Schneier on Security

Skeptical • July 16, 2014 5:53 AM

@Winter: The actions below are crimes in Europe. Btw, hacking Belgacom was a crime too.

None of which are a part of this story. This story reveals tools, all of which would be useful in various legitimate operations (some of which, as I’ve cited, have been reported on). This story reveals nothing scandalous or illegal.

@unhappyApples: As we saw with the recent story of surveillance of Muslim American citizens, it took time to gain permission from the apparent targets to publish their names. To be trite, absence of evidence is not evidence of absence. We do not know what stories have not been published yet.

Yes, and that recent story didn’t reveal anything illegal either. As far as I can tell, it was done for sheer sensationalism and perhaps to aid certain lawsuits.

This story is, frankly, worse in some ways. Greenwald reveals classified information about capabilities useful in various legitimate operations. These capabilities are not illegal; there is no evidence in the article that they were used in any illegitimate ways.

Skeptical • July 17, 2014 5:30 AM

@Clive Err, firstly quite a few are illegal if used in the UK…

There are many illegal acts one could commit in the UK using the tools and weapons of the intelligence services or the armed forces.

So what?

…and you could not give a good account for having it about your person or possessions. Later legislation moved the burden of proof further onto you as the individual with the “going equipped…” legislation. Most of these GCHQ tools are not harmless or legal in use

GCHQ is a government agency empowered to have these sorts of tools.

@Gerard For instance, the “Hacking Online Polls” tool, imagine how that being used for political campaign voting polls statistics? Or for influencing currencies?

Polls are conducted by phone generally, not the internet; the latter are viewed as unreliable and inaccurate. One could influence currencies, I suppose, by planting various false rumors that appear to derive from reliable sources. It would be temporary at best, of course, and it would draw the close attention of law enforcement and regulatory authorities.

It is also more than gathering intelligence alone. These tools allow GCHQ to actively influence a target.

Which is a legitimate function. Some of these tools seem, as someone pointed out above, more likely to be a part of information operations than active collection, but they likely play a role in both types of missions.

These tools have utility in counterterrorism, anti-proliferation, counterinsurgency, intelligence collection against more ordinary foreign state targets, and other legitimate missions.

By disclosing these tools and capabilities, Greenwald has merely ensured that those they would be used against will be even more vigilant against their possible use, thereby blunting their edges.

In a related vein, in my view the press must to some extent function as a watchdog. However, one must also keep in mind, as the business of journalism becomes ever more competitive, that journalists have incredibly strong incentives to publish. Their prestige, and ultimately their autonomy in their careers, rests more on what they publish than on what they withhold.

So there is also strong incentive to hold on to any “newsworthy” material even if the journalist decides that it cannot currently be published, because someday, perhaps, it can be, or someday it may become so relevant that the incentive to publish outweighs other factors.

In doing so the journalist assumes the responsibility that such material will not be acquired and misused, and that his associates and colleagues will act with similar judgment.

But that responsibility cannot be borne in the case of the Snowden material. To hold on to this material indefinitely is to ensure that it will be acquired by others. It is to ensure that the very information most in need of protection will be exposed.

Perhaps Snowden didn’t, or couldn’t, insist that the material he leaked be destroyed after journalists decided what to publish and what not to publish. If so, that was yet another mistake (assuming he truly does not want all of the material acquired by others).

Burn bags, metaphorical and otherwise, are an important part of information security as well. I strongly hope that the journalists engaged in these stories are responsible, strong-willed, and self-aware enough to use them.

Skeptical • July 18, 2014 11:59 PM

@cat: I’m confused about the part where Glenn Greenwald has to carry water for “legitimate” British intelligence, “empowered” as it is to have these tools.

Because he aspires to be a responsible journalist who genuinely cares about the security of liberal democracies?

Because no one who argues and writes the way he does could possibly fail to fathom the importance of such security to the functioning of institutions that protect individual rights?

No one is asking him to cover up scandals or illegal activities. The question is whether he should report classified information that does not reveal illegal activity and that is legitimately classified.

@Mike: Public interest is but a side effect of selling papers and p*ssing off those whose political ideology conflicts with the owner of the whole cabal.

You may be interested in this article, What Drives Media Slant? Evidence from US Daily Newspapers, by Matthew Gentzkow (who won the John Bates Clark Medal) and Jesse Shapiro.

It argues that media slant is actually better explained by the slant of the purchasing customers than by the preferences of the owners. It adduces a fair amount of statistical evidence in support of the finding.

@name.withheld: I’m sorry but this line of thinking does more then suggest mere skepticism, this is clearly a position that limits the range of possibilities to only the legitimate use…

The article doesn’t report any illegal use, however. There is nothing in it that would support the inference that they are being illegally used.

@Clive: GCHQ is no more “empowered to have these sorts of tools” than anyone else…

Does the development and/or acquisition of these tools fall within the legal mission of GCHQ?

Yes.

Was the development and/or acquisition of these tools duly authorized?

Undoubtedly.

Is there any law forbidding the development and/or acquisition of these tools?

No.

It surprises me that you would suggest it’s illegal for them to have these tools.

Skeptical • July 19, 2014 9:04 PM

@Nick P: This, like many of their leaks, is basically a catalog of capabilities. Do you read the auto magazines expecting to see which cars each getaway driver preferred? Do your Best Buy adds give a list of hacking use cases with each computer? Do your Home Depot adds show which sociopaths used which tools?

Unless publication reports illegal activity of sufficient magnitude to justify the harm done, properly classified material ought not be published.

It’s that simple.

Greenwald’s “adversarial journalism” is, at its core, nothing more than the naive importation of the norms of an attorney into the very different realm of journalism. But journalism occurs outside the controlled atmosphere of a courtroom; there is no judge, no developed body of caselaw, no enforced written procedures, to regulate what information is revealed and how it is characterized. With that greater freedom comes greater responsibility. To an extent, Greenwald obviously realizes this, and has exercised some discretion. Yet he still falls prey to unpersuasive illusions of his old slogans. To determine what to report, and what not to report, one must obtain as clear a picture as possible of reality; to do that, one must approach matters with the attitude of a scientist, not a lawyer; one must be open to listening to experts associated with, in one’s mind, “the other side,” and one must incorporate those views rationally.

This is all by way of saying that when it comes to legitimately classified material, the default ethical position is not simply “publish.” There is no avoiding a careful weighing of all factors – including input from government sources.

Skeptical • July 20, 2014 7:30 AM

@Nick P: Classification of material should not happen unless the activity is legal and knowledge of it threatens national security. That’s the law. We know that NSA, particularly, classified many harmless things (maybe majority) by default and Snowden leaks show they routinely lied to Congress/America. That might qualify for using classification to conceal wrongdoing, a felony. They also decide what’s “proper” without any checks outside that system. (That most of Congress had no clue what was going on supports that.) So, your rule is a grey area at best.

These are separate issues.

Regardless of whether you think that the NSA committed criminal acts, not every leak of classified information is justified.

Where that information is legitimately, repeat, legitimately classified, and where it publishing it does not reveal illegal activity of sufficient magnitude to justify the harm done by publication, then the information should not be published.

A catalog of capabilities does not demonstrate any illegal activity whatsoever, and it is obviously legitimately classified.

Therefore it ought not be published.

What one may think of other things that the NSA, or GCHQ, have done is irrelevant.

The other problem with your assessment is that the news organizations have repeatedly worked with countries whose information they have. They’ve redacted many things on request and some automatically as it could cause unnecessary harm. You’re quick to pretend that didn’t happen, point at Greenwald’s questionable tactics.

Actually I said that Greenwald obviously realizes that some things do need to be redacted, and has exercised some discretion.

But not enough.

Yet, you keep playing down problems revealed with NSA.

The article did not reveal any problems with the NSA, or GCHQ. It simply revealed legitimately classified information.

I am talking about the article in the post, not every allegation that has been made over the last year in connection with the NSA or GCHQ.

You haven’t called their leadership or any personnel traitors for breaking the law.

Nor will I until I see persuasive evidence that they have done so. Thus far Snowden’s leaks have demonstrated that they have not. I write that without minimizing the larger policy questions that Snowden’s leaks have raised.

You haven’t called schemes like their State Secrets immunity from prosecution plea a threat to checks and balances.

Because that’s not the subject of discussion. The article in the post is.

You deceive with terms like ‘courts’ and ‘case law’ knowing that black project information typically can’t enter a court and these organizations’ management virtually never do prison time for anything they do.

Also neither the subjects of discussion nor the subjects reported on by the article in question.

You also haven’t called for imprisonment or even termination of all the personnel who simply shunned or retaliated against internal reports of corruption from the likes of Binney.

See above.

If you’re not pushing DOD’s agenda here,

Nick, I have no connection with the NSA. I have no access to classified material on any of the above subjects, nor access to anyone working in government on those issues. Everything I say here, and discuss here, derives from my personal views and thoughts.

If I did, I most assuredly would not be discussing these subjects.

it’s amazing that you have so little to say about all the huge [criminal] issues with NSA, miss out on obvious problems with your recommendations (eg black program court immunity),

I haven’t made any such recommendations.

and still manage to catch every little possibility when looking at Greenwald/Snowden.

Greenwald came up because Greenwald wrote the article.

The fact is that nobody following your advice could’ve informed anyone or changed anything. Everyone before Snowden tried with almost no effect on anything. Yet, when Snowden showed the scope of what they’re doing, even Congressmen are debating the issue when they previously knew nothing about it. You give the next leaker a sure way to accomplish the same thing within the straight-jacket of the classification system and the very corrupt partnership of Pentagon and private industry.

What advice is that?

Then, and only then, should anyone think you’re view of Snowden’s actions (including alternative paths) should merit any consideration.

I’d be happy to discuss my views of Snowden’s actions, and the grossly criminal and irresponsible manner in which he leaked huge volumes of appropriately classified material to various persons across the world. But if that’s what you want to discuss, let’s move that discussion to the Squid thread.

Skeptical • July 22, 2014 2:36 PM

BJP, AnonymousBloke – enjoyed reading your balanced exchange.

@BJP, I’m largely in complete agreement with you on the points you make, which is not to imply that you’re in complete agreement with mine.

@AnonymousBloke, even the less impressive tools might be useful in particular operations, and may have been developed or acquired for operations with a highly specific use in mind. Some of them may simply be less destructive means of achieving an intended objective.

For example, you may want to deny a particular commander’s ability to receive communications from certain sources. And perhaps you want to do this without high explosives, or sending in a unit to interfere with various cables, and so forth. Rendering his phone, email, or fax (whatever he uses) unusable with a stream of messages may accomplish the same effect with less risk and cost; it may have the additional benefit of sowing more confusion than straightforward tactics would.

Or perhaps you wish to reduce the effectiveness of a particular node in a social network without physically removing (killing or capturing) that node. Forged messages and other forms of deception may accomplish that purpose.

During the American Revolutionary War, forged messages would sometimes be inserted into British diplomatic and military pouches, intended to deceive the British as to American force size and dispositions, or to otherwise induce failures of coordination among British forces and efforts (and the British did the same). These tools seem to me to be little different.

Sure, some of the tools may not be sophisticated. But so what? They’re picking the tools for the job, not for the showcase.

Somewhat as a side-note, what really strikes me about articles like this is that their cumulative effect is to increase reliance on less precise and more lethal lines of effort. There are consequences to consider here beyond whether publication directly leads to a death, such as by naming an agent.

Put differently and by an imperfect analogy, publishing information that reduces the effectiveness of a precision guided munition may not directly cause anyone’s death, but by shifting reliance to munitions with less precision and broader lethality the indirect, but clearly connected, effect is still a net negative.

Skeptical • July 24, 2014 10:03 AM

@BJP – I was expecting nice words from Skeptical to flush away any cred I had here like a GCHQ botnet banging on a YouTube “report abuse” button.

Don’t worry, next time I’ll be sure to really insult you while implying that you secretly want the terrorists to win. I may even reference your “UBL In Our Hearts Forever” screensaver.

@AnonymousBloke: There is zero excuse for this incident to have happened. Post-Manning, they did nothing? Post-Hanssen, for that matter? Hanssen was the textbook case to say, “Do not allow unfettered access on computers to confidential material”.

I agree with some of that, although there may be constraints and challenges that we’re not considering in making the “zero excuses” judgment.

Take Manning. Her acts occurred when the military was aggressively expanding and implementing concepts of net-centric warfare. Part of that would include the placement of lots of information at the fingertips of forward units, who could then pull information they think to be relevant rather than having information pushed to them on the basis of what those higher in the chain of command, and perhaps not in the field or even in theatre, deemed to be relevant.

They did this while trying to mount two counterinsurgency campaigns without enough personnel in either, while increasing other unconventional operations globally, and while tackling myriad other complex and urgent problems.

Mistakes made? Definitely. Zero excuses? The term “excuses” may not be accurate, but “reasons other than incompetence” might be.

That said… sure, it may have just been a series of inexcusable foul ups.

…If I wanted to get very esoteric, I could argue that this is the death of means of non-lethal warfare, as you appear to be arguing in that direction.

I wouldn’t go that far. But, at a high level of abstraction and subject to many exceptions and qualifications, when one reduces intelligence and information ops capabilities without reducing the perceived need for military operations, then one is increasing the probability of operations that result in greater “collateral damage” and larger numbers of mistaken strikes than might otherwise be the case.

… Diversions, diversions, diversions. Problem with intelligence agencies of the world is they are the eyes and ears of their nations. So if you grab their attention, you can grab their hearts and minds. And who would know? They won’t say anything.

The issues you mentioned (the Middle East, Ukraine, Russia) are all important. I’m not sure I understand why you think that US or British intelligence services aren’t paying attention to them, though.