Tear Up Texas, Tear Up Another Encryption Claim

Both the Intercept and the Daily Beast have reported on this eye-popping exchange from the criminal complaint charging Erick Hendricks with conspiracy to provide material support for terrorism, showing an undercover FBI employee advising one of the future Garland gunmen to “tear up Texas” in the days before the attack.

[Allegedly] Elton Simpson: Did u see that link I posted? About texas? Prob not.

UCE: [states he doesn’t have Simpson’s Twitter handle]

Simpson: [posts link to Draw Prophet Mohammed Contest

UCE: Tear up Texas.

Simpson: Bro, u don’t have to say that… U know what happened in Paris… I think … Yes or no …?

UCE: Right

Simpson: So that goes without saying … No need to be direct.

[snip]

UCE-1 subsequently traveled to Garland, Texas and was present on or about May 3, 2015, at the event.

[snip]

UCE-1 claimed to have been the “eyes” of Hendricks, to have seen Simpson and Soofi be killed, and stated that “Cops almost shot me.”

In other words, FBI had an officer onsite, scoping out the event, who was in communication with both Elton Simpson and Hendricks, the latter of whom may have been inciting a disruption (the evidence doesn’t clearly support he ordered the attack, though it is certainly possible; the complaint accuses his of conspiring with Amir Said Abdul Rahman al-Ghazi, a cooperating witness, not the Garland shooters). Indeed, the undercover officer encouraged the attack with his “Tear up Texas.”

This raises big questions about the attack itself. But it also raises questions about a claim Jim Comey made in December 2015, when arguing about the dangers of encryption.

That morning, before one of those terrorists left and tried to commit mass murder, he exchanged 109 messages with an overseas terrorist. We have no idea what he said, because those messages were encrypted.

That’s interesting because the affidavit provides extensive details, based in part on Amir Said Abdul Rahman Al-Ghazi’s admissions to law enforcement, and based in part on one of Simpson’s phones obtained by the FBI, how Hendricks would coach people to move back and forth from Twitter to three other “secret” (presumably encrypted) messaging apps, as well as either Tor or a VPN. Certainly, the FBI has Simpson’s side of “secret” conversations. There’s no mention of the other Garland shooter, Nadir Soofi, but the affidavit at least appears to suggest Hendricks was playing a key broker role. So any communications with him would presumably be partly mirrored in what the Garland shooters said. Certainly, the FBI has a great deal of metadata that has been useful in filling in the network its 4 informants and 1 undercover officer haven’t already filled in.

That doesn’t mean the FBI was then or has since been able to crack these 109 encrypted messages.

But the claim sounds a lot less alarming when you say, “We weren’t able to decrypt 109 social media messages though we were watching other messages in real time and had an FBI officer present at the attack.”

How Did Booz Employee Analyst-Trainee Edward Snowden Get the Verizon 215 Order?

One thing I’ve been pondering as I’ve been going through the Snowden emails liberated by Jason Leopold is the transition Snowden made just before he left. They show that in August 2012, Snowden was (as we’ve heard) a Dell contractor serving as a SysAdmin in Hawaii.

The training he was taking (and complaining about) in around April 5 – 12, 2013 was in preparation to move into an analyst role with the National Threat Operations Center.

That would mean Snowden would have been analyzing US vulnerabilities to cyberattack in what is a hybrid “best defense is a good offense” mode; given that he was in HI, these attacks would have been launched predominantly from, and countermeasures would be focused on, China. (Before Stewart Baker accuses me of showing no curiosity about this move, as Baker did about the Chinese invitation to Snowden’s girlfriend to a pole dancing competition, I did, but got remarkably little response from anyone on it.)

It’s not clear why Snowden made the switch, but we have certainly seen a number of cybersecurity related documents — see the packet published by Charlie Savage in conjunction with his upstream cyber article. Even the PRISM PowerPoint — the second thing released — actually has a cybersecurity focus (though I think there’s one detail that remains redacted). It’s about using upstream to track known cyberthreat actors.

I suspect, given the inaccuracies and boosterism in this slide deck, that it was something Snowden picked up while at Booz training, when he was back in Maryland in April 2013. Which raises certain questions about what might have been available at Booz that wasn’t available at NSA itself, especially given the fact that all the PRISM providers’ names appear in uncoded fashion.

Incidentally, Snowden’s job changes at NSA also reveal that there are Booz analysts, not NSA direct employees, doing Section 702 analysis. In case that makes you feel any better about the way the NSA runs it warrantless surveillance programs.

Anyway, thus far, all that makes sense: Snowden got into a cybersecurity role, and some of the latest documents he took was a document that included a cybersecurity function (though presumably he could have gotten most of the ones that had already been completed as a SysAdmin before that).

But one of the most sensitive documents he got — the Verizon Section 215 primary order — has nothing to do with cybersecurity. The Section 215 dragnet was supposed to be used exclusively for counterterrorism .(And as I understand it, there are almost no documents, of any type, listing provider names in the Snowden stash, and not all that many listing encoded provider names). But the Verizon dragnet order it is dated April 23, 2013, several weeks into the time Snowden had moved into a cybersecurity analytical role.

There’s probably an easy explanation: That even though NSA is supposed to shift people’s credentials as they move from job to job, it hadn’t happened for Snowden yet. That would say whoever was responsible for downgrading Snowden’s access from SysAdmin to analyst had not yet done so (there have been at least some cases of credentials not being adjusted since Snowden too, so they haven’t entirely addressed what would have to be regarded as a major fuck-up if that’s how this happened).

Interestingly, however, the declassification stamp on the document suggests it was classified on April 12, not April 23. On April 12, 2013, Snowden was still at Fort Meade.

Whatever the underlying explanation, it should be noted that the most sensitive document Snowden leaked — the one that revealed that the government aspired to collect phone records from every single Verizon customer (and, significantly, the one that made court challenges possible) — had to have been obtained after Snowden formally left his SysAdmin, privileged user, position.