intelligence – Page 2

Backdoors for Spies in Mobile Devices

There’s been a lot of controversy over this summer about the threats made to several large western mobile technology providers mainly by Asian and Middle-Eastern governments to ban their products and services unless they made it easier for their internal intelligence services and political police to access the accounts of users. The arguments actually started way back in 2008 in India, when the country’s Home Ministry demanded access to all communications made through Research in Motion’s (RIM) famous Blackberry smartphone, which was starting to spread rapidly in the country’s business community. Not much came of this beyond RIM agreeing in principle to the demand. Then over this summer, the issue flared up again, both in India and most strongly in the United Arab Emirates (UAE) and Saudi Arabia. RIM’s data servers were located outside the countries and the UAE’s Telecommunications Regulatory Authority (TRA) said that RIM was providing an illegal service which was “causing serious social, judicial and national security repercussions”. Both countries have notorious internal police and employ torture against political opponents.RIM initially defended its encrypted services and its commitment to the privacy of its users in a full statement issued at the beginning of August. However, they soon caved in when they realised that this could cause a cascade of bans across the Middle-East, India and beyond and promised to place a data server in both nations, and now India is once again increasing the pressure on RIM to do the same for its internal security services. So instead of a cascade of bans, we now have a massive increase in corporate-facilitated state surveillance. It’s Google and China all over again, but RIM put up even less of a fight.

However, a lot of people in these increasingly intrusive and often authoritarian regimes are not happy with the new accord between states and technology-providers, and this may yet prove more powerful than what states want. In Iran, Isa Saharkhiz, a leading dissident journalist and member of the anti-government Green Movement is suing another manufacturer, Nokia Siemens Networks, in a US court for providing the Iranian regime with the means to monitor its mobile networks. NSN have washed their hand of this, saying it isn’t their fault what the Iranian government does with the technology, and insist that they have to provide “a lawful interception capability”, comparing this to the United States and Europe, and claiming that standardisation of their devices means that “it is unrealistic to demand… that wireless communications systems based on global technology standards be sold without that capability.”

There is an interesting point buried in all of this, which is that the same backdoors built into western communications systems (and long before 9/11 came along too) are now being exploited by countries with even fewer scruples about using this information to unjustly imprison and torture political opponents. But the companies concerned still have moral choices to make, they have Corporate Social Responsibility (CSR) which is not simply a superficial agreement with anyone who shouts ‘security’ but a duty to their customers and to the human community. Whatever they say, they are making a conscious choice to make it easier for violent and oppressive regimes to operate. This cannot be shrugged off by blaming it on ‘standards’ (especially in an era of the supposed personal service and ‘mass customization’ of which the very same companies boast), and if they are going to claim adherence to ‘standards’, what about those most important standards of all, as stated clearly in the Universal Declaration of Human Rights, Article 12 of which states: “No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence,” and in Article 19: “Everyone has the right to freedom of opinion and expression; this right includes freedom to hold opinions without interference and to seek, receive and impart information and ideas through any media and regardless of frontiers.”

Top Secret America

Top Secret America is a really excellent project from The Washington Post with some excellent articles and classy and educative graphics. It traces the huge current US security-intelligence complex, and is partituclarly interesting for noting the massive private sector involvement. This isn’t actually entirely new – private technology companies have been intimately involved in both the manufacture and the servicing and operation of intelligence for a long time – look at the example of RCA and the early history of the National Security Association, for example. However, this blurring of the boundary between state and private sector now goes much further into the operations of intelligence. The Post alleges that “out of 854,000 people with top-secret clearances, 265,000 are contractors.” That’s almost a third. And the database of companies involved is enormous – nearly 2000. The searchable database is also going to be very helpful in our current work at the Surveillance Studies Centre on the involvment of private companies in Canadian border control!

PS: I should be back up and posting regularly now. I’ve had one of my occasional anti-blogging periods!

Federal judge rules against NSA

A US Federal Court judge has ruled that the National Security Agency’s secret domestic wiretapping program of internal terrorist suspects, was illegal according to the New York Times. The activity violated the 1978 Foreign Intelligence Surveillance Act (FISA) which was put into place after the various inquiries into the activities of the FBI and NSA in the late 1960s and early 1970s. As I’ve said before, that’s hardly a surprise and don’t think this has got a whole lot to do with George W. Bush in particular. Intelligence services might claim to operate under laws but in reality their priorities are not bound by them.But there’s a kind of cycle of collective amnesia that goes on with these inquiries and rulings. This time, the NSA was basically doing almost exactly the same thing as in the earlier period. Some minor superficial changes will occur. People will forget about it. The NSA will carry on. Then in 20 years time, there will be something else that will reveal again the same kinds of activities. Cue collective shock again. And so on. It would take a lot more continual public oversight and openness for them to be held properly to account, and if they were, they’d be very different entities. But that’s not to say that they shouldn’t be held to account: the fact that most democratic nations have what amounts to a secret state within the state that may have very different priorities than the official government or the people should be profoundly worrying. Yet it seems to be such an enormous breach of the democratic ideal that it goes largely unnoticed.

Google does the right thing, but…

Google is, as I type this, closing down its Chinese site as the first stage of its withdrawal of service from mainland China, in response to numerous attacks on the company’s computers from hackers allegedly connected to the Chinese state and ongoing demands to provide a censored service with which they felt they could not comply. The company claims that Chinese users will still be able to use Google, only through the special Hong Kong website, http://www.google.com.hk, which for historical reasons falls outside the Chinese state’s Internet control regime. Whether this will mean that the site will actually be accessible to Chinese Net users is debateable. Some say they cannot access it already. There are also numerous ‘fake Google’ sites that have sprung up to try to make some fast cash out of the situation.

But there’s more to this of course. Google has been widely reported to have opened its doors to the US National Security Agency (NSA) in order, they say, to solve the hacking issue, but the NSA only get involved in matters of US national security – if Google is essentially saying it is effectively beholden to US intelligence policy and interests, I am not sure that this is a whole lot better than bowing to China. You can be sure as well, that once invited in, the NSA will insinuate themselves into the company. Having a proper official backdoor into Google would make things a lot easier for the NSA, especially in populating its shiny new data warehouse in Utah…

Closing the Internet

A lot of my current thinking is based around the dynamic of opening / closing. I’ve been considering the way in which elements of state power, and in particular the military and intelligence agencies, regard openness per se as a threat. Now, Wired’s Threat Level blog (just about my favourite reading right now), has an excellent take on the response to what has been termed (in a deliberately mixed-up phrase) the ‘open-source insurgency’. This is the way in which the ex-head of US intelligence, now working for ‘contractor’*, Booz Allen Hamilton, Michael McConnell. is promoting the re-engineering of the Internet. This is necessary, it is argued, because the current openness of the Net means that terrorists and criminals can flourish. This re-engineering would “make attribution, geo-location, intelligence analysis and impact assessment — who did it, from where, why and what was the result — more manageable”. In other words to close the Internet. remove everything that is innovative and democratic about it, and make it easier for agencies like the NSA to monitor it.

Along with a whole raft of measures like extending ‘lawful access’ regimes, introducing corporate-biased copyright and anti-peer-2-peer legislation, censorship and Net filtering, this is an attack on what the Internet has become and to turn it into something simply for consumption – something, in other words, more like television. But there is another layer here too – the US military, I suspect, still has a nostalgic longing for when the Internet was its private domain. It’s a long way from its origins, and now perhaps the military want it back. But it isn’t theirs anymore, it’s ours and we need to fight for it.

* or, more accurately, arm’s length consulting agency of the US state.

Microsoft takes Cryptome down!

John Young’s Cryptome is perhaps the world’s most informative repository of (now, not so) secret documents and whistleblower’s information. Around since 1996, and with its multiple mirror-sites and determined owner, governments have tried and failed to close it down. However now the evil monopolist and maker of appalling bloatware, Microsoft, has succeeded where states have failed by issuing copyright infringement threats against its ISP, Network Solutions. This apparently worried the company more than any government, and as seems to be the usual craven attitude in these cases, the ISP backed down. According to Wired, they have even put a block on the transfer of the domain name so John Young can’t move ISPs…

The problem was that Cryptome published a short Microsoft document, the Microsoft Online Services Global Criminal Compliance Handbook, about the storage and handling of user data held on online servers,which also offers advice on subpoena tactics, info about state backdoors and more. The odd thing is that this document is old news and openly available elsewhere on the web, including via the link above. Given Microsoft’s well-documented links to US intelligence, could this just be an excuse to take out Cryptome, which has revealed so much about the National Security Agency over the years? Or is this just Microsoft’s usual clumsy, blinkered legal blundering?

Does the expansion of surveillance make assassination harder? Not in a world of UAVs…

Following the killing of Mahmood Al-Mabhouh is Dubai, allegedly by Israeli Mossad agents, some people are starting to ask whether political assassination is being made more difficult by the proliferation of everyday surveillance. The Washington Post argues that it is, and they give three other cases, including that of Alexandr Litvinenko in London in 2006. But there’s a number of reasons to think that this is a superficial argument.

However the obvious thing about all of these is that they were successful assassinations. They were not prevented by any surveillance technologies. In the Dubai case, the much-trumpeted new international passport regime did not uncover a relatively simple set of photo-swaps – and anyone who has talked to airport security will know how slapdash most ID checks really are. Litvinenko is as dead as Georgi Markov, famously killed by the Bulgarian secret service with a poisoned-tipped umbrella in London in 1978, and we still don’t really have a clear idea of what was actually going on in the Markov case despite some high-profile charges being laid.

Another thing is that there are several kinds of assassination: the first are those that are meant to be clearly noticed, so as to send a message to the followers or group associated with the deceased. Surveillance technologies, and particularly CCTV, help such causes by providing readily viewable pictures that contribute to a media PR-campaign that is as important as the killing itself. Mossad in this case, if it was Mossad, were hiding in plain sight – they weren’t really trying to do this in total secrecy. And, let’s not forget many of the operatives who carry out these kinds of actions are considered disposable and replaceable.

The second kind are those where the killers simply don’t care one way or the other what anyone else knows or thinks (as in most of the missile attacks by Israel on the compounds of Hamas leaders within Gaza or the 2002 killing of Qaed Senyan al-Harthi by a remote-controlled USAF drone in the Yemen). The third kind are those that are not meant to be seen as a killing, but are disguised as accidents – in most of those cases, we will never know: conspiracy theories swirl around many such suspicious events, and this fog of unknowing only helps further disguise those probably quite small number of truly fake accidents and discredits their investigation. One could argue that such secret killings may be affected by widespread surveillance, but those involved in such cases are far more careful and more likely to use methods to leverage or get around conventional surveillance techniques.

Then of course, there is the fact that the techniques of assassination are becoming more high-tech and powerful too. The use of remote-control drones as in the al-Harthi case is now commonplace for the US military in Afghanistan and Pakistan, indeed the CIA chief, Leon Panetta, last year described UAVs as “the only game in town for stopping Al-Qaeda.” And now there are many more nations equipping themselves with UAVs – which, of course, can be both surveillance devices and weapons platforms. Just the other day, Israel announced the world’s largest drone – the Eltan from Heron Industries, which can apparently fly for 20 hours non-stop. India has already agreed to buy drones from the same company. And, even local police forces in many cities are now investing in micro-UAVs (MAVs): there’s plenty of potential for such devices to be weaponized – and modelled after (or disguised as) birds or animals too.

Finally, assassinations were not that common anyway, so it’s hard to see any statistically significant downward trends. If anything, if one considers many of the uses of drones and precision-targeted missile strikes on the leaders of terrorist and rebel groups as ‘assassinations’, then they may be increasing in number rather than declining, albeit more confined to those with wealth and resources…

(Thanks to Aaron Martin for pointing me to The Washington Post article)

After the Thighbomber: Virtual Strip Searches at every airport?

The botched attempt to bomb a flight into the US by a the son of a wealthy Nigerian family, using explosive components strapped to his thigh, has led to an immediate techno-economic consequence, which is to speed up the process of installing terahertz wave or other body scanners in major airports, which if nothing else will provide a guaranteed income stream to Rapiscan and Qinetiq, who make these kinds of machines. Schipol in Amsterdam, where announced they would be extending their body scanning operation and the British government almost immediately followed by saying that major British airports would be rolling out body scanning within weeks. Now, Canada is to do the same.

But, will this make a real difference or is it just more symbolic security? The scanners certainly ‘work’ in the sense that they do provide pretty good images of what is under the clothes of passengers (see below). However, interpreting what is seen is still no easy task and will the scanners will certainly not replace physical searches, but will add yet another extra layer of surveillant sorting and therefore delay. And there are questions over the effectiveness of the scanners in particular areas of the body. The Toronto Sun reports that trials at Kelowna Airport in British Columbia “left blind spots over the head and feet”, so these machines are certainly not the ‘silver bullet’.

Then of course, there are the privacy issues. I don’t have any particular problem with the technology, provided it is restricted to airports and doesn’t start to get used in other, more everyday, social settings (which given the rapid development of this technology is by no means certain). However, as I noted the last time I wrote about this, there will be many religious, gender-based and personal reasons for objecting to their use. The other question of course is whether, every time some lone lunatic tries something like this – that was, let us not forget, poorly planned and ineffective, and which should have been prevented by other conventional intelligence operations working properly – it makes sense to jump and harden security (or at least be seen to harden security) for everyone travelling internationally. Doing this just plays into the hands of terrorists as it disrupts the ordinary workings of an open society.

Where Will the Big Red Balloons Be Next?

The US Defence Advanced Research Projects Agency (DARPA) has launched a $40,000 competition ostensibly to see examine the way communication works in Web2.0. The competition will see whether disributed teams working together online can uncover the location of large red weather balloons moored across the USA.

The ‘DARPA Network Challenge’ “will explore the roles the Internet and social networking play in the timely communication, wide-area team-building, and urgent mobilization required to solve broad-scope, time-critical problems”.

All the headlines for this story have been verging on the amused (even The Guardian). Words like ‘whimsical’ and ‘wacky’ have been common. But it seems to me that this project has many underlying aims apart from those outlined in these superficial write-ups, not least of which are: how easily people in a culture of immediate gratification can be mobilised to state aims and in particular to do mundane intelligence and surveillance tasks (following the failure of simple old style rewards to work in the tracking down of Osama Bin Laden and other such problems), and 2, the prospects for manipulating ‘open-source intelligence’ in a more convenient manner, i.e. distributing military work and leveraging (a word the military loves) a new set of assets – the online public, which is paradoxially characterised by both an often extreme scepticism and paranoia, but at the same time, a general superficiality and biddability.

DARPA, of course, was one of the originators of the Internet in the first place (as it continues to remind us), but the increasingly ‘open’ nature of emergent online cultures has meant that the US military now has a chronic anxiety about the security threats posed not so much by overt enemies as by the general loss of control – in fact, there’s been talk for a while of an ‘open-source insurgency’, a strategic notion that in one discursive twist elides terrorism and the open-source / open-access movement, and the CIA has recently bought into firms that specialize in Web 2.0 monitoring.

It seems rather reminiscent of both the post-WW2 remobilisation of US citizens in things like the 1950s ‘Skywatch’ programs (which Matt Farish from the University of Toronto has been studying) or more specifically, some of the brilliant novels of manipulation that emerged from that same climate, in particular Phillip K. Dick’s Time Out of Joint, in which unwitting dupe, Raggle Gumm, plots missile strikes for an oppressive government whilst thinking he’s winning a newspaper competition, ‘Where will the Little Green Man be Next?’

So, who’s going to be playing ‘Where Will the Big Red Balloons Be Next?’ then… ?

Balloon4 — DARPA's Big Red Balloons (DARPA website)

US wiretapping information release

From Chris Parsons:

“Christopher Soghoian, a PhD Candidate at Indiana University, has released the information on US wiretap/pen register information along with documents received through FOIA that are inquiring into the costs that telecommunications carriers demand for the two aforementioned services. He also has full recordings of sessions from (the closed door) ISS World: Intelligence Support Systems for Lawful Interception, Criminal Investigations and Intelligence Gathering. An executive summary of his draft thoughts are below, followed by a link to the full piece he’s written. He has made available his recordings and the responses to his FOIA requests to the public at large, all accessible at the link below.

Executive Summary

Sprint Nextel provided law enforcement agencies with its customers’ (GPS) location information over 8 million times between September 2008 and October 2009. This massive disclosure of sensitive customer information was made possible due to the roll-out by Sprint of a new, special web portal for law enforcement officers.

The evidence documenting this surveillance program comes in the form of an audio recording of Sprint’s Manager of Electronic Surveillance, who described it during a panel discussion at awiretapping and interception industry conference, held in Washington DC in October of 2009.

It is unclear if Federal law enforcement agencies’ extensive collection of geolocation data should have been disclosed to Congress pursuant to a 1999 law that requires the publication of certain surveillance statistics — since the Department of Justice simply ignores the law, and has not provided the legally mandated reports to Congress since 2004.”