Showing posts with label nsa. Show all posts
Showing posts with label nsa. Show all posts

Saturday, July 15, 2017

The Intercept Discloses Top-Secret NSA Document On Russia Hacking Aimed At US Voting System

The report details an operation targeting voter registration in 2016.

By Ben Dreyfuss

On Monday, the Intercept published a classified internal NSA document noting that Russian military intelligence mounted an operation to hack at least one US voting software supplier—which provided software related to voter registration files—in the months prior to last year’s presidential contest. It has previously been reported that Russia attempted to hack into voter registration systems, but this NSA document provides details of how one such operation occurred.

According to the Intercept:
The top-secret National Security Agency document, which was provided anonymously to The Intercept and independently authenticated, analyzes intelligence very recently acquired by the agency about a months-long Russian intelligence cyber effort against elements of the US election and voting infrastructure. The report, dated May 5, 2017, is the most detailed US government account of Russian interference in the election that has yet come to light.
While the document provides a rare window into the NSA’s understanding of the mechanics of Russian hacking, it does not show the underlying “raw” intelligence on which the analysis is based. A US intelligence officer who declined to be identified cautioned against drawing too big a conclusion from the document because a single analysis is not necessarily definitive.
The report indicates that Russian hacking may have penetrated further into US voting systems than was previously understood. It states unequivocally in its summary statement that it was Russian military intelligence, specifically the Russian General Staff Main Intelligence Directorate, or GRU, that conducted the cyber attacks described in the document:
Russian General Staff Main Intelligence Directorate actors … executed cyber espionage operations against a named U.S. company in August 2016, evidently to obtain information on elections-related software and hardware solutions. … The actors likely used data obtained from that operation to … launch a voter registration-themed spear-phishing campaign targeting U.S. local government organizations.
Go read the whole thing.

Sunday, July 9, 2017

Trump’s Son Met With Russian Lawyer After Being Promised Damaging Information On Clinton

A meeting arranged by Donald Trump Jr. was held at Trump Tower in June 2016 with a Russian lawyer who has connections to the Kremlin. Credit Sam Hodgson for The New York Times
President Trump’s eldest son, Donald Trump Jr., was promised damaging information about Hillary Clinton before agreeing to meet with a Kremlin-connected Russian lawyer during the 2016 campaign, according to three advisers to the White House briefed on the meeting and two others with knowledge of it.

The meeting was also attended by his campaign chairman at the time, Paul J. Manafort, and his son-in-law, Jared Kushner. Mr. Manafort and Mr. Kushner only recently disclosed the meeting, though not its content, in confidential government documents described to The New York Times.

The Times reported the existence of the meeting on Saturday. But in subsequent interviews, the advisers and others revealed the motivation behind it.

The meeting — at Trump Tower on June 9, 2016, two weeks after Donald J. Trump clinched the Republican nomination — points to the central question in federal investigations of the Kremlin’s meddling in the presidential election: whether the Trump campaign colluded with the Russians. The accounts of the meeting represent the first public indication that at least some in the campaign were willing to accept Russian help.

And while Trump has been dogged by revelations of undisclosed meetings between his associates and the Russians, the episode at Trump Tower is the first such confirmed private meeting involving members of his inner circle during the campaign — as well as the first one known to have included his eldest son. It came at an inflection point in the campaign, when Donald Trump Jr., who served as an adviser and a surrogate, was ascendant and Mr. Manafort was consolidating power.

It is unclear whether the Russian lawyer, Natalia Veselnitskaya, actually produced the promised compromising information about Mrs. Clinton. But the people interviewed by The Times about the meeting said the expectation was that she would do so.

In a statement on Sunday, Donald Trump Jr. said he had met with the Russian lawyer at the request of an acquaintance. “After pleasantries were exchanged,” he said, “the woman stated that she had information that individuals connected to Russia were funding the Democratic National Committee and supporting Ms. Clinton. Her statements were vague, ambiguous and made no sense. No details or supporting information was provided or even offered. It quickly became clear that she had no meaningful information.”

He said she then turned the conversation to adoption of Russian children and the Magnitsky Act, an American law that blacklists suspected Russian human rights abusers. The law so enraged President Vladimir V. Putin of Russia that he retaliated by halting American adoptions of Russian children.

“It became clear to me that this was the true agenda all along and that the claims of potentially helpful information were a pretext for the meeting,” Mr. Trump said.

When he was first asked about the meeting on Saturday, he said only that it was primarily about adoptions and mentioned nothing about Mrs. Clinton.
President Trump’s son-in-law, Jared Kushner, also attended the meeting last year at Trump Tower. Credit Ruth Fremson/The New York Times
Mark Corallo, a spokesman for the president’s lawyer, said on Sunday that “Trump was not aware of and did not attend the meeting.”

Lawyers and spokesmen for Mr. Kushner and Mr. Manafort did not immediately respond to requests for comment. In his statement, Donald Trump Jr. said he asked Mr. Manafort and Mr. Kushner to attend, but did not tell them what the meeting was about.

American intelligence agencies have concluded that Russian hackers and propagandists worked to tip the election toward Donald J. Trump, in part by stealing and then providing to WikiLeaks internal Democratic Party and Clinton campaign emails that were embarrassing to Mrs. Clinton. WikiLeaks began releasing the material on July 22.

A special prosecutor and congressional committees are now investigating the Trump campaign’s possible collusion with the Russians. Mr. Trump has disputed that, but the investigation has cast a shadow over his administration.

Mr. Trump has also equivocated on whether the Russians were solely responsible for the hacking. On Sunday, two days after his first meeting as president with Mr. Putin, Mr. Trump said in a Twitter post: “I strongly pressed President Putin twice about Russian meddling in our election. He vehemently denied it. I’ve already given my opinion.....” He also tweeted that they had “discussed forming an impenetrable Cyber Security unit so that election hacking, & many other negative things, will be guarded...””

On Sunday morning on Fox News, the White House chief of staff, Reince Priebus, described the Trump Tower meeting as a “big nothing burger.”

“Talking about issues of foreign policy, issues related to our place in the world, issues important to the American people is not unusual,” he said.

But Representative Adam B. Schiff of California, the leading Democrat on the House Intelligence Committee, one of the panels investigating Russian election interference, said he wanted to question “everyone that was at that meeting.”

“There’s no reason for this Russian government advocate to be meeting with Paul Manafort or with Mr. Kushner or the president’s son if it wasn’t about the campaign and Russia policy,” Mr. Schiff said after the initial Times report.

Ms. Veselnitskaya, the Russian lawyer invited to the Trump Tower meeting, is best known for mounting a multipronged attack against the Magnitsky Act.

The adoption impasse is a frequently used talking point for opponents of the act. Ms. Veselnitskaya’s campaign against the law has also included attempts to discredit the man after whom it was named, Sergei L. Magnitsky, a lawyer and auditor who died in 2009 in mysterious circumstances in a Russian prison after exposing one of the biggest corruption scandals during Mr. Putin’s rule.
Mr. Trump’s former campaign chairman, Paul J. Manafort, at the Republican National Convention in July 2016 in Cleveland. Credit Sam Hodgson for The New York Times
Ms. Veselnitskaya’s clients include state-owned businesses and a senior government official’s son, whose company was under investigation in the United States at the time of the meeting. Her activities and associations had previously drawn the attention of the F.B.I., according to a former senior law enforcement official.

Ms. Veselnitskaya said in a statement on Saturday that “nothing at all about the presidential campaign” was discussed. She recalled that after about 10 minutes, either Mr. Kushner or Mr. Manafort walked out.

She said she had “never acted on behalf of the Russian government” and “never discussed any of these matters with any representative of the Russian government.”

The Trump Tower meeting was disclosed to government officials in recent days, when Mr. Kushner, who is also a senior White House aide, filed a revised version of a form required to obtain a security clearance.

The Times reported in April that he had failed to disclose any foreign contacts, including meetings with the Russian ambassador to the United States and the head of a Russian state bank. Failure to report such contacts can result in a loss of access to classified information and even, if information is knowingly falsified or concealed, in imprisonment.

Mr. Kushner’s advisers said at the time that the omissions were an error, and that he had immediately notified the F.B.I. that he would be revising the filing.

In a statement on Saturday, Mr. Kushner’s lawyer, Jamie Gorelick, said: “He has since submitted this information, including that during the campaign and transition, he had over 100 calls or meetings with representatives of more than 20 countries, most of which were during transition. Mr. Kushner has submitted additional updates and included, out of an abundance of caution, this meeting with a Russian person, which he briefly attended at the request of his brother-in-law Donald Trump Jr. As Mr. Kushner has consistently stated, he is eager to cooperate and share what he knows.”

Mr. Manafort, the former campaign chairman, also recently disclosed the meeting, and Donald Trump Jr.’s role in organizing it, to congressional investigators who had questions about his foreign contacts, according to people familiar with the events. Neither Mr. Manafort nor Mr. Kushner was required to disclose the content of the meeting.

A spokesman for Mr. Manafort declined to comment.

Since the president took office, Donald Trump Jr. and his brother Eric have assumed day-to-day control of their father’s real estate empire. Because he does not serve in the administration and does not have a security clearance, Donald Trump Jr. was not required to disclose his foreign contacts.

Federal and congressional investigators have not publicly asked for any records that would require his disclosure of Russian contacts.

Ms. Veselnitskaya is a formidable operator with a history of pushing the Kremlin’s agenda. Most notable is her campaign against the Magnitsky Act, which provoked a Cold War-style, tit-for-tat dispute with the Kremlin when President Barack Obama signed it into law in 2012.

Under the law, about 44 Russian citizens have been put on a list that allows the United States to seize their American assets and deny them visas. The United States asserts that many of them are connected to the fraud exposed by Mr. Magnitsky, who after being jailed for more than a year was found dead in his cell. A Russian human rights panel found that he had been assaulted. To critics of Mr. Putin, Mr. Magnitsky, in death, became a symbol of corruption and brutality in the Russian state.
An infuriated Mr. Putin has called the law an “outrageous act,” and, in addition to banning American adoptions, he compiled what became known as an “anti-Magnitsky” blacklist of United States citizens.

Among those blacklisted was Preet Bharara, then the United States attorney in Manhattan, who led notable convictions of Russian arms and drug dealers. Mr. Bharara was abruptly fired in March, after previously being asked to stay on by President Trump.

One of Ms. Veselnitskaya’s clients is Denis Katsyv, the Russian owner of Prevezon Holdings, an investment company based in Cyprus. He is the son of Petr Katsyv, the vice president of the state-owned Russian Railways and a former deputy governor of the Moscow region. In a civil forfeiture case prosecuted by Mr. Bharara’s office, the Justice Department alleged that Prevezon had helped launder money linked to the $230 million corruption scheme exposed by Mr. Magnitsky by putting it in New York real estate and bank accounts. Prevezon recently settled the case for $6 million without admitting wrongdoing.

Ms. Veselnitskaya and her client also hired a team of political and legal operatives to press the case for repeal. And they tried but failed to keep Mr. Magnitsky’s name off a new law that takes aim at human-rights abusers across the globe. The team included Rinat Akhmetshin, an √©migr√© to the United States who once served as a Soviet military officer and who has been called a Russian political gun for hire. Fusion GPS, a consulting firm that produced an intelligence dossier that contained unverified allegations about Mr. Trump, was also hired to do research for Prevezon.

Ms. Veselnitskaya was also deeply involved in the making of a film that disputes the widely accepted version of Mr. Magnitsky’s life and death. In the film and in her statement, she said the true culprit of the fraud was William F. Browder, an American-born financier who hired Mr. Magnitsky to investigate the fraud after three of his investment funds companies in Russia were seized.

Mr. Browder called the film a state-sponsored smear campaign.

“She’s not just some private lawyer,” Mr. Browder said of Ms. Veselnitskaya. “She is a tool of the Russian government.”

John O. Brennan, a former C.I.A. director, testified in May that he had been concerned last year by Russian government efforts to contact and manipulate members of Mr. Trump’s campaign. “Russian intelligence agencies do not hesitate at all to use private companies and Russian persons who are unaffiliated with the Russian government to support their objectives,” he said.

The F.B.I. began a counterintelligence investigation last year into Russian contacts with any Trump associates. Agents focused on Mr. Manafort and a pair of advisers, Carter Page and Roger J. Stone Jr.

Among those now under investigation is Michael T. Flynn, who was forced to resign as Mr. Trump’s national security adviser after it became known that he had falsely denied speaking to the Russian ambassador about sanctions imposed by the Obama administration over the election hacking.

Congress later discovered that Mr. Flynn had been paid more than $65,000 by companies linked to Russia, and that he had failed to disclose those payments when he renewed his security clearance and underwent an additional background check to join the White House staff.

In May, the president fired the F.B.I. director, James B. Comey, who days later provided information about a meeting with Mr. Trump at the White House. According to Mr. Comey, the president asked him to end the bureau’s investigation into Mr. Flynn; Mr. Trump has repeatedly denied making such a request. Robert S. Mueller III, a former F.B.I. director, was then appointed as special counsel.

The status of Mr. Mueller’s investigation is not clear, but he has assembled a veteran team of prosecutors and agents to dig into any possible collusion.

Saturday, June 24, 2017

Obama’s secret struggle to punish Russia for Putin’s election assault

Early last August, an envelope with extraordinary handling restrictions arrived at the White House. 

Sent by courier from the CIA, it carried “eyes only” instructions that its contents be shown to just four people: President Barack Obama and three senior aides.

Inside was an intelligence bombshell, a report drawn from sourcing deep inside the Russian government that detailed Russian President Vladi­mir Putin’s direct involvement in a cyber campaign to disrupt and discredit the U.S. presidential race.

But it went further. The intelligence captured Putin’s specific instructions on the operation’s audacious objectives — defeat or at least damage the Democratic nominee, Hillary Clinton, and help elect her opponent, Donald Trump.

At that point, the outlines of the Russian assault on the U.S. election were increasingly apparent.

Hackers with ties to Russian intelligence services had been rummaging through Democratic Party computer networks, as well as some Republican systems, for more than a year. In July, the FBI had opened an investigation of contacts between Russian officials and Trump associates. And on July 22, nearly 20,000 emails stolen from the Democratic National Committee were dumped online by WikiLeaks.

https://www.washingtonpost.com/graphics/2017/world/national-security/obama-putin-election-hacking/?utm_term=.12a31b9dd507&hpid=hp_hp-top-table-main_russiaobama-banner-7a%3Ahomepage%2Fstory

2016 election is officially illegitimate. TIME: Hackers Altered Voter Rolls

http://time.com/4828306/russian-hacking-election-widespread-private-data/

Election Hackers Altered Voter Rolls, Stole Private Data, Officials Say
Massimo Calabresi - Jun 22, 2017

The hacking of state and local election databases in 2016 was more extensive than previously reported, including at least one successful attempt to alter voter information, and the theft of thousands of voter records that contain private information like partial Social Security numbers, current and former officials tell TIME.

In one case, investigators found there had been a manipulation of voter data in a county database but the alterations were discovered and rectified, two sources familiar with the matter tell TIME. Investigators have not identified whether the hackers in that case were Russian agents.

The fact that private data was stolen from states is separately providing investigators a previously unreported line of inquiry in the probes into Russian attempts to influence the election. In Illinois, more than 90% of the nearly 90,000 records stolen by Russian state actors contained drivers license numbers, and a quarter contained the last four digits of voters’ Social Security numbers, according to Ken Menzel, the General Counsel of the State Board of Elections.

Congressional investigators are probing whether any of this stolen private information made its way to the Trump campaign, two sources familiar with the investigations tell TIME.

“If any campaign, Trump or otherwise, used inappropriate data the questions are, How did they get it? From whom? And with what level of knowledge?” the former top Democratic staffer on the House Intelligence Committee, Michael Bahar, tells TIME. “That is a crux of the investigation."

Tuesday, May 9, 2017

Why The Sally Yates Hearing Was Very Bad News For The Trump White House

The president just lost his favorite piece of spin for countering the Russia scandal.



The much-anticipated Senate hearing on Monday afternoon with former acting attorney general Sally Yates and former director of national intelligence James Clapper confirmed an important point: the Russia story still poses tremendous trouble for President Donald Trump and his crew.

Yates recounted a disturbing tale. She recalled that on January 26, she requested and received a meeting with Don McGahn, Trump's White House counsel. At the time, Vice President Mike Pence and other White House officials were saying that ret. Lt. Gen. Michael Flynn, Trump's national security adviser, had not spoken the month before with the Russian ambassador to the United States, Sergey Kislyak, about the sanctions then-President Barack Obama had imposed on the Russians as punishment for Moscow's meddling in the 2016 presidential campaign. Yates' Justice Department had evidence—presumably intercepts of Flynn's communications with Kislyak—that showed this assertion was flat-out false.

At that meeting, Yates shared two pressing concerns with McGahn: that Flynn had lied to the vice president and that Flynn could now be blackmailed by the Russians because they knew he had lied about his conversations with Kislyak. As Yates told the members of the Senate subcommittee on crime and terrorism, "To state the obvious: you don't want your national security adviser compromised by the Russians." She and McGahn also discussed whether Flynn had violated any laws.

The next day, McGahn asked Yates to return to the White House, and they had another discussion. According to Yates, McGahn asked whether it would interfere with the FBI's ongoing investigation of Flynn if the White House took action regarding this matter. No, Yates said she told him. The FBI had already interviewed Flynn. And Yates explained to the senators that she had assumed that the White House would not sit on the information she presented McGahn and do nothing.

But that's what the White House did. McGahn in that second meeting did ask if the White House could review the evidence the Justice Department had. She agreed to make it available. (Yates testified that she did not know whether this material was ever reviewed by the White House. She was fired at that point because she would not support Trump's Muslim travel ban.) Whether McGahn examined that evidence about Flynn, the White House did not take action against him. It stood by Flynn. He remained in the job, hiring staff for the National Security Council and participating in key policy decision-making.

On February 9, the Washington Post revealed that Flynn had indeed spoken with Kislyak about the sanctions. And still the Trump White House backed him up. Four days later, Kellyanne Conway, a top Trump White House official, declared that Trump still had "full confidence" in Flynn. The next day—as a media firestorm continued—Trump fired him. Still, the day after he canned Flynn, Trump declared, "Gen. Flynn is a wonderful man. I think he has been treated very, very unfairly by the media, as I call it, the fake media in many cases. And I think it is really a sad thing that he was treated so badly." Trump displayed no concern about Flynn's misconduct.

The conclusion from Yates' testimony was clear: Trump didn't dump Flynn until the Kislyak matter became a public scandal and embarrassment. The Justice Department warning—hey, your national security adviser could be compromised by the foreign government that just intervened in the American presidential campaign—appeared to have had no impact on Trump's actions regarding Flynn. Imagine what Republicans would say if a President Hillary Clinton retained as national security adviser a person who could be blackmailed by Moscow.

The subcommittee's hearing was also inconvenient for Trump and his supporters on another key topic: it destroyed one of their favorite talking points.

On March 5, Clapper was interviewed by NBC News' Chuck Todd on Meet the Press and asked if there was any evidence of collusion between members of the Trump campaign and the Russians. "Not to my knowledge," Clapper replied. Since then, Trump and his champions have cited Clapper to say there is no there there with the Russia story. Trump on March 20 tweeted, "James Clapper and others stated that there is no evidence Potus colluded with Russia. The story is FAKE NEWS and everyone knows it!" White House press secretary Sean Spicer has repeatedly deployed this Clapper statement to insist there was no collusion.

At Monday's hearing, Clapper pulled this rug out from under the White House and its comrades. He noted that it was standard policy for the FBI not to share with him details about ongoing counterintelligence investigations. And he said he had not been aware of the FBI's investigation of contacts between Trump associates and Russia that FBI director James Comey revealed weeks ago at a House intelligence committee hearing. Consequently, when Clapper told Todd that he was not familiar with any evidence of Trump-Russia collusion, he was speaking accurately. But he essentially told the Senate subcommittee that he was not in a position to know for certain. This piece of spin should now be buried. Trump can no longer hide behind this one Clapper statement.

Clapper also dropped another piece of information disquieting for the Trump camp. Last month, the Guardian reported that British intelligence in late 2015 collected intelligence on suspicious interactions between Trump associates and known or suspected Russian agents and passed this information to to the United States "as part of a routine exchange of information." Asked about this report, Clapper said it was "accurate." He added, "The specifics are quite sensitive." This may well have been the first public confirmation from an intelligence community leader that US intelligence agencies have possessed secret information about ties between Trump's circle and Moscow. (Comey testified that the FBI's counterintelligence investigation of links between Trump associates and Russian began in late July 2016.)

So this hearing indicated that the Trump White House protected a national security adviser who lied and who could be compromised by Moscow, that Trump can no longer cite Clapper to claim there was no collusion, and that US intelligence had sensitive information on interactions between Trump associates and possible Russian agents as early as late 2015. Still, most of the Republicans on the panel focused on leaks and "unmasking"—not the main issues at hand. They collectively pounded more on Yates for her action regarding the Muslim travel ban than on Moscow for its covert operation to subvert the 2016 election to help Trump.

This Senate subcommittee, which is chaired by Sen. Lindsey Graham (R-S.C.), is not mounting a full investigation comparable to the inquiry being conducted by the Senate intelligence committee (and presumably the hobbled House intelligence committee). It has far less staff, and its jurisdiction is limited. But this hearing demonstrated that serious inquiry can expand the public knowledge of the Trump-Russia scandal—and that there remains much more to examine and unearth.

Saturday, April 30, 2016

The Blacklist - The Artax Network S3 E20

Reeling with grief, the task force hunts the organization behind Liz's failed abduction - who is Solomon working for and why was Liz the target? Meanwhile, Red confronts a man from his past. Brian Dennehy guest stars.


Tuesday, February 23, 2016

Why The Apple VS Govt Storyline Is A Fake Designed To Distract The Public

 
The backdoor is already in the IPhone.
 

The media is erupting over the FBI’s demand that Apple help it decrypt an iPhone belonging to Syed Rizwan Farook, one of the attackers involved in the assault in San Bernardino this past December.

Originally Apple wanted the FBI to keep things on the down low, asking the Feds to present their application for access under seal. But for whatever reason the FBI decided to go public. Apple then put on a big show of resistance and now there are legislators threatening to change the law in favor of the FBI. Yet concealed amid this unfolding drama is a vital fact that very few outlets are paying attention to.

Tim Cook protests that Apple is being asked to create “a new version of the iPhone operating system.” This glib talking point distracts attention from the reality that there’s essentially a backdoor on every new iPhone that ships around the world: the ability to load and execute modified firmware without user intervention.

Ostensibly software patches were intended to fix bugs. But they can just as easily install code that compromises sensitive data. I repeat: without user intervention. Apple isn’t alone in this regard. Has anyone noticed that the auto-update feature deployed with certain versions of Windows 10 is impossible to turn off using existing user controls?

Update features, it would seem, are a bullseye for spies. And rightly so because they represent a novel way to quietly execute malicious software. This past September the Washington Post published a leaked memo from the White House which proposed that intelligence agencies leverage “provider-enabled remote access to encrypted devices through current update procedures.” Yep, the same update procedures that are marketed as helping to keep users safe. And it would appear that the spies are making progress. There’s news from Bloomberg of a secret memo that tasked spymasters with estimating the budgetary requirements needed to develop “encryption workarounds.”

And, finally, please notice throughout this whole ordeal how the Director of the NSA, unlike the vociferous FBI director, has been relatively silent. With a budget on the order of $10 billion at its disposal the NSA almost certainly has something equivalent to what the courts have asked Apple to create. The NSA probably doesn’t want to give its bypass tool to the FBI and blow its operational advantage. After all, the NSA is well versed in the art of firmware-level manipulation. Experts have opined that for a few million (a drop in the bucket for a spy outfit like the NSA or CIA) this capability could be implemented. NSA whistleblower William Binney tends to agree. When asked what users could do to protect themselves from the Deep State’s prying eyes Binney replied:
“Use smoke signals! With NSA’s budget of over $10 bill a year, they have more resources to acquire your data than you can ever hope to defend against.
This has to be addressed in law and legislation. Call your local governmental representative and complain, otherwise, if you sit and do nothing… you are fucked!!!”
So while Apple manufactures the perception that it’s fighting for user privacy, keep in mind that the media’s Manichean narrative of “good vs. evil” doesn’t necessarily explain what’s transpiring.

Despite cheerleading by Ed Snowden and others Apple is not the company that it would have us believe it is. Apple has a long history of helping the government crack iPhones and security researchers have already unearthed any number of hidden services lurking below the iPhones surface.

The public record over the past several decades informs that ersatz public opposition often conceals private collusion. And Apple, dear reader, is no stranger when it comes to clandestine government programs. The sad truth is that government spies and corporate data hoarders assemble in the corridors of the American Deep State protected by a veil of official secrecy and sophisticated propaganda.

Related Stories

Wednesday, June 24, 2015

N.S.A. Eavesdropped On Last 3 French Presidents, WikiLeaks Says

Tuesday, May 12, 2015

Skynet is real, and it could flag you as a terrorist

Summary:If you visit airports or swap SIM cards often, you might be flagged by "Skynet."

A scene from "Terminator." (Screenshot: Warner Bros. via CNET/CBS Interactive)
It may not be quite the self-aware computer network that takes over millions of computers and machines, but "Skynet" is real.

Documents published by The Intercept, leaked by NSA whistleblower Edward Snowden, confirm that the Skynet program exists -- at least in name only. Its name comes from the intelligent computer defense system in the "Terminator" films, which later destroys most of humanity in a nuclear apocalypse.
As the Snowden leaks began, there was "fear and panic" in Congress
Just a few minutes after the first NSA leak was published, the phones of US lawmakers began to buzz, hours before most of America would find out over their morning coffee.
The National Security Agency program analyzes location and metadata from phone records to detect potentially suspicious patterns, according to the publication. In one example, it was used to identify people that act as couriers between al-Qaeda leadership. (This may have been the program that helped identify Osama bin Laden's courier, leading to his targeted killing in Pakistan by US forces in 2011.)

According to one of the documents, it uses "behavior-based analytics," such as low-use phones that only take incoming calls, SIM card or handset swapping, or frequent disconnections from the phone network (such as powering down cellphones). Also, repeated trips mapped out by location data, including visits to other countries or airports, can flag a person as being suspicious -- or a potential terrorist.

More than 55 million cell records collected from major Pakistani telecom companies were fed into the Skynet system to determine targets of interest, the document said.

But questions remain around why the program flagged a prominent Al Jazeera journalist as a "member" of al-Qaeda. It's probably not a surprise that the system alerted on Ahmad Muaffaq Zaidan, a Syrian national, based on his frequent travel between Afghanistan and Pakistan. But the fact that it identified him as a member of a terrorist group is a mystery, as well as a great concern.

Zaidan "absolutely" denied that he is a member of al-Qaeda, and criticized the US government's "attempt at using questionable techniques to target our journalists."

We reached out to the NSA to see why it used the name, but didn't hear back at the time of writing.

Tuesday, February 17, 2015

NSA hiding Equation spy program on hard drives



By JOSEPH MENN

Equation infection: Kaspersky Labs says the highest number of machines infected with Equation programs were in Iran, Russia and Pakistan.

The US National Security Agency has figured out how to hide spying software deep within hard drives made by Western Digital, Seagate, Toshiba and other top manufacturers, giving the agency the means to eavesdrop on the majority of the world's computers, according to cyber researchers and former operatives.

That long-sought and closely guarded ability was part of a cluster of spying programs discovered by Kaspersky Lab, the Moscow-based security software maker that has exposed a series of Western cyber-espionage operations.

Kaspersky said it found personal computers in 30 countries infected with one or more of the spying programs, with the most infections seen in Iran, followed by Russia, Pakistan, Afghanistan, China, Mali, Syria, Yemen and Algeria. The targets included government and military institutions, telecommunication companies, banks, energy companies, nuclear researchers, media, and Islamic activists, Kaspersky said.
The areas of government Equation has been able to infect by nation.
Kaspersky Labs - The areas of government Equation has been able to infect by nation.

The firm declined to publicly name the country behind the spying campaign, but said it was closely linked to Stuxnet, the NSA-led cyberweapon that was used to attack Iran's uranium enrichment facility. The NSA is the agency responsible for gathering electronic intelligence on behalf of the United States.

A former NSA employee told Reuters that Kaspersky's analysis was correct, and that people still in the intelligence agency valued these spying programs as highly as Stuxnet. Another former intelligence operative confirmed that the NSA had developed the prized technique of concealing spyware in hard drives, but said he did not know which spy efforts relied on it.

NSA spokeswoman Vanee Vines declined to comment.

Kaspersky published the technical details of its research on Monday, which should help infected institutions detect the spying programs, some of which trace back as far as 2001.

The disclosure could further hurt the NSA's surveillance abilities, already damaged by massive leaks by former contractor Edward Snowden. Snowden's revelations have hurt the United States' relations with some allies and slowed the sales of US technology products abroad.

The exposure of these new spying tools could lead to greater backlash against Western technology, particularly in countries such as China, which is already drafting regulations that would require most bank technology suppliers to proffer copies of their software code for inspection.

TECHNOLOGICAL BREAKTHROUGH

According to Kaspersky, the spies made a technological breakthrough by figuring out how to lodge malicious software in the obscure code called firmware that launches every time a computer is turned on.

Disk drive firmware is viewed by spies and cybersecurity experts as the second-most valuable real estate on a PC for a hacker, second only to the BIOS code invoked automatically as a computer boots up.

"The hardware will be able to infect the computer over and over," lead Kaspersky researcher Costin Raiu said in an interview.

Though the leaders of the still-active espionage campaign could have taken control of thousands of PC's, giving them the ability to steal files or eavesdrop on anything they wanted, the spies were selective and only established full remote control over machines belonging to the most desirable foreign targets, according to Raiu. He said Kaspersky found only a few especially high-value computers with the hard-drive infections.

Kaspersky's reconstructions of the spying programs show that they could work in disk drives sold by more than a dozen companies, comprising essentially the entire market. They include Western Digital, Seagate, Toshiba, IBM, Micron Technology and Samsung.

Western Digital, Seagate and Micron said they had no knowledge of these spying programs. Toshiba and Samsung declined to comment. IBM did not respond to requests for comment.

GETTING THE SOURCE CODE

Raiu said the authors of the spying programs must have had access to the proprietary source code that directs the actions of the hard drives. That code can serve as a road map to vulnerabilities, allowing those who study it to launch attacks much more easily.

"There is zero chance that someone could rewrite the [hard drive] operating system using public information," Raiu said.

Concerns about access to source code flared after a series of high-profile cyber attacks on Google Inc and other US companies in 2009 that were blamed on China. Investigators have said they found evidence that the hackers gained access to source code from several big US tech and defense companies.

It is not clear how the NSA may have obtained the hard drives' source code. Western Digital spokesman Steve Shattuck said the company "has not provided its source code to government agencies." The other hard drive makers would not say if they had shared their source code with the NSA.

Seagate spokesman Clive Over said it has "secure measures to prevent tampering or reverse engineering of its firmware and other technologies." Micron spokesman Daniel Francisco said the company took the security of its products seriously and "we are not aware of any instances of foreign code."

According to former intelligence operatives, the NSA has multiple ways of obtaining source code from tech companies, including asking directly and posing as a software developer. If a company wants to sell products to the Pentagon or another sensitive US agency, the government can request a security audit to make sure the source code is safe.

"They don't admit it, but they do say, 'We're going to do an evaluation, we need the source code,'" said Vincent Liu, a partner at security consulting firm Bishop Fox and former NSA analyst. "It's usually the NSA doing the evaluation, and it's a pretty small leap to say they're going to keep that source code."

Kaspersky called the authors of the spying program "the Equation group," named after their embrace of complex encryption formulas.

The group used a variety of means to spread other spying programs, such as by compromising jihadist websites, infecting USB sticks and CDs, and developing a self-spreading computer worm called Fanny, Kasperky said.

Fanny was like Stuxnet in that it exploited two of the same undisclosed software flaws, known as "zero days," which strongly suggested collaboration by the authors, Raiu said. He added that it was "quite possible" that the Equation group used Fanny to scout out targets for Stuxnet in Iran and spread the virus.
 - Reuters

Tuesday, January 27, 2015

EFF’s Game Plan for Ending Global Mass Surveillance

By Rainey Reitman

We have a problem when it comes to stopping mass surveillance. 

The entity that’s conducting the most extreme and far-reaching surveillance against most of the world’s communications—the National Security Agency—is bound by United States law.

That’s good news for Americans. U.S. law and the Constitution protect American citizens and legal residents from warrantless surveillance. That means we have a very strong legal case to challenge mass surveillance conducted domestically or that sweeps in Americans’ communications.

Similarly, the United States Congress is elected by American voters. That means Congressional representatives are beholden to the American people for their jobs, so public pressure from constituents can help influence future laws that might check some of the NSA’s most egregious practices.

But what about everyone else? What about the 96% of the world’s population who are citizens of other countries, living outside U.S. borders. They don't get a vote in Congress. And current American legal protections generally only protect citizens, legal residents, or those physically located within the United States. So what can EFF do to protect the billions of people outside the United States who are victims of the NSA’s spying?

For years, we’ve been working on a strategy to end mass surveillance of digital communications of innocent people worldwide. Today we’re laying out the plan, so you can understand how all the pieces fit together—that is, how U.S. advocacy and policy efforts connect to the international fight and vice versa. Decide for yourself where you can get involved to make the biggest difference.

This plan isn’t for the next two weeks or three months. It’s a multi-year battle that may need to be revised many times as we better understand the tools and authorities of entities engaged in mass surveillance and as more disclosures by whistle-blowers help shine light on surveillance abuses.

If you’d like an overview of how U.S. surveillance law works, check out our addendum.

Intro: Mass Surveillance by NSA, GCHQ and Others 

The National Security Agency is working to collect as much as possible about the digital lives of people worldwide. As the Washington Post reported, a former senior U.S. intelligence official characterized former NSA Director Gen. Keith Alexander’s approach to surveillance as “Collect it all, tag it, store it… And whatever it is you want, you go searching for it.”

The NSA can’t do this alone. It relies on a network of international partners who help collect information worldwide, especially the intelligence agencies of Australia, Canada, New Zealand, and the United Kingdom (collectively known, along with the United States, as the “Five Eyes.”) In addition, the United States has relationships (including various levels of intelligence data sharing and assistance) with Belgium, Denmark, France, Germany, Israel, Italy, Japan, the Netherlands, Norway, Singapore, Spain, South Korea, Sweden, and potentially a number of other countries worldwide.

There are also other countries—like Russia, China, and others—engaging in surveillance of digital communications without sharing that data with the NSA. Some of those governments, including the U.S. government, are spending billions of dollars to develop spying capabilities that they use aggressively against innocent people around the world. Some of them may do so with even less oversight and even fewer legal restrictions.

Although whistle-blowers and journalists have focused attention on the staggering powers and ambitions of the likes of the NSA and GCHQ, we should never assume that other governments lack the desire to join them. Agencies everywhere are hungry for our data and working to expand their reach. Read about international surveillance law reform and fighting back through user-side encryption.

We focus here on the NSA because we know the most about its activities and we have the most legal and political tools for holding it to account. Of course, we need to know much more about surveillance practices of other agencies in the U.S. and abroad and expand our work together with our partners around the world to confront surveillance as a worldwide epidemic.

Mass surveillance is facilitated by technology companies, especially large ones. These companies often have insufficient or even sloppy security practices that make mass surveillance easier, and in some cases may be actively assisting the NSA in sweeping up data on hundreds of millions of people (for example, AT&T). In other cases, tech companies may be legally compelled to provide access to their servers to the NSA (or they may choose to fight that access). Read more about how tech companies can harden their systems against surveillance.

The NSA relies on several laws as well as a presidential order to justify its continued mass surveillance. Laws passed by Congress as well as orders from the U.S. President can curtail surveillance by the NSA, and the Supreme Court of the United States also has authority to put the brakes on surveillance.

The Game Plan

Given that the American legal system doesn’t adequately protect the rights of people overseas, what can we do in the immediate future to protect Internet users who may not be Americans?

Here’s the game plan for right now. Note that these are not consecutive steps; we’re working on them concurrently.

1.  Pressure technology companies to harden their systems against NSA surveillance
To date, there are unanswered questions about the degree to which U.S. technology companies are actively assisting the NSA.

In some cases, we know that tech companies are doing a lot to help the NSA get access to data. AT&T is a clear example of this. Thanks to whistle blower evidence, we know AT&T has a secret room at its Folsom Street facility in San Francisco where a fiber optic splitter creates a copy of the Internet traffic that passes through AT&T’s networks. That splitter routes data directly to the NSA.

Some companies have taken things a step further and deliberately weakened or sabotaged their own products to "enable" NSA spying. We don't know who's done this or what they've done, but the NSA documents make clear that it's happening. It's the height of betrayal of the public, and it could conceivably be taking place with the help even of some companies that are loudly complaining about government spying.

So what do we know about major tech companies, like Google, Facebook, Yahoo, and Microsoft? Here we have mixed reports. Documents provided by Edward Snowden and published in the Guardian and the Washington Post name nine U.S. companies—Microsoft, Yahoo, Google, Facebook, PalTalk, AOL, Skype, YouTube, and Apple—as participants in the NSA’s PRISM program. The documents indicate that the NSA has access to servers at each of these companies, and implies that these companies are complicit in the surveillance of their users.

The companies, in turn, have strongly denied these allegations, and have even formed a lobby group calling on governments to "limit surveillance to specific, known users for lawful purposes, and should not undertake bulk data collection of Internet communications."

While a start, that’s a far cry from the role companies could be playing. Tech companies also have the ability to harden their systems to make mass surveillance more difficult, and to roll out features that allow users to easily encrypt their communications so that they are so completely secure that even their service providers can’t read them. Perhaps most importantly, technology companies must categorically resist attempts to insert back doors into their hardware or software.

There's also an important legal issue that can't be ignored. Tech companies are in a unique position to know about surveillance requests that are kept secret from the press and the public. These companies may have the best chance to fight back on behalf of their users in court (as Yahoo has done).

What’s more, tech companies literally spend millions of dollars to lobby for laws in Washington and enjoy incredible access to and influence over U.S. lawmakers. Often, companies spend that money trying to derail potential regulation. Instead, these companies could be heavily prioritizing positive surveillance reform bills.

So how do we get tech companies to start fighting surveillance in court, hardening their systems against surveillance, pushing back against the administration, and lobbying for real reform? We’re focused on transparency—uncovering everything we can about the degree to which big tech companies are actively helping the government—and public pressure. That means highlighting ways that companies are fighting surveillance and calling out companies that fail to stand up for user privacy.  

It’s why we’re proud to support the Reset the Net campaign, designed to get companies big and small to take steps to protect user data. It's also why we're working to make what companies do and don't do in this area more visible. Campaigns like HTTPS Everywhere and our work on email transport encryption, as well as scorecards like Who Has Your Back are designed to poke and prod these companies to do more to protect all their users, and get them to publicly commit to steps that the public can objectively check.

We also need to cultivate a sense of responsibility on the part of all those who are building products to which the public entrusts its most sensitive and private data. The people who create our computing devices, network equipment, software environments, and so on, need to be very clear about their responsibility to the users who have chosen to trust them. They need to refuse to create backdoors and they need to fix any existing backdoors they become aware of. And they need to understand that they themselves, unfortunately, are going to be targets for governments that will try to penetrate, subvert, and coerce the technology world in order to expand their spying capabilities. They have a grave responsibility to users worldwide and we must use public pressure to ensure they live up to that responsibility.

2. Create a global movement that encourages user-side encryption

Getting tech giants to safeguard our digital lives and changing laws and policies might be slow going, but anybody could start using encryption in a matter of minutes. From encrypted chat to encrypted email, from secure web browsing to secure document transfers, encryption is a powerful way to make mass surveillance significantly more difficult.

However, encryption can be tricky, especially if you don’t have a team of engineers to walk you through it the way we do at EFF. With that in mind, we’ve created Surveillance Self Defense, an in-depth resource that explains encryption to folks who may want to safeguard their data but have little or no idea how to do it.

We’ve already translated the materials into Spanish and Arabic, and we’re working on even more translations.
             
We’ll continue to expand these materials and translate them into as many languages as possible, while also doing a public campaign to make sure as many people as possible read them.

Again, the more people worldwide understand the threat and the more they understand how to protect themselves—and just as importantly, what they should expect in the way of support from companies and governments—the more we can agitate for the changes we need online to fend off the dragnet collection of data.

3. Encourage the creation of secure communication tools that are easier to use

Many of the tools that are using security best practices are, frankly, hard to use for everyday people. The ones that are easiest to use often don’t adopt the security practices that make them resilient to surveillance.

We want to see this problem fixed so that people don’t have to trade usability for security. We’re rolling out a multi-stage Campaign for Secure and Usable Crypto, and we kicked it off with a Secure Messaging Scorecard. The Secure Messaging Scorecard is only looking at a few criteria for security, and the next phases of the project will home in on more challenging security and usability objectives.

The goal? Encouraging the development of new technologies that will be secure and easy for everyday people to use, while also pushing bigger companies to adopt security best practices.

4. Reform Executive Order 12333

Most people haven’t even heard of it, but Executive Order 12333 is the primary authority the NSA uses to engage in the surveillance of people outside the U.S. While Congress is considering much-needed reforms to the Patriot Act, there’s been almost no debate about Executive Order 12333.

This executive order was created by a stroke of the pen from President Ronald Reagan in 1981.

President Obama could undo the worst parts of this executive order just as easily, by issuing a presidential order banning mass surveillance of people regardless of their nationality.

We’ve already launched the first phase of our campaign to reform Executive Order 12333.

5. Develop guiding legal principles around surveillance and privacy with the help of scholars and legal experts worldwide

The campaign got started well before the Snowden leaks began. It began with a rigorous policy document called the International Principles on the Application of Human Rights to Communications Surveillance, which features 13 guiding principles about limiting surveillance. Written by academics and legal experts from across the globe, the principles have now been endorsed by over 417 NGO's and 350,000 individuals worldwide, and have been the basis for a pro-privacy resolution successfully passed by the United Nations.

The 13 Principles, as they're also known, are also meant to work both locally and globally. By giving politicians and activists the context for why mass surveillance is a violation of established international human rights law, they make it clear that legalizing mass surveillance—a path promoted by the Five Eyes countries—is the wrong way forward. The 13 Principles are our way of making sure that the global norm for human rights in the context of communication surveillance isn't the warped viewpoint of NSA and its four closest allies, but that of 50 years of human rights standards showing mass surveillance to be unnecessary and disproportionate.

6. Cultivate partners worldwide who can champion surveillance reform on the local level, and offer them support and promotion

Katitza Rodriguez, EFF’s International Rights Director, is rarely in our San Francisco office. That’s because the majority of her time is spent traveling from country to country, meeting with advocacy groups on the ground throughout Latin America and parts of Europe to fight for surveillance law reform. Katitza and the rest of EFF’s international team assist these groups in working to build country-specific plans to end mass surveillance at home and abroad.

The goal is to engage activists and lawyers worldwide who can use the 13 Principles and the legal analyses we’ve prepared to support them at the national level to fight against the on-going trend of increased surveillance powers. For example, we teamed up with activists in Australia, Mexico, and Paraguay to help fight data retention mandates in those countries, including speaking in the Paraguayan National Congress.

EFF is especially focused on countries that are known to share intelligence data with the United States and on trying to understand the politics of surveillance behind those data sharing agreements and surveillance law proposals.

We’ve been sharing with and learning from groups across the world a range of different tactics, strategies, and legal methods that can be helpful in uncovering and combating unchecked surveillance. Our partners are starting to develop their own national surveillance law strategies, working out a localized version of the Who Has Your Back campaign, evaluating strategic litigation, and educating the general public of the danger of mass surveillance.

In certain locales, these battles are politically and socially difficult, in particular in places where a culture of fear has permeated the society. We’ve seen anti-surveillance advocates wrongly painted as allies of pedophiles or terrorists. In at least one of the countries we’re working in, anonymity is forbidden in its constitution. For some of our partners, promoting a rational debate about checking government power abuses can risk their very freedom, with activists facing jail time or even more serious consequences for speaking out.

Establishing a bottom-up counter-surveillance law movement—even if it's one based on common sense and the entire history of modern democracies—isn't easy. It’s a titanic task that needs the involvement of advocates around the world with different tactics and strategies that are complementary. This is why we’ve also been working to make connections between activists in different countries, with case studies like the Counter-Surveillance Success Stories, and highlighting individuals who are proud to stand up and say "I Fight Surveillance." We’re also teaming up with partners, such as Panoptykon Foundation, to share the strategies and tactics they used in Europe with local groups in Latin America and vice-versa. We're working closely with groups in the Middle East and North Africa, such as 7iber and SMEX, to track, report on, and coordinate responses to state surveillance in these regions.

All of this has helped inform the work we've done in venues like the United Nations, the Office of the High Commissioner on Human Rights, and the Inter-American Commission on Human Rights, where EFF and our allies are helping—with great success—the legal minds there wrap their heads around this new age of state violations of the right to privacy and free expression.

Meanwhile, back in Washington...

7. Stop NSA overreach through impact litigation and new U.S. laws

Executive Order 12333 may be the presidential command that sets the agenda for mass surveillance, but U.S. law also plays a huge role. The NSA claims (often wrongly) that certain U.S. laws allow surveillance of all Internet users, with almost zero oversight of its spying on non-U.S. persons. There's the FISA Amendments Act, which the NSA believes allows it to spy on groups of people instead of with directed warrants and scoop up all of the Internet traffic it can, and grants it carte blanche to target anyone overseas on the grounds that they are potentially relevant to America's "foreign interests." And then there's the Patriot Act, which has been loosely interpreted by the NSA to permit the dragnet surveillance of phone records.
 
EFF Legal Team

Fighting these laws is the bread and butter of our domestic legal team. Our lawsuits, like Jewel v. NSA, aim to demonstrate that warrantless surveillance is illegal and unconstitutional. Our grassroots advocacy is dedicated to showing American lawmakers exactly how U.S. law is broken, what must be done to fix it, and the powerful movement of people working for change.

You can read more details about American law in our addendum below, but here's the upshot: we have to fix the law if we're to stop these secret agencies spying on the world. And we have to make sure that no new tricks are being planned.

That means chipping away at the culture of secrecy that lies at the heart of this mess.

8. Bring transparency to surveillance laws and practices

One of the greatest challenges we face in attempting to end mass surveillance is that we don’t know what we don’t know. Thanks to whistleblower evidence, statements by certain public officials, and years of aggressive litigation under the Freedom of Information Act, we’ve confirmed that the NSA is engaged in mass surveillance of our communications and that it is primarily relying on three legal authorities to justify this surveillance.

But what if the NSA is relying on seven other legal authorities? What if there are other forms of surveillance we have not yet heard about? What if the NSA is partnering with other entities (different countries or different branches of the U.S. government) to collect data in ways we can’t imagine?

It’s extremely difficult to reform the world of surveillance when we don’t have a full picture of what the government is doing and how it’s legally justifying those actions.

With that in mind, we are working to fight for more transparency by:
  • Working to reform the broken classification system, which keeps the government’s actions hidden from public oversight.
  • Using Freedom of Information Act requests and lawsuits to gain access to government documents that detail surveillance practices (and their legal justifications).
  • Helping allies, like Germany and Brazil, to put pressure on the United States to justify its surveillance practices.
  • Educating people about the value of whistleblowers and the important role they play in combating secrecy. This includes advocacy for organizations and platforms like Wikileaks that defend and promote the work of whistleblowers. It also includes highlighting the important contributions provided by whistleblowers like Mark Klein, Bill Binney, Thomas Drake, Edward Snowden, and others.
Global Solutions for a Global Problem

Mass surveillance affects people worldwide, reaching everywhere that the Internet reaches (and many places that it doesn’t!). But laws and court systems are divvied up by jurisdictional lines that don’t make sense for the Internet today. This means we need a range of tactics that include impact litigation, technological solutions, and policy changes both in the United States and across the globe.

This game plan is designed to give you insight into how U.S. laws and policies affect people worldwide, and how we can work to protect people outside of America’s borders.

We're up against more than just a few elements in the American administration here. We're up against a growing despondency about digital privacy, and we're up against the desire of spooks, autocrats, and corporations jockeying for intelligence contracts in every nation, all of whom want to shore up these surveillance powers for themselves. But we work side-by-side with hundreds of other organizations around the world and thousands of supporters in nearly every country. We have the amazing power of technology to protect privacy, organize opposition, and speak up against such damning violations of human rights.

We’re continuing to refine our plan, but we wanted to help our friends understand our thinking so you can understand how each of our smaller campaigns fit into the ultimate objective: secure, private communications for people worldwide.

It's what we’re doing to fight surveillance. But what can you do?

You can join your local digital rights organization, of which there are now hundreds, in almost every nation (and if there isn't one in yours, ask us for advice on starting one). You can pressure companies to increase your protection against government espionage and support companies that make a stand.

You can sign our petition about Executive Order 12333 and help spread the word to others. You can use encryption to protect yourself and raise the cost of mass surveillance, and you can teach your friends and colleagues to use it too. You can personally refuse to cooperate with surveillance and promote privacy protections inside institutions you're a part of. You can tell your friends and colleagues the real risks we are running and how we can turn this mess around.

And whether you're in the United States or not, you can support our plan by becoming a member of EFF.

Addendum: Laws & Presidential Orders We Need to Change

One of the best ways to end mass surveillance by the NSA is to change the United States law to make clear that warrantless surveillance is illegal. However, that’s a little challenging. The NSA is relying on a patchwork of different laws and executive orders to justify its surveillance powers.

Here are a few we know we need to change. Note that there are other parts of U.S. law that may need revision (including provisions such as the Pen Register Trap and Trace and National Security Letters), but this is where we're focusing our energies currently as the primary known authorities used to justify mass surveillance:

Section 215 of the Patriot Act, Known as the "Business Records" Section

Read the law

What it does: The section of the law basically says that the government can compel the production of any "tangible things" that are “relevant" to an investigation.

Why you should care: The NSA relies on this authority to collect, in bulk, the phone records of millions of Americans. There are suggestions it's also being used to collect other types of records, like financial records or credit card records, in bulk as well.

How we can stop it: There are a few ways to fix Section 215. One way is to pass a reform bill, such as the USA FREEDOM Act, which would make clear that using Section 215 to conduct bulk collection is illegal. The USA FREEDOM Act failed to pass in the Senate in 2014, which means it would need to be reintroduced in 2015.

However, there’s an even easier way to defeat this provision of the law. This controversial section of the Patriot Act expires every few years and must be reauthorized by Congress. It’s up for renewal in June 2015, which means Congress must successfully reauthorize the section or it will cease to be a law. We’re going to be mounting a huge campaign to call on Congress not to reauthorize the bill.

We also have three legal cases challenging surveillance conducted under Section 215: Jewel v NSA, Smith v Obama, and First Unitarian Church of Los Angeles v. NSA.

Section 702 of the FISA Amendments Act

Read the law
What it does: This section of law is designed to allow the NSA to conduct warrantless surveillance within the U.S. when the intended target is overseas.

Why you should care: The NSA relies on this law to support PRISM, which compels Internet service providers like Google, Apple, and Facebook to produce its users communications. The NSA's upstream surveillance—which includes tapping into fiber optic cables of AT&T and other telecommunications providers—also relies on this provision. Through these two surveillance options, the NSA "targets" subjects for surveillance. But even when the NSA is "targeting" specific foreign intelligence subjects overseas, they’re "incidentally" collecting communications on millions of people, including both Americans and innocent people abroad.

How we can stop it: Currently, there aren’t any reform bills that show promise. We’re working on educating the public and Congress about the Section 702 and the FISA Amendments Act. In 2017, this authority will be up for reauthorization. We’ll be planning a big campaign to demolish this invasive and oft-abused surveillance authority.

Executive Order 12333

Read the executive order

What it does: Executive orders are legally binding orders given by the President of the United States which direct how government agencies should operate. Executive Order 12333 covers "most of what the NSA does" and is "the primary authority under which the country’s intelligence agencies conduct the majority of their operations."

Why you should care: Executive Order 12333 is the primary authority the NSA uses to conduct its surveillance operations—including mass surveillance programs—overseas. Reforming mass surveillance requires reforming the NSA's authority under EO 12333.

How we can stop it: Executive Order 12333 was created by a presidential order, and so a presidential order could undo all of this damage. That’s why we’re pressuring President Obama to issue a new executive order affirming the privacy rights of people worldwide and ending mass surveillance.

The Funding Hack

While passing a bill through Congress is extremely challenging, another (somewhat more controversial) method of ending this surveillance is through the budget system. Every year, Congress must approve the defense budget. This frequently becomes a contentious battle with numerous amendments introduced and debated. We may see an amendment that tackles some form of surveillance.