Schneier on Security

Dirk Praet • August 22, 2013 7:45 PM

The kind of well-written, detailed, factual and seemingly unbiased report we have come to expect from Susan Landau. Unfortunately, it’s from somewhere in July and thus missing a number of important recent events and revelations, such as the Amash-Conyers vote and the yesterday published FISC opinion report as FOIA’ed by EFF.

Some remarks:

1) Martin Schultz is not the EU President, but the President of the EU Parliament. The EU President is Herman Van Rompuy, whereas Manuel Barroso is the President of the European Commission (sort of PM). It’s a bit like confusing Barack Obama with John Boehner (Speaker of the House).

2) Although Susan states that the US, contrary to China, is not using data collected by the NSA for industrial espionage because that would be illegal under US law, I have recently seen several articles alledging the opposite. I just can’t remember where, but I wouldn’t be too surprised given another recent revelation that the DEA has been tapping into the NSA data stream too.

3) I agree with @ Kevin an Auditor that the part on the EU is reasonably confusing to say the least. Under the European Data Protection Directive (officially Directive 95/46/EC), personal data may only be transferred to third countries if that country provides an adequate level of protection. Under Article 29, a working party negotiating with the US and other stakeholders established the rules for Safe Harbour, many US and other companies have self-certified for as being compliant. Snowden’s revelations have however shown this to be a complete and utter joke, with quite some folks over here demanding immediate revocation of Safe Harbour status for all companies involved in PRISM.

Not mentioned either is that there is a new directive in the making, the General Data Protection Regulation, that will supersede the Data Protection Directive. Snowden’s revelations couldn’t possibly have come at a worse time because a number of very restrictive articles the USG, the UKG and US companies have been vehemently lobbying against are now back on the agenda before the final vote expected somewhere in the fall of this year.

As for the joint NSA-GCHQ operations sanctioned by the UKG and obviously threading on Directive 95/46/EC, the EU has been aware of this ever since the 2001 Echelon report. One of the report’s recommendations was that the UK explained it’s role in Echelon. Perhaps this was done in some secret meeting, but it’s just as likely that the UK – behaving more as a US colony than a EU member state – told the EU to go sod themselves.

I may be overreaching here, but if Susan or anyone close to her is reading this, your former colleague (and fan) DP124845 would be more than happy to help out with the European angle on this matter, even if but for proofreading.

@ commonsense

No sockpuppeting on this forum, please, Mike and Dianne.

Dirk Praet • August 23, 2013 4:27 AM

@ Clive

Did you try clicking the sign up now button ?

Dirk Praet • August 24, 2013 8:42 PM

OT

@ Clive

and the “Continental Habit” of providing a glass of teppid water a bag of indeterminate “tea dust” on a string and a wedge of tired lemon in a “bulldog clip” style squeaser does sometimes cause me to wonder if they are doing a “le roast beuf” on me

I’m sorry to say that we don’t have much of a tea culture over here indeed. It’s quite hard to find civilised bars or hotels with a decent tea offering and serving it in another way than the standard teabag on a string. These can however be great fun spinning them around and launching them at the ceiling, which is a great way to tick off owner/staff as it inevitably requires a ladder to remove them. It’s an incredibly stupid sight to see a bunch of teabags hanging from the ceiling at some posh bar or hotel. Back in the day when we were hanging out with the local rascals, we even made a sport out of trying to group them together in pretty much the same way we practiced our shooting at the gun club.

Dirk Praet • August 25, 2013 6:35 PM

@ Jon

Except at the time of the leaks, Edward Snowden wasn’t working for the NSA. He was working for Booz Allen Hamilton …

At least in theory, supplier-customer confidentiality is covered by a standard non-disclosure agreement (NDA) any contractor or contracting outfit is supposed to sign, especially when working in intelligence. It can also be part of their security clearance. Susan is way too smart to miss something as obvious as that. I’d love to see her on the PCLOB or other watch dog POTUS has recently been making some noise about. If you re-read her essay in that context, I’d say it makes for a very astute and diplomatic application indeed.

@ Clive

Thanks for that link. Very interesting reading indeed. My favourite “politically correct” newspeak expression since a while is “integration area for culturally challenged newcomers” to describe what the rest of us usually call a ghetto of mostly North African and Eastern European poverty immigrants and asylum seakers. I heard it from an old acquaintance, a former drummer with kleptomaniac tendencies who was seeking public office for a local left-wing party in the latest municipal elections. He failed miserably.

Dirk Praet • August 26, 2013 10:45 AM

@ Jon

And of course to ensure enforcement of all those confidentiality agreements there is oversight …

We both know that most NDA’s are not worth the paper they’re written/printed on, and that enforcement is reasonably difficult, especially when dealing with hundreds of thousands of contractors. My point is that “sharing of data” with any third party – particularly contractors and commercial entities – is probably not official NSA policy, and that NDA’s and other processes in place at least give them plausable deniability against any claims of doing so.