BlackBerry Ltd, the NSA, and The Encryption Algorithm that NIST Warned You Not To Use

As part of my ongoing efforts to sort fact from fiction regarding the RSA - NSA debacle, I learned that BlackBerry, Ltd (NASDAQ: BBRY), with its acquisition of Certicom in 2009, became the patent-holder for Dual_EC_DRBG. And since BlackBerry devices are used by so many government and military customers, I contacted the company to inquire whether they had notified their customers about the NIST warning. Before I share what happened with that inquiry, here's a short recap of the facts:

• In 2003, Certicom announced that it licensed its Elliptic Curve Cryptography technology to the NSA for US$25 million.
• In 2004, the NSA convinced RSA to make it the default CPRNG (Crypto Pseudo Random Number Generator) for its BSAFE software for an alleged US$10 million. 
• In December, 2005 NIST issued its draft standard for Dual_EC_DRBG.
• In February, 2006, RSA announced that BSAFE had conformed with Suite B cryptography requirements issued by the NSA.
• In March, 2006, RSA announced that the NSA had chosen BSAFE "for use in a classified communications project".
• Starting in March, 2006 and continuing into 2007, security researchers Kristian Gjøsteen, Berry Schoenmakers and Andrey Sidorenko, Dan Shumow and Niels Ferguson, and Bruce Schneier all published articles warning about weaknesses in Dual EC DRBG. The final NIST standard SP 800-90A published in June 2006 included mention of those weaknesses as unresolved.

BlackBerry Ltd

According to NIST's DRBG Validation List, the following BlackBerry products include Dual EC DRBG:

• BlackBerry Cryptographic Algorithm Library, Version 6.1 which apparently provides advanced cryptographic functionality to systems running BlackBerry 10 OS and components of BlackBerry Enterprise Service 10. 
• BlackBerry Algorithm Library for Secure Work Space Version 1.0. ""The BlackBerry Algorithm Library for Secure Work Space provides a suite of cryptographic services utilized by the BlackBerry Cryptographic Library for the BlackBerry Secure Work Space (BBSWS). BBSWS provides the secure operation and management of iOS and Android devices when used in conjunction with BlackBerry® mobile device management solutions." 
• BlackBerry Tablet Cryptographic Library Version 5.6. "The BlackBerry Tablet Cryptographic Library is the software module that provides advanced cryptographic functionality to BlackBerry Tablets." 

I passed this information to BlackBerry and within a couple of days received this response from Mike K. Brown, VP of Security Product Management & Research, BlackBerry.:

"The Dual EC DRBG algorithm is only available to third party developers via the Cryptographic APIs on the platform. In the case of the Cryptographic API, it is available if a 3rd party developer wished to use the functionality and explicitly designed and developed a system that requested the use of the API."

I then asked if BlackBerry has forwarded the NIST warning about not using Dual EC DRBG to its customers or developers and received this response:

"To your other question, the reason we didn’t issue an advisory is because it wasn’t a vulnerability. We only do them for fixes that are needed. You can read more about that process here: http://bizblog.blackberry.com/2013/07/security-privacy-malware-notices-advisories/. "

Therefore, since this warning from NIST:

"Recommending against the use of SP 800-90A Dual Elliptic Curve Deterministic Random Bit Generation: NIST strongly recommends that, pending the resolution of the security concerns and the re-issuance of SP 800-90A, the Dual_EC_DRBG, as specified in the January 2012 version of SP 800-90A, no longer be used."

does not meet BlackBerry's definition of a vulnerability, the company hasn't issued an advisory. If you are a BlackBerry customer or developer, be advised that it's apparently up to you to keep informed about possible backdoors among the encryption algorithms included with BlackBerry products.

Add to Cart View detail

Guess Who Owns The Patent to RSA's Backdoor Algorithm? Blackberry

Meet Certicom, a subsidiary of Blackberry Ltd, who provides the core technology for the National Security Agency (NSA) Suite B standard for secure government communications. Certicom holds 350 patents, many of which cover key aspects of Elliptic Curve Cryptography (ECC) including this one:

Elliptic curve random number generation 

Abstract

An elliptic curve random number generator avoids escrow keys by choosing a point Q on the elliptic curve as verifiably random. An arbitrary string is chosen and a hash of that string computed. The hash is then converted to a field element of the desired field, the field element regarded as the x-coordinate of a point Q on the elliptic curve and the x-coordinate is tested for validity on the desired elliptic curve. If valid, the x-coordinate is decompressed to the point Q, wherein the choice of which is the two points is also derived from the hash value. Intentional use of escrow keys can provide for back up functionality. The relationship between P and Q is used as an escrow key and stored by for a security domain. The administrator logs the output of the generator to reconstruct the random number with the escrow key.

Certicom was acquired by Research In Motion (now known as Blackberry Ltd) in March 2009 but it has been in business since 1985. The patent authors are two Certicom employees Daniel Brown and Scott A. Vanstone who are also members of the ANSI X9.82 standardization committee. Matthew Green, a cryptography professor at Johns Hopkins, wrote a blog post describing Dual EC DRBG's history with Brown and Vanstone, ANSI and the NSA on December 28, 2013.

The existence of this patent does not mean that Brown and Vanstone were responsible for Dual EC. In fact, the generator appears to be an NSA invention, and may date back to the early 2000s. What this patent demonstrates is that some members of the ANSI committee, of which RSA was also a member, had reason to at least suspect that Dual EC could be used to create a wiretapping backdoor. (Update: John Kelsey confirms this.)

To date, Blackberry has not made a public announcement about its use of Dual EC DRBG but here are the Blackberry products that use it according to NIST:

• "The BlackBerry Algorithm Library for Secure Work Space provides a suite of cryptographic services utilized by the BlackBerry Cryptographic Library for the BlackBerry Secure Work Space (BBSWS). BBSWS provides the secure operation and management of iOS and Android devices when used in conjunction with BlackBerry® mobile device management solutions."
• "The BlackBerry Cryptographic Algorithm Library is a suite of cryptographic algorithms that provides advanced cryptographic functionality to systems running BlackBerry 10 OS and components of BlackBerry Enterprise Service 10."
• "The BlackBerry Tablet Cryptographic Library is the software module that provides advanced cryptographic functionality to BlackBerry Tablets."

Other companies that have Dual EC DRBG in their products are Microsoft, RSA, Cisco, Juniper Networks, McAfee, Symantec, Samsung, Lancope, SafeLogic, GE Healthcare, Thales eSecurity, Panzura, Catbird Networks, ARX, Kony, CoCo Communications, Riverbed Technology, OpenSSL Foundation, Certicom, and Mocana. 

I've only found a few who have made public announcements advising their customers about Dual EC use: Cisco and SafeLogic. The OpenSSL Foundation has had many discussions about Dual EC in their own forum. Please leave a comment if you know of other advisories by the remaining companies which I've missed.

Related

BlackBerry Ltd, the NSA, and The Encryption Algorithm that NIST Warned You Not To Use

Add to Cart View detail

NSA meta data no help

from Greg
The Verge posted a story about NSA data collection programs producing no usable results according to the New America Foundation. I am no fan of the NSA meta data program. They have collected information on every phone call I have made since becoming a Verizon customer three years ago. You can have my meta data when you pry it from my cold dead iPhone.

Read the full story HERE

Read the report HERE

Get a PDF of the report HERE

from The Verge
Is NSA surveillance really necessary to defend against terrorist attacks? It's been a common claim by the agency's defenders as the programs come under scrutiny, but a report released today by the New America Foundation casts doubt on that logic. The report examines how NSA surveillance functioned in 225 counterterrorism cases since 9/11 and concludes that the agency wasn't as crucial as it would have you believe.

The report found that the NSA was responsible for 7.5 percent of counterterrorism investigations, and there was only one case out of the 225 that was initiated by NSA evidence. The case involved a cab driver named Basaaly Moalin who was convicted of sending money to Somalian terrorist groups. While successful, the case did not involve any direct threat of attack, and took more than two months between the initial tip and the eventual action by the FBI. Far more common were cases initiated by traditional tools like informants or suspicious-activity reports, which helped law enforcement focus their attention on particular targets. "The overall problem for US counterterrorism officials is not that they need vaster amounts of information from the bulk surveillance programs," the report says, "but that they don’t sufficiently understand or widely share the information they already possess."

from the New America Foundation
By PetervBergen, David Sterman, Emily Schneider, Bailey Cahall

January 13, 2014

On June 5, 2013, the Guardian broke the first story in what would become a flood of revelations regarding the extent and nature of the NSA’s surveillance programs.  Facing an uproar over the threat such programs posed to privacy, the Obama administration scrambled to defend them as legal and essential to U.S. national security and counterterrorism. Two weeks after the first leaks by former NSA contractor Edward Snowden were published, President Obama defended the NSA surveillance programs during a visit to Berlin, saying: “We know of at least 50 threats that have been averted because of this information not just in the United States, but, in some cases, threats here in Germany. So lives have been saved.”  Gen. Keith Alexander, the director of the NSA, testified before Congress that: “the information gathered from these programs provided the U.S. government with critical leads to help prevent over 50 potential terrorist events in more than 20 countries around the world.”  Rep. Mike Rogers (R-Mich.), chairman of the House Permanent Select Committee on Intelligence, said on the House floor in July that “54 times [the NSA programs] stopped and thwarted terrorist attacks both here and in Europe – saving real lives.”  

However, our review of the government’s claims about the role that NSA “bulk” surveillance of phone and email communications records has had in keeping the United States safe from terrorism shows that these claims are overblown and even misleading.  An in-depth analysis of 225 individuals recruited by al-Qaeda or a like-minded group or inspired by al-Qaeda’s ideology, and charged in the United States with an act of terrorism since 9/11, demonstrates that traditional investigative methods, such as the use of informants, tips from local communities, and targeted intelligence operations, provided the initial impetus for investigations in the majority of cases, while the contribution of NSA’s bulk surveillance programs to these cases was minimal. Indeed, the controversial bulk collection of American telephone metadata, which includes the telephone numbers that originate and receive calls, as well as the time and date of those calls but not their content, under Section 215 of the USA PATRIOT Act, appears to have played an identifiable role in initiating, at most, 1.8 percent of these cases. NSA programs involving the surveillance of non-U.S. persons outside of the United States under Section 702 of the FISA Amendments Act played a role in 4.4 percent of the terrorism cases we examined, and NSA surveillance under an unidentified authority played a role in 1.3 percent of the cases we examined. 

Regular FISA warrants not issued in connection with Section 215 or Section 702, which are the traditional means for investigating foreign persons, were used in at least 48 (21 percent) of the cases we looked at, although it’s unclear whether these warrants played an initiating role or were used at a later point in the investigation. (Click on the link to go to a database of all 225 individuals, complete with additional details about them and the government’s investigations of these cases: http://natsec.newamerica.net/nsa/analysis).

Surveillance of American phone metadata has had no discernible impact on preventing acts of terrorism and only the most marginal of impacts on preventing terrorist-related activity, such as fundraising for a terrorist group. Furthermore, our examination of the role of the database of U.S. citizens’ telephone metadata in the single plot the government uses to justify the importance of the program – that of Basaaly Moalin, a San Diego cabdriver who in 2007 and 2008 provided $8,500 to al-Shabaab, al-Qaeda’s affiliate in Somalia – calls into question the necessity of the Section 215 bulk collection program.  According to the government, the database of American phone metadata allows intelligence authorities to quickly circumvent the traditional burden of proof associated with criminal warrants, thus allowing them to “connect the dots” faster and prevent future 9/11-scale attacks. Yet in the Moalin case, after using the NSA’s phone database to link a number in Somalia to Moalin, the FBI waited two months to begin an investigation and wiretap his phone. Although it’s unclear why there was a delay between the NSA tip and the FBI wiretapping, court documents show there was a two-month period in which the FBI was not monitoring Moalin’s calls, despite official statements that the bureau had Moalin’s phone number and had identified him. ,  This undercuts the government’s theory that the database of Americans’ telephone metadata is necessary to expedite the investigative process, since it clearly didn’t expedite the process in the single case the government uses to extol its virtues. 

Additionally, a careful review of three of the key terrorism cases the government has cited to defend NSA bulk surveillance programs reveals that government officials have exaggerated the role of the NSA in the cases against David Coleman Headley and Najibullah Zazi, and the significance of the threat posed by a notional plot to bomb the New York Stock Exchange. 

Related articles

• Study Shows NSA Metadata Collection Doesn't Prevent Terrorist Attacks
• Nsa Snooping Fails to Prevent Terrorist Attacks, Watchdog Group Says
• New America Foundation Report: "Do NSA's Bulk Surveillance Programs Stop Terrorists?" Nope
• NSA Bulk Collection of Americans' Phone Data Had "No Discernible Impact" on Preventing Terrorism, Says New Study

Add to Cart View detail

RSA Boycott or Not? 3 Questions To Help You Decide.

1. Did Joseph Menn's Reuters article contain sufficient information to raise your suspicion that RSA may have collaborated with the NSA for $10M in exchange for using NSA's preferred encryption algorithm?
If no, you can stop here. If yes, move to question 2.

2. Did RSA's response address your concerns?
If yes, you can stop here. If no, move to question 3.

3. What action can you take that you believe would prompt RSA to be more forthcoming?
Then do it.

Related

Joining Mikko in Protest, I've Cancelled My Talk at RSA

NSA's $10M RSA Contract: Origins

Add to Cart View detail

NSA Limericks, Jim Bidzos' Threats, and the 1st RSA Conference

I found some illuminating and very funny quotes that depict the adversarial relationship that existed between the NSA and RSA before the controversial $10M contract deal of 2004:

"There is a group at Fort Meade
who fear that which they cannot read
so they fight with their friends
(God knows to what ends! )
In attempts to get more than they need."
-- Jim Bidzos, CEO of RSA Data Security (source: Sam Simpson Cryptography Quotes)

"If I see you in the parking lot, I'll run your ass over"
- NSA Export Officer to Jim Bidzos (Head of RSA), April '94 (pg 287, Crypto by S.Levy)

"(C) Jim Bidzos, the aggressive RSA representative, was unable to attend but curmudgeon Whit Diffle presented a frail RSA position (Bidzos would have been much more implacable) and was essentially ignored by the panel."
- Declassified NSA "Cryptolog" March, 1994, p.17 describing a meeting at Eurocrypt '92 held on May 24-28, 1993 in Hungary.

 And then I found this recounting by Jim Bidzos of how the first RSA Security conference came about:

"Yost: You mentioned the conference. Can you talk a bit about the origin of the RSA Data
Security Conference, about both the founding and the early years of it?
"Bidzos: Yes, actually it originated—you know there’s another example where there’s just
one moment, one phone call where this happened—right about the time that the
Electronic Frontier Foundation was being born around 1991. And actually it was also the
time that something called CPSR, Computer Professionals for Social Responsibility, was
becoming EPIC, the Electronic Privacy Information Center. The director of which is a
guy named Marc Rotenberg.
"This was a time when the government made an announcement. I don’t think it was the Clipper chip at the time, I think it was something called the DSA. Anyway they were starting to try to set or dictate [encryption] standards for the business community. They had made some announcement and Marc called me up
and said, “They’ve just announced this. Have you seen this?”
"And I said, “Yes.” And he said, “What are we going to do about this?” And I said, “I don’t know. It sounds to me like the best thing we can do is educate people, so maybe what we ought to do is host a
conference and educate people about this. I’ve got access to a lot of people who can talk about it.”
"It was his phone call, basically pleading, “What are we going to do? What are you going to do?” He was really bothered by DSA, seemed up in arms and didn’t know what to do. All that nervous energy that I felt somehow made me feel obligated to do something. So that’s when I came up with this idea to have this conference. So I got Rivest and a few other people, I think Marty Hellman was there, Taher El Gamal and
some other people to say this is a bad idea and here’s why. And so we let people come for free, I think we got sixty people. It just seemed like a good thing to do again the following year."

How times have changed.

Add to Cart View detail

NSA's $10M RSA Contract: Origins

"For almost 10 years, I've been going toe to toe with these people at Fort Meade. The success of this company (RSA) is the worst thing that can happen to them. To them, we're the real enemy, we're the real target."

"We have the system that they're most afraid of. If the U.S. adopted RSA as a standard, you would have a truly international, interoperable, unbreakable, easy-to-use encryption technology. And all those things together are so synergistically theatening to the N.S.A.'s interests that it's driving them into a frenzy." 

- James Bidzos (President, RSA Data Security in an interview with Steven Levy of the New York Times, June 1994)

Compare the above remarks by former RSA President James Bidzos in 1994 with RSA's formal statement about its relationship with the NSA (December 2013):

We made the decision to use Dual EC DRBG as the default in BSAFE toolkits in 2004, in the context of an industry-wide effort to develop newer, stronger methods of encryption. At that time, the NSA had a trusted role in the community-wide effort to strengthen, not weaken, encryption.

What happened to a company that in the 90's knew exactly where it stood vis a vis the NSA and this latest NSA-friendly incarnation? According to Reuters, it was a change in business direction away from pure cryptology in favor of joining the government for the war on hackers.

"When I joined there were 10 people in the labs, and we were fighting the NSA," said Victor Chan, who rose to lead engineering and the Australian operation before he left in 2005. "It became a very different company later on." By the first half of 2006, RSA was among the many technology companies seeing the U.S. government as a partner against overseas hackers."

 Steven Levy's article "Battle of the Clipper Chip" which is where I found the top quote from James Bidzos is a must-read because although it was written 19 1/2 years ago, it provides keen insight into the issues that frame today's crisis of trust with RSA. Back then, the NSA and the Clinton Administration thought that a Key Escrow plan like Clipper Chip was the way to go. When the market place rejected using Clipper, the NSA eventually switched tactics to develop and promote its own encryption algorithm; first to RSA with a $10 million sweetener and then to NIST with the incentive that RSA had already adopted it. Today we all know that the NSA succeeded. What isn't known is why RSA agreed to it.

RSA's public statement on the issue is both misleading and lacking details which pertain to the facts uncovered by Joseph Menn for Reuters. Here are the four key points made in their statement and the problems with each:

“We made the decision to use Dual EC DRBG as the default in BSAFE toolkits in 2004, in the context of an industry-wide effort to develop newer, stronger methods of encryption. At that time, the NSA had a trusted role in the community-wide effort to strengthen, not weaken, encryption.”

This fails to disclose the terms of RSA's agreement with the NSA to use Dual EC DRBG. It also paints RSA as naive as to the NSA's motives which is ludicrous once you know what happened 10 years earlier with Clipper Chip.

“This algorithm is only one of multiple choices available within BSAFE toolkits, and users have always been free to choose whichever one best suits their needs.”

With this statement RSA is trying to pass off the responsibility for using a back-doored Random Number Generator to the user!

“We continued using the algorithm as an option within BSAFE toolkits as it gained acceptance as a NIST standard and because of its value in FIPS compliance. When concern surfaced around the algorithm in 2007, we continued to rely upon NIST as the arbiter of that discussion.”

It became a NIST standard because RSA took the NSA's money in the first place. Concerns about the algorithm were raised in 2006 and were included in NIST SP 800-90A as being unresolved. By 2007, RSA should have been sufficiently alarmed to investigate on its own. To say that they relied upon NIST as the arbiter is merely an attempt to shift responsibility away from itself as the producer and onto NIST.

“When NIST issued new guidance recommending no further use of this algorithm in September 2013, we adhered to that guidance, communicated that recommendation to customers and discussed the change openly in the media.”

So once the New York Times' article was published and NIST took steps, then RSA did the right thing? And they expect credit for that?

RSA cannot escape responsibility for offering a compromised BSAFE product for the last 9 years by saying "we just followed NIST" and "our customers had a choice". This is a gross violation of its own mission statement not to mention its own illustrious history of defending the integrity of encryption against government attempts to weaken it.

I announced last Friday that I joined Mikko Hyponnen and Josh Thomas in pulling my talk from RSAC, but there needs to be an industry-wide boycott of RSA products. It's not enough to just talk about how bad this is. RSA's parent EMC, like every other corporation, has a Board of Directors that is answerable to its shareholders for maximizing revenue. If RSA's customers begin canceling their contracts and/or refuse to buy RSA products, the company's earnings will drop and that's the type of message that forces Boards to make changes.

Related

Joining Mikko in Protest, I've Cancelled My Talk at RSA
BlackBerry Ltd, the NSA, and The Encryption Algorithm that NIST Warned You Not To Use

Add to Cart View detail

Joining Mikko in Protest, I've Cancelled My Talk at RSA

Granted, I'm no Mikko Hyponnen and my talk was a mere 20 minutes on the last day of the RSA conference, but I think it's vitally important that those of us who profoundly object to RSA's $10 million secret contract with the NSA do more than just tweet our outrage. We need to take action.

RSA has issued the weakest of denials possible on Dec 22nd and hasn't made any attempt to clarify its position since. The company's denial failed to address most of the troubling points raised in Joe Menn's article for Reuters. This on top of RSA's horrible handling of its 2011 SecureID breach has shattered any remaining trust in the company as far as I'm concerned.

Obviously, I hope that RSA and EMC's leadership will eventually rise to the occasion and be fully transparent about what happened and why. However unless and until RSA fully addresses this apparent breach of trust, I won't be speaking at any RSA events nor will I accept RSA as a sponsor at any future Suits and Spooks events.

UPDATE (Jan 3, 2014): I just learned that Josh Thomas of Atredis also pulled his talk from RSA back on December 26th. That makes three of us as of today.

UPDATE (Jan 7, 2014): Christopher Soghoian announced that he has canceled his RSA talk and Adam Langley announced that he's withdrawing from his panel.

Related

NSA's $10M RSA Contract: Origins
An Open Letter to the Chiefs of RSA and EMC by Mikko Hyponnen
Exclusive: Secret contract tied NSA and security industry pioneer by Joseph Menn

RSA Response to Media Claims Regarding NSA Relationship

Add to Cart View detail

Who's Defending U.S. Military Networks if the NSA and FIS are Breaking Them?

According to Der Spiegel, the NSA has been developing tools to compromise software, hardware, and firmware made by multinational corporations in the U.S. and overseas. U.S. companies affected include Juniper Networks, Cisco, Dell, Western Digital, Seagate, Maxtor plus many others. Unless the company has offered to work with the NSA to create backdoors in their own products, you have a situation where the agency with the primary responsibility of defending U.S. Department of Defense networks from digital attack is also engaged in weakening the very technology used by the DOD on those networks such as Jupiter Network firewalls, Cisco routers, Seagate hard drives, etc.

Perhaps this wouldn't be a problem if foreign intelligence services (FIS) didn't also have the technical capability of finding those same vulnerabilities or others. For example, Xidian University in Xi'an, Shaanxi, China is one of China's top engineering universities. It's State Key Laboratory of Integrated Services Networks conducts research for military-specific and dual use systems including cryptography, offensive network attacks, and systems to be used in confrontational environments.

Here's another example taken from our data base on adversary R&D research. The Chinese Academy of Sciences' State Key Lab of Information Security reports directly to the Ministry of Public Security, among other government agencies. In addition to their primary research area of information security, they develop network attack systems.

Russia has similar educational institutions which focus on information security and electronic warfare for the Ministry of Defense, the FSB, and other relevant agencies. One example is the Voronezh Military Radio-electronics Insititute which is part of the Voronezh Aviation Engineering School. Part of their information warfare research includes breaking the security of automated systems.

Since Dell, Cisco, Juniper, etc. build hardware, firmware, and software that's broadly used around the world and especially on U.S. government networks, it's only logical to conclude that those companies' products are being examined for exploitable vulnerabilities by Russian and Chinese scientists who are at least equal if not superior to those employed by the NSA. Let's remember that unlike the NSA, scientists at Russian and Chinese foreign research laboratories don't have to compete with their respective versions of a Silicon Valley for high paying tech jobs. They can attract and keep their nation's brightest scientists focused on these high priority government military and civilian projects.

Bottom line - if the NSA has found or developed backdoors in critical U.S. technology, so have our adversaries, and by "adversaries", I don't mean Mandiant's version of the bored PLA hacker with sloppy OPSEC. We need as an industry to have more respect for our opponents. And there needs to be a serious discussion about whether the NSA can really defend U.S. military networks while also engaged in exploiting weaknesses in the very technology that those networks rely upon.

UPDATE (JAN 02 2014): Bruce Schneier has begun posting one NSA exploit per day at his blog. The first one called DEITYBOUNCE exploits the motherboard on Dell PowerEdge servers.

Add to Cart View detail

Judge Leon's Three Key Findings Against the NSA that Prompted those Exclamation Points

“He’s very passionate; he uses a lot of italics and exclamation points,” Orin S. Kerr, a professor at the George Washington University Law School and a defender of the N.S.A.’s surveillance programs said referring to the way Judge Leon wrote the decision. Mr. Kerr said he found the judge’s ruling short “on legal reasoning.” (source: The New York Times) 

There are several exclamation points in this decision. Judge Leon plainly feels that he has been lied to, and that we all have been. And he seems to be done with it. (source: The New Yorker)

Considering the above comments about Judge Leon's use of exclamation points, I thought it might be interesting to see what prompted them. I read his 68 page decision, and found that Judge Leon used exclamation points three times. Here are those instances.

1(a). Plaintiffs Have Standing to Challenge Bulk Telephony Metadata Collection and Analysis.

"The Government argues that Judge Vinson's order names only Verizon Business Network Services ("VBNS") as the recipient of the order, whereas plaintiffs claim to be Verizon Wireless subscribers."

"Put simply, the Government wants it both ways. Virtually all of the Government's briefs and arguments to this Courst explain how the Government has acted in good faith to create a comprehensive metadata database... - in which case the NSA must have collected metadata from Verizon Wireless, the single largest wireless carrier in the United States, as well as AT&T and Sprint, the second and third-largest carriers."

"Yet in one footnote, the Government asks me to find that plaintiffs lack standing based on the theoretical possibility that the NSA has collected a universe of metadata so incomplete that the program could not possibly serve its putative function. Candor of this type defies common sense and does not exactly inspire confidence!" (p. 38)

2. The Collection and Analysis of Telephony Metadata Constitutes a Search.

"First, the pen register in Smith was operational for only a matter of days between March 6, 1976 and March 19, 1976, and there is no indication from the Court's opinion that it expected the Government to retain those limited phone records once the case was over.

"In his affidavit, Acting Assistant Director of the FBI Robert J. Holley himself noted that "[p]en-register and trap-and-trace (PR/TT) devices provide no historical contact information, only a record of contacts with the target occurring after the devices have been installed."

"This short-term, forward-looking (as opposed to historical), and highly-limited data collection is what the Supreme Court was assessing in Smith. The NSA telephony metadata program, on the other hand, involves the creation and maintenance of a historical database containing five years' worth of data."

"And, I might add, there is the very real prospect that the program will go on for as long as America is combatting terrorism, which realistically could be forever!" (p. 47)

3. The Public Interest and Potential Injury to Other interested Parties Also Weigh in Favor of Injunctive Relief.

"("[T]he public interest lies in enjoining unconstitutional searches.") That interest looms large in this case, given the significant privacy interests at stake and the unprecedented scope of the NSA's collection and querying efforts, which likely violate the Fourth Amendment. Thus, the public interest weighs heavily in favor of granting an injunction."

"The Government responds that the public's interest in combating terrorism is of paramount importance - a proposition that I accept without question. But the Government offers no real explanation as to how granting relief to these plaintiffs would be detrimental to that interest. Instead the Government says that it will be burdensome to comply with any order that requires the NSA to remove plaintiffs from its database."

"Of course, the public has no interest in saving the Government from the burdens of complying with the Constitution!" (p.65-66)

---------

Here's the full opinion. It's well-worth reading. The fact is that our interaction with and reliance upon technology has fundamentally changed what privacy means to us today and that will certainly change even more tomorrow. Past court decisions from 30 years ago and longer which have informed current laws protecting our Fourth Amendment rights should be re-visited and updated to meet today's new reality of instant communication, geolocation, and data analytics.

Add to Cart View detail

Level 3 Communications, the NSA, and the end of the Physical-Digital Divide. What needs to be done?

The Level 3 Communications (NYSE: LVLT) blog recently published an article entitled "Say Goodbye to the Physical-Digital Divide." It's a light-hearted, upbeat corporate feel-good piece about how television shows are become Twitter-enabled. It's also a very disturbing piece when you realize that Level 3 is one of the Tier 1 backbone providers who has assisted the NSA in its collection efforts:

This is an exciting time!  Not only for Joe Consumer, who is being further enabled (and actively encouraged) to merge his offline and online behavior, blurring the lines of the physical-digital divide, but also for major content providers – many of whom we’re fortunate enough to call customers.  This is the new model of content consumption.  Always-on and always-available. Cross-media and cross-platform. 

Think about that from the standpoint of legal intercepts and data collection, and you'll see my point. We used to be vulnerable based upon what we read at the library, what we threw away in our trash, and what we wrote to our friends. Today, that has expanded exponentially and we've lost control of exactly how and where we are vulnerable to exposure.

Now consider that Level 3 is Google's upstream provider. Is that how the NSA was able to intercept the data traveling between Google's data centers? To be clear, Level 3 isn't doing anything illegal, nor is the NSA for that matter. And that's precisely the problem that needs addressing.

In less than 10 years, the physical - digital divide has disintegrated. In less time than it takes a human being to achieve mastery over a skill, technology has exponentially expanded how we interact with each other and, conversely, how we can harm each other.

Intelligence and law enforcement agencies, whose mission is to identify and intercept those who wish to cause us harm, have leveraged legal regimes like the Patriot Act, EO 12333, etc. to gain a foothold within the networks that are the primary supports (i.e., backbone) for our digital environment. The difference between what those out-dated laws still allow and what technology has made possible in the way of data collection and analysis is where our focus needs to be. In other words, the laws must be amended to catch up with how exposed we are in today's digital and physical world so that a better privacy:security balance can be restored.

Wasting time bashing the NSA and other intelligence services does more harm than good because it fails to address the real problem (out-dated authorities that need revising) in favor of lashing out at an easy and unpopular target - the NSA and its fellow agencies who diligently attempt to accomplish the very difficult tasks that we expect from them.

In an effort to help move this debate forward and clarify where reforms are needed, I've set aside two hours for a panel discussion at Suits and Spooks DC on how our parallel needs for security and privacy can be met through reform of the current laws authorizing data collection by the IC. It's not an easy panel to fill, so let me know if you have any suggestions for experts to participate on it. Dr. Catherine Lotrionte of Georgetown University will be the moderator. 

Add to Cart View detail

Germany's BND Caught Spying on Afghan Minister's Emails (2008)

In light of the current tensions between German Chancellor Merkel and President Obama over alleged NSA spying, I found this Der Speigel article in the bookmarks that I keep on nation state espionage:

The BND, Germany's foreign intelligence service, was caught spying on Minister Amin Farhang of the Afghan government via a trojan that they installed on his computer. The campaign lasted for about six months and included collecting the emails of a Der Speigel journalist.

Then in 2009 there was this Der Speigel headline: "BND Infiltrated Thousands of Computers Abroad" - which describes how Germany's foreign intelligence service used keyloggers and other tactics to monitor at least 2500 computers in a highly targeted espionage campaign. 

Granted, this is nowhere close to the scale of the NSA revelations, however Chancellor Merkel should certainly be aware that her own intelligence services have engaged in the same activities as everyone else's and her outrage should be tempered accordingly.

Add to Cart View detail

A Suits and Spooks Collision in Washington DC

No, President Obama didn't authorize a CIA direct action against House Tea Party members who are keeping the government closed. The "Collision" that I'm talking about is the Suits and Spooks event that is happening in Washington DC on January 19-21. Some of you know that I've been reluctant to call it a "conference" ever since I created this event in 2011. Finally, thanks to my friend Jim Stogdill at O'Reilly Media, I've got a new name for it - a collision.

It's the perfect word because that's precisely what happens during many of the talks. It's not a Summit where high profile speakers get to express their opinions without the opportunity for audience members to question them. Our speakers understand that the content of their talks can be challenged at any time by the attendees. And since we keep our total attendance capped to under 150 and keep all of the sessions on a single track, there's a lot of interaction taking place that just doesn't happen at any other event. In fact, when you consider who some of our speakers are, that's a remarkable thing to experience.

Here are just a few of the 25 or so high profile speakers that we've lined up for SNS DC:

• Barbara M. Hunt: Co-founder of Cutting Edge C.A. who was formerly the Director for Capabilities of Tailored Access Operations at NSA as well as a 20 year veteran technical expert at CIA
• David Howe: CEO at Civitas Group; formerly Special Assistant to the President (Homeland Security Council)
• Carmen Medina: Career senior national security executive at CIA (retired). Assignments included Director for the Center of the Study of Intelligence; Deputy Director of  Intelligence; and Chief of the Strategic Assessments Group, Office of Transnational Issues, Directorate of Intelligence.
• Eric O’Neill: Attorney and co-founder, The Georgetown Group; former FBI operative who was instrumental in the Robert Hanssen espionage case.
• John Gilkes: Principal, Deloitte Financial Advisory Services; more than twenty years experience in asset tracing and recovery and in the management and conduct of financial/fraud investigations involving wire transfer fraud, bribery/corruption, and extortion.
• Steven Chabinsky: General Counsel, Chief Risk Officer at CrowdStrike; Previously Deputy Ass’t Director Cyber at FBI
• Stewart Baker: Partner, Steptoe & Johnson LLP; Previously Ass’t Secretary for Policy at DHS

Another first for Suits and Spooks DC 2014 will be our workshops. We're not a hacker con so you won't find the workshops that you're accustomed to at Blackhat and other events. That's because there's more to cyber security than malware alone. We'll be offering four workshops in January:

• Lance Cottrell, the founder of Anonymizer, will teach a half-day workshop on Internet Anonymity and Pseudonymity.
• Rob DuBois, a retired Navy SEAL and former director of operations for the Dept of Defense Red Team will teach a full-day course on how to train and operate a full spectrum red team.
• Carmen Medina, a former Deputy Director of Intelligence at CIA will teach a half-day course on analytic methods.
• Phil Rosenberg and John Gilkes will teach a course on financial fraud investigations and money laundering.

Registration for SNS DC is now open and we're already 25% full. Registration for the workshops is currently open for Lance Cottrell's topic and the others should be ready by next week (separate tuition is charged for the workshops). Here's the link for the SNS DC webpage. See you in January.

And if you're interested in having your company become a sponsor, please shoot me an email. 

Add to Cart View detail

Taking a Deep Dive into China's Cyber Threat Landscape

The cyber threat landscape is so much more complex than is commonly reported by the media, the government, and especially by information security vendors. China is no different. The goal of the Suits and Spooks conference in New York City is to begin the process of diagramming the most complete cyber threat landscape that has ever been done by bringing together 15 international authorities on different geographical regions to discuss and debate the issues.

One of our panels is "Cyber Attacks and China: Who Should Be Held Responsible", and includes:

• Joel Brenner (moderator): former National Counterintelligence Executive at the Office of the Director of National Intelligence and former Senior Counsel at the NSA
• Peiran Wang: Ph.D. candidate, The Center for Economic Law and Governance, Faculty of Law and Criminology, Vrije Universiteit Brussel 
• Peter Mattis: Editor, Jamestown Foundation China Brief 
• Mihoko Matsubara: Cybersecurity analyst at Hitachi Systems and Adjunct Fellow at Pacific CSIS
• Tom Creedon: Chief Researcher, East Asia Cyber Threat Intelligence, Verisign-iDefense
• Sheena Chestnut Greitens, Ph.D.: Fellow, Harvard’s Fairbank Center for Chinese Studies
• Roel Schouwenberg: Sr. researcher, Kaspersky Labs' Global Research and Analysis Team

In addition to serving on this panel, each of the above panel members will be giving their own talks on related subjects. A full agenda for this two day event will be published soon. In the meantime, you may want to register for this unique and important conference before it sells out.

Add to Cart View detail

France Outraged over NSA spying. How do you say "Glass Houses" in French?

The hypocrisy of French Foreign Minister Laurent Fabius' outrage over U.S. spying allegations is stunning. France's record on espionage is well-known and long-standing. Here are just a few examples:

----
Votre Secrets, Monsieur?
"AS THE 20TH CENTURY DRAWS TO A CLOSE, a country's economic power has become more essential to its survival than its military prowess. This increased emphasis on market dominance means the world's intelligence services are refocusing their efforts from collecting the traditional political and military material to collecting economic, scientific, technological, and business information. One intelligence service that has become synonymous with this new effort is the French government's General Directorate of External Security (DGSE)."

"The idea of the French using their intelligence service to obtain scientific, economic, and technological information from friendly countries is not new. Returning to power in 1958, President Charles de Gaulle indicated that the Service for External Documentation and Counterespionage (SDECE), the then French intelligence agency, needed to focus on obtaining technological information about the United States and other Western countries."

Read more

----

WIKILEAKS: France leads Russia, China in Industrial Spying in Europe
"Back in 2001, European leaders accused the United States government of operating a vast industrial espionage network that was eavesdropping on European businesses and giving trade secrets to American companies. According to the latest WikiLeaks cable release, they should have been looking internally."

"France is the country that conducts the most industrial espionage on other European countries, even ahead of China and Russia, according to leaked U.S. diplomatic cables, reported in a translation by Agence France Presse of Norwegian daily Aftenposten's reporting."

"French espionage is so widespread that the damages (it causes) the German economy are larger as a whole than those caused by China or Russia," an undated note from the U.S. embassy in Berlin said."

Read more

----

Next Up for France: Police Keyloggers and Web Censorship
"Having just passed its super-controversial Internet "graduated response" law, you might think the French government would take at least a brief break from riling up the "internautes." Instead, the government is prepping a new crime bill that will, among other things, mandate Internet censorship at the ISP level, legalize government spyware, and create a massive meta-database of citizen information called "Pericles."

Read more

----

And this is just from the ones that I collected while researching and writing my security guide for business travelers ebook. The public might be outraged, but government officials know better.

Add to Cart View detail

Fact-checking Secretary Panetta's Speech Regarding a Preemptive Strike

In an important speech on Thursday night, Defense Secretary Leon Panetta spoke about how the Department of Defense has improved capabilities to protect the U.S. against the threat of a catastrophic cyber attack; that if such an attack were imminent, the U.S. would strike first. While this statement was clearly mean't to deliver a message to Iran which featured prominently in the Secretary's remarks, the U.S. lacks the technical ability to deliver on that threat.

According to the Law of Armed Conflict, a nation state must be under imminent threat of an attack which will cause grievous harm to its populace before it can launch a pre-emptive strike in self defense. Rather than a traditional kinetic attack, Secretary Panetta specifically referred to a cyber attack by "an aggressor nation or extremist group [who] could gain control of critical switches and derail passenger trains, or trains loaded with lethal chemicals". The Secretary went on to say that "If we detect an imminent threat of attack that will cause significant physical destruction or kill American citizens, we need to have the option to take action to defend the nation when directed by the President".

The fact is however that neither the NSA nor any other agency has the ability to identify a malicious program that was custom-written to target an industrial control system before the attack occurs. It cannot "see" such a program traveling across the Internet backbone assuming that were the delivery method. More likely, as in the case of Stuxnet, Shamoon, and other malware, it would be hand-carried onto the target's premises and inserted via removable media into a networked computer which bypasses the capabilities of any NSA-run signals intelligence program to identify it.

Even if we had the ability to discern the purpose and target of malware in-transit, we'd also have to know which nation state was behind it. Although Secretary Panetta claimed that DoD has made "significant advances" in determining attribution, there's ample reason to doubt that statement - the most obvious being the Secretary's own words that "DoD is already in an intense daily struggle against thousands of cyber actors who probe the Defense Department’s networks millions of times per day." Anonymity has provided much of the impetus for the increasing number of automated and targeted attacks against the U.S. and other countries. Those attacks are on the rise because anonymity remains intact.

U.S. offensive cyber warfare capabilities are second to none, but in the words of General Peter Pace, the former Chairman of the Joint Chiefs of Staff, we cannot defend against what we send out, and since what we have sent out (like Stuxnet) is being reverse-engineered, we should re-think whether our being in a weak defensive state is really the best time to be running offensive cyber operations in the first place.

Add to Cart View detail

Offensive Tactics That You Won't Hear About At HackerCons

Here's a first look at the partial agenda for Suits and Spooks Boston. We're still finalizing content for some of our speakers (i.e., "to be announced"). You'll quickly see the reason why it's closed to journalists and why no presentations will be shared or made public. And you'll also see why Suits and Spooks isn't just another security conference. No one covers what we do.

8:30am Registration and Continental Breakfast

9:00am: David Bray: "The Need for a Science of Cybersecurity and Critical Infrastructure"

9:30am: Rob DuBois "How would a red team plan and launch an assault against a typical power plant"

10:00am: Dale Peterson: "How adversaries could take out thousands of power plants around the world as well as large parts of the electric transmission system"

10:30am: Break

10:45am: John Sullivan: "How a large municipal water system can be disrupted and why there's no defense against it"

11:15am: Dan Kuehl: to be announced

11:45am: Lunch

12:45pm: Christopher Ahlberg "How to create a targeting package against a corporation or individual using social media"

1:15pm: Henry Shiembob "How multi-national corporations watch for outside threats but miss the more dangerous insider threat"

1:45pm: Dan Geer: to be announced

2:15pm: Larry Castro: "A Policy Review of Pending Cyber Security Legislation and What an Executive Order Might Cover"

2:45pm: Break

3:00pm: Christopher Burgess: "Creating havoc through the disruption of medical devices and electronically altering patient data"

3:30pm: Derek Gabbard: to be announced

4:00pm: Zach Tumin: to be announced

4:30pm: Closing Remarks

The final agenda will be announced on October 1st. A full list of speakers and their bios is at the Suits and Spooks Boston web page. Our early bird registration rate of $295 ($100 savings off the standard rate) ends in six days so reserve your space today.

Options

Early bird registration $295.00 USD

Add to Cart View detail

Justice Wins. Bin Laden is Dead.

It took 10 years, a new President, and the stellar collaborative work of the U.S. Intelligence Community to enable the success of the military operation against Osama bin Laden. Congratulations to all of the people whose names we'll never know that led to this momentous event of justice and vindication. We're so quick to judge intelligence failures that become public knowledge while the successes rarely make the news. Not only is this an intelligence success for CIA, NSA, and other agencies, it's vindication for President Obama's strategy to re-focus on capturing or killing Osama bin Laden in spite of political pressure to quit. I'm proud of everyone involved, and hugely grateful.

Related Links:

Timeline: The Intelligence Work Behind Bin Laden's Death
Latest on the Osama Raid: Tricked-Out Choppers, Live Tweets, Possible Pakistani Casualties
The Secret Team That Killed bin Laden

Add to Cart View detail