October 2013 - cypherpunks - lists.cpunks.org

Internal Patriot Discovery: NSA's next logical step
by J.A. Terranson 19 Oct '13

19 Oct '13

http://vimeo.com/77082456 //Alif -- Those who make peaceful change impossible, make violent revolution inevitable. An American Spring is coming: one way or another.

1 0

Thank You, Edward Snowden
by coderman 19 Oct '13

19 Oct '13

Ron Wyden++ -- http://reason.com/archives/2013/10/18/thank-you-edward-snowden/print Ronald Bailey | Oct. 18, 2013 1:30 pm Last week the Cato Institute put on a terrific conference about unconstitutional domestic spying. The Cato conference took place after a summer of alarming revelations of just how deep and extensive the feds’ secret surveillance of our everyday communications had become. The conference, held at the institute’s downtown D.C. headquarters, brought some of the most knowledgeable Internet luminaries together with some of the fiercest fighters for Americans’ Fourth Amendment rights. Watchdog organizations such as the Electronic Frontier Foundation (EFF) and the American Civil Liberties Union (ACLU) had sought for years to expose the extent and depth of federal surveillance, but their efforts were largely stymied by the very walls of secrecy they were trying to breach. In the 2006 case Hepting v. AT&T, for example, the EFF sued the giant telco for the privacy violations incurred by allowing the National Security Agency (NSA) to wiretap and data-mine all of the company’s customers’ communications. To forestall this case, Congress in 2008 passed the FISA Amendments Act, conferring retroactive immunity on the telephone companies and government agencies for engaging in warrantless wiretapping. Earlier this year, the U.S. Supreme Court rejected a challenge to the FISA Amendments Act by the ACLU and other groups, on the grounds that they had no standing to sue because they could not actually prove that the NSA was spying on them. This is Catch-22 logic: The ACLU needs to sue the NSA to get the evidence that the agency spied on it and its clients, but they can’t sue because they have no evidence that the agency spied on them. The walls of surveillance secrecy were finally cracked by the June revelations of whistleblower Edward Snowden. Snowden’s files conclusively show that the federal government has been operating a vast spying program that violates the Fourth Amendment rights of tens of millions of ordinary Americans. To justify this surveillance, the government offers tortured legal interpretations of Section 702 of the Foreign Intelligence Surveillance Act and Section 215 of the PATRIOT Act. Section 702 authorizes warrantless surveillance of the communications of foreigners outside of the United States. As Snowden’s documents reveal, the NSA has interpreted Section 702 as a backdoor loophole allowing the agency to retain and comb through the call data and emails of Americans whose communications are “about” a terror suspect or have been “inadvertently” intercepted by the NSA’s PRISM monitoring program. The even more egregious violations of our constitutional rights, Snowden revealed, occurred under Section 215 of the PATRIOT Act, which the NSA has used to justify the dragnet collection and retention of the call metadata of essentially all Americans. (Metadata includes the numbers called and the location, date, time, and duration of each call.) The first keynote at the Cato conference was delivered by Sen. Ron Wyden (D-Ore.), who cited the “revelations of June” numerous times. Several speakers used such circumlocutions during the conference, clearly as a way to avoid actually speaking the name of the man who finally broke the news that our government has been unconstitutionally spying on us for years. Despite his reticence with regard to Snowden, Wyden has been at the lonely forefront of the fight to rein in America’s growing surveillance state. It was Wyden who asked Director of National Intelligence James Clapper in a March hearing whether the agency collected any sort of data on hundreds of millions of Americans. “No, sir,” lied Clapper. “Not wittingly.” After Snowden’s revelations proved that Clapper was a liar, Clapper attempted to justify himself in a June television interview by suggesting that “collect” doesn’t mean the same thing to him that it means to ordinary Americans. “Collect,” Clapper claimed, doesn’t mean intercepting and storing data about telephone calls; the data are only “collected” when the agency goes searching through its vast databases looking for specific calls. At the Cato conference, New York Times national security reporter Charlie Savage pointed out that “Congress doesn’t know that there is a secret lexicon at the NSA in which words mean something else at the NSA.” He recommended that people might want to look up the Electronic Frontier Foundation’s helpful NSA glossary, which shows how the agency reinterprets normal words in ways that ordinary people would say amount to “lies.” Another speaker, Rep. Justin Amash (R-Mich.), said that Clapper should step down and be prosecuted for lying to Congress. During his morning keynote, Wyden outlined the main provisions of a new bill he introduced with Sens. Mark Udall (D-Utah), Richard Blumenthal (D-Conn.), and Rand Paul (R-Ky.) two weeks earlier. The bill would end the mass collection of American’s communication data, close the backdoor search loophole under FISA Section 702, provide an advocate to argue against government abuses before the Foreign Intelligence Surveillance Court, and enable citizens to be heard in federal courts when they believe that the surveillance agencies have violated their Fourth Amendment right to privacy. In addition, telecommunications companies would be enabled to disclose more information about their cooperation with government surveillance activities. Wyden warned that the agency heads and their enablers in the Congress, such as Senate Intelligence Committee Chair Dianne Feinstein (D-Calif.), would be striking back against proposals for increased transparency. “Their objective is to fog up the surveillance debate,” he explained, “and convince Congress and the public that the real problem is not unconstitutional surveillance, the real problem is sensationalistic reporting.” Wyden is encouraged, however, by the broader reaction to the “revelations of June.” Referring to the Amash amendment, a July measure that sought to cut funding to the NSA’s bulk collection of Americans’ phone records, Wyden said, “If you’d told me that you could get 200 votes on the floor of the House of Representative, I would have said you’re dreaming.” The amendment failed, but the vote was surprisingly close. Of course, that vote was only possible because of Snowden’s disclosures. Yet in July, when Wyden was asked whether Snowden is a hero or a villain, he replied that “when there is an individual who’s been charged criminally and he has been charged with espionage, I don’t get into commenting beyond that.” Wyden should comment, and his comment should be: “Thank you, Edward Snowden.” Next up at the conference was a panel of national security reporters moderated by Cato’s Julian Sanchez. The panelists were Bart Gellman of the Washington Post, Spencer Ackerman of The Guardian, Siobhan Gorman of The Wall Street Journal, and Charlie Savage of The New York Times. Gellman was the first speaker to say the word “Snowden,” noting that the whistleblower’s greatest fear was that the risks he took would be all for nothing; that there would be no debate over the extent and intrusiveness of domestic surveillance. In fact, Gellman declared, “Snowden succeeded beyond his wildest dreams.” Gellman also said that Clapper wasn’t the only administration official to lie to Congress. NSA chief Keith Alexander wasn’t telling the truth when he claimed a year ago that his agency does “not hold data on U.S. citizens” at its gigantic new data facility in Bluffdale, Utah. And the Justice Department had certainly been misleading, even if it didn’t technically lie, when it said the Section 215 authorities had been used only 20 to 30 times to collect data. Yes, but those 20 to 30 times allowed the NSA to collect trillions of records. Gorman added that the Snowden revelations had “shaken the trees” and prompted other reporting that has forced other government disclosures about various domestic spying efforts. For example, the NSA has tapped the Internet backbone through secret agreements with nine major (but unnamed) U.S. telecommunications companies. This has given the agency the capacity to monitor 75 percent of all U.S. Internet communications. Once it was revealed that the big telecommunications companies were cooperating with the NSA spying program, Gellman noted, they started agitating to be allowed to disclose more about what they are being asked and ordered to do. The luncheon keynote was delivered by Rep. Amash, who described how spy agencies try to limit congressional access to information about their activities, making meaningful oversight all but impossible. Agencies speak in generalities and then engage in a game of 20 questions with legislators who seek deeper knowledge. They might, for example, answer a query with “No, our agency doesn’t do that” without mentioning that another agency does. Amash described one occasion in which he was seeking to review a particular document and the agency promised to arrange for members of Congress to do so. The agency did not send a message that the document was available for scrutiny by emailing members’ offices directly; instead it sent the notification through the more general and less read Dear Colleague email system. Even then, the document was available for review only between 9 a.m. and noon in a briefing room on the day just before Congress was scheduled to leave for vacation. Members who reviewed the document also had to sign a nondisclosure agreement saying that they would not discuss it with other members who had not seen it. After lunch, the conference featured a panel of legal experts, many of whom have tangled in court with the NSA and the Justice Department. Georgetown law professor Laura Donohue argued that the Foreign Intelligence Surveillance Court (FISC) was solely created to supervise spying on foreign powers and their agents. Under statute, the FISC is supposed to review and grant orders under Section 215 only when agencies supply “a statement of fact showing that there are reasonable grounds to believe that tangible things sought are relevant to an authorized investigation.” Donohue argues that the FISC and the NSA have now interpreted “relevant” to include all data on all telephone calls, and possibly other records, such as data on all emails, financial records, medical records, and so forth. As such, Section 215 orders function as general warrants allowing officials to rifle through the records of any American without the need to show probable cause as delimited by the Fourth Amendment. The ACLU’s Jameel Jaffer agreed that the NSA’s dragnet collection of phone records violates the relevance standard of Section 215. He also argued that it violated Americans’ reasonable expectations of privacy under the Fourth Amendment and, less obviously, our right of free association under the First Amendment. If people think they are watched by government agents, he explained, they may curtail innocuous contacts with others out of fear that government functionaries will misinterpret or abuse information about their relationships. David Lieber, privacy counsel for Google, struck another First Amendment note, expressing frustration over the government’s prior restraint of speech when it forbade his company (and others) from disclosing even summary statistics on how much information on its customers the feds were requiring it to turn over. Paul Rosenzweig, a former deputy assistant for policy at the Department of Homeland Security, is much more sanguine about NSA domestic surveillance. He offered a very nice demonstration, produced by journalist Kieran Healy based on David Hackett Fischer’s biography of Paul Revere, showing how metadata on various club memberships would have identified Paul Revere to the British authorities as the center of terrorist network in late-18th-century Boston. That may sound alarming to you, but to Rosenzweig the NSA’s use of such relational data-mining is “relevant” to an investigation. The second afternoon panel focused on techniques to protect data from federal surveillance. First, the good news: Jim Burrows of Silent Circle, a new company offering various encryption services, observed that TOR, the free open source software that protects users’ anonymity, generally stands up to NSA snooping. Less happily, David Dahl of SpiderOak, a company that offers encrypted file backup, decried the recent revelations that the NSA had succeeded in introducing subtle vulnerabilities by influencing the development of encryption standards. Matt Blaze, an Internet security guru at the University of Pennsylvania, observed that maintaining vulnerabilities in computer code doesn’t just make it easier for the NSA to spy; it makes it easier for the Chinese, Russians, and Iranians to spy, and for Internet criminals to steal data and cause other havoc. Burrows discussed the case of Lavabit, an encrypted email service apparently used by Snowden. The NSA ordered Ladar Levison, the owner of the service, to hand over data that would enable the agency to spy on his 350,000 customers. Levison instead shut down the service, saying that he refused “to become complicit in crimes against the American people.” Burrows noted that Silent Circle was also an offering encrypted email service. Within 10 hours of learning what had happened to Lavabit, Silent Circle shut down and purged its own service without notice to subscribers. Burrows noted that had Silent Circle informed its customers in advance the shutdown might have become illegal. “We knew for sure that someday some law enforcement agency would order us to give them a backdoor,” said Burrows. Burrows noted that there is no email that is currently secure against metadata collection, although users can securely encrypt the content of their messages. The ACLU’s Chris Soghoian added that the laws of physics make it impossible to shield the location data emitted by mobile phones. SpiderOak’s Dahl speculated that some peer-to-peer communications protocols with built-in cryptography might make secure email possible. The final panel considered what reforms are necessary to rein in domestic surveillance. Cato Senior Fellow John Mueller demolished the claim that the NSA’s domestic spying has done much to protect Americans against terrorism. NSA chief Alexander claimed in June that mass telephone surveillance program had thwarted 54 terrorist plots. In October, Alexander admitted in a Senate hearing that the telephone dragnet’s effect was much more modest: It may have helped in one or maybe two cases. “The Obama administration has doubled down on this program and doesn’t believe that it has done anything wrong,” despaired Michelle Richardson, legislative counsel for the ACLU. Center for Democracy and Technology senior counsel Kevin Bankston remarked that it is “insane” that Google’s privacy counselor David Lieber “had to dance around the question of receiving requests from the NSA.” People are free to say they haven’t received such requests, but they’re not allowed to tell anyone when they have. “The NSA has turned the Internet into a giant surveillance platform,” declared renowned tech guru and Harvard Berkman Center fellow Bruce Schneier. Metadata collection that tells spies where a person went, who he spoke to, what he bought, and what he saw equals surveillance. “When the president says, ‘It’s just metadata,’” he means, “Don’t worry, you’re all under surveillance all of the time.” Schneier argued that we need to make the Internet secure against all attackers. “A secure Internet is in everyone’s interests,” said Schneier. “We are all better off if no one can do this kind of bulk surveillance. Fundamentally, security is more important than surveillance.” The panel agreed that it is critical to pass legislation preventing the government from mandating that companies build spy-friendly insecurities into their systems. The final keynote speaker, Rep. James Sensenbrenner (R–Wisc.), outlined the contours of his Uniting and Strengthening America by Fulfilling Rights and Ending Eavesdropping, Dragnet-Collection, and Online Monitoring (USA FREEDOM) Act. His bill would limit the collection of phone records to known terrorist suspects, force the Foreign Intelligence Surveillance Courts to disclose surveillance policies, establish a constitutional privacy advocate in that court’s proceedings, and permit companies to disclose NSA information requests. At the end of conference, the one person whose efforts made it possible to for new Congressional reform efforts aimed at reining in the surveillance state went largely unacknowledged. And so, again: Thank you, Edward Snowden. Disclosure: I am still a card-carrying member of the ACLU.

1 0

Curious RNG stalemate [was: use of cpunks]
by Jim Bell 19 Oct '13

19 Oct '13

On Oct 18, 2013, at 12:16 AM, Cathal Garvey (Phone) <cathalgarvey(a)cathalgarvey.me> wrote: >> Accepted, entirely, but if "noisy diodes" are all you need for quantum entropy, why are designs for OSHW entropy generators so scarce? I suggested smoke alarms not through radioactivity-fetishism but because of ubiquity and low cost, likely low difficulty to adapt. >Because people think that over-the-top is necessary. >Perhaps more to the point, people start gilding the lily, and then worrying about how pure the gold is on the lily, and then deciding that the gilt on the lily needs to be mono-atomic and to form a single crystal. >Even more to the point, they start thinking in their heads that they will be criticized for not having a single-crystal structure on the gilt on their lily, and give up. >After that, they criticize other people who grow lilies because -- heck, anyone can do that, and years ago, they gave up on lilies because of how hard it is to get mono-crystalline gilt. Go look it up in the cypherpunks archives, for pete's sake. Nicholas Bourbaki discussed it to death there back in '92. >Building a good RNG is both simpler than you think and harder. You need: >* An unguessability source. It doesn't have to be as good as you think it does. If it's crap, you just need more. It just has to be unguessable. The deterministic process going on on my LAN might be good enough. It might not. What matters is the work factor of guessing. A few weeks ago I posted a cite which referred to a RNG. (actually three cites; one of them was this). One of them consisted of a number (I'd choose 4, arbitrarily) of 'ring oscillators' (an odd number of digital inverters connected in a loop; I'd choose 7, 11, 13, and 17 inverters, being primes and unlikely to synchronize) which were each tapped at some point, feeding 2-input XOR (exclusive-or) gates, and those XOR outputs themselves being XOR'd together. The output would feed the D input of a D-flip-flop, and that would be clocked via a signal synchronized with the (external) CPU clock. (A read signal, presumably). It could be built in relatively old technology (250 nanometers) with inverter delays of about 20 picoseconds, so the frequencies seen in the oscillator taps would be about 4/2.5/2.1/1.6 gigahertz. Such a device could probably be accessed (clocked by the D-flip-flop) at 100 MHz, which is a far greater rate (100 megabits/second of random bits) than most systems would need. Such a system might have a little bias, perhaps leading to there only being 0.9 bits of entropy in each bit, but as a source of entropy that would be okay. A somewhat more complex chip could store thousands of bits, perhaps with a microprocessor to monitor randomness and/or produce a truly random output. A logical company to build such a thing would be Texas Instruments, which was big on TTL (SSI, MSI, LSI, VLSI) even in the early 1970s, or any one of a few dozen other glue-logic manufacturers. Target price: 50 cents in 1000's. Jim Bell

1 0

Re: [cryptography] NYT Planning NSA Ppaers
by John Young 19 Oct '13

19 Oct '13

Carlos Slim is my gym client. Despite begging and tipping bags of pesos, not yet slim. Hung before his exerbike is Thompson's headshot. >- taking any bets? loooong odds ;)

1 0

NYT Planning NSA Ppaers
by John Young 19 Oct '13

19 Oct '13

Musings on Snowden being devoured, threatened then totemized like Ellsberg: http://cryptome.org/2013/10/nyt-nsa-papers.htm

2 1

Police warning after drug traffickers' cyber-attack
by Eugen Leitl 18 Oct '13

18 Oct '13

Eat your heart out, William Gibson. http://www.bbc.co.uk/news/world-europe-24539417 Police warning after drug traffickers' cyber-attack By Tom Bateman Reporter, Today programme Drug traffickers hacked into the computer controlling shipping containers at the port of Antwerp Earlier this year drug traffickers hacked into the computer controlling shipping containers at the port of Antwerp The head of Europe's crime fighting agency has warned of the growing risk of organised crime groups using cyber-attacks to allow them to traffic drugs. The director of Europol, Rob Wainwright, says the internet is being used to facilitate the international drug trafficking business. His comments follow a cyber-attack on the Belgian port of Antwerp. Drug traffickers recruited hackers to breach IT systems that controlled the movement and location of containers. Police carried out a series of raids in Belgium and Holland earlier this year, seizing computer-hacking equipment as well as large quantities of cocaine and heroin, guns and a suitcase full of cash. Fifteen people are currently awaiting trial in the two countries. Mr Wainwright says the alleged plot demonstrates how the internet is being used as a "freelance marketplace" in which drug trafficking groups recruit hackers to help them carry out cyber-attacks "to order". "[The case] is an example of how organised crime is becoming more enterprising, especially online," he says. A Europol official tells Tom Bateman how traffickers hacked into the IT system at Antwerp port "We have effectively a service-orientated industry where organised crime groups are paying for specialist hacking skills that they can acquire online," he adds. Vanishing containers The attack on the port of Antwerp is thought to have taken place over a two-year period from June 2011. Prosecutors say a Dutch-based trafficking group hid cocaine and heroin among legitimate cargoes, including timber and bananas shipped in containers from South America. The organised crime group allegedly used hackers based in Belgium to infiltrate computer networks in at least two companies operating in the port of Antwerp. The breach allowed hackers to access secure data giving them the location and security details of containers, meaning the traffickers could send in lorry drivers to steal the cargo before the legitimate owner arrived. Workers were first alerted to the plot when entire containers began to disappear from the port without explanation. "These criminal organisations always look for a new way to get drugs out of the harbour," says Danny Decraene who heads the Antwerp organised crime unit of the Belgian Federal Police. Bag of cash seized by Belgian police This suitcase, containing 1.3m euros, was seized by Belgian police during raids on drug traffickers "In this case they hired hackers [who were] very high level, intelligent guys, doing a lot of software work," he adds. He says the operation to hack the port companies took place in a number of phases, starting with malicious software being emailed to staff, allowing the organised crime group to access data remotely. When the initial breach was discovered and a firewall installed to prevent further attacks, hackers broke into the premises and fitted key-logging devices onto computers. This allowed them to gain wireless access to keystrokes typed by staff as well as screen grabs from their monitors. Assault rifle attack Mr Decraene says the total quantity of drugs trafficked by the group is unknown, but in a series of raids earlier this year police seized more than a tonne of cocaine, with a street value of £130m, and a similar amount of heroin. In January a lorry driver unconnected to the plot was shot at after he had unwittingly driven a container allegedly filled with cocaine from the terminal at Antwerp. The attack took place in the province of Limburg, where suspects armed with AK-47 assault rifles fired at the driver, who was unharmed. Following the cyber-attack in Antwerp, a joint operation by Belgian and Dutch police resulted in raids on more than 20 homes and businesses. Officers seized six firearms including a machine gun and silencer, bullet-proof vests, and 1.3m euros (£1.1m) in cash inside a suitcase. Mr Wainwright says the IT attack is consistent with a "new business model" of organised crime activity and he says he expects this kind of cyber-security breach to "become a more significant feature in future" of drug trafficking. "What it means therefore is that the police need to change the way they operate - they have to become much more tech savvy," he says. "But also I think governments and parliaments need to help us to make sure therefore that we have the right laws to fight back against this massive exploitation of the internet," he adds. Container companies operating out of the port of Antwerp say their IT security has now been improved.

1 0

Just Published: Secrets and Leaks: The Dilemma of State Secrecy
by John Young 18 Oct '13

18 Oct '13

Secrets and Leaks: The Dilemma of State Secrecy, Rahul Sagar: http://www.amazon.com/Secrets-Leaks-Dilemma-State-Secrecy-ebook/dp/B00F8MII…

1 0

Re: [Full-disclosure] Secure whistleblowing feedback / reporting systems in the content of compartmented information, endpoint security [was: [NSA bitching] [formerly Re: PRISM][]]
by coderman 18 Oct '13

18 Oct '13

On Thu, Oct 17, 2013 at 10:16 PM, Jeffrey Walton <noloader(a)gmail.com> wrote: > ... > Even if the right to privacy was recognized, it would only apply to > government. Corporate would be free to spy on us and then sell it to > the government. this, in the traditional sense, is what John calls a "COMSEC cover-up": http://cryptome.org/2013/10/nsa-hysteria-coverup.htm meaning that the continual, most significant, and most likely to be abused and widely are commercial services and collaborations and products, where the product is your private information of any sort, that you usually unwittingly but sometimes capriciously yield to un trustworthy third parties with little constraint on secondary distribution for money to further removed stranger parties... note that fully decentralized, end-to-end secured, with properly managed keying and sessions capable technologies are resistant to these third-party weaknesses and vulnerabilities. crypto and comms and computing technology should not be abandoned en whole like the russians for their manual type writers, but the minimum required operational safety of any information processing system needs huge innovation to get from current systems to something effective and usable... hey look, it's more of those fun problems to solve again ;)

2 1

Snowden sets OPSEC record straight
by coderman 18 Oct '13

18 Oct '13

it doesn't get much more definitive than this retort.. : """ [Snowden] felt confident that he had kept the documents secure from Chinese spies, and that the N.S.A. knew he had done so. His last target while working as an agency contractor was China, he said, adding that he had had “access to every target, every active operation” mounted by the N.S.A. against the Chinese. “Full lists of them,” he said. “If that was compromised,” he went on, “N.S.A. would have set the table on fire from slamming it so many times in denouncing the damage it had caused. Yet N.S.A. has not offered a single example of damage from the leaks. They haven’t said boo about it except ‘we think,’ ‘maybe,’ ‘have to assume’ from anonymous and former officials. Not ‘China is going dark.’ Not ‘the Chinese military has shut us out.’ ” """ there is a clear thoughtfulness, moral reasoning, and conscientiousness repeatedly demonstrated by Snowden in these events. it is now obvious that history will exonerate him fully. ... the distance between current reactionary retribution and that future absolution appears to be a bit of a distance, however... hopefully not too long. --- http://www.nytimes.com/2013/10/18/world/snowden-says-he-took-no-secret-file… October 17, 2013 Snowden Says He Took No Secret Files to Russia By JAMES RISEN WASHINGTON — Edward J. Snowden, the former National Security Agency contractor, said in an extensive interview this month that he did not take any secret N.S.A. documents with him to Russia when he fled there in June, assuring that Russian intelligence officials could not get access to them. Mr. Snowden said he gave all of the classified documents he had obtained to journalists he met in Hong Kong, before flying to Moscow, and did not keep any copies for himself. He did not take the files to Russia “because it wouldn’t serve the public interest,” he said. “What would be the unique value of personally carrying another copy of the materials onward?” he added. He also asserted that he was able to protect the documents from China’s spies because he was familiar with that nation’s intelligence abilities, saying that as an N.S.A. contractor he had targeted Chinese operations and had taught a course on Chinese cybercounterintelligence. “There’s a zero percent chance the Russians or Chinese have received any documents,” he said. American intelligence officials have expressed grave concern that the files might have fallen into the hands of foreign intelligence services, but Mr. Snowden said he believed that the N.S.A. knew he had not cooperated with the Russians or the Chinese. He said he was publicly revealing that he no longer had any agency documents to explain why he was confident that Russia had not gained access to them. He had been reluctant to disclose that information previously, he said, for fear of exposing the journalists to greater scrutiny. In a wide-ranging interview over several days in the last week, Mr. Snowden offered detailed responses to accusations that have been leveled against him by American officials and other critics, provided new insights into why he became disillusioned with the N.S.A. and decided to disclose the documents, and talked about the international debate over surveillance that resulted from the revelations. The interview took place through encrypted online communications. Mr. Snowden, 30, has been praised by privacy advocates and assailed by government officials as a traitor who has caused irreparable harm, and he is facing charges under the Espionage Act for leaking the N.S.A. documents to the news media. In the interview, he said he believed he was a whistle-blower who was acting in the nation’s best interests by revealing information about the N.S.A.’s surveillance dragnet and huge collections of communications data, including that of Americans. He argued that he had helped American national security by prompting a badly needed public debate about the scope of the intelligence effort. “The secret continuance of these programs represents a far greater danger than their disclosure,” he said. He added that he had been more concerned that Americans had not been told about the N.S.A.’s reach than he was about any specific surveillance operation. “So long as there’s broad support amongst a people, it can be argued there’s a level of legitimacy even to the most invasive and morally wrong program, as it was an informed and willing decision,” he said. “However, programs that are implemented in secret, out of public oversight, lack that legitimacy, and that’s a problem. It also represents a dangerous normalization of ‘governing in the dark,’ where decisions with enormous public impact occur without any public input.” Mr. Snowden said he had never considered defecting while in Hong Kong, nor in Russia, where he has been permitted to stay for one year. He said he felt confident that he had kept the documents secure from Chinese spies, and that the N.S.A. knew he had done so. His last target while working as an agency contractor was China, he said, adding that he had had “access to every target, every active operation” mounted by the N.S.A. against the Chinese. “Full lists of them,” he said. “If that was compromised,” he went on, “N.S.A. would have set the table on fire from slamming it so many times in denouncing the damage it had caused. Yet N.S.A. has not offered a single example of damage from the leaks. They haven’t said boo about it except ‘we think,’ ‘maybe,’ ‘have to assume’ from anonymous and former officials. Not ‘China is going dark.’ Not ‘the Chinese military has shut us out.’ ” An N.S.A. spokeswoman did not respond Thursday to a request for comment on Mr. Snowden’s assertions. Mr. Snowden said his decision to leak N.S.A. documents developed gradually, dating back at least to his time working as a technician in the Geneva station of the C.I.A. His experiences there, Mr. Snowden said, fed his doubts about the intelligence community, while also convincing him that working through the chain of command would only lead to retribution. He disputed an account in The New York Times last week reporting that a derogatory comment placed in his personnel evaluation while he was in Geneva was a result of suspicions that he was trying to break in to classified files to which he was not authorized to have access. (The C.I.A. later took issue with the description of why he had been reprimanded.) Mr. Snowden said the comment was placed in his file by a senior manager seeking to punish him for trying to warn the C.I.A. about a computer vulnerability. Mr. Snowden said that in 2008 and 2009, he was working in Geneva as a telecommunications information systems officer, handling everything from information technology and computer networks to maintenance of the heating and air-conditioning systems. He began pushing for a promotion, but got into what he termed a “petty e-mail spat” in which he questioned a senior manager’s judgment. Several months later, Mr. Snowden said, he was writing his annual self-evaluation when he discovered flaws in the software of the C.I.A.’s personnel Web applications that would make them vulnerable to hacking. He warned his supervisor, he said, but his boss advised him to drop the matter and not rock the boat. After a technical team also brushed him off, he said, his boss finally agreed to allow him to test the system to prove that it was flawed. He did so by adding some code and text “in a nonmalicious manner” to his evaluation document that showed that the vulnerability existed, he said. His immediate supervisor signed off on it and sent it through the system, but a more senior manager — the man Mr. Snowden had challenged earlier — was furious and filed a critical comment in Mr. Snowden’s personnel file, he said. He said he had considered filing a complaint with the C.I.A.’s inspector general about what he considered to be a reprisal, adding that he could not recall whether he had done so or a supervisor had talked him out of it. A C.I.A. spokesman declined to comment on Mr. Snowden’s account of the episode or whether he had filed a complaint. But the incident, Mr. Snowden said, convinced him that trying to work through the system would only lead to punishment. He said he knew of others who suffered reprisals for what they had exposed, including Thomas A. Drake, who was prosecuted for disclosing N.S.A. contracting abuses to The Baltimore Sun. (He met with Mr. Snowden in Moscow last week to present an award to him for his actions.) And he knew other N.S.A. employees who had gotten into trouble for embarrassing a senior official in an e-mail chain that included a line, referring to the Chinese Army, that said, “Is this the P.L.A. or the N.S.A.?” Mr. Snowden added that inside the spy agency “there’s a lot of dissent — palpable with some, even.” But he said that people were kept in line through “fear and a false image of patriotism,” which he described as “obedience to authority.” He said he believed that if he tried to question the N.S.A.’s surveillance operations as an insider, his efforts “would have been buried forever,” and he would “have been discredited and ruined.” He said that “the system does not work,” adding that “you have to report wrongdoing to those most responsible for it.” Mr. Snowden said he finally decided to act when he discovered a copy of a classified 2009 inspector general’s report on the N.S.A.’s warrantless wiretapping program during the Bush administration. He said he found the document through a “dirty word search,” which he described as an effort by a systems administrator to check a computer system for things that should not be there in order to delete them and sanitize the system. “It was too highly classified to be where it was,” he said of the report. He opened the document to make certain that it did not belong there, and after he saw what it revealed, “curiosity prevailed,” he said. After reading about the program, which skirted the existing surveillance laws, he concluded that it had been illegal, he said. “If the highest officials in government can break the law without fearing punishment or even any repercussions at all,” he said, “secret powers become tremendously dangerous.” He would not say exactly when he read the report, or discuss the timing of his subsequent actions to collect N.S.A. documents in order to leak them. But he said that reading the report helped crystallize his decision. “You can’t read something like that and not realize what it means for all of these systems we have,” he said. Mr. Snowden said that the impact of his decision to disclose information about the N.S.A. had been bigger than he had anticipated. He added that he did not control what the journalists who had the documents wrote about. He said that he handed over the documents to them because he wanted his own bias “divorced from the decision-making of publication,” and that “technical solutions were in place to ensure the work of the journalists couldn’t be interfered with.” Mr. Snowden declined to provide details about his living conditions in Moscow, except to say that he was not under Russian government control and was free to move around.

4 6

Re: HTML List Abuse (was: "please ignore: this is only a test")
by brian carroll 18 Oct '13

18 Oct '13

so you're saying the person is reading this on a two-line 80s electronic pager then? Actually, it's gmail that is doing that. People using pure-text > interfaces are posting only 7-bit ASCII. >

3 2