America’s Cyber-Contortionist (and Free Trade Champion? – Not)

Just a few days ago, cyber-security specialists and senior government representatives met in Germany at the 50^th annual Munich Security Conference.  

Since 1963, the MSC has served as “an independent forum dedicated to promoting peaceful conflict resolution and international cooperation and dialogue in dealing with today’s and future security challenges.” (More at: https://www.securityconference.de/en/).

Needless to say, in recent years, the MSC has focused on security challenges in the realm of cyber.  This year’s sessions were no different.  One session in particular stood out for me: The January 31 Panel Discussion focused on: "Rebooting Trust? Freedom vs. Security in Cyberspace."

The President of Estonia made an opening statement, and then the CEO of Deutsche Telekom introduced the panelists, including the German Minister of the Interior, the EU Commissioner for Home Affairs, Microsoft’s VP of Security, Huawei’s Chief Security Officer (reminder: Huawei is my employer), and the Chairman of the U.S. House of Representatives Permanent Select Committee on Intelligence (HPSCI), Mike Rogers. 

The panel was moderated by the President of the EastWest Institute, an organization founded in 1980 which “seeks to make the world a safer place by addressing the seemingly intractable problems that threaten regional and global stability.” (More on EWI at http://www.ewi.info/).

Generally speaking, the panelists (almost all) acknowledged the shattered trust in the information communication technology industry (and select governments) in the wake of the Snowden revelations.  Likewise, the panelists (most) detailed possible steps towards restoring confidence.

One panelist, however, stuck out like a sore thumb (one cannot imagine the countless phrases I considered and rejected for that analogy): Chairman Mike.

Go figure.

Mike opened with an acknowledgment that there is “a trust issue,” but pondered aloud about why the group was really gathered: “Damaging classified information that was leaked?  Maybe so.”  But, Mike thinks not.  Indeed, Mike commented that he was “a little surprised” that people were talking about “the problems with the NSA.” 

The Chairman then transitioned into scare-mongering about Iran, North Korea, Russia, China, etc., oozed into an explanation that reports of U.S. spying on French phone calls were misrepresented, and, subsequently, segued to his key mis-direction of the day:  

“The most recent release of information…the United States engages in economic espionage…I have been on the oversight committee doing oversight for our 16 intelligence agencies…for the last ten years…It is against the law in the United States to use our intelligence services for industrial espionage…If they do it, they are going to jail. Period. End of story.” 

Now that’s only part one of the mis-direction, but let’s take a brief time-out to consider it.

Last September I posted on Mike’s utter failure to conduct the oversight with which he is charged (link), so I won’t belabor that point.  But, since he has raised laws and jail, let’s hold him to it: If future revelations show that such industrial espionage did take place, then Mike, by virtue of his position, is aware of and as such complicit to such “illegal” activity and he should be summarily incarcerated…

…But let’s get back to the Chairman’s key mis-direction, part two:

Per Mike: “Now wouldn’t you find it interesting that that information was released at a time when we’re trying to arrange a trade arrangement that I think benefits both Europe and the United States…  I do…”

This little nugget doesn’t get fully matured until the Q&A session, but, the gist: The Russians are managing Snowden in order to time his revelations to tank U.S.-EU Free Trade talks.

In the Q&A session, Mike hammers it home: “I think it’s a huge mistake to allow this issue…to step in the way of a trade agreement between Europe and the United States.  These are two very separate issues…but by tying them together I will guarantee you that you will see more disclosures like we saw last week that the Americans engage in economic espionage…” 

He went on: “You’re gonna see more of that because it breeds distrust – the Russians have a specific purpose for driving a wedge between us and our European allies.”

The Chairman is wrong.  

Not in terms of our seeing further revelations, but in terms of his interpretation of the “tie” between European privacy concerns and the U.S.-EU Free Trade talks.

Europeans have every right to consider privacy protections in the context of U.S.-EU Free Trade negotiations – the former might (albeit unlikely) serve as leverage towards achieving some sort of protections in the context of agreeing the latter, although not likely in the actual substance of any trade agreement.  That is a legitimate tie.  Mike’s suggestion that the Russians are somehow orchestrating the tie borders on absurd.

It gets worse.  Following his initial suggestion that the Russians are orchestrating revelations, and in advance of his Q&A session elaboration on this point, Mike goes on to propel himself headlong into a trap he has set for himself more than once in recent months: 

In defending the integrity and due process of U.S. espionage activities, the Chairman refers to “an oversight mechanism that is not seen anywhere else in the world.  Our judicial branch, our…legislative branch, and our executive branch have to go through an approval process for these activities… that is an important distinction and we argue that is our transparency.”

Sigh. 

Really?  That reference, and the Chairman’s subsequent Q&A session reference to the FISA court and 4^th Amendment protections, are both to processes that only apply to American citizens, and, seemingly, only within U.S. borders, and, from what we have had revealed to us by Mr. Snowden, perhaps not at all. 

One thing is certain though: Europeans and other non-Americans do not benefit from any such oversight or Constitutional prophylaxis (as was pointed out by one clued-in questioner).

C’mon Mike. C’mon America.  Is this the best we have, is this the best we can do?  

(Link to video of the full 1.5 hour panel discussion)

HPSCI: Promising Past, Unfortunate Present

On July 14, 1977 the House of Representative passed a resolution creating the House Permanent Select Committee on Intelligence (HPSCI).   A counterpart committee in the Senate—the Senate Select Committee on Intelligence (SSCI)—had been in existence for more than a year.

The creation of these oversight committees came out of the recommendations of two congressional investigatory panels established in 1975 – the Church Committee in the Senate and the Pike Committee in the House – both focused on allegations of illegal CIA and other intelligence and law enforcement Agency activities.  Such activities ranged from covert action programs involving assassination attempts against foreign leaders and covert attempts to subvert foreign governments to efforts by intelligence agencies to collect information on the political activities of US citizens.

HPSCI, specifically, is charged with the oversight of the United States Intelligence Community, which includes the intelligence and intelligence related activities of 17 elements of the US Government, and the Military Intelligence Program.

Flash forward almost 40 years.

In November of 2011, HPSCI's Chairman introduced the “Cyber Intelligence Sharing and Protection Act (CISPA)” to “help American businesses better protect their computer networks and intellectual property from advanced cyber attacks.” 

The purported intent of the legislation was to “allow the Federal government to provide classified cyber threat information to the private sector…” and to “empower American businesses to share anonymous cyber threat information with others in the private sector and enable the private sector to share information with the government on a purely voluntary basis, all while providing strong protections for privacy and civil liberties.”  

Importantly, the Chairman stressed that the legislation would provide “liability protection for companies that choose to protect their own networks or share threat information.”

That ominous provision aside, the Chairman took great pains to communicate that Americans need not fear for their privacy, hyping:

“The bill’s strong protections for privacy and civil liberties include:

- Narrow definitions that permit only the voluntary sharing by the private sector of a limited category of information—cyber threat information—and only for cybersecurity purposes;

- Strict restrictions on the government’s use, retention, and searching of any data voluntarily shared by the private sector;

- Permitting individuals to sue the government in federal court for violations of the bill’s privacy restrictions;

- Requiring the independent Intelligence Community Inspector General to conduct a detailed review of the government’s use of any information voluntarily shared by the private sector, and provide an unclassified report to Congress;

- A sunset for the bill’s authorities in five years, requiring Congress to carefully review the use of the authorities provided under the legislation to determine whether they should be extended or modified.

These are all interesting points, from an academic perspective.  Reality, however, is a bit more harsh.  

The oversight that the Chairman's office is charged with conducting has seemingly been perverted into cover-up: CISPA - notwithstanding the legitimate benefits that might be derived from honest interpretation and implementation - seems to have been, to some extent, an attempt to establish after-the-fact "legalization" (in part) of the illicit activities of the very intelligence Agencies HPSCI is meant to safeguard the American population against. 

In the wake of the initial Snowden allegations in June 2013, the Chairman – the man responsible for leading this key Congressional Committee charged with reining in intelligence agency abuses – barfed up an op-ed in the Detroit Free Press (still posted on his Congressional website at http://mikerogers.house.gov/news/documentsingle.aspx?DocumentID=339391).

Key excerpts:

- As chairman of the House Intelligence Committee, it is my responsibility to ensure strict and thorough congressional oversight of the important work done by America’s intelligence agencies.

-  I have been disheartened by dangerous national security leaks that have grossly distorted two vital NSA programs…Neither program allows the NSA to read e-mails or listen to phone calls of American citizens. Both programs are constitutional and do not violate any American’s Fourth Amendment rights. Both are strictly overseen by the Foreign Intelligence Surveillance Court, a federal court created in 1978 to protect the rights of American citizens in the course of foreign intelligence gathering.

- There are also several layers of checks and balances put in place around these programs within the executive branch and Congress. Both programs are overseen by lawyers and compliance auditors from the Department of Justice, the director of national intelligence and multiple independent inspectors general. Both have also been authorized by large bipartisan majorities in Congress and are regularly reviewed by the House and Senate intelligence committees.

- The first program allows the NSA to preserve a limited category of business records to help identify foreign terrorists and their plots to attack the U.S. This court-authorized program allows NSA to preserve only phone records such as the numbers dialed and the date, time and duration of calls. These records do not include the names or personal information of any American and do not include any content of calls.

- When the NSA wants to query the records, it must establish through a court-approved process that there is a reasonable suspicion a specific number is connected to a foreign terrorist. Only a limited number of analysts can obtain approval to conduct a narrow and targeted search of those numbers. If U.S. connections are found, they are passed to the FBI for further investigation. If the FBI wants to determine the identity of a phone number resulting from an NSA search, they must obtain a separate court order…”

- The second program, known as PRISM, allows the NSA to obtain a court order to access the electronic communications of suspected foreign terrorists overseas. Because much of the world’s Internet traffic flows through U.S. infrastructure, the law allows the NSA to obtain the specific communications of foreign suspects from U.S. companies with a court order. This program does not create a “back door” to any U.S. company’s server. This program cannot and does not monitor the communications of any U.S. citizens.

- All 535 members of Congress have had access to classified briefings describing the specific uses of these two programs, though not all members have chosen to attend these briefings.

Subsequent revelations and confirmations from the Intelligence Agencies themselves reveal virtually all of the observations in the Chairman's op-ed to be, seemingly, knowing and willful untruths - knowing and willful violations of the Chairman's primary commitment and responsibility to the American people.

What else has he been lying about?

Internet Balkanization Yet More Likely - PRISM+

A little over a week ago, it became known that Verizon was surrendering data on all telephony traffic over its networks to U.S. security agencies.  A day later, a young U.S. intelligence operative – a rare and anomalous “patriotic traitor” – leaked the details of a top secret U.S. Government global digital surveillance and data mining program built on access to the rich and almost-endless data reservoirs of leading American Internet companies (PRISM). 

This morning, Bloomberg reported (link) that “Thousands of technology, finance and manufacturing companies are working closely with U.S. national security agencies, providing sensitive information…” ranging from advance notice of “zero day-exploit” flaws in software, other vulnerabilities, hardware and software specifications of gear shipped overseas, metadata from any individual device.  Further, as Bloomberg reports, “some U.S. telecommunications companies willingly provide intelligence agencies with access to facilities and data offshore that would require a judge’s order if it were done in the U.S.”

Among other things, the existence of such programs calls into question the purpose of the much bally-hooed Cyber Intelligence Sharing and Protection Act (CISPA), introduced in the House of Representatives in 2011, which would allow for the sharing of vulnerability information between the U.S. government and technology and manufacturing companies to help the U.S government investigate cyber threats and ensure the security of networks against cyberattacks.  It seems that this is already happening in the absence of any statutory authority.  (Aside: Ironically, in terms of recent PRISM and related news, the White House has in the past opposed CISPA because it “lacks confidentiality and civil liberties safeguards”).

More importantly, what Bloomberg exposed today goes well beyond sharing of vulnerability information.  Indeed, according to Bloomberg, “In some cases, the information gathered may be used not just to defend the nation but to help infiltrate computers of its adversaries.”  This is certainly true in terms of zero-day vulnerabilities.  Consider the following excerpt from Gigaom’s reporting today (linked):

“Imagine you’re a government customer of Microsoft’s, in some country that isn’t the U.S. You’re already anxious over the PRISM scandal and its implications for data processed in the firm’s cloud. Now this: according to a Bloomberg report on Friday, when Microsoft finds a vulnerability in its software it informs U.S. intelligence agencies before its own customers. 

So, in theory, apart from having advance notice to patch their own systems, those agencies could exploit that zero-day vulnerability to hack into your data, before Microsoft gives you a chance to patch the flaw. And it’s not just Microsoft. According to the report, “thousands of [U.S.] technology, finance and manufacturing firms” are closely aligned with American national security agencies.”

Equally concerning, or more so from an individual perspective, in terms of the metadata that is collected from compromised U.S. hardware vendors in accord with another recently-unveiled U.S. Government program code-named “Blarney.”  While it remains unclear to what extent Blarney relies on “backbone hacking” as referenced by PRISM leaker Snowden and/or the “software and hardware specifications” that Bloomberg reports U.S. tech companies are sharing with security agencies, whatever the combination, the information gathered includes, per Bloomberg, “which version of the operating system, browser and Java software are being used on millions of devices around the world, information that U.S. spy agencies could use to infiltrate those computers or phones and spy on their users.”

To the extent such activities are truly extra-territorial, they are not subject to U.S. law nor is any oversight or permission required by the Foreign Intelligence Surveillance Act or the FISA Court.  Interestingly, per Bloomberg, “Most of the arrangements are so sensitive that only a handful of people in a company know of them, and they are sometimes brokered directly between chief executive officers and the heads of the U.S.’s major spy agencies.”

As for any potential violation of U.S. law or the privacy and liberties of American citizens, Bloomberg reports that “before they agreed to install the system on their networks, some of the five major Internet companies…asked for guarantees that they wouldn’t be held liable under U.S. wiretap laws. Those companies that asked received a letter signed by the U.S. attorney general…granting them immunity from civil lawsuits.”

In a related and somewhat heartening report, the New York Times detailed today (link) how Yahoo!, one of the companies named as part of the NSA's PRISM data collection program, didn't go quietly.  The company was behind a 2008 FISA court challenge to fight a court order requiring the company to give data to the U.S. Government without a warrant. 

According to the Times, "the company argued that the order violated its users’ Fourth Amendment rights against unreasonable searches and seizures. The court called that worry “overblown.”  Yahoo! lost.  While Yahoo! was not identified as the plaintiff at the time of the case, limited information about the case and its resolution was made partially public, putting other American Internet companies on notice a legal challenge would likely be fruitless.

A week ago today, just as PRISM was being unveiled for the public, I posted my concern that PRISM might herald a fracturing of the Internet as non-U.S. customers – governments, enterprises and individuals – may well lose trust in American Internet incumbents and leaders (link to my June 7 post).  Today’s additional information - claims that thousands of U.S. tech vendors are apparently engaged in voluntary information exchange with America’s spy agencies – amplifies my worry.

Indeed, Gigaom reported yesterday (link) that “a division of the Swedish government has prohibited government bodies from using Google Apps.”  While the Swedish review predates the outing of PRISM, per Gigaom,“it’s fair to view the news as the latest proof point in the resistance to relying on shared infrastructure certain United States companies run because the U.S. government can access data.”

We will doubtless see more of this.

It is true that the Internet has ushered in a new era of and architecture for espionage and crime.  And our Government is correct to take measures to ensure our national security and safety. The over-reaching that has been reported over the last week should be of concern to every American in terms of the potential – or very real - violation of their personal privacy and liberties.  But we should also be concerned about the broader impact. 

Notwithstanding that spies and criminals wield the Internet to their own ends, the benefits that the Internet has extended far eclipse such concerns, as does the potential sacrifice of those benefits (and I’m not just talking about the devastating commercial impact that a global loss of trust might have on American Internet and tech companies, and, by extension, the broader U.S. economy).  

The Internet – intrinsically global in nature by virtue of the globalization of information and communications technologies – has been a powerful force for the exchange of information, for freedom of speech, for democratic values.  The fracturing, fragmentation or Balkanization of the Internet is in no-one’s long-term interest, including even the U.S. national security agencies whose overreach via PRISM and otherwise may well have backfired in terms of future access to global intelligence.