- cypherpunks - lists.cpunks.org

Mu [was: How worse is the Shellshock bash bug than Heartbleed?]
by coderman 05 Oct '14

05 Oct '14

On 9/30/14, Georgi Guninski <guninski(a)guninski.com> wrote: > ... > I find this _much_ worse than the passive Heartbleed. > > How worse is the shellshock bash bug than Heartbleed? a simplistic "shellshock worse than heartbleed" is mis-characterization of the situation. first, this presents a vulnerability without context, by itself. in the real world, we care about vulnerability with respect to exploitation. usually many vulnerabilities are leveraged together in exploitation of notoriety. in the sense of best practice and conservative security posture, heartbleed could be worse by far. a strongly keyed, defense in depth surreptitiously bypassed via bleeding. e.g. bleed UDP DTLS VPN to access internal network, bleed intranet HTTPS for admin credentials to critical infrastructure services. the ability to send things to a bash shell, even restricted shell, even constrained behind application layers, was always seen as bad practice for security conscious configurations - insiders get shell, not untrusted inputs. last but not least, this is all bullshit speculation; risk is a perspective and shellshock or heartbleed is better or worse depending on what you're looking at. best regards, P.S. #langsec asked how long you earth humans will be exchanging risky bits with strangers. i channeled djb and bet on "Forever!". [c.f. http://cr.yp.to/talks/2014.07.10/slides-djb-20140710-a4.pdf "Making sure software stays insecure"]

2 6

properly timing FOIPA for best results [was: 1977 Justice Dept. Report on CIA (was: Rockefeller Commission Report)]
by coderman 05 Oct '14

05 Oct '14

as per, On 10/3/14, Gregory Foster <gfoster(a)entersection.org> wrote: >> "... it was standard procedure >> not to notify the object of a criminal investigation (think John Gotti) >> once it is completed and requested under FOIA. i have been pondering the question of when is the most effective time to file a FOIPA. presumably this would be after the statute of limitations, plus some delay, to ensure that completed/discarded investigations are included in the scope of the disclosure. does anyone have guidance on this timing? perhaps 6-8 years after initially coming under scrutiny? best regards,

2 1

Re: bashing your head against nation-state social engineering
by Stephan Neuhaus 04 Oct '14

04 Oct '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 2014-10-03, 23:14, cyryl wrote: > On 29/09/14 08:58, Stephan Neuhaus wrote: >> On 2014-09-28 15:47, Subrosa.io wrote: >>> I think this vulnerability should have been discovered with any >>> kind of basic fuzzing. >> >> If I understand the vulnerability correctly, it occurs in very >> specific circumstances, namely trailing data at the end of a >> function definition that's transported in an environment >> variable. >> >> In that case, I'd venture that *no* kind of "basic fuzzing" could >> have uncovered this; the proportion of ShellShock-inducing >> environment variable definitions among all possible environment >> variables is simply too small. >> >> What you would need instead is very specific syntax-directed >> fuzzing, and even then I'm not sure that you have a decent chance >> of discovering this without knowing already that it's there. >> > > To uncover more vulns lcamtuf fed the fuzzer with the initial > state, but then left it there to do the work. > > http://lcamtuf.blogspot.nl/2014/10/bash-bug-how-we-finally-cracked.html Without > belittling the effort that's described in this article (after all, they found more vulnerabilities, which is good), I stand by my original point. If you want to fuzz the whole of bash, your chances of uncovering ShellShock are essentially nil. Once you know that function definitions transported in environment variables (a feature that I didn't even know existed, and I've been working with bash since the late 90's) are probably bug-ridden, your work becomes much, much easier. Fun, Stephan -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.21 (Darwin) iQEcBAEBAgAGBQJUL5mlAAoJEE0T/LJL2oHTGxgIAKuBg2aFEesnrAd4qWiGEqfx 0E6SWWkJLkYEGD4gDcMQW5XVUUP45kJdINKZFd/rFY3Ep47VXHJ0zD89XrP4YVHH +ujQMH4lF7+GLiVZ/tNYZCQ0k/t/9LBUS2bcvjuqIUxlmkzZN8UFFsD1L3/t+HDD LBAmRi28Z4TOREOdHRga9BdpAKTHy7I4toHoiiA3x1psJxwkqr9WD8C7CLABWCeC j6Gs1U5gqhCTOg0nz9DV8owuUJG1XqyOwApqC6hf1LZFWzr9WAR0G9Y+Xot4mdlJ 8s9Dkf9iEuN5nJpOPH9Hunhpoaxu8/B/TNYFvRYjE7zac3Icd8Hj3mu0TUc6RwY= =8VXa -----END PGP SIGNATURE-----

1 0

Rockefeller Commission Report (RCR, Jun 30 1976)
by Gregory Foster 04 Oct '14

04 Oct '14

The James Bamford article sent along by coderman is excellent. The Intercept (Oct 2) - "The NSA and Me" by James Bamford [ @WashAuthor ]: https://firstlook.org/theintercept/2014/10/02/the-nsa-and-me/ I just noticed the article links to an interesting document. Rockefeller Commission Report (RCR, 1977) "REPORT ON INQUIRY INTO CIA-RELATED ELECTRONIC SURVEILLANCE ACTIVITIES" http://www.documentcloud.org/documents/1304974-report-on-inquiry-into-cia-r… > A 1977 Justice Department report, obtained by reporter James > Bamford in 1981 under the Freedom of Information Act, investigating > criminal surveillance operations conducted by the CIA and NSA. In 1975, the executive branch under President Gerald Ford initiated its own investigation of the CIA's and the NSA's activities in parallel with the larger committees in the legislature. The report Bamford shared is a (redacted) product of the President's Commission. http://en.wikipedia.org/wiki/United_States_President%27s_Commission_on_CIA_… gf -- Gregory Foster || gfoster(a)entersection.org @gregoryfoster <> http://entersection.com/

1 1

NSA releases two documents on decrypting CIA KRYPTOS sculpture
by John Young 03 Oct '14

03 Oct '14

NSA releases two documents on decrypting CIA KRYPTOS sculpture, formerly classified FVEY//20320108 The CIA Kryptos Sculpture Slides https://www.nsa.gov/public_info/_files/cia_kryptos_sculpture/KRYPTOS_Slides… The CIA Kryptos Sculpture: A summary of Previous Work and New Revelations https://www.nsa.gov/public_info/_files/cia_kryptos_sculpture/KRYPTOS_Summar…

1 0

[OT] Can a combinatorial hardware circuit solve a crypto problem?
by Georgi Guninski 03 Oct '14

03 Oct '14

DISCLAIMER: I am noob at electronics, this is crazy or at best a fishing expedition... Let $f$ be some hash function, say md5. Restrict the size of input to be equal to the output (128 bits for md5). Cryptographer told be it is open problem if there is solution to $f(x)=x$ (treated as sequence of bits). Implement $f$ as pure combinatorial circuit (NO CLOCK), with 128 $i_k$ inputs and 128 outputs $o_k$. For all $j$, connect $i_j$ with $o_j$ so the circuit doesn't have neither inputs nor inputs (basically loop the circuit $f$). Power on. Measure (possibly with oscilloscope) $i_j=o_j$. If you are lucky to hit stable state, you have solved $f(x)=x$. In an unstable stable (no solution), maybe one will measure very high frequency. Probably this is well studied, though an engineer couldn't find reference for the general case. 1. Are there references for this? 2. If it fails why will it fail? 3. If a solution exists is it known for how long it will be found? 4. If the question is not entirely insane, is there better forum? --- Partial experimental results: It wasn't easy, but me convinced an engineer to test it on bare metal. Take $n$ inverters (logical negation) and loop them in a cycle (basically this corresponds to the cycle graph $C_n$). There are no input and no outputs. For even $n$ the circuit has exactly 2 stable states. For odd $n$, there is no stable state since the boolean formula is unsatisfiable. The engineer worked with NAND gates on a stand. Experimentally, for $n=4$, the engineer reached stable state. Depending on which NAND gates he chose, the stable state differed. For $n=3$ there was no stable state. The voltage was in the middle between logical 0-1, possibly with high frequency which his oscilloscope couldn't measure. The engineer told me these circuits don't make sense in electronics. (So what?). I wouldn't trust a software simulation for this, might be wrong. The experiments were too simple, so it is possible electric current to solve easy problems and not solve hard problems.

2 2

Radical-safest TLDs in 2007
by Douglas Lucas 02 Oct '14

02 Oct '14

I have a historical question. In 2007, anywhere from January to September, what TLDs were regarded as the most pirate-friendly or journalism-friendly or safest from takedowns of whatever stripe, e.g. the sort of DHS DMCA takedowns we have now, etc.?

6 7

The NSA and Me - by James Bamford
by coderman 02 Oct '14

02 Oct '14

"More than three decades later, the NSA, like a mom-and-pop operation that has exploded into a global industry, now employs sweeping powers of surveillance that Frank Church could scarcely have imagined in the days of wired phones and clunky typewriters. At the same time, the Senate intelligence committee he once chaired has done an about face, protecting the agencies from the public rather than the public from the agencies..." --- The NSA and Me - by James Bamford https://firstlook.org/theintercept/2014/10/02/the-nsa-and-me/ The tone of the answering machine message was routine, like a reminder for a dental appointment. But there was also an undercurrent of urgency. “Please call me back,” the voice said. “It’s important.” What worried me was who was calling: a senior attorney with the Justice Department’s secretive Office of Intelligence Policy and Review. By the time I hung up the payphone at a little coffee shop in Cambridge, Mass., and wandered back to my table, strewn with yellow legal pads and dog-eared documents, I had guessed what he was after: my copy of the Justice Department’s top-secret criminal file on the National Security Agency. Only two copies of the original were ever made. Now I had to find a way to get it out of the country—fast. It was July 8, 1981, a broiling Wednesday in Harvard Square, and I was in a quiet corner of the Algiers Coffee House on Brattle Street. A cool, souk-like basement room, with the piney aroma of frankincense, it made for a perfect hideout to sort through documents, jot down notes, and pore over stacks of newspapers while sipping bottomless cups of Arabic coffee and espresso the color of dark chocolate. For several years I had been working on my first book, The Puzzle Palace, which provided the first in-depth look at the National Security Agency. The deeper I dug, the more troubled I became. Not only did the classified file from the Justice Department accuse the NSA of systematically breaking the law by eavesdropping on American citizens, it concluded that it was impossible to prosecute those running the agency because of the enormous secrecy that enveloped it. Worse, the file made clear that the NSA itself was effectively beyond the law—allowed to bypass statutes passed by Congress and follow its own super-classified charter, what the agency called a “top-secret birth certificate” drawn up by the White House decades earlier. Knowing the potential for such an unregulated agency to go rogue, I went on to write two more books about the NSA, Body of Secrets, in 2001, and The Shadow Factory, in 2008. My goal was to draw attention to the dangers the agency posed if it is not closely watched and controlled—dangers that would be laid bare in stark detail by Edward Snowden years later. “You Want to Hear Something Interesting?” The idea of writing a book about the NSA had occurred to me several years earlier. During the war in Vietnam, I spent three years in the Navy at Pacific Fleet Headquarters in Hawaii. It was a nice venue a long way from the bloody battlefields, where the only dangers were rogue surfboards on Waikiki Beach and bar fights on Hotel Street. Assigned to an NSA unit, I experienced the war vicariously: One of my jobs every morning was reading a foot-high stack of overnight messages from the war zone, mostly NSA reports classified top secret and higher, and passing them on to whichever project officer had responsibility to simply read or take action. Later, in law school and running low on cash, I decided to rejoin the Naval Reserve to help pay for living expenses. The Navy was very accommodating, allowing me to pick not only when I wanted to do my two weeks of active duty, but also where. So I decided to request two weeks in October 1974, which coincided with a school break. And for location I chose Puerto Rico—a nice warm island far from chilly Boston. Although I had NSA clearances, I had never worked at an actual NSA intercept site. Nevertheless, the Navy decided to send me down to Sabana Seca, one of the agency’s key listening posts, which focused on Cuba, the Caribbean, and Central and South America. Like most listening posts at the time, Sabana Seca consisted of a gigantic circular antenna about half a mile wide and a hundred or so feet high, an odd structure that closely resembled its nickname—the “elephant cage.” Known as a Wullenweber antenna, it was used not only to intercept communications, but also to assist in triangulating where the transmissions were coming from. At the center of the elephant cage was the operations building, a windowless, two-story, gray cement Rubik’s cube. Inside were tall racks of receivers with blinking lights, big black dials, oval-shaped gauges, and silver toggle switches facing rows of earphone-clad men and women in blue Navy-issue dungarees. Unfamiliar with the technology and unable to speak more than rudimentary Spanish, I spent my two weeks pushing a few papers and staying out of the way, hoping to avoid work as much as possible. But one day an intercept operator with whom I had downed a few beers at the base club the night before spotted me and waved me over. “You want to hear something interesting?” he said as he took off his earphones. I thanked him but explained I didn’t speak Spanish. “No, no,” he said, “It’s English.” So I put on the earphones and listened in to what appeared to be several Americans carrying on a conversation. I only heard a few snippets, not enough to get a sense of the topic, but I was surprised. “Interesting,” I said. “You get many Americans speaking?” He said they did on certain channels they were assigned to target. I thanked him, said something about getting another beer later that night, and wandered off to watch some other intercept operators pulling in long reams of blue teletype paper covered in Spanish. It was only when I was back in Boston, where I had a part-time job as a student prosecutor with the Suffolk County district attorney’s office, that the conversation came back to me. I was working on a case in which the topic of a wiretap came up, and there was a long discussion about procedures for a warrant. I suddenly wondered what legal authority the intercept operators at Sabana Seca had to target American conversations. I did a little research in the law library, but could find nothing that gave the military any powers for warrantless eavesdropping on Americans. A few weeks later, just before Christmas, The New York Times broke a series of stories by Seymour Hersh outlining Operation Chaos, the program by which the FBI, CIA, and other intelligence agencies targeted U.S. citizens involved in anti-war protests. The articles caused widespread public outrage, followed by a high-profile congressional investigation led by Senator Frank Church. I felt certain that whatever it was I saw—and heard—in Sabana Seca would soon be discovered. But during the summer of 1975, as reports began leaking out from the Church Committee, I was surprised to learn that the NSA was claiming that it had shut down all of its questionable operations a year and a half earlier. Surprised because I knew the eavesdropping on Americans had continued at least into the prior fall, and may have still been going on. After thinking for a day or so about the potential consequences of blowing the whistle on the NSA—I was still in the Naval Reserve, still attending drills one weekend a month, and still sworn to secrecy with an active NSA clearance—I nevertheless decided to call the Church Committee. It was July 1, and at first the staffer with whom I spoke sounded skeptical—someone calling out of the blue and accusing the NSA of lying. But after I mentioned my work at Sabana Seca, he asked how soon I could come down to Washington to testify. At 8:40 the next morning, I boarded American Airlines Flight 605 and took seat 13A—an unlucky number, I thought. It would be the first of numerous trips. The committee agreed to keep my name confidential and allowed me to testify in executive session in Sen. Church’s private office. Soon after, committee staffers flew down to Sabana Seca for a surprise inspection. Surprise, indeed. They were shocked to discover the program had never been shut down, despite the NSA’s claims. “Just Because the Information Has Been Published Doesn’t Mean it Should No Longer Be Classified” The discovery that the NSA had been lying to the Church Committee shocked me. But it also gave me the idea to write the first book about the agency. As more and more revelations came out about the NSA’s widespread, illegal eavesdropping activities, I found myself filled with questions. Where did the agency come from? What did it do? How did it operate? Who was watching it? In the summer of 1979, after a year of research, I submitted a proposal to Houghton Mifflin for The Puzzle Palace, and within a few months was awarded a book contract. It was the start of wild ride, taking on an agency so secret that even New Jersey Sen. Bill Bradley told me, at the time, that he had never heard of it. I soon learned that there was one major advantage to being first: The NSA had grown so confident that no one would ever dare to write about it that it had let its guard down. I would occasionally drive up to the agency, park in the executive parking lot, walk in the front door to the lobby, get some coffee and have a seat. All around me were employees from the CIA and foreign intelligence agencies, all waiting to be processed for their NSA visitor’s badge. As I read my paper and sipped my coffee, I quietly listened to them chat away about signals intelligence operations, new listening posts, cooperative agreements, and a host of other topics. No one ever asked who I was or why I was there. In the parking lot, I copied the license plate numbers of the dozen cars parked closest to the front entrance, then ran the numbers at the registry of motor vehicles. The result was a Who’s Who of the NSA’s leadership, as well as the liaison officers from America’s so-called Five Eyes surveillance partners: England, Canada, Australia, and New Zealand. By the summer of 1981, I had also won several significant legal battles with the agency. As a result of an out-of-court settlement, the NSA was forced to give me a tour of the agency, detail the entire structure of its internal organization to me, and provide me interviews with senior officials. Even though the agency was virtually immune from the Freedom of Information Act, I managed to find a loophole that allowed me access to more than 6,000 pages of internal documents. I even worked out an agreement whereby they would provide me with an office in the agency for a week to go through the 6,000 pages. But then the NSA got its revenge—when they handed me the 6,000 pages, they were all out of order, as if they had been shuffled like a new deck of cards. Nothing in the Freedom of Information Act, it turns out, requires collation. The hostility became so intense that the director, Adm. Bobby Ray Inman, accused me of using a “hostage approach” in my battle to force the agency to give me documents and interviews. But the NSA knew nothing about one of my biggest finds, which took place on the campus of the Virginia Military Institute. Nicknamed “the West Point of the South,” VMI housed the papers of William F. Friedman, a founder of both the NSA and of American cryptology. The NSA’s own auditorium is named after him. Yet Friedman had soured on the agency by the time he retired, and deliberately left his papers to a research library at VMI to get them as far away from the NSA as possible. After Friedman’s death, and without his permission, agency officials traveled to the library, pulled out hundreds of his personal letters, and ordered them locked away in a secure vault. When I discovered what the NSA had done, I persuaded the library’s archivist to give me access to the letters, all of which were unclassified. Many were embarrassingly critical of the agency, describing its enormous paranoia and obsession with secrecy. Others contained clues to a secret trips that Friedman had made to Switzerland, where he helped the agency gain backdoor access into encryption systems that a Swiss company was selling to foreign countries. I also discovered that a former NSA director, Lt. Gen. Marshall Carter, had left his papers – including reams of unclassified documents from his NSA office – to the same research library at VMI. They included personal, handwritten correspondence from Carter’s British counterpart about listening posts, cooperative agreements, and other sensitive topics. Later, Carter gave me a long and detailed interview about the NSA. The agency knew nothing about either the documents or the interview. Following the publication of my book, the NSA raided the research library, stamped many of the Friedman documents secret, and ordered them put back into the vault. “Just because information has been published,” NSA director Lincoln Faurer explained to The New York Times, “doesn’t mean it should no longer be classified.” Faurer also flew to Colorado, where Gen. Carter was living in retirement, met with him at the NSA listening post at Buckley Air Force Base, and threatened him with prosecution if he ever gave another interview or allowed anyone else access to his papers. “Prima Facie Questions of Criminality” But my biggest battle with the NSA came before my book was even published. Without the agency’s knowledge, I had obtained the criminal file that the Justice Department had opened on the NSA. Marked as Top Secret, the file was so sensitive that only two original copies existed. Never before or since has an entire agency been the subject of a criminal investigation. Senior officials at the NSA were even read their Miranda rights. The secret investigation grew out of the final report by the Rockefeller Commission, a panel that had been set up by President Gerald Ford to parallel the Church Committee. Issued on June 6, 1975, the report noted that both the NSA and CIA had engaged in questionable and possibly illegal electronic surveillance. As a result, Attorney General Edward Levi established a secret internal task force to look into the potential for criminal prosecution. Focusing particularly on NSA, the task force probed more deeply into domestic eavesdropping than any part of the executive branch had ever done before. I had heard rumors from several sources about such a probe, so I thought it would be worth requesting a copy of the file under FOIA. Nevertheless, I was surprised when the documents, with relatively few redactions, turned up at my door 10 months later. They included a lengthy, detailed “Report on Inquiry into CIA-Related Surveillance Activities” that laid out the investigation in stark detail, as well as a shorter draft “prosecutive summary” evaluating the potential for criminal prosecution. I was shocked that the Justice Department had released them to me without notifying the NSA. An official at Justice later told me that it was standard procedure not to notify the object of a criminal investigation (think John Gotti) once it is completed and requested under FOIA. It turned out that just as with its investigations into organized crime, the Justice Department had received little cooperation from the potential criminal defendant – in this case, the NSA. Noting that the attitude of agency officials “ranged from circumspection to wariness,” the file made clear that the NSA had stonewalled investigators at every step. “One typically had to ask the right question to elicit the right answer or document,” an attorney for the Justice Department reported. “It is likely, therefore, that we had insufficient information on occasion to frame the ‘magic’ question.” But the agency’s obstructionism didn’t prevent the Justice Department from finding evidence of serious wrongdoing. The draft prosecutive summary of the Justice Department’s investigative task force, dated March 4, 1977, and classified top secret detailed 23 categories of questionable eavesdropping operations. Five of the illegal activities were immune from prosecution because the statute of limitations had passed, and seven were found to “clearly possess no prosecutive potential.” The rest, however, were fair game for criminal prosecution. Discussing the agency’s Operation Minaret, for example, the full report concluded: “This electronic surveillance activity presents prima facie questions of criminality and is well within the limitations period.” The prosecutive summary had been sent to Attorney General Benjamin Civiletti for further action. But any attempt to prosecute top officials of America’s most secret agency, the file warned, would almost certainly be met by finger-pointing and scapegoating. “There is likely to be much ‘buck-passing’ from subordinate to superior, agency to agency, agency to board or committee, board or committee to the President, and from the living to the dead,” the report cautioned. In addition, calling the crimes “an international cause célèbre involving fundamental constitutional rights of United States citizens,” the task force pointed to the likelihood that the NSA would put political pressure on anyone who dared to testify against it. What’s more, the report added, defense attorneys for senior NSA officials would likely subpoena “every tenuously involved government official and former official” to establish that the illegal operations had been authorized from on high. “While the high office of prospective defense witnesses should not enter into the prosecutive decision,” the report noted, “the confusion, obfuscation, and surprise testimony which might result cannot be ignored.” The report’s prosecutive summary also pointed to the NSA’s top-secret “charter” issued by the Executive Branch, which exempts the agency from legal restraints placed on the rest of the government. “Orders, directives, policies, or recommendations of any authority of the Executive branch relating to the collection . . . of intelligence,” the charter reads, “shall not be applicable to Communications Intelligence activities, unless specifically so stated.” This so-called “birth certificate,” the Justice Department report concluded, meant the NSA did not have to follow any restrictions placed on electronic surveillance “unless it was expressly directed to do so.” In short, the report asked, how can you prosecute an agency that is above the law? If the first shock to top officials at the NSA was the discovery that they were being investigated as potential criminals, the second shock was that I had a copy of the top secret file on the investigation. When the NSA discovered that the file was in my possession, director Bobby Inman wrote to the attorney general informing him that the documents contained classified information and should never have been handed over to me. But Civiletti, apparently believing that the file had been properly reviewed and declassified, ignored Inman’s protest. Then, on January 20, 1981, Ronald Reagan was sworn into office. At the Justice Department, Civiletti was replaced by a new attorney general with a much more accommodating attitude when it came to the NSA: William French Smith. A few months later, while I was working on a chapter of my book that dealt with the Five Eyes partnership, I sent a letter to George Gapp, the senior liaison officer from GCHQ, the NSA’s British counterpart. In the letter, I noted that documents released to me by the Justice Department implicated his agency in Operation Minaret, the illegal NSA program directed against American citizens. I asked whether he knew of GCHQ’s involvement in the operation and whether the agency was currently engaged in any similar activities in the United States. The letter apparently set off a firestorm, both at the NSA and GCHQ. Lt. Gen. Faurer, who had replaced Inman as director, sent a letter to the new attorney general again pointing out that the documents in my possession contained top-secret material. Considering that they accused his agency of being a criminal enterprise, they were also embarrassing to the NSA, and potentially explosive. The decision was made to try to get them back from me before the publication of my book. Thus the answering machine message I heard on that steamy day in Cambridge, while I was quietly working away at a back table in the Algiers Coffee House. The call was from Gerald Schroeder, a senior attorney with the Justice Department. When I called him back, he asked whether we could meet in Washington to discuss the file that had been released to me by his own department. The Reagan Justice Department, it seemed, now wanted to reverse the decision of the Carter Justice Department and get the documents back. Long before the arrival of the internet, and the ability to transfer documents at the tap of a finger, I was very concerned about what the agency might do to retrieve the physical copy of the file in my possession. Years before, when David Kahn had written his monumental history of cryptology, the agency had considered placing him under surveillance and conducting a “surreptitious entry” into his Long Island home to steal the manuscript prior to publication. Decades earlier, after Herbert Yardley wrote about the Black Chamber, the predecessor to NSA, the Justice Department actually did steal the manuscript for his second book, preventing it from ever being published. My first thought was to quickly make a duplicate of the file and get the copy out of the country. That would protect the documents not only from theft, but also from any court order prohibiting me from revealing their contents. With a copy beyond the jurisdiction of U.S. courts, a foreign newspaper could always publish the documents. I called a close friend who worked for the Insight Team, the investigative unit of London’s Sunday Times. She agreed to help. It turned out that an American journalist she knew was flying from Boston to London that night, and she quickly arranged for him to take the documents with him and give them to her to hide. That night I met the journalist on a dark Boston street corner and passed him a package, with the understanding that I was not to tell him was it contained. He wanted as little information as possible, in case he was questioned later. Early the next morning, my friend at the Sunday Times called from London with a code indicating that all was well and that the documents were in a secure place. With the documents safely beyond the reach of the Justice Department, I next turned to my next problem – finding an attorney to represent me. With the advance on my book totaling $7,500, spread over three years, I was in no position to seek out a white-shoe law firm on Beacon Hill. Instead, I called the ACLU’s Center for National Security Studies and explained my problem. They immediately put me in touch with Mark Lynch, a staff attorney at the center who had considerable experience going up against intelligence agencies, including the NSA. Lynch agreed to represent me. On July 23, two weeks after I had received the phone call at the coffee shop, Lynch and I met with Schroeder for an hour and a half in the conference room of the center, a cluster of rooms in the stately Stewart Mott house on Capitol Hill. Schroeder began by insisting that the two documents had been released to me “by mistake.” The NSA and the CIA had determined that they contained information that was still classified, he said, and the Justice Department would like me to return them. I politely informed Schroeder that the documents had been in my possession for more than two years, that material from them was already incorporated into my manuscript, and that the Carter administration had spent 10 months reviewing them before releasing the documents to me. There had been no mistake. In addition, because the documents raised questions about criminal activities by the NSA and CIA, I felt it was important for the public to be informed. In the end, we agreed to another meeting – but this time I insisted that since I had traveled to Washington for the first meeting, they would come to Boston for the next one. The second meeting took place on August 14, in the editorial conference room of my publisher, Houghton Mifflin, on Beacon Hill. This time, the government dispensed with any attempt at politeness. Accompanying Schroeder were the NSA’s general counsel, Daniel Schwartz, and the agency’s director of policy, Eugene Yeates. They immediately began by interrogating me. How many copies of the document I had made? Whom I had given them to? Where were the documents now located? I responded that none of those questions were on the agenda; since my attorney could not be present, we had agreed in advance that the meeting was simply to allow them to explain the government’s position. Any questions, I said, would have to go through Mark Lynch. I pointed to the phone. After placing a call to Lynch, Schroeder brought up the possibility of using the espionage statue to force me to return the documents. Lynch immediately asked to speak with me privately. Once the three officials left the room, Lynch expressed worry over the way the meeting was going. The officials could have a subpoena or a restraining order or a warrant for my arrest in their pocket, he said. He advised me to put down the receiver, call Schroeder to the phone, leave the room – and keep walking. To this day, I still have no idea how long the three officials waited for me to return before finding their way out of the publishing house and back to Washington. The fight quickly escalated. On September 24, after we informed Schroeder that I was going to use the documents in my book and that all further discussions would be pointless, I received a registered letter. “You are currently in possession of classified information that requires protection against unauthorized disclosure,” Schroeder wrote. “Under the circumstances, I have no choice but to demand that you return the two documents . . . Of course, you will have a continuing obligation not to publish or communicate the information.” To emphasize the point, on November 27 the Justice Department sent my attorney a letter stating that “there should be no misunderstanding of the Government’s position that Mr. Bamford holds information that is currently and properly classified” and that failure to return the documents could force federal prosecutors to resort to an unnamed “post-publication judicial remedy.” Despite the threats, I refused to alter my manuscript or return the documents. Instead, we argued that according to Executive Order 12065, “classification may not be restored to documents already declassified and released to the public” under the Freedom of Information Act. That prompted the drama to move all the way up to the White House. On April 2, 1982, President Reagan signed a new executive order on secrecy that overturned the earlier one and granted him the authority to “reclassify information previously declassified and disclosed.” We responded by citing the legal principal of ex post facto, arguing that even if the new executive order was legal, Reagan could not retroactively enforce it against me. The Puzzle Palace was published on schedule, in September 1982, with no deletions or alterations to the text. And ever since then, the NSA’s criminal file – still officially top secret, according to the NSA – has remained on my bookshelf. Wrongdoing Masquerading as Patriotism More than three decades later, the NSA, like a mom-and-pop operation that has exploded into a global industry, now employs sweeping powers of surveillance that Frank Church could scarcely have imagined in the days of wired phones and clunky typewriters. At the same time, the Senate intelligence committee he once chaired has done an about face, protecting the agencies from the public rather than the public from the agencies. It is a dangerous combination – one the Church Committee warned of long ago. “The potential for abuse is awesome,” the committee observed, especially when “checks and balances designed … to assure accountability have not been applied.” As the committee presciently noted in its report, “Intelligence collection programs naturally generate ever-increasing demands for new data.” For proof, one need only look at the NSA’s ever-expanding array of surveillance techniques. The agency’s metadata collection program now targets everyone in the country old enough to hold a phone. The gargantuan data storage facility it has built in Utah may eventually hold zettabytes (1,000,000,000,000,000,000,000 bytes) of information. And the massive supercomputer that the NSA is secretly building in Oak Ridge, Tennessee, will search through it all at exaflop (1,000,000,000,000,000,000 operations per second) speeds. Without adequate oversight, or penalties for abuse, the only protection that citizens have comes not from Congress or the courts, but from whistleblowers. As one myself, albeit in the most minor capacity, I understand what motivates someone to expose wrongdoing masquerading as patriotism. There is no graduate school for whistleblowing and no handbook for whistleblowers. It’s an imperfect science, and whistleblowers learn from the mistakes of their predecessors. Edward Snowden, Chelsea Manning, Tom Drake, Bill Binney and Kirk Wiebe all came from different backgrounds and worked in different fields. None joined the intelligence community to become a whistleblower, but each was driven by unchecked government abuse to tell the public what they knew to be true. The solution is not to jail the whistleblowers, or to question the patriotism of those who tell their stories, but to do what Attorney General Edward Levi courageously attempted to do more than a third of a century ago – to have the criminal division of the Justice Department conduct a thorough investigation, and then to prosecute any member of the intelligence community who has broken the law, whether by illegally spying on Americans or by lying to Congress. I would be happy to lend my copy of the NSA’s criminal file to Attorney General Eric Holder, if he would like to see how to begin. Or he can read it here.

1 0

Fwd: [tor-talk] Tor in the media - request for unsung positive narratives
by coderman 02 Oct '14

02 Oct '14

---------- Forwarded message ---------- From: Patrick <apexcp(a)gmail.com> Subject: [tor-talk] Tor in the media Hi everyone, Over the past few weeks, I've talked with a number of Tor people about how the project is portrayed in the media. As a reporter on this beat, the many legitimate criticisms the community have had strike pretty close to home for me. I don't think I need to tell this list why Tor's portrayal in the media is important, now more than ever. So, with the blessing and encouragement of a couple of official Tor people, I've got a question to ask of tor-talk (secure contact info follows at the bottom of the message): -- What untold but important stories about Tor are you willing to share? When writing about Tor, it's relatively easy to write about, for instance, popular hidden services (and I've admittedly done it plenty). The drug markets that advertise themselves and run a business are often more than willing to talk to reporters. They're even proactive about it. It's much tougher for a reporter to nail down important Tor stories about, as another example, domestic abuse victims using the software or political activists protecting their lives with it. That makes perfect sense, those people rely on anonymity in a much different way than enterprising drug dealers, but this reality makes it trickier for reporters to tell the full story when it comes to Tor. The trick, then, is to be proactive as well. I recently took a swing at writing precisely the kind of article I'm talking about--an untold but important story about how Tor is used in the wild--here: http://kernelmag.dailydot.com/issue-sections/features-issue-sections/10393/… ... I was inspired in large part by articles like this: http://betaboston.com/news/2014/05/07/as-domestic-abuse-goes-digital-shelte…. The BetaBoston article is very good, obviously, but it's a too-rare breed. I'd like to hear from anyone who might be willing to talk about (on the record or off) untold but important Tor stories that can shed light on the way the software serves its users. By design, I'll never get the full picture, but we can surely do more than surface scratching. If you have a story to tell, if you know someone who might, if you can think of others who I should be talking to, or if you have a good direction to point me in, I would love to hear from you. Or if you just want to talk more about Tor in the media, that's a topic I'm really interested in as well to be honest, so I'm happy to talk about that. If you're interested in talking (again, on the record or off, it's still valuable to hear stories I won't write about), you can find my contact info and PGP key at http://www.patrickhowelloneill.com/contact , you can email me here (my personal email), or at pat(a)dailydot.com. Obviously we can also work out other ways of communicating if need be. Thanks!

2 1

Fwd: [Cryptography] "Spy Agencies Urge Caution on Phone Deal"
by grarpamp 02 Oct '14

02 Oct '14

Number portability and more... trivially redirected to anywhere for MITM... courtesy Neustar. http://en.wikipedia.org/wiki/PSTN_network_topology http://en.wikipedia.org/wiki/Routing_in_the_PSTN http://en.wikipedia.org/wiki/Intelligent_Network http://en.wikipedia.org/wiki/Local_number_portability http://en.wikipedia.org/wiki/RespOrg http://en.wikipedia.org/wiki/Toll-free_number_portability http://en.wikipedia.org/wiki/North_American_Numbering_Plan http://en.wikipedia.org/wiki/Neustar http://www.npac.com/ http://leap.neustar.biz/ ---------- Forwarded message ---------- From: Jerry Leichter <leichter(a)lrw.com> Date: Mon, Sep 29, 2014 at 11:51 PM Subject: [Cryptography] "Spy Agencies Urge Caution on Phone Deal" To: Cryptography <cryptography(a)metzdowd.com> Not directly crypto-related, but an example of the tangle of relationships that drive surveillance: http://www.nytimes.com/2014/09/29/us/spy-agencies-urge-caution-on-phone-dea… reports on a backstage argument going on in Washington about a special network/database - oddly never named in the article - that "rout[es] millions of phone calls and text messages in the United States". Apparently this was a system created back in the late 1990's to implement number portability. It's not clear from the article whether it's a database of number-to-carrier mappings, or actually routes call based on such a database. A small Virginia company named Neustar created the system and has managed it ever since. Recently, the major carriers recommended to the FCC that Neustar be replaced by Telcordia, an American subsidiary of Ericsson, which allegedly can do the job more cheaply. The "intelligence community" has been pushed to leave the job in Neustar's hands, claiming that letting a European company run the system would leak important information about how US surveillance of the phone networks is implemented. Neustar, obviously no stranger to the Washington inside game, has hired good ol' Michael Chertoff to represent them. The bullshit and inside baseball and lobbying here runs so deep you can't see bottom. And underneath it all, another piece of the vast tapping network we've built in the US in the last 12 or so years is revealed, just a little bit. -- Jerry

1 1