Schneier on Security

A-Team • January 16, 2014 10:08 AM

It would surely open a lot of doors if little people could obtain Lawful Intercept access and pose queries. Better, put MARINA and MAINWAY portals on the public internet and give us five milliseconds each to task our personal selectors.

Recall the 2010 Aurora attacks on Google (and Microsoft) were not so much activist email as years of FISA-court authorized surveillance on behalf of the FBI.

http://www.washingtonpost.com/world/national-security/chinese-hackers-who-breached-google-gained-access-to-sensitive-data-us-officials-say/2013/05/20/51330428-be34-11e2-89c9-3be8095fe767_story.html

http://www.networkworld.com/community/blog/will-chinese-hackers-launch-re-tread-attacks-surveillance-databases

“These [FISA orders] provide the legal cover for targeting people of interest in the US, notably the list of known or suspected undercover agents for the Chinese (who then might need to be extracted, change selectors, or provide misinformation). When in early 2010 Google shared with the public that they had been breached in what became known as the Aurora attacks, they said that the attackers got their hands on some source code and were looking to access Gmail accounts of Tibetan activists.

What they didn’t make public is that the hackers have also accessed a database containing information about court-issued surveillance orders that enabled law enforcement agencies to monitor email accounts belonging to diplomats, suspected spies and terrorists. Armed with such information, Chinese intelligence agencies might decide to extract the suspected operatives, or instruct them to provide false information aimed at deceiving U.S. intelligence agents.

As Google was responding to the breach, its technicians made another startling discovery: its database with years’ worth of information on surveillance orders had been hacked. The database included data on thousands of orders issued by judges around the country to law enforcement agents seeking to monitor suspects’ emails.

The most sensitive orders, however, came from a federal court that approves surveillance on foreign targets such as spies, diplomats, suspected terrorists, and agents of other governments. Those orders, issued under the Foreign Intelligence Surveillance Act, are classified.

The theory is also backed by an earlier claim by Dave Aucsmith, senior director of Microsoft’s Institute for Advanced Technology in Governments, who said that the Aurora attacks directed at Microsoft were aimed at discovering similar information regarding Microsoft accounts.

“If you think about this, this is brilliant counter-intelligence. You have two choices: If you want to find out if your agents, if you will, have been discovered, you can try to break into the FBI to find out that way. Presumably that’s difficult. Or you can break into the people that the courts have served paper on and see if you can find it that way. That’s essentially what we think they were trolling for, at least in our case,” he shared with the attendees of a government IT conference.

Aucsmith said the attack on Microsoft appeared to be “a reconnaissance mission hackers were conducting to determine what type of surveillance U.S. authorities were conducting on undercover operatives through records obtained from the software giant via court orders.”