The FBI’s Asinine Attempt to Retroactively Justify Cracking Farook’s Phone

“Hold on honey,” said Syed Rizwan Farook, who had just murdered 14 of his co-workers, “let me go get my work phone in case they call me during our getaway”

That’s the logic the FBI is now peddling to reporters who are copping onto what was clear from the start: that there was never going to be anything of interest on Farook’s phone. After all, they’re suggesting geolocation data on the phone (some of which would be available from Verizon) might explain the 18 minutes of the day of the attack the FBI has yet to piece together.

For instance, geolocation data found on the phone might yet yield clues into the movements of the shooters in the days and weeks before the attack, officials said. The bureau is also trying to figure out what the shooters did in an 18-minute period following the shooting.

Farook drove a SUV to the attack and was killed in the same SUV. To suggest his work phone, which was found in a Lexus at his house, might have useful geolocation data about the day of the attack would suggest he made a special trip to the car to leave his phone in it and turned it off afterwards (if we really believe it was off and not just drained when the FBI found it the day after the attack).

Hold on honey, let me go place my work phone in the Lexus.

Similarly, it is nonsensical to suggest the phone would yield evidence of ties with foreign terrorists.

The FBI has found no links to foreign terrorists on the iPhone of a San Bernardino, Calif., terrorist but is still hoping that an ongoing analysis could advance its investigation into the mass shooting in December, U.S. law enforcement officials said.

They’ve had the metadata from the phone since December 6, at the latest. That’s what would show ties with foreign terrorists, if Farook had been so stupid as to plot a terrorist attack against his colleagues on his work phone, to which his employer had significant access.

Finally, reporters should stop repeating the FBI’s claim that Farook turned off his backups.

In particular, the bureau wanted to know if there was data on the phone that was not backed up in Apple’s servers. Farook had stopped backing up the phone to those servers in October, six weeks before the attack.

The government has actually never said that in sworn declarations. Rather, their forensics guy, Christopher Pluhar, asserted only that Farook may have turned them off.

Importantly, the most recent backup is dated October 19, 2015, which indicates to me that Farook may have disabled the automatic iCloud backup feature associated with the SUBJECT DEVICE. I believe this because I have been told by SBCDPH that it was turned on when it was given to him, and the backups prior to October 19, 2015 were with almost weekly regularity. [my emphasis]

But if he did, he was a damned incompetent terrorist, because — as Jonathan Zdziarski, who is quoted in this article, pointed out — at the same screen he would have used to turn off the iCloud backup, he could have also deleted all his prior backups, which we know he didn’t do.

• Find my iPhone is still active on the phone (search by serial number), so why would a terrorist use a phone he knew was tracking him? Obviously he wouldn’t. The Find-my-iPhone feature is on the same settings screen as the iCloud backup feature, so if he had disabled backups, he would have definitely known the phone was being tracked. But the argument that Farook intentionally disabled iCloud backup does not hold water, since he would have turned off Find-my-iPhone as well.
• In addition to leaving Find-my-iPhone on, the option to delete all prior backups (which include iMessage history and other content) is also on the same settings screen as the option to disable iCloud backups. If Farook was trying to cover up evidence of leads, he would have also deleted the existing backups that were there. By leaving the iCloud backup data, we know that Farook likely did not use the device to talk to any leads prior to October 19.

We also know from a supplemental Pluhar declaration that Farook had not activated the remote-wipe function, which he also would have done if he were a smart terrorist trying to cover his tracks.

Finally, Apple’s Privacy Manager, as Erik Neuwenschander demonstrated, Pluhar didn’t know what the fuck he was talking about with regards to backups.

Agent Pluhar also makes incorrect claims in paragraph 10(b). Agent Pluhar claims that exemplar iPhones that were used as restore targets for the iCloud backups on the subject device “showed that … iCloud back-ups for ‘Mail,’ ‘Photos,’ and ‘Notes’ were all turned off on the subject device.” This is false because it is not possible. Agent Pluhar was likely looking at the wrong screen on the device. Specifically, he was not looking at the settings that govern the iCloud backups. It is the iCloud backup screen that governs what is backed up to iCloud. That screen has no “on” and “off” options for “Mail,” “Photos,” or “Notes.

Zdziarski offers another possible explanation for the lack of backups on Farook’s phone, so there are other possible explanations.

iCloud backups could have ceased for a number of reasons, including a software update that was released on October 21, just two days after the last backup, or due to iCloud storage filling up.

The point is, we don’t know, and it’s not even clear Pluhar would know how to check. So given all that other evidence suggesting Farook may not have turned off his backups, journalists probably should not claim, as fact, he did.

Of course, that claim is really just a subset of the larger set of the bullshit FBI has fed us about the phone. It’d really be nice if people stopped taking their bullshit claims seriously, as so few of the past ones have held up.

The CIA Doesn’t Want You To Know that ISI Supports Terror

The National Security Archive just got a number of documents on the funding of the Haqqani network, showing it gets (or got) funding from Gulf donations, the Taliban in the tribal lands, and Pakistan’s ISI. A particularly interesting DIA cable describes how a guy named Qabool Khan, on orders of the Haqqani, got a job — thanks to Hamid Karzai’s brother Mahmoud’s influence — running security for the US Salerno and Chapman bases. Along with intelligence about Americans on the base, of the $800 he made for each guard at the base, Khan sent $300 back to the Haqqanis.

This DIA cable, however, has generated more attention. It alleges that Pakistan’s ISI gave the Haqqanis $200,000 to carry out the attack on the Chapman base in Khost that killed seven CIA officers.

Reuters reported it here, saying this about the accuracy of the report.

A spokesman for Pakistan’s embassy in Washington did not have any immediate comment.

Because the document is heavily censored, it is not clear whether it represents an intelligence agency consensus or fragmentary reporting. One line, which has been crossed out, says: “This is an information report, not finally evaluated intelligence.”

More amusing is this piece from Joby Warrick who, after all, wrote an entire book about the attack filled with very detailed descriptions that could only have come from top CIA people. His anonymous source(s) — whose particular agency affiliation he does not identify, which clearly matters here — cast doubt on the report, and either they or Warrick himself questions the claim that Arghawan might be involved in the plot because he died.

But is the claim credible? The new version of events has prominent skeptics, starting with the U.S. intelligence community, which was both targeted by the attack and also spent many months piecing together the evidence on how and why it happened.

[snip]

One U.S. intelligence official who studied the newly released document described its contents on Thursday as an “unverified and uncorroborated report”— essentially raw intelligence of the kind that routinely lands on the desk of U.S. analysts and diplomats in overseas posts. The redacted report says nothing about the source of the information, including whether the person was regarded as reliable or how the allegations were eventually assessed.

“The document clearly states that it contains unevaluated information,” said the official, who insisted on anonymity because much of the investigation into the bombing remains classified.

“The Haqqanis are brutal terrorists who continue to target innocent people, including Americans,” the official said. “Nonetheless, the general consensus is that the 30 December attack was primarily an al-Qaeda plot and did not involve the Haqqani network.”

[snip]

Arghawan was in fact the man assigned by the CIA to pick up Balawi at the Pakistan border and drive him to Khost for the meeting. But his involvement in any plot would appear doubtful, as he was killed along with seven Americans when Balawi detonated his bomb.

Call me crazy, but I can imagine how an extra $100,000 might motivate someone to kill an accomplice, even setting aside the possibility that those who plotted this attack would want as few live witnesses as possible. Note, too, that Bob Baer pointed to the use of a driver (that is, Arghawan) as a key failure of tradecraft.

An old operative I used to work with in Beirut said he would have picked up Balawi himself and debriefed him in his car, arguing that any agent worth his salt would never expose the identity of a valued asset to a foreigner like the Afghan driver. I pointed out that if he’d been there and done it that way, he’d probably be dead now. “It’s better than what happened,” he said.

But all the discussion about the credibility (or not) of this report doesn’t consider something: that this just got released under FOIA! It is a cinch to withhold information, especially raw intelligence, under FOIA. Indeed, the paragraph, like the cable as a whole, is classified Secret/No Forn. But here, the State Department not only went to DIA to facilitate this release, but the censors made an affirmative decision this piece of data should not be withheld.

Whether or not its true (and I’d be surprised if DIA wanted inaccurate information implicating ISI released, unless they just wanted to burn this source), it is the case that DIA, possibly with the involvement of State, released information revealing that DIA obtained intelligence that those in charge of Chapman (that is, the CIA) were employing at least one and probably two Haqqani agents. (Remember, too, that CIA reportedly got warning about this attack but still failed to prevent it.)

I’d also add that alleged ISI involvement in the attack would raise really interesting questions about whether ISI wanted the particular CIA attendees, including key Osama bin Laden targeter Jennifer Matthews, at the meeting killed, rather than just a strike at CIA drone targeters generally. Indeed, the possibility that ISI facilitated the attack, luring in the CIA with promises of the location of Ayman al-Zawahiri, particularly when we know that ISI wanted the Haqqanis protected, is particularly intriguing.

In any case, I’m sure the ISI is reading the reporting on this cable with some interest.

Hillary’s Bold Plan to Financially Penalize Recidivist Super-Predators

The other day Hillary promised she would appoint Attorneys General like Eric Holder and Loretta Lynch. “I will appoint an Attorney General who will continue the courageous work of Eric Holder and Loretta Lynch.” Given that the comments came at an Al Sharpton event, I assumed the comment meant to invoke Holder and Lynch’s efforts to reform criminal justice and, presumably, their even more successful support for civil rights.

Nevertheless, it was a disturbing comment, given that Holder and Lynch have also both coddled the bankers who crashed our economy. Indeed, when Hillary tries to defend her huge donations from bankers, she always points to Obama’s even huger ones, and insists that there’s no evidence he was influenced by them. But the Obama DOJ record on bank crime is itself the counter to Hillary’s claim those donations didn’t influence the President.

But then, last night, Hillary said something even more outrageous, which I take to be a solid promise to her funders they’ll continue to get special treatment before the law. Amid a comment shifting from Too Big to Fail into the serial settlements the banks have signed for their crimes, Hillary took the bold step of calling for financial penalties for the people directing that crime.

CLINTON: Dana, let me add here that there are two ways to at this under Dodd-Frank, which is after all the law we passed under President Obama, and I’m proud that Barney Frank, one of the authors, has endorsed me because what I have said continuously is, yes, sometimes the government may have to order certain actions. Sometime the government can permit the institution themselves to take those actions. That has to be the judgement of the regulators.

But, there’s another element to this. I believe strongly that executives of any of these organizations should be financially penalized if there is a settlement.

(APPLAUSE)

CLINTON: They should have to pay up through compensation or bonuses because we have to go after not just the big giant institution, we have got to go after the people who are making the decisions in the institutions.

Granted, under Holder and Lynch, those courageous Attorneys General Hillary would model her own pick on, the banksters haven’t even been asked to do this much.

But the fact that Hillary thought a great punishment for those harming the country with their serial crime wave is to fine them is a testament that she doesn’t even see the underlying crimes.

This is behavior that has continued over years, often after previous settlements. If anyone can be called a super-predator, it’s the bankers who toy with millions of people’s livelihoods and savings to make a buck. If there were a Three Strikes law for bankers most of these guys would be looking at life imprisonment.

And yet Hillary’s bold plan is not to incarcerate them, but instead to take a little bit of their money.