Schneier on Security

Skeptical • January 17, 2014 6:03 AM

Stillenacht, Representative Mike Thompson (is not a co-sponsor of Sensenbrenner’s bill) wasn’t one of the Representatives who attended. Bruce is referring to another Thompson.

So none of them sits on an intelligence oversight committee. The intelligence oversight committees were specifically designed and designated by law, i.e. by Congress itself, to receive certain disclosures from the IC and to conduct oversight of the IC.

I’m sure Bruce consulted an attorney before doing this – there are some excellent attorneys working for the EFF – though his risk of liability here is very low (though I have no idea whether there is a private CA/NDA at issue). The Representatives may be at some risk of censure for encouraging and allowing the exposure of classified material to persons not cleared for it and in an unsuitable environment, but I doubt anyone wants to rock the boat at this point (although this is Congress, so God only knows).

Industrial espionage? Petrobras, it was all over the news for the usual soundbite couple seconds. NSA told some oil companies which of the leases for sale had oil under them.
Brazil was (and still it) really pissed, since normally, the deal is you sell all the leases, and a few buyers get lucky, but the seller always gets good prices for all of them. With the info given out – only some brought a good price for Brazil.

Nope. There was only one bid – at the minimum eligible amount – by a consortium of Petrobras, Shell, Total, and CNOOC. See, e.g. The Economist: Brazil’s Oil Auction

Interest in the pre-sal oil off Rio was high six years ago, when this was first announced, before shale fracking accelerated in the United States and elsewhere. Since then, private interest in the Brazilian fields, which are technically difficult to access, has evaporated. US companies didn’t bid.

Nothing to do with the NSA.

As to why the NSA would look at Petrobras, the answer is at least two-fold. First, Petrobras is a major state-owned company, and Brazil is economically and fiscally fragile in many ways. Analysts assessing different political scenarios in Brazil need economic analysis and analysis of the Brazilian government’s likely fiscal resources. Petrobras can affect both of those things. Second, because of how cozy state owned enterprises are with states, there are likely politically influential figures in Petrobras who would be of interest from a foreign intelligence perspective.

The US Government has very consistently, over the course of decades, and without ever being contradicted by any evidence, adamantly refused to engage in commercial espionage, i.e. the use of espionage to obtain information which is then given to a firm in order to benefit that firm commercially. A policy change was debated after the end of the Cold War, during the End of History nonsense (interesting nonsense though!), with some arguing that the US should engage in commercial espionage given how many other states were. But the answer was no, although I suspect that this is as much because the IC doesn’t like the idea of risking officers and resources to enrich a CEO as it is because major businesses in the US are heavily multinational.

It is for that reason that Western businesses are in reality less concerned about the NSA than you might think, at least from an intellectual property (IP) perspective. The big APTs from an IP perspective are, at the nation-state level, China and Russia. 🙂 They don’t get as much press these days, though.

Skeptical • January 17, 2014 9:58 AM

Stillenacht, right you are re Mike Thompson. That was my mistake. One of the Members briefed does sit on the House Permanent Select Committee on Intelligence. But only one. The Subcommittee on National Security, on which Amash sits, last held a hearing on August 2nd, as best I can tell, entitled Missing Weapons at the National Park Service: Mismanagement and Lack of Accountability. Its function is nothing like the actual intelligence oversight committees in the House and Senate.

Adjuvant, ah, that old chestnut. The EU report (which I believe was compiled by a journalist for the committee creating the report) contains zero events in which the NSA or CIA participated in commercial espionage.

The EU report primarily notes events where the US Government detected, and told a foreign government, of bribery by various European companies, such as Airbus in Saudi Arabia. US companies are forbidden by law from attempting to bribe foreign officials, and it is a law enforced aggressively by the Justice Department. Of course, for some time certain European countries allowed their companies to do so, and were presumably annoyed when expensive bribery schemes were exposed. I think some higher officials at the CIA at the time found some of the protests quite amusing.

Other than cases where the US reported on bribery, there are incidents reported where the US detected and reported commercial espionage by other entities, and where the US conducted espionage in the course of negotiating treaties between itself and other governments.

None of those constitute commercial espionage.

Then there is Enercon. A US company sued Enercon for infringing on its patents for a windmill generator design, resulting in a ban in the US on some of Enercon’s products until 2010. Enercon claimed in defense that the NSA had stolen its secret windmill generator designs and given them to the US company. Problematically, Enercon failed to fact-check before telling this fantastic story – the US company registered the patents three years before the alleged espionage occurred. Nonetheless, it was dumped into the EU report.

So, zero incidents of commercial espionage. This despite Congressional investigations, tons of leaks on all kinds of activities within the Intelligence Community, plenty of espionage by foreign nations in good positions to reveal commercial espionage by the US, and, of course, the latest “independent audit” by Snowden.

Is it possible that there’s commercial espionage which we somehow have never heard about? It’s possible. But I would have expected that to be one of the very first stories reported by Greenwald et al, as it would be a huge scandal.

Skeptical • January 18, 2014 11:34 AM

Fluffy, I’m careful with facts, but since these are comments on a blog, I also write quickly. Sometimes even I will make mistakes. When someone points one out, I’ll go and check; and if they’re right, I’ll happily admit the error. But I also tend not to write anything unless the subject is one I’m familiar with and knowledgeable about.

And it’s possible that the US did engage in commercial espionage. There are always possible points of failure in an analysis. Occasionally even very strong analysis, like a well-built and well-operated aircraft, can suffer a series of coincident failures. The available evidence points to “no” however, and over the course of years, after investigations by many interested parties, that evidence has become quite strong.

I’ve found that those who strongly disagree with that finding tend to fall into three categories.

(1) Some simply have performed no research into the question, but have a general worldview in which all governments conduct commercial espionage, and are simply too rigid to allow for the possibility that they are wrong;
(2) some have performed research, but are from countries in which governments are extremely corrupt, and they begin their analysis of the US with that image in mind – for them, particularly those from closed societies, it’s easier to believe that the US is simply very good at hiding commercial espionage;
(3) some have performed research, are from open societies, but for whatever reason have a worldview in which government is almost cartoonishly corrupt – and that worldview is deeply enough ingrained that it’s very difficult for them to allow evidence to change their minds.

Where I become most concerned about the possibility of state-sponsored commercial espionage is at the intersection of two circumstances: (a) weak intellectual property protection for foreign companies where the beneficiary of the commercial espionage operates; and (b) very strong association, to the point of complete ownership and control, between the beneficiary and the state-sponsor.

Think about where those two circumstances are most strongly in evidence, and you’ll likely find where state-sponsored commercial espionage is the greatest threat. And while there are other factors to consider, those two alone can provide pretty good guidance.