet the Press, Julian Assange was on more Sunday shows today than John McCain, with two TV appearances earlier this week.

Sadly, even in discussions of the potential that the DNC hack-plus-publication amounts to tampering with US elections, few seem to understand that evidence at least suggests that Wikileaks — not its allegedly Russian source — determined the timing of the release to coincide with the Democratic National Convention. Guccifer 2, at least, was aiming to get files out earlier than Wikileaks dumped them. So if someone is tampering, it is Julian Assange who, I’ve noted, has his own long-standing gripes with Hillary Clinton (though he disclaims any interest in doing her harm). If his source is Russia, that may just mean they had mutual interest in the publication of the files; but Assange claims to have determined the timing.

Since Wikileak’s role in the leak has been downplayed even as Assange has made the media rounds, since the nation’s spooks claim that publishing these documents is what makes it different, I want to consider this exchange Assange had with Chuck Todd:

CHUCK TODD:

All right. Let me ask you this. Do you, without revealing your source on this, do you accept information and leaked documents from foreign governments?

JULIAN ASSANGE:

Well, our publishing model means that what we publish is guaranteed to be true. That’s what we’re concerned about. That’s what our readers are concerned about. That’s the right of the general public, to not–

[snip]

CHUCK TODD:

Does that not trouble you at all, if a foreign government is trying to meddle in the affairs of another foreign government?

JULIAN ASSANGE:

Well, it’s an interesting speculative question that’s for the press and others to perhaps–

CHUCK TODD:

That doesn’t bother you? That is not part of the WikiLeaks credo?

JULIAN ASSANGE:

Well, it’s a meta story. If you’re asking would we accept information from U.S. intelligence that we had verified to be completely accurate, and would we publish that, and would we protect our sources in U.S. intelligence, the answer is yes, of course we would. [my emphasis]

Sure, at one level this is typical Assange redirection. When Todd asked if he’d accept files from Russia, Assange instead answered that he would accept them from the United States.

But it may not be so farcical as it seems. Consider the case of the Syria Files Wikileaks posted in spring 2012, at the beginning of the time the US was engaging in covert operations in Syria. They contained embarrassing information on Bashar al-Assad, his wife, and close associates, as well as documents implicating western companies that had facilitated Assad’s repression. Even at the time, people asked if the files were a western intelligence pys-op, though they were explicitly sourced to various factions of Anonymous. Then, between Jeremy Hammond and Sabu’s sentencing processes, it became clear that in January 2012, the latter identified targets for Anonymous hackers, targets that include the Syrian government.

An informant working for the F.B.I. coordinated a 2012 campaign of hundreds of cyberattacks on foreign websites, including some operated by the governments of Iran, Syria, Brazil and Pakistan, according to documents and interviews with people involved in the attacks.

Exploiting a vulnerability in a popular web hosting software, the informant directed at least one hacker to extract vast amounts of data — from bank records to login information — from the government servers of a number of countries and upload it to a server monitored by the F.B.I., according to court statements.

[snip]

The sentencing statement also said that Mr. Monsegur directed other hackers to give him extensive amounts of data from Syrian government websites, including banks and ministries of the government of President Bashar al-Assad. “The F.B.I. took advantage of hackers who wanted to help support the Syrian people against the Assad regime, who instead unwittingly provided the U.S. government access to Syrian systems,” the statement said.

What’s not known (as multiple reports say is still not known about the DNC hack) is whether the specific files the Sabu-directed Anonymous hackers obtained were the same ones that Wikileaks came to publish, though the timing certainly works out. It’s a very distinct possibility. In which case Assange’s comment may be more than redirection, but instead a reminder that Wikileaks has played the analogous role in US-directed hack-and-publish operation, one designed to damage Assad and his western allies. If those documents did ultimately come via FBI direction of Sabu, then Assange might be warning US spooks that their own similar actions could be exposed if he were asked to reveal more about any Russian role in the DNC hack.

Brennan Calls Out the Press for Giving ISIS More Credit Than They Deserve

Both James Clapper and John Brennan appeared at the Aspen Security Forum this week (it was Brennan’s first appearance, apparently). As I may lay out, Clapper was by far the more measured of the two. But this exchange, between Brennan and Dina Temple-Raston, deserves more attention. She notes that ISIS gets credit for attacks (she doesn’t name any, but I’d point to the San Bernardino killing and the Orlando massacre) that seem incidentally motivated at the last minute by ISIS, but generally are motivated by other issues.

To his credit, Brennan blames the press for crediting ISIS with these attacks.

Temple-Raston: It seems that people get credit for being an ISIS adherent just by having a brief flirtation online with the group. And I wonder if by calling something an ISIS attack so readily, which we seem to do, whether or not we’re giving ISIS more credit than it deserves.

Brennan: When you say “calling something an ISIS attack” that we’re prone to do, you’re talking about the media, right?

[Laughter, Brennan not exactly smiling, then later smiling]

Temple-Raston: No.

[More laughter]

Temple-Raston: I just wonder if you can’t say that it’s an opportunistic attack, as opposed to an ISIS attack.

But then Brennan goes on and notes that getting credit for such attacks is part of ISIS’s strategy.

Brennan: Sometimes I think ISIL doesn’t know themselves. I think most times they don’t. If somebody has been encouraged and incited by ISIL, they have no idea if that was the real motivation. Even if somebody is found with literature in their apartment that might reflect ISIL’s, you know, narrative, that doesn’t mean that they carried it out for that. It may mean that they, you know, woke up that day and wanted to commit suicide and wanted to take others down with them. But, it is part of ISIL’s strategy to have people that they can deploy, directly, that they can support directly, as well as to encourage and provide indirect direction and incitement to individuals. They will claim credit for a lot of things and they feel as though this is part of their brand.

Therein is the rub. If this is part of ISIS’ strategy, then having the media — and FBI (or, in other countries, other security organizations) — give them credit for it only serves to play to their strength.

Both Brennan and Temple-Raston remained silent about FBI’s role in this process, leaking details about affiliation with ISIS. But that — and the budget driving impulse that is a part of the motivation for it — is as much a part of the problem as the media’s rush to label things ISIS.

Was “Computer Network” “Analytics Data Program” Hacked at Hillary HQ VAN or Something Else?

Several outlets have reported that Hillary’s campaign — or rather, a network the Hillary campaign uses — got hacked along with the DNC and DCCC, presumably by the same APT 28 group presumed to be Russia’s military intelligence GRU. But reports on this, coming after a day of equivocation about whether Hillary’s campaign had been hacked at all, are unclear.

Reuters explains hackers accessed an “analytics program server” for five days (though doesn’t provide a date for that access).

A Clinton campaign spokesman said in a statement late on Friday that an analytics data program maintained by the DNC and used by the campaign and a number of other entities “was accessed as part of the DNC hack.”

[snip]

Later, a campaign official said hackers had access to the analytics program’s server for approximately five days. The analytics data program is one of many systems the campaign accesses to conduct voter analysis, and does not include social security numbers or credit card numbers, the official said.

KTLA (working off a CNN feed, I think) described the target as a “dynamic voter database — with voter participation, voter contact information and voter files all campaign organizations use.”

A person familiar with the Clinton campaign program described it as essentially a dynamic voter database — with voter participation, voter contact information and voter files that all campaign organizations use. It’s a list — but a dynamic one with key voter data.

A Clinton aide said the hackers had access to the analytics program’s server for approximately five days. The analytics data program is among many systems accessed to conduct voter analysis. It does not include social security numbers or credit card numbers.

The aide noted further that according to the campaign’s outside cyber security expert, the hack of this analytics data program could not have resulted in access to Clinton campaign internal emails, voicemails, computers or other internal communications and documents. Those are completely independent systems.

Some, though not all, of those reports is based off this circumspect statement from Nick Merrill.

An analytics data program maintained by the DNC, and used by our campaign and a number of other entities, was accessed as part of the DNC hack. Our campaign computer system has been under review by outside cyber security experts. To date, they have found no evidence that our internal systems have been compromised.

Meanwhile, the FBI sources in these stories seem hesitant to definitively tie this hack to the others.

I raise all this because the KTLA description of the program sounds a lot like VAN, the voter management program that has already made the news several times this election year. VAN is dynamic and accessible to all Democratic campaigns so they can share data about voter participation, contacts, and enthusiasm for one or another candidate.

But if it were VAN it’d be of particular interest for two reasons. First, because a firewall between Hillary and Bernie’s campaigns went down in December, just as Bernie’s campaign finished up an utterly historic fundraising day. A few of Bernie’s staffers accessed some of Hillary’s data — they said to monitor the extent of the breach, which they claimed was the second time it had happened. Bernie sued the DNC over the insecurity of the VAN, but ultimately he ended up punishing several staffers.

In other words, by December, if not before, the DNC had warning that the VAN was unstable. If the hack was of VAN and if it was in any way associated with this time period — or if it was a response to DNC taking no action to force VAN to improve security — then it would be very damaging to the Democrats.

If this hack was of VAN, it would also be significant given that Guccifer 2’s technically bogus explanation of how “he” hacked the DNC claimed he got in through VAN.

How did you break into the DNC network? And are you still in?

These questions are also very popular. I’ve already said about the software vulnerabilities. The DNC had NGP VAN software installed on their system so I used the 0-day exploit and then deployed my backdoor. The DNC used Windows on their server, so it made my work much easier. I installed my Trojan like virus on their PCs. I just modified the platform that I bought on the hacking forums for about $1.5k.

I’ve been inside the network for pretty long time, so I downloaded a lot of files. I lost access after they rebooted the system on June 12. But after all, if they’ll carry on like this it won’t be a problem to get in again and again.

I’ve worked with VAN (albeit in a county party office) and I can’t think of a way it would be hooked up to more substantive computers (hmm–except perhaps within a computer and from there back up through a network). And the explanation appears bogus for a number of other reasons. But it would be interesting if Guccifer 2 had pointed to VAN weeks before the campaign decided to check whether VAN had been accessed (after having been proven to be unstable in the primary).

Finally, it would be interesting if it were VAN for one more reason: because after the December incident, Bernie moved off of VAN. Which means he has files protected from whatever the Russians or whoever else have been up to.

I Con the Record Rolls Out Its 3-Page Intel Collection Efficacy Process

Last year, PCLOB suggested that the intelligence community formalize its process to assess the efficacy of intelligence collection. While it made the recommendation as part of its 702 report, the recommendation itself came against the background of Congress and the IC having decided that the phone dragnet wasn’t really worth the cost and privacy exposure.

I Con the Record just released a report on the processes the IC now uses to conduct such efficacy assessments; the report itself is actually dated February 8. Here’s what the report addressing this complex subject includes:

Page 1: Formal cover

Page 2: [PAGE INTENTIONALLY LEFT BLANK]

Page 3:

• Introductory paragraph
• Two paragraphs laying out PCLOB recommendation
• Two paragraphs discussing “Assessing Efficacy and Value”
  • One paragraph describing that one must make both quantitative and qualitative judgements
  • One paragraph introducing the “comprehensive processes”

Page 4:

• Four paragraphs on the National Intelligence Priorities Framework (see this document for a summary of what the NIPF looked like in 2013), citing both PPD-28’s mandate to consider privacy implications and ODNI’s updated ICD 204 which includes this paragraph (but no mention of the FBI and military/covert operations exceptions to this mandate):

PPD-28 specifically requires consideration of the value of Signals Intelligence activities and the risks of potential exposure of those activities to U.S. foreign policy, defense, commercial, economic, and financial interests, international agreements, privacy concerns, and the protection of intelligence sources and methods.

• The first of two paragraphs on the IC’s “Refined Process on SIGINT Targeting” describing how requiring heads of policy departments to sign off on priorities ensures that senior policymakers provide “comprehensive” oversight of “potentially sensitive” SIGINT collection

Page 5:

• The second paragraph on the IC’s “Refined Process on SIGINT Targeting” describing how, if the senior policymakers decide the risks of collection on a target outweighs its value, they will terminate the collection
• Four paragraphs on “Assessing IC Reporting,” describing how ODNI performs a quantitative (counting reports, including those that get into important reports like the President’s Daily Briefing) and qualitative review of resources dedicated to priorities and production from those units

Page 6 (a half page):

• Two paragraphs on other processes
  • One paragraph noting that individual elements conduct their own assessment
  • One paragraph describing the Intelligence Community Inspector General’s own assessments, noting especially that USA Freedom Act required he complete an assessment of the information acquired under FISA’s Business Records provision
• One paragraph describing a “Path Forward” that might include using prediction markets to identify the most valuable intelligence, but noting such an approach is in a “nascent stage”

Overall, there are just three pages of meat, none of which is terrifically impressive.The reference to the USAF report on assessing the value of intelligence coming from a program underscores that such reporting requirements don’t exist for all other programs. And nowhere in the discussion is any consideration whether the same information might be acquired via less intrusive means (as has happened with the phone dragnet), something that would seem central to balancing trade-offs.

In short, it’s not so much a real process for assessing the value of intelligence against the risks of it, rather than a declaration that policymakers (you know? The people who want to expand their budgets?) will decide.

 

Waving the Constitution at Those Who Ignore It

I waved my pocket copy of the Constitution at Nancy Pelosi on July 19,2008. Khizr Khan waved his at Donald Trump on July 28,2016.

In real time Thursday night, I caught only the final few seconds of Khizer Khan’s powerful speech at the Democratic National Convention in Philadelphia. Through the rest of Thursday and Friday, more and more of the details of the speech flitted through my Twitter stream and then my heart was warmed when I saw photos of Khan pulling out his pocket copy of the Constitution and waving it at Donald Trump. Almost exactly eight years ago, I had done the same thing, waving my pocket copy at Nancy Pelosi, who then was Speaker of the House and appearing at Netroots Nation in Austin.

Khan was confronting Trump about his campaign in which he had noted that “Trump consistently smears the character of Muslims. He disrespects other minorities, women, judges, even his own party leadership. He vows to build walls and ban us from this country.” (Quotes come from this copy of Khan’s transcript.) Khan then continued, presumably in reference to banning Muslims from the US: “Donald Trump, you are asking Americans to trust you with our future. Let me ask you: Have you even read the U.S. Constitution? I will gladly lend you my copy.”

In my case, as I noted here and then in a follow-up a couple of months later here, I was urging Pelosi to act on the clear evidence that the George W. Bush administration had committed war crimes including torture. Sadly, as we now approach the end of two terms with Barrack Obama as President, no significant Bush Administration official has faced any consequences for the torture and other war crimes carried out in our name. Further, despite clear-cut evidence of many crimes by banksters in the massive foreclosure fraud crisis that dispossessed a significant proportion of the US middle class, no significant prosecutions have been undertaken by the Department Formerly Known as Justice.

Khan is so right to wave the Constitution in Trump’s face. Note that a central feature at recent Trump rallies has been endless chanting of “Lock her up”, calling for prosecution of Hillary Trump for crimes associated with her use of a private email server (and presumably also for Benghazi!!1!) while serving as Secretary of State.

And that is where I see potential huge danger for our dear Constitution. We already have seen failure to prosecute crimes of tremendous impact to the world and to ordinary citizens here at home. Should Trump win, how could a “Justice Department” that already has shown a willingness to ignore the law in response to the desires of two presidents in a row refuse Trump’s insistence that Clinton be incarcerated through massive overcharging of any technical violation (if it even occurred, which is a huge stretch on its own) on the email front and totally fabricated charges on Benghazi.

Thank you, Khizr Khan for reminding our country that we are founded on what should be a sacred document that lays out how we should establish justice. And thank you for the sacrifice of your son Humayun, who was lost while taking part in an ill-advised war in which many of the war crimes discussed above were carried out.

Here is the full video of Khan’s speech. Standing next to him is his wife, Ghazala Khan.

Security Territory And Population Part 3: Security As The Basis For Governing

In the second lecture in Security, Territory and Population, Michele Foucault takes up the problem of food scarcity; this follows his examination of the problems of criminal law and epidemics in the first lecture. Foucault discusses two ways of thinking about problems like scarcity. One idea is that they are misfortunes, in the classical Greek sense, obstacles for humans to overcome. In the other story, they are the result of “man’s evil nature”. These two ideas lead to the basic forms of governmental response. If problems arise from man’s evil nature, then solutions must limit freedom of action and control the exercise of that evil nature. If they are just inevitable facts of life, the ideal solutions come from allowing the greatest freedom to find and test solutions.

Through the mid-18th Century the second idea dominated in Europe. The reaction in France to the problem of food scarcity was an increasingly complex and detailed set of regulations and prohibitions, designed to limit and control the evil behavior that caused scarcity. Foucault identifies a second reason for the adoption of discipline besides man’s evil nature:

The objective is of course for grain to be sold at the lowest possible price so that peasants make the smallest possible profit and townspeople can thus be fed at the lowest possible cost and are consequently paid the lowest possible wages.

This idea is identified with mercantilism. Then in the mid-1700s, the French Physiocrats brought dramatic changes with their emphasis on freeing up trade in grain and letting markets deal with the problems of supply. The government began to allow greater freedom to the market for food. The role of the government shifted from control to supervision and occasionally some assistance to those damaged.

Foucault points out that the problem of scarcity is that it hit everyone in the territory, rich and poor, urban and country. The universality of pain is why scarcity was considered a curse. But with the new arrangement, the problem of universality of damage was ended. Those who could pay were safe, and the problem became one of dealing with those who could not pay. Under the new arrangement the problem of scarcity disappears as a problem for the population as a whole, and becomes a problem only for a comparatively few few.

This is another example of what we saw in the first lecture. The goal of security is to deal with the population as a whole, even knowing that some are not protected.

This lecture closes with a discussion of some of the differences between discipline and security as a theory of government.

1. Discipline encloses and contracts. Security opens and increases circulation, and increases the range of tools of production and control.

2. Discipline focuses on the smallest detail, while security looks at the end results, and ignores details that do not detract from the desired outcome.

3. Discipline divides everything into the categories of permitted and forbidden. Security tries to grasp the “effective reality” of events and processes, The point is to “respond to reality in such a way that this response cancels out the reality to which it responds –nullifies it, or limits, checks, or regulates it.”

Security is connected to liberalism as a form of government. This last difference helps us see the nature of liberalism as a political ideal. It promises more freedom of action, more freedom of response to realty.

The idea of a government of men that would think first of all and fundamentally of the nature of things and no longer of man’s evil nature, the idea of an administration of things that would think before all else of men’s freedom, of what they want to do, of what they have an interest in doing, and of what they think about doing, are all correlative elements. A physics of power, or a power thought of as a physical action in the element of nature, and a power thought of as a regulation that can only be carried out through and by reliance oven the freedom of each, is, I think, something absolutely fundamental. It is not an ideology …. First of all and above all it is a technology of power….

Commentary

1. The idea Foucault is grasping at in that last paragraph is almost defiantly abstract. It isn’t obvious how a government which considers first “the nature of things” and then works through and with “men’s freedom” is a “technology of power” in the normal usage of those words. It seems to me that the choice of outcomes to be sought constitutes the exercise of power. This suggests that by technology, Foucault means merely the choice of methods of reaching the goals of power. Technology of Power sounds more imposing, though.

2. The nature of security becomes quite clear in this lecture. Foucault says that government doesn’t try to provide absolute safety. Instead, it tries to provide an acceptable level of safety while allowing the greatest possible degree of freedom to individuals. He explicitly says that under a security regime people will die of hunger, they will die from inoculations, and there will be murders and property crimes. The government does not attempt to eradicate these problems. Foucault doesn’t even argue that the role of government is to ameliorate the ills visited on the few.

a. This is descriptive, not normative. Foucault doesn’t say what should be, merely what is.

b. Professional experts use this framework as the basis for their analysis. Obama apologist Paul Krugman is a good example. He points to various statistics that say that the economy is functioning well, including low unemployment and the stock market, and he argues heatedly that Sanders’ ideas for change would be bad. It’s certainly true that things are better for many, but Donald Trump is succeeding by arguing that it isn’t working for a huge group of people.

c. The experts who operate within this intellectual framework have consistently refused to deal with the left-behind, the superfluous people. That’s just as true of liberals as it is of the congenitally vicious conservatives. Worse, politicians constantly say that the first job of the politician is to assure our safety. Foucault says the President and all politicians are only going so far to provide that safety. And people will be killed by terrorists; and babies will be born microcephalic because the Congress thinks Zika research is not worth doing.

3. Foucault discusses the notion of man’s evil nature as the cause of social problems. This idea has its origins in Christian religious doctrine. For example, in response to plagues, Medieval Christians engaged in penitential rites seeking mercy from the Almighty. In Evil in Modern Thought, Susan Nieman says that this nonsense only died out in the aftermath of the Lisbon Earthquake of 1755, a horrible disaster in which an earthquake started a fire driving people to the seashore just in time for a tidal wave to kill them. Malagrida, a Jesuit cleric, blamed the disaster on the sinful people of Lisbon, and demanded that they scourge themselves and fast and pray instead of rebuilding. The chief minister Pombal was able to get rid of him and focus on healing the sick, feeding the hungry and rebuilding that great city. According to Nieman, that was the beginning of the end of sin as an explanation of natural disaster.

4. Foucault dismisses the idea of man’s evil nature as the cause of social issues, but wait. There are plenty of aspects of human reality that cause social problems: religious hatred, racism, misogyny, homophobia, xenophobia, and a host of others. These are real parts of us as primates. We shouldn’t just dismiss man’s evil nature as a fantasy. It kills people too, and it isn’t obvious how government can or should or does respond in Foucault’s description.

Two (Three, Four?) Data Points on DNC Hack: Why Does Wikileaks Need an Insurance File?

Actually, let me make that three data points. Or maybe four.

First, Reuters has reported that the DCCC has also been hacked, with the hacker apparently believed to be the same entity (APT28, also believed to be GRU). The hackers created a spoof version of ActBlue, which donors use to give money to campaigns.

The intrusion at the group could have begun as recently as June, two of the sources told Reuters.

That was when a bogus website was registered with a name closely resembling that of a main donation site connected to the DCCC. For some time, internet traffic associated with donations that was supposed to go to a company that processes campaign donations instead went to the bogus site, two sources said.

The sources said the Internet Protocol address of the spurious site resembled one used by Russian government-linked hackers suspected in the breach of the DNC, the body that sets strategy and raises money for the Democratic Party nationwide.

That would mean hackers were after either the donations themselves, the information donors have to provide (personal details including employer and credit card or other payment information), or possibly the bundling information tied to ActBlue.

Second, Joe Uchill, who wrote one of the stories — on two corrupt donors to the Democratic Party — that preceded both publication at the Guccifer 2 site and Wikileaks, said Guccifer gave him the files for the story because Wikileaks was dawdling in publishing what they had.

Guccifer posted some of the documents Uchill used here.

This detail is important because it says Julian Assange is setting the agenda (and possibly, the decision to fully dox DNC donors) for the Wikileaks release, and that agenda does not perfectly coincide with Guccifer’s (which is presumed to be a cut-out for GRU).

As I’ve noted, Wikileaks has its own beef with Hillary Clinton, independent of whom Vladimir Putin might prefer as President or any other possible motive for Russia to do this hack.

Now consider this bizarre feature of several high level leak based stories on the hack: the claim of uncertainty about how the files got from the hackers to Wikileaks. This claim, from NYT, seems bizarrely stupid, as Guccifer and Wikileaks have both said the former gave the latter the files.

The emails were released by WikiLeaks, whose founder, Julian Assange, has made it clear that he hoped to harm Hillary Clinton’s chances of winning the presidency. It is unclear how the documents made their way to the group. But a large sampling was published before the WikiLeaks release by several news organizations and someone who called himself “Guccifer 2.0,” who investigators now believe was an agent of the G.R.U., Russia’s military intelligence service

The claim seems less stupid when you consider these two cryptic comments from two equally high level sourced piece from WaPo. In a story on FBI’s certainty Russia did the hack(s), Ellen Nakashima describes that the FBI is less certain that Russia passed the files to Wikileaks.

What is at issue now is whether Russian officials directed the leak of DNC material to the anti-secrecy group WikiLeaks — a possibility that burst to the fore on the eve of the Democratic National Convention with the release of 20,000 DNC emails, many of them deeply embarrassing for party leaders.

The intelligence community, the officials said, has not reached a conclusion about who passed the emails to WikiLeaks.

“We have not drawn any evidentiary connection to any Russian intelligence service and WikiLeaks — none,” said one U.S. official. Doing so will be a challenge, in part because the material may not have been passed electronically. [my emphasis]

The claim appears this way in a more recent report.

The bureau is trying to determine whether the emails obtained by the Russians are the same ones that appeared on the website of the anti-secrecy group WikiLeaks on Friday, setting off a firestorm that roiled the party in the lead-up to the convention.

The FBI is also examining whether APT 28 or an affiliated group passed those emails to WikiLeaks, law enforcement sources said.

Now, the doubts about whether the files were passed electronically is thoroughly fascinating. I assume the NSA has Assange — and potentially even the Wikileaks drop — wired up about 100 different ways, so the questions about whether the files were passed electronically may indicate that they didn’t see them get passed in such a fashion.

Add in the question of whether they’re even the same emails! We know the DCCC hack is targeting donor information. The Wikileaks release included far more than that. Which raises the possibility GRU is only after donor information (which is part of, but just one part of, what Guccifer has released).

But then there’s this detail. On June 17, Wikileaks released an insurance file — a file that will be automatically decrypted if Wikileaks is somehow impeded from releasing the rest of the files. It has been assumed that the contents of that file are just the emails that were already released, but that is almost certainly not the case. After all, Wikileaks has already released further documents (some thoroughly uninteresting voice mails that nevertheless further impinge on the privacy of DNC staffers). They have promised still more, files they claim will be more damaging. Indeed, Wikileaks claims there’s enough in what they have to indict Hillary, though such claims should always be taken with a grain of salt. Correction: That appears to have been a misunderstanding about what Assange said about the previously released State emails.

But here’s the other question.

There’s no public discussion of Ecuador booting Assange from their Embassy closet (though I’m sure they’re pretty tired of hosting him). His position — and even that of Wikileaks generally — seems pretty stable.

So why does Assange believe they need an insurance file? I don’t even remember the last time they issued an insurance file (update: I think it was when they released an insurance file of Chelsea Manning’s documents). So is there someone else in the process that needs an insurance file? Is there someone else in the process that would use the threat of full publication of the files (which presumably is going to happen anyway) to ensure safety?

I’ll leave that question there.

That said, these data point confirms there are at least two players with different motivations: Wikileaks, and the Russian hackers. But the FBI isn’t even certain whether the files the Russians took are the same that Wikileaks released, which might suggest a third party.

Meanwhile, James Clapper (who thankfully is willing to poo poo claims that hacks that we ourselves do are unique) seems very interested in limiting the panic about this hack.

Update: Oh! I forgot this fifth data point. This absolutely delightful take-down of Debbie Wasserman Schultz includes this claim that Wikileaks has malware in its site, which I’ve asked around and doesn’t seem to be true.

Staff members were briefed in a Tuesday afternoon meeting in Washington that their personal data was part of the hack, as were Social Security numbers and other information for donors, according to people who attended. Don’t search WikiLeaks, they were told — malware is embedded throughout the site, and they’re looking for more data.

Who told the DNC Wikileaks is releasing malware, and why?

Friday: Possibility

Let’s try a Swedish import today, a little something I can’t really classify by a particular genre. This piece is one of my favorites, one of the most haunting tunes I’ve ever heard. It’s probably dream pop for lack of a better label. Lykke Li’s most popular works tend toward indie and synth-pop, sharing a strong rhythm and English lyrics melded with Lykke Li’s unearthly vocals.

Try out I Follow Rivers (dance/synth-pop) and Sadness Is A Blessing (retro indie pop) for comparison. The latter in particular has a funky video featuring another famous Swedish artist, Stellan Skarsgård. Love his understated effort which acts like a punctuation to the singer’s work.

Speaking of Sweden…

Carl Bildt, a former prime minister of Sweden (1991-1994) and former Minister for Foreign Affairs (2006-2014), tweeted on Wednesday:

I never thought a serious candidate for US President could be a serious threat against the security of the West. But that’s where we are.

Bildt is known for his conservative politics and neoliberal business ethics. Pretty sure he wasn’t referring to Clinton.

Turkic troubles

• Insane numbers of people arrested or detained after Turkey’s anti-Gülenist crackdown (EWN) — Graphic in article offers a breakdown. Doesn’t break out the journalists arrested; see Mahir Zeynalov’s timeline for a journo-by-journo roll call.
• UN Special Rapporteur and OSCE worried about Turkey’s journalists (OSCE) — UN Special Rapporteur on the right to freedom of opinion and expression and the Organization for Security and Cooperation in Europe Representative on Freedom of the Media condemned President Erdoğan’s purge of journalism attacking free speech. The numbers bolster their concerns:
  

  Reports indicate that the Government ordered the closure of three news agencies, 16 TV channels, 23 radio channels, 45 papers and 15 magazines. Since the attempted coup, authorities have issued arrest warrants against 89 journalists and have already arrested several of them, blocked access to more than 20 news websites, revoked the licenses of 29 publishing houses, and cancelled a number of press accreditations.

• Generals stepped down as military rejiggered (Euronews) — Looks like the president is grabbing power over the military in the same way the judiciary’s independence has now been smashed by removals from office. Hey, anybody worried at all about Incirlik air base while the Turkish military is reformulated?

Economic emesis

• Investors ‘totally lost’ (Business Insider) — Credit Suisse’s clients are casting about for direction because there’s no strong performance in the market across any industry, and indicators are confusing:
  

  Here’s a summary of what clients are worried about: workers fighting back in the US, hitting earnings; equities still not cheap; US growth mixed; China still screwed; central banks’ empty policy cupboards; politics being nuts (protectionism, anti-immigration moves, anticorporate feeling); and technology running rampant and destroying business models.

  Yeah, about the “workers fighting back”…perhaps if workers were better paid, making a living wage, all of the confusion would evaporate as consumption improved. There’s a reason home ownership rates have dropped below 1965 levels and it’s not because Millennials don’t want them (really crappy blame-casting, CNBC, catch the cluestick).

• Nevada utilities commish not reappointed due to solar energy rate structure (Las Vegas Sun) — Something about this story tweaks my hinky-meter. Maybe a certain commissioner has friends who don’t want solar energy to become competitive? Which is really a shame considering the Tesla’s new Wonderwall battery plant now in the Vegas area.
• Five-year-long shortage of cancer drug forces reliance on disqualified Chinese maker (Bloomberg) — There’s been a shortage of doxorubicin since 2011, and companies the size of Pfizer — the largest pharma company in the world — rely on a facility in China banned by the FDA because of quality problems like contamination. What the hell is wrong with this picture?
• Kazahk emigre sentenced for export violations (The Hill) — How did this guy pull off exporting dual-use technology to Russia for ten years? Doesn’t look like it took much effort based on available information. Have we cut regulatory oversight so much and been so distracted at the same time that we’ve given away the farm?

Something STEMmed

• TSA’s keys compromised (TechCrunch) — Hacking’s not just for software. All seven of TSA’s master keys have been cloned; anybody can 3D print one and unlock baggage with TSA-approved padlock. Why even bother locking stuff? Of course bags can be so damaged during handling the lock may be worthless anyhow. Makes you wonder how many other physical security devices can be defeated with 3D printing.
• Bees’ sperm dramatically affected by insecticides (SFGate) — Hey dudes, especially you in Congress. Maybe you ought to ask if insecticides reduce bees’ sperm production by 40% whether human sperm might also be similarly affected? Just sayin’.
• Huge great white shark trolls family’s boat off east coast (Cape Cod Chronicle) — But there’s an app for that; they could ‘see’ him coming, thanks to an app which monitored the tag. Mixed feelings on this: glad the family was safe, but jeepers, how else can this tag be used?

Oikonomia
How screwed up is the United Kingdom post-referendum vote and how jacked up is the current economic system, when a disabled theoretical physicist and cosmologist must beg in an op-ed for his country to reconsider its understanding and reaction to wealth?

Worth recalling the word ‘economics’ originated from the Greek ‘oikonomia’, meaning “household management.”

Have a safe, relaxing weekend!

Mix and Match Cyber-Priorities Likely Elevates Gut Check To National Level

As I noted yesterday, earlier this week President Obama rolled out a new Presidential Policy Directive, PPD 41, which made some changes to the way the US will respond to cyberattacks.(PPD, annex, fact sheet, guideline) I focused yesterday on the shiny new Cyber Orange Alert system. But the overall PPD was designed to better manage the complexity of responding to cyberattacks — and was a response, in part, to confusion from private sector partners about the role of various government agencies.

That experience has allowed us to hone our approach but also demonstrated that significant cyber incidents demand a more coordinated, integrated, and structured response.  We have also heard from the private sector the need to provide clarity and guidance about the Federal government’s roles and responsibilities.   The PPD builds on these lessons and institutionalizes our cyber incident coordination efforts in numerous respects,

The PPD integrates response to cyberattacks with the existing PPD on responding to physical incidents, which is necessary (actually, the hierarchy should probably be reversed, as our physical infrastructure is in shambles) but is also scary because there’s a whole lot of executive branch authority that gets asserted in such things.

And the PPD sets out clear roles for responding to cyberattacks: “threat response” (investigating) is the FBI’s baby; “asset response” (seeing the bigger picture) is DHS’s baby; “intelligence support” (analysis) is ODNI’s baby, with lip service to the importance of keeping shit running, whether within or outside of the federal government.

To establish accountability and enhance clarity, the PPD organizes Federal response activities into three lines of effort and establishes a Federal lead agency for each:

• Threat response activities include the law enforcement and national security investigation of a cyber incident, including collecting evidence, linking related incidents, gathering intelligence, identifying opportunities for threat pursuit and disruption, and providing attribution.   The Department of Justice, acting through the Federal Bureau of Investigation (FBI) and the National Cyber Investigative Joint Task Force (NCIJTF), will be the Federal lead agency for threat response activities.
• Asset response activities include providing technical assets and assistance to mitigate vulnerabilities and reducing the impact of the incident, identifying and assessing the risk posed to other entities and mitigating those risks, and providing guidance on how to leverage Federal resources and capabilities.   The Department of Homeland Security (DHS), acting through the National Cybersecurity and Communications Integration Center (NCCIC), will be the Federal lead agency for asset response activities.  The PPD directs DHS to coordinate closely with the relevant Sector-Specific Agency, which will depend on what kind of organization is affected by the incident.
• Intelligence Support and related activities include intelligence collection in support of investigative activities, and integrated analysis of threat trends and events to build situational awareness and to identify knowledge gaps, as well as the ability to degrade or mitigate adversary threat capabilities.  The Office of the Director of National Intelligence, through the Cyber Threat Intelligence Integration Center, will be the Federal lead agency for intelligence support and related activities.

In addition to these lines of effort, a victim will undertake a wide variety of response activities in order to maintain business or operational continuity in the event of a cyber incident.  We recognize that for the victim, these activities may well be the most important.  Such efforts can include communications with customers and the workforce; engagement with stakeholders, regulators, or oversight bodies; and recovery and reconstitution efforts.   When a Federal agency is a victim of a significant cyber incident, that agency will be the lead for this fourth line of effort.  In the case of a private victim, the Federal government typically will not play a role in this line of effort, but will remain cognizant of the victim’s response activities consistent with these principles and coordinate with the victim.

Thus far, this just seems like an effort to stop everyone from stepping on toes, though it also raises concerns for me whether this is the first step (or the public sign) of Obama implementing a second portal for CISA, which would permit (probably) FBI to get Internet crime data directly without going through DHS’s current scrub process. Unspoken, of course, is that necessity for a new PPD means there has been toe-stepping in incident response in the last while, which is particularly interesting when you consider the importance of the OPM breach and the related private sector hacks. Just as one example, is it possible that no one took the threat information from the Anthem hack and started looking around to see where else it was happening.

So yeah, some concerning things here, but I can see the interest in minimizing the toe-stepping as we continue to get pwned in multiple breaches.

Also, there’s no mention of NSA here. Shhhh. They’re here, as soon as an entity asks them for help and (from an intelligence perspective with data laundered through FBI and ODNI and DHS) from an intelligence perspective.

Here’s what I find particularly interesting about all this.

The PPD — along with the fancy Cyber Orange Alert system — came out less than a week after DOJ’s Inspector General released a report on the FBI’s means of prioritizing cyber threats (which is different than cyber attacks). The report basically found that the FBI has improved its cyber response (there’s some interesting discussion about a 2012 reorganization into threat type rather than attack location that I suspect may have implications for both criminal venue and analytical integrity, including for the attack on the DNC server), but that the way in which it prioritized its work didn’t result in prioritizing the biggest threats, in part because it was basically a “gut check” and in part because the ranking process wasn’t done frequently enough to reflect changes in the nature of a given threat (there was a classified example of a threat that had grown but been missed and of conflicting measures in the two ways FBI assesses threats, both of which are likely very instructive). The report does mention the OPM hack as proof that the threat is getting bigger, which does not confirm nor deny that it was one of the classified issues redacted.

The FBI conducts a bureau-wide Threat Review and Prioritization (TRP) process, of which cyber is a part, which happens to have the same number of outcomes as the PPD 41 does, 6, though it is more of a table cross-referencing impact with mitigation (the colors come from DOJ IG so comparing them would be meaningless).

And the FBI TRP asks some of the same questions as the PPD’s Cyber Orange Alert system does.

The FBI’s Directorate of Intelligence (DI) manages the TRP process and publishes standard guidance for the operational divisions and field offices to use; including the criteria for the impact level of the threat and the mitigation resources needed to address the threat. The FBI impact level criteria attempt to measure the likely damage to U.S. critical infrastructure, key resources, public safety, U.S. economy, or the Integrity and operations of government agencies in the coming ear based upon FBI’s current understanding of the threat issue. Impact level criteria seek to represent the negative consequences of the threat issue, nationally. The impact level criteria include: (1) these threat issues are likely to cause he greatest damage to national interests or public safety in the coming year; (2) these threat issues are likely to cause great damage to national interests or public safety in the coming year; (3) these threat issues are likely to cause moderate damage to national interests or public safety in the coming year; or (4) these threat issues are likely to cause minimal damage to national interests or public safety in he coming year (FBI emphasis added). 12 One FBI official told us that these impact criteria questions, which are developed and controlled by the Directorate of Intelligence, are designed to be interpreted by the operational divisions.

The three levels of mitigation criteria, which also are standard across the FBI, measure the effectiveness of current FBI investigative and intelligence activity based upon the following general criteria: ( 1) effectiveness of FBI operational activities; (2} operational division understanding of the threat issue at the national level; and {3) evolution of the threat issue as it pertains to adapting or establishing mitigation action.

This is the system that people DOJ IG interviewed described as a “gut check.”

While the criteria are standardized, we found that they were inherently subjective. One FBI official told us that the prioritization of the threats was essentially a “gut check.” Other FBI officials told us that the TRP is vague and arbitrary. The Cyber Division Assistant Director told us that the TRP criteria are subjective and assessments can be based on the “loudest person in the room.”

There was some tweaking of this system in March, but DOJ IG said it didn’t affect the findings of this report.

FBI has another newer system called Threat Examination and Scoping (TExAS; it claimed it was far more advanced in its own 9/11 review report a few years back), which they also only use once a year, but which at least is driven by objective questions to carry out the prioritization. DOJ IG basically found this better system suffered the things you always find at FBI: data entry problems, a lack of standard operating procedures, stove-piped management, disconnection from FBI’s other data system. But it said that if TExAS fixed those issues and made it more objective it would be the tool the FBI needs to properly prioritize threats.

There’s one detail of particular interest. The report narrative described one advantage of TExAS as that it could integrate information from other agencies, foreign, or private partners.

According to FBI officials, TExAS has the capability to include intelligence from other agencies, the United States Intelligence Community, private industry, and foreign partners to inform FBI’s prioritization and strategy. For example, a response in TExAS can be supported with documentation from a United States Intelligence Community partner for a threat as to which the FBI lacks visibility. The tool also is capable of providing data visualizations, which can help inform FBI decision makers about prioritizing or otherwise allocating resources toward new national security cyber intrusion threats, or towards national security intrusion threats where more intelligence is needed.

But way down in the appendix, it describes what appears to be this same ability to integrate information on which the “FBI lacks visibility” as a “classification limitation” that requires analysts to review the rankings to tweak them to account for the classified information.

In other words, because of classification issues (see?? I told you NSA was here!!), even the system that might become objective will still be subject to these reviews by analysts who are privy to the secret information.

Now I’m not sure that makes PPD 41’s own prioritization system fatal — aside from the fact that it seems like it will be a gut check, too. Though it does lead me to wonder whether FBI didn’t adequately prioritize some growing threat (cough, OPM) and as a result — the DOJ IG report admits — FBI simply wouldn’t dedicate the resources to investigate it until it really blew up. Under PPD-41, it would seem ODNI would do some of this anyway, which would eliminate some of the visibility problems.

I point all this out, mostly, because of the timing. Last week, DOJ IG said FBI needed to stop gut checking which cyber threats were most important. This week, the White House rolled out a broad new PPD, including a somewhat different assessment system that determines how many federal agencies get to step on cyber-toes.

On Responsible Sourcing for DNC Hack Stories

For some reason Lawfare thinks it is interesting that the two Democratic members of the Gang of Four — who have apparently not figured out there’s a difference between the hack (allegedly done by Russia) and the dissemination (done by Wikileaks, which has very different motivations) are calling for information on the DNC hack to be released.

The recent hack into the servers of the Democratic National Committee (DNC) and the subsequent release via WikiLeaks of a cache of 20,000 internal e-mails, demonstrated yet again the vulnerability of our institutions to cyber intrusion and exploitation.  In its timing, content, and manner of release, the email dissemination was clearly intended to undermine the Democratic Party and the presidential campaign of Secretary Hillary Clinton, and disrupt the Democratic Party’s convention in Philadelphia.

[snip]

Specifically, we ask that the Administration consider declassifying and releasing, subject to redactions to protect sources and methods, any Intelligence Community assessments regarding the incident, including any that might illuminate potential Russian motivations for what would be an unprecedented interference in a U.S. Presidential race, and why President Putin could potentially feel compelled to authorize such an operation, given the high likelihood of eventual attribution.

For some equally bizarre reason, WaPo thinks Devin Nunes’ claim — in the same breath as he claims Donald Trump’s repeated calls on Russia to release Hillary’s email were sarcastic — that there is “no evidence, absolutely no evidence” that Russia hacked the DNC to influence the election is credible.

Rep. Devin Nunes (R-Calif.), the chairman of the House Intelligence Committee, told The Washington Post in an interview Wednesday that speculation about Russian attempts to sway the presidential election is unfounded.

“There is no evidence, absolutely no evidence, that the Russians are trying to influence the U.S. election,” Nunes said, repeatedly swatting away the suggestion made by some Democrats that the Russians may be using their intelligence and hacking capabilities to boost Donald Trump’s chances.

“There is evidence that the Russians are actively trying to hack into the United States — but it’s not only the Russians doing that. The Russians and the Chinese have been all over our networks for many years.”

These are two obvious (because they’re on the record) examples of partisans using their access to classified information to try to boost or refute a narrative that the Hillary Clinton campaign has explicitly adopted: focusing on the alleged Russian source of the hack rather on the content of the things the hack shows.

Kudos to Richard Burr, who is facing a surprisingly tough reelection campaign, for being the one Gang of Four member not to get involved in the partisan bullshit on this.

There are plenty of people with no known interest in either seeing a Trump or a Clinton presidency that have some measure of expertise on this issue (this is the rare moment, for example, when I’m welcoming the fact that FBI agents are sieves for inappropriate leaks). So no outlet should be posting something that obviously primarily serves the narrative one or the other candidate wants to adopt on the DNC hack without a giant sign saying “look at what partisans have been instructed to say by the campaign.” That’s all the more true for positions, like the Gang of Four, that we’d prefer to be as little politicized as possible. Please don’t encourage those people to use their positions to serve a partisan narrative, I beg of you!

For the same reason I’m peeved that Harry Reid suggested the Intelligence Community give Trump fake intelligence briefings. Haven’t we learned our lesson about politicizing intelligence?

More generally, I think journalists should be especially careful at this point to make it clear whether their anonymous sources have a partisan dog in this fight, because zero of those people should be considered to be unbiased when they make claims about the DNC hack.

A very special case of that comes in stories like this, where Neocon ideologue Eliot Cohen, identified as Bush appointee, is quoted attacking Trump for suggesting Russia should leak anymore emails.

But now Republican-aligned foreign policy experts are also weighing in along similar lines.

“It’s appalling,” Dr. Eliot A. Cohen, who was counselor of the State Department during the second term of George W. Bush’s presidency, said to me today. “Calling on a foreign government to go after your opponent in an American election?”

Cohen recently organized an open letter from a range of GOP national security leaders that denounced Trump in harsh terms, arguing that Trump’s “own statements” indicate that “he would use the authority of his office to act in ways that make America less safe, and which would diminish our standing in the world.” The letter said: “As committed and loyal Republicans, we are unable to support a Party ticket with Mr. Trump at its head. We commit ourselves to working energetically to prevent the election of someone so utterly unfitted to the office.”

But this latest from Trump, by pushing the envelope once again, raises the question of whether other prominent Republicans are ever going to join in.

For instance, to my knowledge, top national security advisers to George W. Bush, such as Stephen Hadley and Condoleezza Rice (who was also secretary of state), have yet to comment on anything we’ve heard thus far from Trump. Also, there could theoretically come a point where figures like former Defense Secretary Donald Rumsfeld and possibly even Dubya and George H.W. Bush feel compelled to weigh in.

Meanwhile, senior Republican elected officials who have backed Trump continue to refrain from taking on his comments forcefully or directly. Some Republicans actually defended Trump’s comments today. Paul Ryan’s spokesman issued a statement saying this: “Russia is a global menace led by a devious thug. Putin should stay out of this election.”

I feel differently about Trump’s asinine comment than I do about attribution of the attack. I’m all in favor of Hillary’s campaign attacking Trump for it, and frankly Cohen is a far more credible person to do so than Jake Sullivan and Leon Panetta, who also launched such attacks yesterday, because as far as I know Cohen has not mishandled classified information like the other two have.

But I would prefer if, rather than IDing Cohen as one of the Republicans who signed a letter opposing Trump, Greg Sargent had IDed him as someone who has also spoken affirmatively for Hillary.

On foreign policy, Hillary Clinton is far better: She believes in the old consensus and will take tough lines on China and, increasingly, Russia. She does not hesitate to make the case for human rights as a key part of our foreign policy. True, under pressure from her own left wing, she has backtracked on the Trans-Pacific Partnership, a set of trade deals that supports American interests by creating a counterbalance to China and American values by protecting workers’ rights. But she might edge back toward supporting it, once in.

Admittedly, this was at a time when Cohen and others still hoped some Mike Bloomberg like savior would offer them a third choice; that was before Bloomberg gave a very prominent speech endorsing Hillary last night.

Here’s the thing. The Neocons (led by Robert Kagan, whose wife got named as a target of Russian aggression in the Feinstein-Schiff letter) are functioning as surrogates for Hillary just like top Democrats are. They are, just like Democrats are, now scrambling to turn their endorsements into both policy and personnel wins. Therefore we should no more trust the independence of a pro-Hillary Neocon — even if he did work for George Bush — than we would trust the many Democrats who have used their power to help Hillary win this election. Progressives should be very wary about the promises Hillary has made to get the growing number of Neocons (and people like Bloomberg) to so aggressively endorse her. Because those endorsements will come with payback, just like union or superdelegate endorsements do.

In any case, it’s hard enough to tease out attribution for two separate hacks and the subsequent publication of the hacked data by Wikileaks. Relying on obviously self-interested people as sources only further obscures the process.

What Are the DNC Hack(s) Rated on Obama’s New Cyber-Orange Alert System?

Yesterday, President Obama rolled out yet another new cyber-directive, this one aiming to better coordinate response to attacks. (PPD, annex, fact sheet) Along with all that, the White House released a guideline on the ranking of cyberattacks, including the Orange Alert type table that reminds me of Tom Ridge’s discredited system.

I’m going to post at more length about this prioritization system and the PPD.

But for the moment I wanted to post the table separately to ask what you think the DNC hack(s) (remember there were two) would rank on the system. My guess is the initial hack (APT29, alleged to be FSB) would be Level 1 or even 0. State actors spy on political parties all the time, and that’s all we’ve been told APT29 was doing.

The real question is APT28, which is the hack alleged to have ties to Guccifer and therefore to the Wikileaks posting of all the emails. It’s not yet clear the hack was intended to elect Trump (assuming it is Russian); I think it more likely to be retaliation for the Ukrainian coup. It’s not clear how important it will be on the election (and I expect more damaging documents to be released closer to the election). And it’s not clear how much this really has affected public confidence.

The question is still more problematic if you try to grade the OPM hack, which has to be far closer to a Level 4 (because of the risk it placed clearance holders under). But do you also lump it in with, say, the hack of Anthem, which is understood to be related?

I will ask the White House tomorrow if it has ranked the DNC hack(s). But for now, where do you think it would rate?

ISIS’ 4 Terabyte Cache of Un- or Badly Encrypted Data

Reuters just published a story about a big cache of data ISIS left as it retreated from Manbij. It’s great news that the military got these materials, as it will helps us defeat ISIS. Just as important is this part.

The material, gathered as fighters moved from village to village surrounding the town of Manbij, includes notebooks, laptops, USB drives, and even advanced math and science textbooks rewritten with pro-Islamic State word problems, Colonel Chris Garver, the U.S. military spokesman in Iraq, said in a news briefing.

The U.S.-backed fighters – an alliance of Kurdish and Arab forces – have gathered more than 4 terabytes of digital information, and the material, most of it in Arabic, is now being analyzed by the U.S-led coalition fighting the militant group.

This retreat is happening as we speak. That means that US forces were able to exploit the data almost immediately on seizing it. And that, in turn, either means it is not encrypted, it is badly encrypted, or the US also got passwords for encrypted files along with the rest of the stash.

Perhaps this can put to rest the calls to weaken encryption because ISIS is using it to great effect?

The Other Factor in the DNC Hack: WikiLeaks’ Personal War with Hillary Clinton

Since yesterday, both Jack Goldsmith and Peter Singer have had offered some interesting perspective on the alleged Russian hack of the DNC.

Singer had a bit of a Twitter rant.

His linked (recent) Oversight testimony which discussed how much more complex cyber deterrence is than Cold War nuclear deterrence is.

For his part, Goldsmith first considered what was old and new in the hack, finding the only real new thing was releasing the emails.

While there is nothing new in one nation using its intelligence services to try to influence an election in another, doing so by hacking into a political party’s computers and releasing their emails does seem somewhat new.

He then dismissed the notion — floated elsewhere — that this amounts to cyberwar while implying that the US has to get far better at defending our own networks and systems.

How seriously do you think the government takes issues of cyberwarfare? Do you feel confident about our defensive capabilities and competence?

“Cyberwar” is a misleading term—the Russian hack, if it is that, is not an act of war, at least not by traditional standards. It is closer to an intelligence operation with the twist of a damaging publication of the stolen information. That said, the U.S. government takes all major cyberoperations against it and its major public and private institutions very seriously. My confidence about our defensive capabilities and competence depends on what institutions you are talking about. Today, some components of the government (e.g. the Defense Department) do better than others (e.g. the Office of Personnel Management, which recently suffered an very damaging hack). And private sector defenses, even of important critical infrastructure networks, are a very mixed bag. The scale of the challenge is enormous, and offense has many advantages over defense. I don’t know anyone who is sanguine about our defensive capabilities overall.

Then we went on a Twitter rant directed at the hand-wringing about how unusual this is.

1/ In assessing the DNC hack, remember that USG is no innocent when it comes to infiltrating foreign computer networks.

2/ The cyber-attack on Iranian nuclear centrifuges was one of the most consequential in history.

3/ USG openly & aggressively supports technologies that weaken foreign gov’t control over networks.

[snip]

6/ It’s also well known that US has in past used covert ops to influence foreign elections.

7/ Current U.S. cyber-espionage almost certainly extends to political organizations in adversary states.

[snip]

11/ The point is that USG plays rough in cyberspace, and should expect others to do so as well.

12/  And yet USG seems perpetually unprepared. DNC hack is tiny tip of iceberg of possible electoral disruptions via cyber.

In short, both think this is something other than cyberwar, but view the importance of it differently (even while both provide suggestions for a policy framework to respond), particularly the uniqueness of the perceived sabotage of the election. But their discussion (along with virtually everyone else’s) has pitched this as a two-front question, us against Russia.

After having dismissed the unthinking equation of 2 intelligence hacks = Guccifer = Russia = WikiLeaks = Russia story, I want to return to it to complicate matters somewhat, to talk about Wikileaks role whether or not it cooperated with Russia on this. First, what follows is in no way meant to be a defense of Wikileaks’ action here, which included the inclusion of credit card and social security information in the dump. Particularly against the background of what it recently did with Turkish documents: in the guise of releasing a bunch of Erdogan documents, it also dumped voting information on most women in Turkey, including whether or not they were members of Erdogan’s AKP.

WikiLeaks also posted links on social media to its millions of followers via multiple channels to a set of leaked massive databases containing sensitive and private information of millions of ordinary people, including a special database of almost all adult women in Turkey.

Yes — this “leak” actually contains spreadsheets of private, sensitive information of what appears to be every female voter in 79 out of 81 provinces in Turkey, including their home addresses and other private information, sometimes including their cellphone numbers. If these women are members of Erdogan’s ruling Justice and Development Party (known as the AKP), the dumped files also contain their Turkish citizenship ID, which increases the risk to them as the ID is used in practicing a range of basic rights and accessing services. The Istanbul file alone contains more than a million women’s private information, and there are 79 files, with most including information of many hundreds of thousands of women.

[snip]

Another file appears to contain sensitive information, including Turkish citizenship IDs of what appears to be millions of AKP members, listed as active or deceased. Yet another file contains the full names, citizenship IDs and cellphone numbers of hundreds of thousands of AKP election monitors — the most active members of the party.

As Zeynep Tufekci points out, in the wake of the failed coup and Erdogan’s retaliation, this has the possibility of endangering a great number of people.

She blames the dump on Wikileaks’ failure to work with locals, who could have explained that the emails themselves were virtually worthless. Perhaps. Perhaps Wikileaks served as someone else’s useful idiots — or even, if you believe there’s something more deliberate behind the coup and counter-coup, perhaps Wikileaks played a more active role.

So Wikileaks has done two things that were egregious and damaging. I do not defend that. I condemn it (and the sloppy journalism that enabled it).

But I want to consider how different its role is with the target of this leak — Hillary Clinton (and Democrats more generally) — and Turkey.

Most of the discussion about the where and whyfor of the leak assumes it is all about Russia’s interest (assuming, of course, that this was a Russian state hack). But consider why Wikileaks might want to leak in this way and at this time.

Hillary was, of course, Secretary of State when Wikileaks leaked the State department cables and pushed aggressively for Chelsea Manning’s prosecution (as Charlie Savage wrote in a piece published just before I finished this, this is a point Assange made when he discussed the emails 6 weeks ago). She has, since then, been found to treat information claimed to be far more sensitive in careless fashion (as has the State Department generally).

Very importantly, State worked closely with DOJ as it investigated Wikileaks. There is very good reason to believe that as part of that investigation, DOJ mapped out Wikileaks’ supporters and, possibly, financial contributors — that is, precisely the kind of people, to the DNC, that Wikileaks just doxxed. That’s arguably a violation of Section 215, which includes First Amendment protections.

We also know that GCHQ was (at least as a SIGDEV research project, but those often serve to conduct surveillance that wouldn’t really fly within other legal guidelines) collecting log files of people who visit Wikileaks.

We know that under pressure from the US government, traditional funding sources stopped taking donations for Wikileaks. I’ve seen hints of some legally dubious action that my be worse, as well. In addition, in 2012, the FBI considered Bitcoin donations to Wikileaks among the many nefarious things one could do with Bitcoin.

Love or hate Wikileaks, but it — and its political and financial supporters — were tracked. Its sources of funding were cut off. And then the government realized that Wikileaks (at that point, at least) was engaging in what a lot of media outlets also do and conceded it couldn’t charge Assange for those activities.

Now I’m not trying to say two wrongs make a right — that because FBI collected data implicating innocent supporters of Wikileaks, it is okay for Julian Assange to dox all the DNC’s supporters.

Rather, I’m trying to raise this in the context of the issues that Singer and Goldsmith lay out. Whether Wikileaks cooperated with Russia (if Russia did the hack) or not, it is a key player in this leak. Even if Russia did this to help Trump, Assange executed the leaks to maximal damage to Hillary (and I suspect Wikileaks will continue to do more damage with further leaks). What does this say about issues of retaliation against non-state actors working with the sphere of state actors, as people consider information war in the era of cyber?

I don’t know the answer to that, but as we raise the question, those issues need to be addressed as readily as the state actor question. The way this rolls out may be as much a question of a non-state actor retaliating against a political figure as it is a state actor trying to elect its preferred candidate.

 

NSA and CIA Hacked Enrique Peña Nieto before the 2012 Election

Part of the frenzied discussion about the possibility that Russia hacked the DNC includes claims that the US would never do something so dastardly.

Except that the Foreign Government Section 702 Certificate makes it clear the NSA is authorized to spy on foreign based political organizations even within the US (and would have far more liberty under EO 12333). Among the parties specifically authorized for targeting in 2010 was Pakistan’s People Party.

Indeed, the Snowden documents have an even better example of us spying in advance of an election — when, in June 2012, NSA targeted the texts between Enrique Peña Nieto and nine of his closest associates.

The NSA’s intelligence agents in Texas must have been asking themselves such questions when they authorized an unusual type of operation known as structural surveillance. For two weeks in the early summer of 2012, the NSA unit responsible for monitoring the Mexican government analyzed data that included the cell phone communications of Peña Nieto and “nine of his close associates,” as an internal presentation from June 2012 shows. Analysts used software to connect this data into a network, shown in a graphic that resembles a swarm of bees. The software then filtered out Peña Nieto’s most relevant contacts and entered them into a databank called “DishFire.” From then on, these individuals’ cell phones were singled out for surveillance.

According to the internal documents, this led to the agency intercepting 85,489 text messages, some sent by Peña Nieto himself and some by his associates. This technology “might find a needle in a haystack,” the analysts noted, adding that it could do so “in a repeatable and efficient way.”

This would have been in the weeks leading up to the election on July 1.

There is one difference: We don’t know what our spooks did with the information gleaned 85,489 texts kept from candidate EPN (it was a close election, and I presume we preferred EPN to Andrés Manuel López Obrador). NSA and CIA (with which NSA partnered on this hack) certainly did not release any information we know of from those texts. A more interesting question, in this case, is whether the US used anything from those texts to reassure ourselves — or ensure — that EPN’s campaign promises to change Mexico’s level of cooperation in the war on drugs (which of course also means spying) would change once he won the election, as they did.

None of this excuses Russia if it hacked the DNC. But it does provide a very concrete example where the US hacked the most intimate network of a person running for office — and of an ally, no less.

Spies steal information, even from political candidates. Including American spies.

The Two Intelligence Agency Theory of Handing Trump the Election

There has been a lot written about Russia intelligence agencies allegedly hacking the DNC server and — by leaking it — attempting to influence the election. Some observers have, based on that assumption, called the hack an act of war.

I’m agnostic on whether Russian intelligence did one or both of the hacks, in part for reasons I’m still working through. I’m even more skeptical of some of the claims made about Russia’s motivations in launching this attack to put Trump in the presidency (which is not to say Trump wouldn’t be horrible for a whole slew of other reasons); on that topic, see this Josh Marshall piece and a fact-checking of it. And I’m frankly amused that, after using several other outlets for publicity and to release documents, the hacker(s’) cooperation with WikiLeaks (which irresponsibly released credit card and social security information on Democratic donors, but which almost certainly had its donors investigated by DOJ with the heavy involvement of Clinton after Wikileaks published the State cables) itself is a sign of Russian involvement. Does Russia also run The Hill, the last outlet used by DNC hacker(s)?

In short, there are a whole bunch of claims being made, all serving a narrative that Putin is playing in our elections, with little scrutiny of how you get from one level (what have been described as two separate hacks) to another (to Guccifer 2, to help Putin) to another (with the help of Wikileaks). It’s like the Rosetta stone of Cold War 2.0 paranoia. All may be true, but the case is thus far still fragile.

This post, from Thomas Rid, is the most sober analysis of the claim that Russian hackers hacked the DNC. Even still, there are some logical problems with the analysis (that are sadly typical of the underlying cybersecurity consultants). Take these two passages, for example.

The DNC knew that this wild claim would have to be backed up by solid evidence. APost story wouldn’t provide enough detail, so CrowdStrike had prepared a technical report to go online later that morning. The security firm carefully outlined some of the allegedly “superb” tradecraft of both intrusions: the Russian software implants were stealthy, they could sense locally-installed virus scanners and other defenses, the tools were customizable through encrypted configuration files, they were persistent, and the intruders used an elaborate command-and-control infrastructure. So the security firm claimed to have outed two intelligence operations.

[snip]

The metadata in the leaked documents are perhaps most revealing: one dumped document was modified using Russian language settings, by a user named “Феликс Эдмундович,” a code name referring to the founder of the Soviet Secret Police, the Cheka, memorialised in a 15-ton iron statue in front of the old KGB headquarters during Soviet times. The original intruders made other errors: one leaked document included hyperlink error messages in Cyrillic, the result of editing the file on a computer with Russian language settings. After this mistake became public, the intruders removed the Cyrillic information from the metadata in the next dump and carefully used made-up user names from different world regions, thereby confirming they had made a mistake in the first round.

They argue (based in part on CrowdStrike’s claims of expertise) both that the hacker(s) were really sophisticated and that they deliberately adopted a Russian name but accidentally left Russian metadata in the files. Particularly with regards to the Russian metadata, you don’t both adopt a notable Russian spook’s ID while engaging in a false flag but then “accidentally” leave metadata in the files, although the second paragraph here pertains to Guccifer 2 and not the Crowdstrike IDed hackers.

If Guccifer were a true false flag, he might well be pretending to be Russian to hide his real identity.

Add to that this post (from June), which notes some confirmation bias in the way that FireEye first attributed APT 28 (which CrowdStrike believes to be GRU, Russia’s military intelligence).

I chose to look at Fancy Bear (APT28 in FireEye’s ecosystem). The most comprehensive report on that threat actor was written by FireEye and released last October, 2014 so I started with that. To my surprise, the report’s authors declared that they deliberately excluded evidence that didn’t support their judgment that the Russian government was responsible for APT28’s activities:

“APT28 has targeted a variety of organizations that fall outside of the three themes we highlighted above. However, we are not profiling all of APT28’s targets with the same detail because they are not particularly indicative of a specific sponsor’s interests.” (emphasis added)

That is the very definition of confirmation bias. Had FireEye published a detailed picture of APT28’s activities including all of their known targets, other theories regarding this group could have emerged; for example, that the malware developers and the operators of that malware were not the same or even necessarily affiliated.

And even if you took the underlying report as definitive, APT 28 was primarily focused on military targets, which by itself ought to raise questions about why they’d go after the DNC.

To make the argument based on targets that APT 28 is GRU you need to do even more adjusting of motivation (though more recent APT 28 attributed attacks are more similar to this one).

But one reason I find the Rid piece sober and useful is it emphasizes something that has been ignored by much of the inflamed reporting. First, even CrowdStrike claims that DNC was hacked twice, by two different Russian entities, which did not appear to be coordinating during the hack. From the CrowdStrike report:

At DNC, COZY BEAR intrusion has been identified going back to summer of 2015, while FANCY BEAR separately breached the network in April 2016. We have identified no collaboration between the two actors, or even an awareness of one by the other. Instead, we observed the two Russian espionage groups compromise the same systems and engage separately in the theft of identical credentials. While you would virtually never see Western intelligence agencies going after the same target without de-confliction for fear of compromising each other’s operations, in Russia this is not an uncommon scenario. “Putin’s Hydra: Inside Russia’s Intelligence Services”, a recent paper from European Council on Foreign Relations, does an excellent job outlining the highly adversarial relationship between Russia’s main intelligence services – Федеральная Служба Безопасности (FSB), the primary domestic intelligence agency but one with also significant external collection and ‘active measures’ remit, Служба Внешней Разведки (SVR), the primary foreign intelligence agency, and the aforementioned GRU. Not only do they have overlapping areas of responsibility, but also rarely share intelligence and even occasionally steal sources from each other and compromise operations. Thus, it is not surprising to see them engage in intrusions against the same victim, even when it may be a waste of resources and lead to the discovery and potential compromise of mutual operations.

And, as Rid points out, the proof that Guccifer is tied to Russia (it would be to GRU or APT 28 if the tie were real, so the less persistent of the two apparently unrelated hacks) is even less clear, though there still is a lot of circumstantial evidence.

The evidence linking the Guccifer 2.0 account to the same Russian operators is not as solid, yet a deception operation—a GRU false flag, in technical jargon—is still highly likely. Intelligence operatives and cybersecurity professionals long knew that such false flags were becoming more common. One noteworthy example was the sabotage of France’s TV5 Monde station on 9/10 April 2015, initially claimed by the mysterious “CyberCaliphate,” a group allegedly linked to ISIS. Then, in June, the French authoritiessuspected the same infamous APT 28 group behind the TV5 Monde breach, in preparation since January of that year. But the DNC deception is the most detailed and most significant case study so far. The technical details are as remarkable as its strategic context.

[snip]

Other features are also suspicious. One is timing, as ThreatConnect, another security company, has pointed out in a useful analysis: various timestamps indicate that the Guccifer-branded leaking operation was prompted by the DNC’s initial publicity, with preparation starting around 24 hours after CrowdStrike’s report came out. Both APT 28 and Guccifer were using French infrastructure for communications. ThreatConnect then pointed out that both the self-proclaimed hacker’s technical statements on the use of 0-day exploits as well as the alleged timeline of the DNC breach are most likely false. Another odd circumstantial finding: sock-puppet social media accounts may have been created specifically to amplify and extend Guccifer’s reach, as UK intelligence startup Ripjar told me.

Perhaps most curiously, the Guccifer 2.0 account, from the beginning, was not simply claiming to have breached the DNC network—but claiming that two Russian actors actually were not on the DNC network at the same time. It is common to find multiple intruders in tempting yet badly defended networks. Nevertheless the Guccifer 2.0 account claimed confidently, and with no supporting evidence, that the breach was simply a “lone hacker”—a phrasing that seems designed to deflect blame from Russia. Guccifer 2.0’s availability to the journalists was also surprising, and something new altogether.

The combative yet error-prone handling of the Guccifer account is in line with the GRU’s aggressive and risk-taking organizational culture and a wartime mindset prevalent in the Russian intelligence community. Russia’s agencies see themselves as instruments of direct action, working in support of a fragile Russia under siege by the West, especially the United States.

Now, again, I’m not saying the Russians didn’t do this hack, nor am I dismissing the idea that they’d prefer Trump to Hillary. By far the most interesting piece of this is the way those with the documents — both the hackers and Wikileaks — held documents until a really awkward time for some awkward disclosures, with what may be worse to come.

But discussions that want to make the case should explain several things: Which of the two agencies alleged to have hacked DNC are behind the operation — or are they both, even though they weren’t, at least according to eh report that everyone is relying on without question, apparently cooperating? How certain can they be that the GRU is Guccifer, and if Guccifer is supposed to be a false flag why was it so incompetently done? What explains Guccifer’s sort of bizarre strategy along the way, encompassing both Wikileaks (an obvious one) and The Hill?

Again, I absolutely don’t put this kind of thing beyond Putin. Russia has used hacking to influence outcomes of elections and authority in various countries in the past and the only thing new here is that 1) we wouldn’t already be playing the other side and 2) we’re big and can fight back. But the story, thus far, is more complex than being laid out.