Comment by tptacek | Hacker News Reader

Comment by tptacek | Hacker News Reader

I don't have a strong opinion on the whole article, but almost from the beginning it's less than honest.

Of all the whistleblower cases of the last 10 years, Thomas Drake has the most sympathetic. The conventional narrative about Drake appears to be mostly correct. But there are two very important details that this story not only leaves out, but implicitly contradicts.

1. Drake did not follow NSA whistleblower protocol in revealing details about Trailblazer. Unless NSA whistleblower protocol includes "create a Hushmail account and then send classified documents to journalists over it".

2. Drake was concerned about dragnet surveillance. But his concern wasn't "why" or "whether". It was "how". Drake blew the whistle on Trailblazer after a program he sponsored, ThinThread, was pushed aside for Trailblazer. ThinThread sounds a lot better in magazine articles, but it too was a large-scale dragnet surveillance system. The differences were that ThinThread was less expensive, and that ThinThread had better technical controls. But nobody on HN would be OK with ThinThread either.

For pretty much all of the whistleblower cases, you can go to the Federation of American Scientists (FAS.org) to get the original case documents.

Ah, I see, the agency which appears to not protect whistleblowers at all and fabricates information has official documents which claims he didn't follow protocol, which is probably because he was never taken seriously.

It seems with every agency with poor oversight finds some important reason to punish whistleblowers for some comparatively trivial infraction to the one they reveal. The information they reveal rarely leads to punishment but thr small (possibly made up) transgression ruins there career and gets them crucified.

By all accounts this belies a broken system.

You've missed my point. I'm not litigating Drake. I'm criticizing the article.

Again: the documents on FAS suggest that he created a Hushmail account and used it to send classified documents to reporters. "Not following protocol" doesn't capture that.

Perhaps for once someone is actually trying to tell his story rather than following official documents, which as I said, seem to be prone to a lot of bias and wrong doings.

It doesn't seem to invalidate the account, nor does it seem like the most important comment to give to this story.

Telling Drake's side of the story is a fine exercise, but it's not what this article purports to do. Instead, it's loaded with copy intended to bolster it's claims of being heavily reported and of breaking new news. But it doesn't do that.

Here's the kernel of what seems to have happened, synthesizing both the Crane reporting from the Guardian today and the Drake indictment:

1. Drake favored a competing dragnet surveillance system that was pushed aside in favor of Trailblazer.

2. Drake lodged a complaint with the NSA IG that Trailblazer was a waste of money with inadequate technical controls. He is joined in his complaint by William Binney and several other former NSA employees.

3. Concurrently, Drake began leaking to reporters --- presumably, James Risen and Eric Lichtblau, who broke the first major NSA surveillance story for the NYT --- using Hushmail.

4. In handling Drake's formal complaint, the NSA managed to leak Drake's identity to DOJ. The article is fuzzy about exactly which law this violates (it refers to the Whistleblower Protection Act, much of which does not apply to national defense and classified information, and not the ICWPA, which has different procedures and protections). Either way: the White House is apoplectic about the Risen/Lichtblau scoop and uses the leak to raid Drake.

5. In the course of investigating Drake, DOJ discovers (perhaps by first ruling out Binney and the other original complainants) Drake's Hushmail leak. Drake is prosecuted.

The Guardian article would have you believe that Drake was prosecuted directly for blowing the whistle through formal channels. But that is not at all what seems to have happened. Yes, in the process of investigating Drake's complaint, there was a procedural foul (Drake's name shouldn't have ended up at DOJ). But it wasn't Drake's formal complaint that got Drake in real trouble!

Again: I think Drake has the most sympathetic case of all the NSA whistleblowers. His leak was extraordinarily targeted, not particularly political, and clearly in the public interest. I'm not writing to litigate whether Drake was right. I'm saying: the Guardian did a poor job of reporting this story.

> the Guardian did a poor job of reporting this story

Given Jacob Appelbaum's description[1] of the Guardian, this is not surprising.

[1] https://www.youtube.com/watch?v=KJValv4YQcY#t=78 (note: strong language - Jacob doesn't pull his punches)

I would not generally describe myself as a Jacob Appelbaum fan, but that was a really well done talk. (It doesn't do my argument here any favors; it's accusing The Guardian of collaborating with the Five Eyes powers, and I'm saying that in this piece they did the opposite).

You're also incorrect on many points here.

1. You're making Trailblazer sound similar to Drake's favored system. This is extremely misleading, and is a long discussion on its own. But making this claim paints Drake's motives as career politics and seeks to diminish his character by inferring ulterior motives. If nothing else, that isn't a productive debate.

2. Drake's complaint was not merely that it was a waste of money with inadequate technical controls. He was also not joined in his complain by William Binney.

Binney made the initial complaint, and it was to the Pentagon Inspector General, not the NSA Inspector General (if that is a thing), and he was anonymously joined by Drake and 3 others. This was in Two of the other complainants were former NSA employees who worked on the original program, and one was Diane Roark, a staff member on the House Permanent Select Committee on Intelligence, who had been trying to investigate the NSA on these matters (which is her job), and was getting stonewalled. Drake was still an NSA employee and did not want his career to be impacted, so his name was left off. Others, including Binney, who originally made the "competing system" initiated this because they felt that TrailBlazer was a modified version of ThinThread with all of the privacy protections removed and deployed domestically.

3. Drake did not concurrently leak to reporters. His contact with reporters was several years later. The first report was internally, then he went to congress, then in 2005 he finally went to the media. The Binney complaint was filed in 2012, and the internal escalations within the NSA and Congress had already been happening for years before (ultimately leading to Binney's 2001 resignation in protest).

Drake's hushmail communication was to Gorman of the WSJ about Trailblazer, not James Risen and Eric Lichtblau of NYT, who instead had a totally different story, which was the AT&T warrantless surveillance issue. He set some ground rules for his communication with Gorman, one of which was that he would not reveal anything classified. He maintains that he never did. The outcome of the trial was that he never did. Yes, this contradicts the indictment, for very obvious reasons.

Risen/NYT on the warrantless AT&T issue was a totally different story and in fact had nothing to do with Drake! The investigators of the leak thought the sources might have been the same, and they were wrong.

No, that's not what I believe. As I keep saying: Drake has the most sympathetic of all the NSA leaker cases. What he revealed was very targeted and motivated by the public interest (something you cannot say of some other leakers who, for instance, leaked counterproliferation secrets, or details in preparation for a book they were promoting). I do not believe Drake's leak was careerist.

I bring up ThinThread because the article paints Drake as someone who was motivated to blow the whistle based on the same concerns Snowden had. But that's not what happened. Both ThinThread and Trailblazer were in large part motivated by concerns that more and more SIGINT had a nexus in the US, and that large-scale systems needed to be implemented to capture intelligence that had a US nexus.

When you look at the Drake complaint to the NSA IG through the lens of Snowden, your natural reaction is that the NSA was pushing the concern aside out of C.Y.A., to prevent the public from learning that it was monitoring US comms. But in fact, Drake's complaint is about how Trailblazer was monitoring US comms; the privacy concerns it had were procedural and not substantive. It wasn't stark, the way the article makes it out to be.

I was imprecise about the word "concurrent". My frame of reference was "between the numbered steps in my outline". You're right to correct me. Either way, the point I'm trying to make is that it isn't the IG complaint that got Drake in trouble; it was the communication with reporters.

You can believe that the communications with the press were proper (I don't agree) or in the public interest to the extent that they overrode "proper" (I do agree). But either way, you should be able to agree with me that in an article that is entirely about what happens when insiders at NSA raise concerns through official channels, the fact that Drake got in trouble primarily for what he did through unofficial channels is important to the story, and should have been prominently included.

Considering that you conflated the Risen/NYT leak with the Drake/Binney/ThinThread/WSJ story, I am not sure how you feel comfortable enough to say that Drake got in trouble for doing things through unofficial channels. If that is your central point, you got the most important detail here completely mixed up with another case. I charge that it is you who is doing a poor job of reporting (to say nothing of the Guardian).

That's an association the article made, not me. The indictment and court filings aren't specific about which reporters were involved. Either way, can you rebut the argument I actually made?

I agree that if we're going to hold Guardian stories to the standards of Hacker News comments, I have much less of a case. That article would make a fine Hacker News comment.

This is false. He used hushmail as a secure document storage system for himself. He communicated unclassified information to the reporter. This communication happened way after his internal efforts went nowhere.

The only classified information ever found was in Drake's house, and the court found that there was no evidence that it was passed to a reporter or anyone else. This is entirely consistent with what this article's source claims a whistleblower would be told to do.

The worst thing he did was violate a document retention policy and store classified information on uncleared devices. And if you're a whistleblower providing evidence, well...no shit?

First, that's misleading --- again, unless the accusation is that the DOJ is lying in the indictment, which would be a bigger story than today's:

https://www.dropbox.com/s/fgt8bg4fykz0b7x/Screenshot%202016-...

Second, whatever reasons he had for violating the NSA's process are besides the point. The lede of this story is that following NSA's internal procedures for blowing the whistle will result in NSA destroying your life. But as evidence for that argument, they marshall the story of Thomas Drake, where that is not at all what happened. It's critically important to the story that readers know that he did not simply follow protocol and then get punished for it. Instead, he followed protocol, was dissatisfied with its outcome, and then flagrantly and repeatedly broke protocol.

It's a very convenient strategy to try to hold my argument to account for what happened to Thomas Drake. But the point of my argument isn't Thomas Drake; it's the extraordinarily well-known and easily-acquired information about the Drake case that The Guardian not only left out but by repeated implication contradicted in writing this story. Just because the story lands on a conclusion you're comfortable with doesn't mean you should be comfortable with the story.

So let me see if I have this right. He repeatedly followed protocol, was shut down for doing so, and told to be a "good team player", and things continued as they were. Illegal activity on the part of the NSA and the suppression of this by the NSA and the government, AND the congressional staff this was communicated to. All kept quiet. All suppressed. And ILLEGAL. And so, when the system doesn't work and it is leaked to the press, at that point the ONLY way to get this information out to fellow US citizens, your position is that the key thing is that he didn't continue to play along with keeping all this secret? The whistleblower protocol failed and was co-opted by the very agency that was supposed to protect it. And it failed not once, but multiple times against multiple people who worked for the NSA and found these things out. The only other recourse was to talk to the press. You know, the one protected by the first amendment? Exposing how the government was violating the fourth amendment and lying about it and saying as well that any evidence of it was a national security secret?

And for you the key part is that, when the protocols fail and are subverted by the IG agency, Drake is in the wrong? Wow.

I think you summarized someone else's comment, and not mine.

Stopped reading at "unless the accusation is that the DOJ is lying in the indictment".

Do you seriously not understand how indictments work? Why would you use them as your source for an account of the events? The whole point of an indictment, which consists entirely of unproven allegations by design, is to throw everything possible at the target and paint the worst possible picture to make your case. It's not a finding of facts and it's not an impartial document.

Lying in an indictment would not be news in any way whatsoever. Not lying in an indictment would be news. But it's not really considered lying.

A better way to say "I stopped reading at" on HN is "I wanted to stop reading at". You read the whole comment, or you wouldn't have replied.

What part of what I said do you think is a DOJ lie? Based on things Drake has conceded elsewhere, your claim may be more or less rebuttable. You have to actually make the claim before we can discern that.

I in fact did stop reading there. Mostly because we have 3 debates going at once, and I can only debunk so many things at a time. When an indictment is cited as a primary source of the facts in favor of contradictory findings in the case that followed, that's an easy short-circuit.

So why did the DOJ drop most of the charges?

Because there was a negotiated guilty plea.

A guilty plea to one misdemeanor count of "exceeding the authorized use of a computer" after having been indicted on 10 counts, all of which were dropped.

The DOJ argued that they should be able to prosecute for revealing classified documents without revealing what the documents were. When the judge prevented that, the case collapsed and they were forced to settle.

Reply on news.ycombinator.com