- cypherpunks - lists.cpunks.org

How Laura Poitras Helped Snowden Spill His Secrets
by Eugen Leitl 27 Aug '13

27 Aug '13

(possible dupe) http://www.nytimes.com/2013/08/18/magazine/laura-poitras-snowden.html?ref=t… How Laura Poitras Helped Snowden Spill His Secrets By PETER MAASS This past January, Laura Poitras received a curious e-mail from an anonymous stranger requesting her public encryption key. For almost two years, Poitras had been working on a documentary about surveillance, and she occasionally received queries from strangers. She replied to this one and sent her public key — allowing him or her to send an encrypted e-mail that only Poitras could open, with her private key — but she didn’t think much would come of it. The stranger responded with instructions for creating an even more secure system to protect their exchanges. Promising sensitive information, the stranger told Poitras to select long pass phrases that could withstand a brute-force attack by networked computers. “Assume that your adversary is capable of a trillion guesses per second,” the stranger wrote. Before long, Poitras received an encrypted message that outlined a number of secret surveillance programs run by the government. She had heard of one of them but not the others. After describing each program, the stranger wrote some version of the phrase, “This I can prove.” Seconds after she decrypted and read the e-mail, Poitras disconnected from the Internet and removed the message from her computer. “I thought, O.K., if this is true, my life just changed,” she told me last month. “It was staggering, what he claimed to know and be able to provide. I just knew that I had to change everything.” Poitras remained wary of whoever it was she was communicating with. She worried especially that a government agent might be trying to trick her into disclosing information about the people she interviewed for her documentary, including Julian Assange, the editor of WikiLeaks. “I called him out,” Poitras recalled. “I said either you have this information and you are taking huge risks or you are trying to entrap me and the people I know, or you’re crazy.” The answers were reassuring but not definitive. Poitras did not know the stranger’s name, sex, age or employer (C.I.A.? N.S.A.? Pentagon?). In early June, she finally got the answers. Along with her reporting partner, Glenn Greenwald, a former lawyer and a columnist for The Guardian, Poitras flew to Hong Kong and met the N.S.A. contractor Edward J. Snowden, who gave them thousands of classified documents, setting off a major controversy over the extent and legality of government surveillance. Poitras was right that, among other things, her life would never be the same. Greenwald lives and works in a house surrounded by tropical foliage in a remote area of Rio de Janeiro. He shares the home with his Brazilian partner and their 10 dogs and one cat, and the place has the feel of a low-key fraternity that has been dropped down in the jungle. The kitchen clock is off by hours, but no one notices; dishes tend to pile up in the sink; the living room contains a table and a couch and a large TV, an Xbox console and a box of poker chips and not much else. The refrigerator is not always filled with fresh vegetables. A family of monkeys occasionally raids the banana trees in the backyard and engages in shrieking battles with the dogs. Greenwald does most of his work on a shaded porch, usually dressed in a T-shirt, surfer shorts and flip-flops. Over the four days I spent there, he was in perpetual motion, speaking on the phone in Portuguese and English, rushing out the door to be interviewed in the city below, answering calls and e-mails from people seeking information about Snowden, tweeting to his 225,000 followers (and conducting intense arguments with a number of them), then sitting down to write more N.S.A. articles for The Guardian, all while pleading with his dogs to stay quiet. During one especially fever-pitched moment, he hollered, “Shut up, everyone,” but they didn’t seem to care. Amid the chaos, Poitras, an intense-looking woman of 49, sat in a spare bedroom or at the table in the living room, working in concentrated silence in front of her multiple computers. Once in a while she would walk over to the porch to talk with Greenwald about the article he was working on, or he would sometimes stop what he was doing to look at the latest version of a new video she was editing about Snowden. They would talk intensely — Greenwald far louder and more rapid-fire than Poitras — and occasionally break out laughing at some shared joke or absurd memory. The Snowden story, they both said, was a battle they were waging together, a fight against powers of surveillance that they both believe are a threat to fundamental American liberties. Two reporters for The Guardian were in town to assist Greenwald, so some of our time was spent in the hotel where they were staying along Copacabana Beach, the toned Brazilians playing volleyball in the sand below lending the whole thing an added layer of surreality. Poitras has shared the byline on some of Greenwald’s articles, but for the most part she has preferred to stay in the background, letting him do the writing and talking. As a result, Greenwald is the one hailed as either a fearless defender of individual rights or a nefarious traitor, depending on your perspective. “I keep calling her the Keyser Soze of the story, because she’s at once completely invisible and yet ubiquitous,” Greenwald said, referring to the character in “The Usual Suspects” played by Kevin Spacey, a mastermind masquerading as a nobody. “She’s been at the center of all of this, and yet no one knows anything about her.” As dusk fell one evening, I followed Poitras and Greenwald to the newsroom of O Globo, one of the largest newspapers in Brazil. Greenwald had just published an article there detailing how the N.S.A. was spying on Brazilian phone calls and e-mails. The article caused a huge scandal in Brazil, as similar articles have done in other countries around the world, and Greenwald was a celebrity in the newsroom. The editor in chief pumped his hand and asked him to write a regular column; reporters took souvenir pictures with their cellphones. Poitras filmed some of this, then put her camera down and looked on. I noted that nobody was paying attention to her, that all eyes were on Greenwald, and she smiled. “That’s right,” she said. “That’s perfect.” Poitras seems to work at blending in, a function more of strategy than of shyness. She can actually be remarkably forceful when it comes to managing information. During a conversation in which I began to ask her a few questions about her personal life, she remarked, “This is like visiting the dentist.” The thumbnail portrait is this: She was raised in a well-off family outside Boston, and after high school, she moved to San Francisco to work as a chef in upscale restaurants. She also took classes at the San Francisco Art Institute, where she studied under the experimental filmmaker Ernie Gehr. In 1992, she moved to New York and began to make her way in the film world, while also enrolling in graduate classes in social and political theory at the New School. Since then she has made five films, most recently “The Oath,” about the Guantánamo prisoner Salim Hamdan and his brother-in-law back in Yemen, and has been the recipient of a Peabody Award and a MacArthur award. On Sept. 11, 2001, Poitras was on the Upper West Side of Manhattan when the towers were attacked. Like most New Yorkers, in the weeks that followed she was swept up in both mourning and a feeling of unity. It was a moment, she said, when “people could have done anything, in a positive sense.” When that moment led to the pre-emptive invasion of Iraq, she felt that her country had lost its way. “We always wonder how countries can veer off course,” she said. “How do people let it happen, how do people sit by during this slipping of boundaries?” Poitras had no experience in conflict zones, but in June 2004, she went to Iraq and began documenting the occupation. Shortly after arriving in Baghdad, she received permission to go to Abu Ghraib prison to film a visit by members of Baghdad’s City Council. This was just a few months after photos were published of American soldiers abusing prisoners there. A prominent Sunni doctor was part of the visiting delegation, and Poitras shot a remarkable scene of his interaction with prisoners there, shouting that they were locked up for no good reason. The doctor, Riyadh al-Adhadh, invited Poitras to his clinic and later allowed her to report on his life in Baghdad. Her documentary, “My Country, My Country,” is centered on his family’s travails — the shootings and blackouts in their neighborhood, the kidnapping of a nephew. The film premiered in early 2006 and received widespread acclaim, including an Oscar nomination for best documentary. Attempting to tell the story of the war’s effect on Iraqi citizens made Poitras the target of serious — and apparently false — accusations. On Nov. 19, 2004, Iraqi troops, supported by American forces, raided a mosque in the doctor’s neighborhood of Adhamiya, killing several people inside. The next day, the neighborhood erupted in violence. Poitras was with the doctor’s family, and occasionally they would go to the roof of the home to get a sense of what was going on. On one of those rooftop visits, she was seen by soldiers from an Oregon National Guard battalion. Shortly after, a group of insurgents launched an attack that killed one of the Americans. Some soldiers speculated that Poitras was on the roof because she had advance notice of the attack and wanted to film it. Their battalion commander, Lt. Col. Daniel Hendrickson, retired, told me last month that he filed a report about her to brigade headquarters. There is no evidence to support this claim. Fighting occurred throughout the neighborhood that day, so it would have been difficult for any journalist to not be near the site of an attack. The soldiers who made the allegation told me that they have no evidence to prove it. Hendrickson told me his brigade headquarters never got back to him. For several months after the attack in Adhamiya, Poitras continued to live in the Green Zone and work as an embedded journalist with the U.S. military. She has screened her film to a number of military audiences, including at the U.S. Army War College. An officer who interacted with Poitras in Baghdad, Maj. Tom Mowle, retired, said Poitras was always filming and it “completely makes sense” she would film on a violent day. “I think it’s a pretty ridiculous allegation,” he said. Although the allegations were without evidence, they may be related to Poitras’s many detentions and searches. Hendrickson and another soldier told me that in 2007 — months after she was first detained — investigators from the Department of Justice’s Joint Terrorism Task Force interviewed them, inquiring about Poitras’s activities in Baghdad that day. Poitras was never contacted by those or any other investigators, however. “Iraq forces and the U.S. military raided a mosque during Friday prayers and killed several people,” Poitras said. “Violence broke out the next day. I am a documentary filmmaker and was filming in the neighborhood. Any suggestion I knew about an attack is false. The U.S. government should investigate who ordered the raid, not journalists covering the war.” In June 2006, her tickets on domestic flights were marked “SSSS” — Secondary Security Screening Selection — which means the bearer faces extra scrutiny beyond the usual measures. She was detained for the first time at Newark International Airport before boarding a flight to Israel, where she was showing her film. On her return flight, she was held for two hours before being allowed to re-enter the country. The next month, she traveled to Bosnia to show the film at a festival there. When she flew out of Sarajevo and landed in Vienna, she was paged on the airport loudspeaker and told to go to a security desk; from there she was led to a van and driven to another part of the airport, then taken into a room where luggage was examined. “They took my bags and checked them,” Poitras said. “They asked me what I was doing, and I said I was showing a movie in Sarajevo about the Iraq war. And then I sort of befriended the security guy. I asked what was going on. He said: ‘You’re flagged. You have a threat score that is off the Richter scale. You are at 400 out of 400.’ I said, ‘Is this a scoring system that works throughout all of Europe, or is this an American scoring system?’ He said. ‘No, this is your government that has this and has told us to stop you.’ ” After 9/11, the U.S. government began compiling a terrorist watch list that was at one point estimated to contain nearly a million names. There are at least two subsidiary lists that relate to air travel. The no-fly list contains the names of tens of thousands of people who are not allowed to fly into or out of the country. The selectee list, which is larger than the no-fly list, subjects people to extra airport inspections and questioning. These lists have been criticized by civil rights groups for being too broad and arbitrary and for violating the rights of Americans who are on them. In Vienna, Poitras was eventually cleared to board her connecting flight to New York, but when she landed at J.F.K., she was met at the gate by two armed law-enforcement agents and taken to a room for questioning. It is a routine that has happened so many times since then — on more than 40 occasions — that she has lost precise count. Initially, she said, the authorities were interested in the paper she carried, copying her receipts and, once, her notebook. After she stopped carrying her notes, they focused on her electronics instead, telling her that if she didn’t answer their questions, they would confiscate her gear and get their answers that way. On one occasion, Poitras says, they did seize her computers and cellphones and kept them for weeks. She was also told that her refusal to answer questions was itself a suspicious act. Because the interrogations took place at international boarding crossings, where the government contends that ordinary constitutional rights do not apply, she was not permitted to have a lawyer present. “It’s a total violation,” Poitras said. “That’s how it feels. They are interested in information that pertains to the work I am doing that’s clearly private and privileged. It’s an intimidating situation when people with guns meet you when you get off an airplane.” Though she has written to members of Congress and has submitted Freedom of Information Act requests, Poitras has never received any explanation for why she was put on a watch list. “It’s infuriating that I have to speculate why,” she said. “When did that universe begin, that people are put on a list and are never told and are stopped for six years? I have no idea why they did it. It’s the complete suspension of due process.” She added: “I’ve been told nothing, I’ve been asked nothing, and I’ve done nothing. It’s like Kafka. Nobody ever tells you what the accusation is.” After being detained repeatedly, Poitras began taking steps to protect her data, asking a traveling companion to carry her laptop, leaving her notebooks overseas with friends or in safe deposit boxes. She would wipe her computers and cellphones clean so that there would be nothing for the authorities to see. Or she encrypted her data, so that law enforcement could not read any files they might get hold of. These security preparations could take a day or more before her travels. It wasn’t just border searches that she had to worry about. Poitras said she felt that if the government was suspicious enough to interrogate her at airports, it was also most likely surveilling her e-mail, phone calls and Web browsing. “I assume that there are National Security Letters on my e-mails,” she told me, referring to one of the secretive surveillance tools used by the Department of Justice. A National Security Letter requires its recipients — in most cases, Internet service providers and phone companies — to provide customer data without notifying the customers or any other parties. Poitras suspected (but could not confirm, because her phone company and I.S.P. would be prohibited from telling her) that the F.B.I. had issued National Security Letters for her electronic communications. Once she began working on her surveillance film in 2011, she raised her digital security to an even higher level. She cut down her use of a cellphone, which betrays not only who you are calling and when, but your location at any given point in time. She was careful about e-mailing sensitive documents or having sensitive conversations on the phone. She began using software that masked the Web sites she visited. After she was contacted by Snowden in 2013, she tightened her security yet another notch. In addition to encrypting any sensitive e-mails, she began using different computers for editing film, for communicating and for reading sensitive documents (the one for sensitive documents is air-gapped, meaning it has never been connected to the Internet). These precautions might seem paranoid — Poitras describes them as “pretty extreme” — but the people she has interviewed for her film were targets of the sort of surveillance and seizure that she fears. William Binney, a former top N.S.A. official who publicly accused the agency of illegal surveillance, was at home one morning in 2007 when F.B.I. agents burst in and aimed their weapons at his wife, his son and himself. Binney was, at the moment the agent entered his bathroom and pointed a gun at his head, naked in the shower. His computers, disks and personal records were confiscated and have not yet been returned. Binney has not been charged with any crime. Jacob Appelbaum, a privacy activist who was a volunteer with WikiLeaks, has also been filmed by Poitras. The government issued a secret order to Twitter for access to Appelbaum’s account data, which became public when Twitter fought the order. Though the company was forced to hand over the data, it was allowed to tell Appelbaum. Google and a small I.S.P. that Appelbaum used were also served with secret orders and fought to alert him. Like Binney, Appelbaum has not been charged with any crime. Poitras endured the airport searches for years with little public complaint, lest her protests generate more suspicion and hostility from the government, but last year she reached a breaking point. While being interrogated at Newark after a flight from Britain, she was told she could not take notes. On the advice of lawyers, Poitras always recorded the names of border agents and the questions they asked and the material they copied or seized. But at Newark, an agent threatened to handcuff her if she continued writing. She was told that she was being barred from writing anything down because she might use her pen as a weapon. “Then I asked for crayons,” Poitras recalled, “and he said no to crayons.” She was taken into another room and interrogated by three agents — one was behind her, another asked the questions, the third was a supervisor. “It went on for maybe an hour and a half,” she said. “I was taking notes of their questions, or trying to, and they yelled at me. I said, ‘Show me the law where it says I can’t take notes.’ We were in a sense debating what they were trying to forbid me from doing. They said, ‘We are the ones asking the questions.’ It was a pretty aggressive, antagonistic encounter.” Poitras met Greenwald in 2010, when she became interested in his work on WikiLeaks. In 2011, she went to Rio to film him for her documentary. He was aware of the searches and asked several times for permission to write about them. After Newark, she gave him a green light. “She said, ‘I’ve had it,’ ” Greenwald told me. “Her ability to take notes and document what was happening was her one sense of agency, to maintain some degree of control. Documenting is what she does. I think she was feeling that the one vestige of security and control in this situation had been taken away from her, without any explanation, just as an arbitrary exercise of power.” At the time, Greenwald was a writer for Salon. His article, “U.S. Filmmaker Repeatedly Detained at Border,” was published in April 2012. Shortly after it was posted, the detentions ceased. Six years of surveillance and harassment, Poitras hoped, might be coming to an end. Poitras was not Snowden’s first choice as the person to whom he wanted to leak thousands of N.S.A. documents. In fact, a month before contacting her, he reached out to Greenwald, who had written extensively and critically about the wars in Iraq and Afghanistan and the erosion of civil liberties in the wake of 9/11. Snowden anonymously sent him an e-mail saying he had documents he wanted to share, and followed that up with a step-by-step guide on how to encrypt communications, which Greenwald ignored. Snowden then sent a link to an encryption video, also to no avail. “It’s really annoying and complicated, the encryption software,” Greenwald said as we sat on his porch during a tropical drizzle. “He kept harassing me, but at some point he just got frustrated, so he went to Laura.” Snowden had read Greenwald’s article about Poitras’s troubles at U.S. airports and knew she was making a film about the government’s surveillance programs; he had also seen a short documentary about the N.S.A. that she made for The New York Times Op-Docs. He figured that she would understand the programs he wanted to leak about and would know how to communicate in a secure way. By late winter, Poitras decided that the stranger with whom she was communicating was credible. There were none of the provocations that she would expect from a government agent — no requests for information about the people she was in touch with, no questions about what she was working on. Snowden told her early on that she would need to work with someone else, and that she should reach out to Greenwald. She was unaware that Snowden had already tried to contact Greenwald, and Greenwald would not realize until he met Snowden in Hong Kong that this was the person who had contacted him more than six months earlier. There were surprises for everyone in these exchanges — including Snowden, who answered questions that I submitted to him through Poitras. In response to a question about when he realized he could trust Poitras, he wrote: “We came to a point in the verification and vetting process where I discovered Laura was more suspicious of me than I was of her, and I’m famously paranoid.” When I asked him about Greenwald’s initial silence in response to his requests and instructions for encrypted communications, Snowden replied: “I know journalists are busy and had assumed being taken seriously would be a challenge, especially given the paucity of detail I could initially offer. At the same time, this is 2013, and [he is] a journalist who regularly reported on the concentration and excess of state power. I was surprised to realize that there were people in news organizations who didn’t recognize any unencrypted message sent over the Internet is being delivered to every intelligence service in the world.” In April, Poitras e-mailed Greenwald to say they needed to speak face to face. Greenwald happened to be in the United States, speaking at a conference in a suburb of New York City, and the two met in the lobby of his hotel. “She was very cautious,” Greenwald recalled. “She insisted that I not take my cellphone, because of this ability the government has to remotely listen to cellphones even when they are turned off. She had printed off the e-mails, and I remember reading the e-mails and felt intuitively that this was real. The passion and thought behind what Snowden — who we didn’t know was Snowden at the time — was saying was palpable.” Greenwald installed encryption software and began communicating with the stranger. Their work was organized like an intelligence operation, with Poitras as the mastermind. “Operational security — she dictated all of that,” Greenwald said. “Which computers I used, how I communicated, how I safeguarded the information, where copies were kept, with whom they were kept, in which places. She has this complete expert level of understanding of how to do a story like this with total technical and operational safety. None of this would have happened with anything near the efficacy and impact it did, had she not been working with me in every sense and really taking the lead in coordinating most of it.” Snowden began to provide documents to the two of them. Poitras wouldn’t tell me when he began sending her documents; she does not want to provide the government with information that could be used in a trial against Snowden or herself. He also said he would soon be ready to meet them. When Poitras asked if she should plan on driving to their meeting or taking a train, Snowden told her to be ready to get on a plane. In May, he sent encrypted messages telling the two of them to go to Hong Kong. Greenwald flew to New York from Rio, and Poitras joined him for meetings with the editor of The Guardian’s American edition. With the paper’s reputation on the line, the editor asked them to bring along a veteran Guardian reporter, Ewen MacAskill, and on June 1, the trio boarded a 16-hour flight from J.F.K. to Hong Kong. Snowden had sent a small number of documents to Greenwald, about 20 in all, but Poitras had received a larger trove, which she hadn’t yet had the opportunity to read closely. On the plane, Greenwald began going through its contents, eventually coming across a secret court order requiring Verizon to give its customer phone records to the N.S.A. The four-page order was from the Foreign Intelligence Surveillance Court, a panel whose decisions are highly classified. Although it was rumored that the N.S.A. was collecting large numbers of American phone records, the government always denied it. Poitras, sitting 20 rows behind Greenwald, occasionally went forward to talk about what he was reading. As the man sitting next to him slept, Greenwald pointed to the FISA order on his screen and asked Poitras: “Have you seen this? Is this saying what I’m thinking it’s saying?” At times, they talked so animatedly that they disturbed passengers who were trying to sleep; they quieted down. “We couldn’t believe just how momentous this occasion was,” Greenwald said. “When you read these documents, you get a sense of the breadth of them. It was a rush of adrenaline and ecstasy and elation. You feel you are empowered for the first time because there’s this mammoth system that you try and undermine and subvert and shine a light on — but you usually can’t make any headway, because you don’t have any instruments to do it — [and now] the instruments were suddenly in our lap.” Snowden had instructed them that once they were in Hong Kong, they were to go at an appointed time to the Kowloon district and stand outside a restaurant that was in a mall connected to the Mira Hotel. There, they were to wait until they saw a man carrying a Rubik’s Cube, then ask him when the restaurant would open. The man would answer their question, but then warn that the food was bad. When the man with the Rubik’s Cube arrived, it was Edward Snowden, who was 29 at the time but looked even younger. “Both of us almost fell over when we saw how young he was,” Poitras said, still sounding surprised. “I had no idea. I assumed I was dealing with somebody who was really high-level and therefore older. But I also knew from our back and forth that he was incredibly knowledgeable about computer systems, which put him younger in my mind. So I was thinking like 40s, somebody who really grew up on computers but who had to be at a higher level.” In our encrypted chat, Snowden also remarked on this moment: “I think they were annoyed that I was younger than they expected, and I was annoyed that they had arrived too early, which complicated the initial verification. As soon as we were behind closed doors, however, I think everyone was reassured by the obsessive attention to precaution and bona fides.” They followed Snowden to his room, where Poitras immediately shifted into documentarian mode, taking her camera out. “It was a little bit tense, a little uncomfortable,” Greenwald said of those initial minutes. “We sat down, and we just started chatting, and Laura was immediately unpacking her camera. The instant that she turned on the camera, I very vividly recall that both he and I completely stiffened up.” Greenwald began the questioning. “I wanted to test the consistency of his claims, and I just wanted all the information I could get, given how much I knew this was going to be affecting my credibility and everything else. We weren’t really able to establish a human bond until after that five or six hours was over.” For Poitras, the camera certainly alters the human dynamic, but not in a bad way. When someone consents to being filmed — even if the consent is indirectly gained when she turns on the camera — this is an act of trust that raises the emotional stakes of the moment. What Greenwald saw as stilted, Poitras saw as a kind of bonding, the sharing of an immense risk. “There is something really palpable and emotional in being trusted like that,” she said. Snowden, though taken by surprise, got used to it. “As one might imagine, normally spies allergically avoid contact with reporters or media, so I was a virgin source — everything was a surprise. . . . But we all knew what was at stake. The weight of the situation actually made it easier to focus on what was in the public interest rather than our own. I think we all knew there was no going back once she turned the camera on.” For the next week, their preparations followed a similar pattern — when they entered Snowden’s room, they would remove their cellphone batteries and place them in the refrigerator of Snowden’s minibar. They lined pillows against the door, to discourage eavesdropping from outside, then Poitras set up her camera and filmed. It was important to Snowden to explain to them how the government’s intelligence machinery worked because he feared that he could be arrested at any time. Greenwald’s first articles — including the initial one detailing the Verizon order he read about on the flight to Hong Kong — appeared while they were still in the process of interviewing Snowden. It made for a strange experience, creating the news together, then watching it spread. “We could see it being covered,” Poitras said. “We were all surprised at how much attention it was getting. Our work was very focused, and we were paying attention to that, but we could see on TV that it was taking off. We were in this closed circle, and around us we knew that reverberations were happening, and they could be seen and they could be felt.” Snowden told them before they arrived in Hong Kong that he wanted to go public. He wanted to take responsibility for what he was doing, Poitras said, and he didn’t want others to be unfairly targeted, and he assumed he would be identified at some point. She made a 12½-minute video of him that was posted online June 9, a few days after Greenwald’s first articles. It triggered a media circus in Hong Kong, as reporters scrambled to learn their whereabouts. There were a number of subjects that Poitras declined to discuss with me on the record and others she wouldn’t discuss at all — some for security and legal reasons, others because she wants to be the first to tell crucial parts of her story in her own documentary. Of her parting with Snowden once the video was posted, she would only say, “We knew that once it went public, it was the end of that period of working.” Snowden checked out of his hotel and went into hiding. Reporters found out where Poitras was staying — she and Greenwald were at different hotels — and phone calls started coming to her room. At one point, someone knocked on her door and asked for her by name. She knew by then that reporters had discovered Greenwald, so she called hotel security and arranged to be escorted out a back exit. She tried to stay in Hong Kong, thinking Snowden might want to see her again, and because she wanted to film the Chinese reaction to his disclosures. But she had now become a figure of interest herself, not just a reporter behind the camera. On June 15, as she was filming a pro-Snowden rally outside the U.S. consulate, a CNN reporter spotted her and began asking questions. Poitras declined to answer and slipped away. That evening, she left Hong Kong. Poitras flew directly to Berlin, where the previous fall she rented an apartment where she could edit her documentary without worrying that the F.B.I. would show up with a search warrant for her hard drives. “There is a filter constantly between the places where I feel I have privacy and don’t,” she said, “and that line is becoming increasingly narrow.” She added: “I’m not stopping what I’m doing, but I have left the country. I literally didn’t feel like I could protect my material in the United States, and this was before I was contacted by Snowden. If you promise someone you’re going to protect them as a source and you know the government is monitoring you or seizing your laptop, you can’t actually physically do it.” After two weeks in Berlin, Poitras traveled to Rio, where I then met her and Greenwald a few days later. My first stop was the Copacabana hotel, where they were working that day with MacAskill and another visiting reporter from The Guardian, James Ball. Poitras was putting together a new video about Snowden that would be posted in a few days on The Guardian’s Web site. Greenwald, with several Guardian reporters, was working on yet another blockbuster article, this one about Microsoft’s close collaboration with the N.S.A. The room was crowded — there weren’t enough chairs for everyone, so someone was always sitting on the bed or floor. A number of thumb drives were passed back and forth, though I was not told what was on them. Poitras and Greenwald were worried about Snowden. They hadn’t heard from him since Hong Kong. At the moment, he was stuck in diplomatic limbo in the transit area of Moscow’s Sheremetyevo airport, the most-wanted man on the planet, sought by the U.S. government for espionage. (He would later be granted temporary asylum in Russia.) The video that Poitras was working on, using footage she shot in Hong Kong, would be the first the world had seen of Snowden in a month. “Now that he’s incommunicado, we don’t know if we’ll even hear from him again,” she said. “Is he O.K.?” MacAskill asked. “His lawyer said he’s O.K.,” Greenwald responded. “But he’s not in direct contact with Snowden,” Poitras said When Greenwald got home that evening, Snowden contacted him online. Two days later, while she was working at Greenwald’s house, Poitras also heard from him. It was dusk, and there was loud cawing and hooting coming from the jungle all around. This was mixed with the yapping of five or six dogs as I let myself in the front gate. Through a window, I saw Poitras in the living room, intently working at one of her computers. I let myself in through a screen door, and she glanced up for just a second, then went back to work, completely unperturbed by the cacophony around her. After 10 minutes, she closed the lid of her computer and mumbled an apology about needing to take care of some things. She showed no emotion and did not mention that she had been in the middle of an encrypted chat with Snowden. At the time, I didn’t press her, but a few days later, after I returned to New York and she returned to Berlin, I asked if that’s what she was doing that evening. She confirmed it, but said she didn’t want to talk about it at the time, because the more she talks about her interactions with Snowden, the more removed she feels from them. “It’s an incredible emotional experience,” she said, “to be contacted by a complete stranger saying that he was going to risk his life to expose things the public should know. He was putting his life on the line and trusting me with that burden. My experience and relationship to that is something that I want to retain an emotional relation to.” Her connection to him and the material, she said, is what will guide her work. “I am sympathetic to what he sees as the horror of the world [and] what he imagines could come. I want to communicate that with as much resonance as possible. If I were to sit and do endless cable interviews — all those things alienate me from what I need to stay connected to. It’s not just a scoop. It’s someone’s life.” Poitras and Greenwald are an especially dramatic example of what outsider reporting looks like in 2013. They do not work in a newsroom, and they personally want to be in control of what gets published and when. When The Guardian didn’t move as quickly as they wanted with the first article on Verizon, Greenwald discussed taking it elsewhere, sending an encrypted draft to a colleague at another publication. He also considered creating a Web site on which they would publish everything, which he planned to call NSADisclosures. In the end, The Guardian moved ahead with their articles. But Poitras and Greenwald have created their own publishing network as well, placing articles with other outlets in Germany and Brazil and planning more for the future. They have not shared the full set of documents with anyone. “We are in partnership with news organizations, but we feel our primary responsibility is to the risk the source took and to the public interest of the information he has provided,” Poitras said. “Further down on the list would be any particular news organization.” Unlike many reporters at major news outlets, they do not attempt to maintain a facade of political indifference. Greenwald has been outspoken for years; on Twitter, he recently replied to one critic by writing: “You are a complete idiot. You know that, right?” His left political views, combined with his cutting style, have made him unloved among many in the political establishment. His work with Poitras has been castigated as advocacy that harms national security. “I read intelligence carefully,” said Senator Dianne Feinstein, chairwoman of the Senate Intelligence Committee, shortly after the first Snowden articles appeared. “I know that people are trying to get us. . . . This is the reason the F.B.I. now has 10,000 people doing intelligence on counterterrorism. . . . It’s to ferret this out before it happens. It’s called protecting America.” Poitras, while not nearly as confrontational as Greenwald, disagrees with the suggestion that their work amounts to advocacy by partisan reporters. “Yes, I have opinions,” she told me. “Do I think the surveillance state is out of control? Yes, I do. This is scary, and people should be scared. A shadow and secret government has grown and grown, all in the name of national security and without the oversight or national debate that one would think a democracy would have. It’s not advocacy. We have documents that substantiate it.” Poitras possesses a new skill set that is particularly vital — and far from the journalistic norm — in an era of pervasive government spying: she knows, as well as any computer-security expert, how to protect against surveillance. As Snowden mentioned, “In the wake of this year’s disclosure, it should be clear that unencrypted journalist-source communication is unforgivably reckless.” A new generation of sources, like Snowden or Pfc. Bradley Manning, has access to not just a few secrets but thousands of them, because of their ability to scrape classified networks. They do not necessarily live in and operate through the established Washington networks — Snowden was in Hawaii, and Manning sent hundreds of thousands of documents to WikiLeaks from a base in Iraq. And they share their secrets not with the largest media outlets or reporters but with the ones who share their political outlook and have the know-how to receive the leaks undetected. In our encrypted chat, Snowden explained why he went to Poitras with his secrets: “Laura and Glenn are among the few who reported fearlessly on controversial topics throughout this period, even in the face of withering personal criticism, [which] resulted in Laura specifically becoming targeted by the very programs involved in the recent disclosures. She had demonstrated the courage, personal experience and skill needed to handle what is probably the most dangerous assignment any journalist can be given — reporting on the secret misdeeds of the most powerful government in the world — making her an obvious choice.” Snowden’s revelations are now the center of Poitras’s surveillance documentary, but Poitras also finds herself in a strange, looking-glass dynamic, because she cannot avoid being a character in her own film. She did not appear in or narrate her previous films, and she says that probably won’t change with this one, but she realizes that she has to be represented in some way, and is struggling with how to do that. She is also assessing her legal vulnerability. Poitras and Greenwald are not facing any charges, at least not yet. They do not plan to stay away from America forever, but they have no immediate plans to return. One member of Congress has already likened what they’ve done to a form of treason, and they are well aware of the Obama administration’s unprecedented pursuit of not just leakers but of journalists who receive the leaks. While I was with them, they talked about the possibility of returning. Greenwald said that the government would be unwise to arrest them, because of the bad publicity it would create. It also wouldn’t stop the flow of information. He mentioned this while we were in a taxi heading back to his house. It was dark outside, the end of a long day. Greenwald asked Poitras, “Since it all began, have you had a non-N.S.A. day?” “What’s that?” she replied. “I think we need one,” Greenwald said. “Not that we’re going to take one.” Poitras talked about getting back to yoga again. Greenwald said he was going to resume playing tennis regularly. “I’m willing to get old for this thing,” he said, “but I’m not willing to get fat.” Their discussion turned to the question of coming back to the United States. Greenwald said, half-jokingly, that if he was arrested, WikiLeaks would become the new traffic cop for publishing N.S.A. documents. “I would just say: ‘O.K., let me introduce you to my friend Julian Assange, who’s going to take my place. Have fun dealing with him.’ ” Poitras prodded him: “So you’re going back to the States?” He laughed and pointed out that unfortunately, the government does not always take the smartest course of action. “If they were smart,” he said, “I would do it.” Poitras smiled, even though it’s a difficult subject for her. She is not as expansive or carefree as Greenwald, which adds to their odd-couple chemistry. She is concerned about their physical safety. She is also, of course, worried about surveillance. “Geolocation is the thing,” she said. “I want to keep as much off the grid as I can. I’m not going to make it easy for them. If they want to follow me, they are going to have to do that. I am not going to ping into any G.P.S. My location matters to me. It matters to me in a new way that I didn’t feel before.” There are lots of people angry with them and lots of governments, as well as private entities, that would not mind taking possession of the thousands of N.S.A. documents they still control. They have published only a handful — a top-secret, headline-grabbing, Congressional-hearing-inciting handful — and seem unlikely to publish everything, in the style of WikiLeaks. They are holding onto more secrets than they are exposing, at least for now. “We have this window into this world, and we’re still trying to understand it,” Poitras said in one of our last conversations. “We’re not trying to keep it a secret, but piece the puzzle together. That’s a project that is going to take time. Our intention is to release what’s in the public interest but also to try to get a handle on what this world is, and then try to communicate that.” The deepest paradox, of course, is that their effort to understand and expose government surveillance may have condemned them to a lifetime of it. “Our lives will never be the same,” Poitras said. “I don’t know if I’ll ever be able to live someplace and feel like I have my privacy. That might be just completely gone.” Peter Maass is an investigative reporter working on a book about surveillance and privacy. Editor: Joel Lovell

3 2

hardened *nix for Lenovo X60
by Eugen Leitl 26 Aug '13

26 Aug '13

I've managed to lay my hands onb a couple of Lenovo X60's that are in pretty good shape and would like to use them as a moderately secure communication/development system. (I'm not trusting my desktops, servers or mobile devices for obvious reasons). I'm loath to modify the hardware at this point, so I expect to only flash coreboot upon it. What kind of security-minded Linux or *BSD would you guys recommend? Liberte looks a bit too stable (cough, sorry Максим)), Kali is more for security h4x0rs. Anything else what is well-maintained yet borderline secure from *untargeted* TLA-level scrutiny? I'm okay with text-mostly distros, or minimalistic window managers. It shouldn't be a kitchensink of stuff I don't need, but on the other hand it's shouldn't be so secure it's unusable, either. Pointers to any HOWTOs or SOPs highly welcome. Tanks & machine guns.

6 7

Re: hardened *nix for Lenovo X60
by John Down 26 Aug '13

26 Aug '13

If so, then worth to have a look at hardened gentoo to have full control over the process how the system is built, what patches are applied, etc On Mon, Aug 26, 2013 at 04:05:25PM +0000, Dan White wrote: > On 08/26/13 17:09 +0200, Eugen Leitl wrote: > > > >I've managed to lay my hands onb a couple of Lenovo X60's that are > >in pretty good shape and would like to use them as a moderately secure > >communication/development system. (I'm not trusting my desktops, > >servers or mobile devices for obvious reasons). I'm loath to modify > >the hardware at this point, so I expect to only flash coreboot > >upon it. > > > >What kind of security-minded Linux or *BSD would you guys > >recommend? Liberte looks a bit too stable (cough, sorry Максим)), > >Kali is more for security h4x0rs. Anything else what is well-maintained > >yet borderline secure from *untargeted* TLA-level scrutiny? > > > >I'm okay with text-mostly distros, or minimalistic window > >managers. It shouldn't be a kitchensink of stuff I don't need, > >but on the other hand it's shouldn't be so secure it's > >unusable, either. > > > >Pointers to any HOWTOs or SOPs highly welcome. Tanks & machine guns. > > The boring recommendation: Debian > > Pros: > * Lots of eyeballs > * Timely security updates (well, timely as far as vendors go) > * A wealth of pre-packed software, which can be twiddled down to size > * Some fancy features out of the box (like remotely booting a LUKS > encrypted root filesystem via an initramfs ssh daemon) > > Cons: > * Patching your locally installed (packaged) software must be done with > Debian build scripts, or you quickly lose the benefits of the apt system > * Stupid patches have made it past the package maintainer (the OpenSSL > 2008 patch being the one that comes immediately to mind) > > If you're willing to compile your own software or security updates, then I > think your choice of OS/distro may be mostly moot. > > I'd recommend against a specialized security (linux) distro, unless you > know what you're doing. Support for many of them seems to be pretty spotty, > according to my unscientific observation from ##linux.

1 0

NSA Head: US Cyber Offense Is Best in World
by John Young 26 Aug '13

26 Aug '13

http://blogs.fas.org/secrecy/2013/08/cyber-offense/ NSA Head: US Cyber Offense Is Best in World "Cyber offense requires a deep, persistent and pervasive presence on adversary networks in order to precisely deliver effects," Gen. Alexander explained in response to a question from Rep. Trent Franks (R-AZ). "We maintain that access, gain deep understanding of the adversary, and develop offensive capabilities through the advanced skills and tradecraft of our analysts, operators and developers. When authorized to deliver offensive cyber effects, our technological and operational superiority delivers unparalleled effects against our adversaries' systems."

1 0

[Cryptography] Formal Verification (was Re: Email and IM are ideal candidates for mix networks)
by Eugen Leitl 26 Aug '13

26 Aug '13

----- Forwarded message from "Perry E. Metzger" <perry(a)piermont.com> ----- Date: Mon, 26 Aug 2013 10:02:54 -0400 From: "Perry E. Metzger" <perry(a)piermont.com> To: Jerry Leichter <leichter(a)lrw.com> Cc: cryptography(a)metzdowd.com, Christian Huitema <huitema(a)huitema.net> Subject: [Cryptography] Formal Verification (was Re: Email and IM are ideal candidates for mix networks) X-Mailer: Claws Mail 3.9.0 (GTK+ 2.24.20; x86_64-apple-darwin12.4.0) On Sun, 25 Aug 2013 23:32:32 -0400 Jerry Leichter <leichter(a)lrw.com> wrote: > I think the goal to aim for is no patches! Keep the device and its > interfaces simple enough that you can get a decent formal proof of > correctness, along with a ton of careful review and testing (per > Don Knuth's comment somewhere to "Be careful of the following code, > I've only proved it correct, not tested it") and then *leave it > alone*. I'd like to point out that this is no longer a pipe dream. The formal verification of seL4, CompCert and other substantial pieces of code in recent years shows the technology has improved a lot. Quark (the web browser verified by the use of a "shim") has shown one can get enormous leverage by formally verifying only tiny fractions of an overall system comprising millions of lines of code, which is an especially interesting technique in the context of existing large code bases. Formal verification is not a panacea. One has to know what to verify, for example, and if you verify the wrong properties, you've gained little. However, unlike current methods, if you discover you have failed to verify a needed property, adding a theorem to your development fixes that hole _completely_ and _forever_. (Yes, you also need a verified toolchain, but given things like CompCert, that is now doable.) I'm something of a recent arrival to the world that developed the most widely used tools for formal verification (like Coq), and so I'm in a better position than most to explain how to learn about them. I would be happy to produce an extended post on how to learn about what is out there for people who are interested. Warning: although in the long term there is no reason the tools cannot be made very user friendly and easy to use, right now that is not the case. This is not inherently so, it is just a feature of the development history of the tools. Error messages tend to be pretty poor, as is documentation, and the learning curve is steep. However, in the long run, I'll state very directly I think the recent advances in the state of the art in proof assistants are the most significant new development in software quality in decades. The user unfriendliness could be fixed by a new generation of users and developers who started "further away from the problem". Perry -- Perry E. Metzger perry(a)piermont.com _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

Alternatives to Lavabit
by Stakewinner00 26 Aug '13

26 Aug '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Now that Lavabit is off, we should seek another server with encryption. My question are, there are another encrypted email service like Lavabit? Or we have to create a new encrypted email service? -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (MingW32) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEVAwUBUhfOC2nZMKDLC/xbAQKUMQgAjls2AY+VZpY4PEudvb5Dc5c+7SOYehHC 8GVDwkXRI+Pp09e3aTK5lYaij7fQZ/aGO3lGnr8Hm7s0xRYig7hpCPiIymJ/O9Kq i0nQibqMrgLTter/7MkIbyjsmAvO1hYE8rbct1snk2JIDjw/gkLi4kzxtMd5h2qn RZoMmAKgZlDou4MUDrpA9iTvRQY8qisB+27wAHgDYxtZzejdr0b2pNZxsaUwOLXv EjASFiBPi07DyZqrDHUArGyiIMQn2sBqEEzmKvUrp4DTm1IT/B6e7A5tUhkDAX7r ThcD2rKK43Kqog+zPogDJ8Hp3lhB7aR0QPTP3ILq7ioKmy+nvnQzOw== =YEFA -----END PGP SIGNATURE-----

2 1

Re: Who bought off Zimmermann?
by Bill Stewart 26 Aug '13

26 Aug '13

At 07:09 PM 8/25/2013, Shawn K. Quinn wrote: >On Sun, Aug 25, 2013, at 07:36 PM, John Young wrote: > > Phil probably means the infrastructure of email is the vul not the > > crypto. Crypto alone is sterile, a boy in a bubble which requires > > life support which can be assaulted. > >I think Phil is referring to traffic analysis. We solved this problem >already somewhat with Mixmaster, but it's cumbersome to impossible to >use for everyday email. It's not just traffic analysis, though that's another layer of the problem. And it's not just the issue of PGP being hard to run on some phones, though that makes it a problem for users of those phones. Phil's not just a cryptographer; he's primarily a service provider here. If you assume that the NSA can come to you with a FISA court order overriding ECPA, saying "Give us every piece of information that anybody sends you, including your subscribers and outsiders who want to send email to them, any time any new bit of information arrives, Or Else!" then you can't run a "secure" email service that accepts unencrypted email, because what you have isn't secure against that threat model. If the NSA and their rubber-stamping buddies at FISA aren't stepping way over the bright shiny constitutionality line, you could run an email service that automatically PGP-encrypts any incoming message to a public key associated with the mailbox, and build a user interface for the mailbox client's device that's not totally annoying. The fact that Phil and Jon say they can't run a service implies that the threat model includes mail in transit, not just mail delivered to a mailbox. You might be able to run an email service that scans inbound email for an X-PGP-Encrypted: header, and if it sees "From:" or "Subject:" first, bounces the email with a 503 or 550: "Sorry, Encrypted Email Only, Get PGP at www.pgp.com", but that's really more annoying than just using Gmail with a user name pgp-only-johndoe43(a)gmail.com. An alternative threat model is that the NSA declares anybody sending encrypted mail to be a target (s/target/weasel-word-of-the-week/g), so any ISP that sends data to silentcircle.com has to allow the NSA to wiretap their connections, just in case they might be encrypted email. The effects are similar, though it wouldn't provide access to the contents of encrypted SMTP sessions; Phil and Jon might also be refusing to handle email because of this slightly less aggressive threat model. Bill Stewart

4 4

Re: [liberationtech] Why_can't_email_be_secure
by Bill Stewart 26 Aug '13

26 Aug '13

At 01:40 PM 8/25/2013, coderman wrote: >and to StealthMonger's point about latest generation mix networks for >best privacy, why not instead focus on building low latency protocols >that are resistant to traffic analysis and confirmation? Because "low latency protocols that are resistant to traffic analysis" is a really really hard problem. Even doing "high latency protocols that are resistant to traffic analysis" is a really hard problem. "Building" them is a mere application of sufficiently advanced technology, right? >make them datagram based; utilize user space stacks Datagrams don't give you any useful anonymity, because any decent ISP is going to block forged-source packets, but they do give you a bit more flexibility about timing, which is important for defending against traffic analysis. The standard warning about using them for an application is that it's extremely tempting to use them to reinvent TCP badly, because TCP really does a lot of things you want, and in a security context it's tempting to also reinvent TLS badly. Some other problems with them are that you need to get firewalls to allow them through, unless you disguise them as other protocols like the horribly evil things Dan Kaminsky regularly does to DNS, and if you don't disguise them then they stick out like a sore thumb on any IDS or netflow analyser. And if you're the only person using that protocol, you're not hiding from traffic analysis. It's a lot easier to hide if you implement your datagrams as http/https transactions of some kind, but building a bunch of relay nodes to pass those transactions along ends up reinventing Tor. Putting them in user space is just fine and mostly more portable. It's hard to get millisecond-level latency if you do that, but you can't hide from traffic analysis with latency that low anyway.

2 1

Re: Who bought off Zimmermann?
by Bill Stewart 26 Aug '13

26 Aug '13

At 10:45 PM 8/25/2013, Shawn K. Quinn wrote: >Though I think the following poster who >suggested scanning the email itself for the PGP identifier might be more >useful and less prone to being fooled by someone who just puts the >header in there without actually encrypting. Anybody who's putting in the header without doing the encryption is going out of their way to ask for trouble, and presumed to be doing it on purpose, whether for entrapment or denial of service or whatever. As long as you don't make it easy to do by accident, it's not a problem. >Also, headers don't have to >be in a specific order, it's possible that "From:" or "Subject:" >accidentally get moved ahead of "X-PGP-Encrypted:" by mistake and that >would result in a false bounce. The threat model I was worrying about was that if you get to From: or Subject:, and you're subject to an NSA Vacuum Cleaner Order, you've got potentially sensitive information about your users or their contacts that you could be forced to retain and turn over. You need to reject the message before you see that, which means checking the header keyword before you accept any characters past the :. And yeah, that means you could get false bounces, but hopefully anybody who's trying to hide their identity from the NSA will leave those headers out of the cleartext part of the message anyway. Ideally you don't even want the SMTP-level FROM keyword, but it's probably hard to get most MTAs not to send that one.

1 0

Re: [liberationtech] Why_can't_email_be_secure
by coderman 26 Aug '13

26 Aug '13

On Sun, Aug 25, 2013 at 12:26 PM, Ali-Reza Anghaie <ali(a)packetknife.com> wrote: > ... > And herein lies the problem - Silent Circle isn't talking to "us" - > they are talking to the other 99.99% of email users in the world. and to StealthMonger's point about latest generation mix networks for best privacy, why not instead focus on building low latency protocols that are resistant to traffic analysis and confirmation? make them datagram based; utilize user space stacks and latest research. solving the low latency datagram anonymity problem enables existing usable private communication with the additional benefit of endpoint and peer anonymity. i believe this possible to make useful, even if never infallible. certainly more possible than the odds of making truly scalable, available, and _usable_ mix mailer networks and clients for the masses. most important: make this low latency infrastructure usable and cross platform, so the implementations are easily adopted... like Napster and BitTorrent back in the day. ;)

2 1