Schneier on Security

Roger • May 25, 2006 11:33 PM

I have to say, my suspicions about the USA Today story are growing. I’m not yet bold enough to call “bogus”, but, well, I’m now very suspicious.

First, Leslie Cauley, a previously little-known reporter from the telecom beat, breaks a big intelligence story, based entirely on anonymous sources.

Anonymous sources are always a worry, but not necessarily a fatal one if you can rely on the journalist to have checked up on them properly. So I tried to check up on Cauley’s journalistic reputation — and found nothing big enough to be google-visible. But she had written a book about the collapse of AT&T, and there were a lot of reviews online. A disturbing number of these referred to her research as sloppy, careless, relying too much on unfounded sources, full of obvious errors, etc.

Another aspect of the story struck me as odd: this source is supposedly providing he said/she said dialogue of the negotiations between Qwest and NSA. It seemed to me that either that dialogue was made up, or else the NSA is going to take about 5 minutes to figure out who is committing the Federal felony.

Next, Bell South, and slightly later Verizon, come out to say that they have completed internal investigations of Cauley’s claims and categorically deny them, in terms which would almost certainly broaden their vulnerability to lawsuits if they are lying. Verizon goes so far as to call USA Today liars, which means USA Today gets to sue Verizon if they think they have anything that will stand up in court. USA Today doesn’t sue, they just say they “have faith” in their reporter. Uh oh.

Then, rumours circulate which claim to have identified Cauley’s supposed high ranking intelligence sources as actually a low ranking AT&T tech. Hmm. Only rumours, mind, which are even worse than anonymous sources; but in view of claims of Cauley’s carelessness, her history of having contacts in AT&T but not in intel, and the fact that AT&T are the only accused party not to categorically deny the allegations, this lifts the suspicion meter a couple more notches.

And now we find that Matt Klein is part of the story somewhere. Matt Klein is a former AT&T tech who made allegations about AT&T collaborating with the NSA back in 2004 or thereabouts. For several reasons, it didn’t cause much of a fuss back then. For the main reason, read very_carefully the PDF which Bruce linked to above, which contains Klein’s testimony.

Finished reading carefully? What did you notice?

That’s right; Klein’s claim that he was looking at a classified NSA monitoring program is purely conjectural. (The thing most people notice first is they way he jumps from the project name — Study Group 3 — to the conclusion that there are at least two other “monitoring facilities”, without even considering the possibility that SG 3 is the third version of the same facility, or that SG 1 and 2 do something altogether different, or that if it is an intelligence program, the names are selected at random precisely to avoid giving these sorts of clues.) The only thing that even links the NSA to it is that one person involved with the project once spoke to a person identified to Klein as an NSA agent by an (unnamed) 2nd hand source. If it wasn’t for that point, you would probably dismiss Klein’s entire tale as paranoia. As it stands, that gives it a hmm, maaaybeee, feel, but it’s several leagues short of evidence. The “link” that Narus also supplies equipment to the NSA is ridiculous; Narus produces telecoms analysis equipment and has many customers, including several of the world’s largest telecoms.

Noting that the equipment Klein saw was monitoring internet connections, not voice lines, here’s another possible explanation for everything Klein saw: AT&T, like many telecoms who have traditionally made their big bucks from long distance calls, want to know how much money its own broadband arm is taking from it by carrying VoIP traffic. To that end, they wish to monitor the volume of VoIP packets on their broadband networks, and possibly one day block them. (Whatever you might think of this personally, it’s completely legal). So, they buy and install a Narus system, designed for exactly that purpose. The project is somewhat confidential because there might be a public outcry if someone hinted that AT&T was going to block VoIP, but it isn’t classified (notice the lack of national security markings on the documents freely handed to Klein?) The NSA guy may have been there to ask “if we presented you with a warrant to monitor a VoIP telephone call, can you do that?”, or he may have been there for a totally unrelated purpose, or the 2nd hand source who told Klein the guy was an NSA agent may have been pulling his leg.