Snowden impersonated NSA officials, sources say
investigations.nbcnews.com
investigations.nbcnews.com
That would be like having secret documents in a drawer marked "John Smith," then saying that someone who opened that drawer and took some documents was "impersonating" John Smith.
Then there's the bit about "hiring brilliant people." What's so brilliant about someone with root access having access to everything? Nothing. That's what root access enables. It's not a case of Snowden's brilliance. It's a case of the NSA's administrative incompetence: there should be auditing in place.
EDIT: So there was RBAC in place. Evidently, the implementation was botched. Amounts to the same thing: "security theater." This actually bolsters Snowden's case that whistleblowing was justified.
This has been a buried lede since the beginning: under the Common Criteria, what EAL was supposed to be in place for his role?
Another possibility is that Snowden had the ability to create login credentials and just gave himself the ability to log in as another user.
Presenting that as "impersonation" to the general public is deceptive, regardless of whether it is intended to be or not.
This is called "seperation of duties" and it's covered in the RBAC security model.
If Snowden pointed this out to his bosses and was ignored, then he had a legitimate reason to blow the whistle.
What I see is a use of RBAC that is not all that stupid, and that I happen to use on my own systems. RBAC is being used not to guard against abuse but to guard against mistakes. I use the SELinux sandbox to run my web browser, because it is easy to make a mistake like this:
http://thejh.net/misc/website-terminal-copy-paste
Ah, not so fast, the sandbox keeps that mistake from spreading all over my home directory. Now, the NSA has people who deal with important national security matters (or whatever), but they might make mistakes too. So the NSA uses RBAC to ensure that an analyst cannot accidentally copy and paste some intelligence secrets into a document that will be sent to people without clearance. Remember that the NSA does not just hire random people off the street; there is some amount of filtering meant to reduce the number of insider threats, but that process alone does not necessarily protect against honest mistakes (hence RBAC).
It may also be the case that the NSA is not trying to guard against abuses by sysadmins, but by the tens of thousands of non-sysadmins they employ. In theory this is silly because it just means that your enemies will try to get their agents to work as sysadmins, but in practice it is likely to be a cost-effective solution that greatly reduces the number of people you need to worry about.
Finally there is the matter of auditing. It is OK to have a sysadmin who can transition to an unauthorized security level if the audit logs record it and if you frequently inspect those logs. Again, if sysadmins are the only employees who can make such transitions, you have far fewer people you need to watch -- a net win.
If it's ineffective and just serves as bureaucratic window-dressing, then it is security theater.)
> What I see is a use of RBAC that is not all that stupid, and that I happen to use on my own systems. RBAC is being used not to guard against abuse but to guard against mistakes.
What specific information are you using to come to this conclusion?
Also, if you put this in the context of the OP, then RBAC is immaterial to the Snowden case. That makes the article smell even more like deliberate spin-doctoring.
> Again, if sysadmins are the only employees who can make such transitions, you have far fewer people you need to watch -- a net win.
Then the question is, "Were they watching admins like Snowden well enough?"
Deleted comment
> “Every day, they are learning how brilliant [Snowden] was,” said a former U.S. official with knowledge of the case. “This is why you don’t hire brilliant people for jobs like this. You hire smart people. Brilliant people get you in trouble.”
A DBA can't do their job if they can't access the databases they manage/design/maintain.
Two things that are undeniable:
1) They were doing IT security worse than the level which was actually needed
2) All the while, they were telling the world that effective mechanisms were in place which would prevent abuses.
So they weren't doing what they were supposed to and they were deceiving the public about it. Whether or not this was intentional is just secondary.
1. Administrator accounts were not confined (in the SELinux sense), so he was able to transition to whatever security context he needed/wanted.
2. He was able to set up the login credentials for other users. He could have created his own accounts with higher-level clearances, or set up his own smartcard for logging in to some other person's account, etc.
It may seem like poor design, but it is understandable why things might have been set up like that. In the first case, it is because the admins need to be able to solve problems that happen in a variety of security contexts / levels, and the overhead of defining a second set of policies governing the admins was just too high. In the second, it would be because someone has to be able to set up credentials and that there are a lot of systems for which credentials must be set up, making it hard to impose restrictions. There is also the matter of audit logs -- it might not be so bad to allow an admin to transition to whatever security level if each transition is logged.
I suspect that much of the NSA's computer security is devoted to ensuring that people do not accidentally leak classified information, and that preventing insider attacks is done at a higher level (the clearance process, random audits, etc.).
So long as "preventing insider attacks is done at a higher level" isn't synonymous with: "once you're hired as sysadmin, you have the unsupervised keys to the kingdom!"
At least Snowden hasn't been locked away in a hole for three years only to be brought out into the public to tell everyone he's really thinks his a woman.
> NSA Director Keith Alexander told the House Permanent Select Committee on Intelligence that Snowden fabricated digital keys that gave him access to areas way above his clearance as a low-level contractor and systems administrator. [1]
[1] http://www.businessinsider.com/edward-snowden-copied-a-lot-o...
>> "You hire smart people. Brilliant people get you in trouble.”
What does that even mean?
The army breaks down a soldier's individuality as part of a soldier's training. The NSA does not have that luxury (as far as I know), and Booz Allen Hamilton certainly does not.
Have any of the NSA leaks told us anything we don't know? Haven't the majority of the leaks told our foreign enemies how to avoid being tracked more than anything? I have yet to see any serious abuse of the NSA's power. The fact that they know that low level employees were spying on potential love interests means that they have a system in place to track such abuses. Leaking those kind of emails can be spun to state the opposite, when those emails are direct evidence that such abuses are tracked and presumably punished.
I've seen articles that have said "what if they use this power to subvert political dissidents" Well, what if they actually have checks built into this system as they have claimed and this new information proves? Such rumor spinning gets us nowhere as a society. Wouldn't that make Snowden a spy with his own self interests at heart, not the interests of the American people? Leaking piece-meal like he has is in his interests, not ours.
http://en.wikipedia.org/wiki/2013_mass_surveillance_disclosu...
Look at the scope of these systems. The fact that no abuses have come up (locally) is quite telling, imho. When this same type of hardware is in the hands of countries like China, we see these abuses. Is China seeing something we don't and just not telling us? I highly doubt it.
Are the two mutually incompatible?
>The fact that they know that low level employees were spying on potential love interests means that they have a system in place to track such abuses.
The love interest thing wasn't part of a leak, was it? I thought they just voluntarily disclosed it, probably to distract from thoughts of domestic spying on e.g. politcal views, rather than petty tabloid personal stuff.
Anything we i.e. the readership of HN / Slashdot / Reddit / etc. do not know? Of course not. That accounts for about 2% of the population of the United States. The rest of America is still trying to get past the "but I am not even interesting, why would the NSA spy on me?" stage of life.
"Haven't the majority of the leaks told our foreign enemies how to avoid being tracked more than anything?"
How is that coherent with your first sentence? If the leaks did not tell us anything we do not already know, surely they are not telling our enemies anything they do not already know.
The reality is that foreign governments already know that the US is trying to spy on them. Terrorists know that too. That is why foreign governments use cryptography and other information security techniques. That is why terrorists deliver notes by courier.
"what if they actually have checks built into this system as they have claimed"
...this is a story about a low-level sysadmin who walked out of the very same organization with an untold number of classified documents. What checks do you think are built in, exactly?
"they know that low level employees were spying on potential love interests"
I think your question has been settled: no, effective checks on the NSA's power are not in place. Obama could not care less about some low level guy's love interests. Of course, those pesky journalists pointing out the ways he has lied, abused Presidential authority, etc., that's another story...
>How is that coherent with your first sentence?
you can't have it both ways. People who live in USA and are technical would know about these systems. People external and non-technical would not necessarily. Is that so hard to understand?
>What checks do you think are built in, exactly?
Read the article, please, before commenting.
>effective checks on the NSA's power are not in place.
There is still no evidence that your statement is true. The article shows that effective checks are there, but like all defenses, they can be flanked. Thus Snowden had to abuse his trust to get around them. This is just reality. There will never be a defense that can't be flanked.
You can say that this article is proof that there is ineffective checks, but then you have to admit that this article proves that Snowden had a ulterior motive when he accepted his contract with NSA. You must accept that if the goverment broke some rules to do their job (which so far I have not seen any evidence for) then you must also accept that Snowden broke some rules to steal these documents.
http://www.reuters.com/article/2013/08/05/us-dea-sod-idUSBRE...
The question you have to ask yourself, whether you think that would have come out without the Snowden revelations.
Evidence that the govt. broke rules to do their job (after Obama explicitly denied the powers are abused):
http://www.theguardian.com/world/2013/aug/21/nsa-illegally-c...
Evidence that checks are not in place:
http://www.washingtonpost.com/blogs/the-switch/wp/2013/08/24...
The LOVEINT revelations only showed up when the officers volunteered the information pre-polygraph test, which are more of a fear instrument than verifiably accurate. That's not a check or balance. More to the point the relevant facts emerged after Alexander categorically denied that abuses take place.
The emails being grabbed beyond the warrant NSA had was a result of encryption being used by GMail, so they had to grab emails by screenshot and keyword only, which caused collateral collection, but the amount of collection here is trivial.
I already addressed LOVEINT, and you're arguing against yourself. LOVEINT is a perfect example of NSA cracking down on abuses then addressing them in open court so that they can legally take action, or if they can't take action, that it's known about so that bigger reforms can be made.
I just gathered these facts by reading your article. It's clear that there are always two sides of the story, but nowhere here do I see NSA doing anything it didn't have permission to do.
In the NSA's own words "If the intelligence community collects information pursuant to a valid foreign intelligence tasking that is recognised as being evidence of a crime, [it] can disseminate that information to law enforcement, as appropriate." [1]
[1] http://www.theguardian.com/world/2013/aug/06/justice-departm...
There's two modes of operation, you seem to have the second in mind, and I am thinking of the first:
1:
a. NSA collects American national's "information pursuant to a valid foreign intelligence tasking". (this may be illegal, violation of fourth amendment rights, no supreme court decision)
b. NSA tip SOD (if 1. is illegal, then it follows it's illegal to pass on)
c. SOD instruct police force to stop and search for 'traffic violation' at time and place, obscure evidence trail. (DOJ investigating if this is illegal)
d. d:a) no evidence is found.
d:b) evidence is found, parallel construction begins.
a. law enforcement agency DEA/IRS/SOD asks NSA to get foreign intelligence, because of investigation already underway.
other steps as above.
I take issue with this: "the goverment broke some rules to do their job (which so far I have not seen any evidence for)"
The FISC found NSA overstepped their remit, broke the fourth amendment, announced that the FISC did not have sufficient oversight, and said that the NSA misrepresented facts repeatedly. The NSA initiate programs and depending how they feel about it present them to the FISC after the fact. In addition this contradicts what Obama said about there being no abuses. The only way that Obama could not be a liar here is if he did not know about it. Is Obama misinformed?
In your own words: "the amount of collection here is trivial.", the government broke the law however 'trivially'. This is an admission on your part there is evidence and that you have seen it.
You have not addressed LOVEINT. You seem to be missing how the LOVEINT stuff came to light, it was self reported by staffers, not uncovered by the NSA. Voluntary handover of information is not a check or a balance. Would you think the police were doing a good job if they only dealt with cases where the perpetrator made a statement on their own actions and turned themselves in without an investigation? Would you consider such behaviour a crackdown by the police? If there were sufficient checks, the NSA would know well before the culprit volunteered the information. In addition this contradicts what Alexander said about there being no abuses.
Yes. Due to the fourth amendment (I'd recommend reading it), I'm definitely surprised at the scope of what has come to light. These actions directly contradict it, both in letter and spirit.
> I have yet to see any serious abuse of the NSA's power.
Please make a modest effort before making such statements.
1. The fact that the blanket spying exists at all is an abuse. It is a DUI checkpoint on every single road, every day, instead of pulling over swerving drivers.
2. Secret laws, courts = abuse. In America?
3. No oversight, congress un/misinformed = abuse!
4. The sympathetic fisc court itself has ruled many actions have been unconstitutional. Abuse!
5. That the leak we're talking about exists is an abuse!
6. If there have been admitted abuses, the number of non-disclosed must be far larger. Due to #5 we know they are quite possible.
7. Harassment of journalists, families, abuse.
In short, it is abusive from macro to micro. Betterunix's reply points out your multiple-contradictory statements.
I'd bother replying to the rest of your ill-informed statements, but it's clear that you don't understand the systems involved. Read up on it before making such false statements. I really don't need to address your circular logic, that's just sad.
There is no "blanket spying" any more than a police watching traffic go by for speeders is "blanket spying". There's your car analogy.
[0] https://en.wikipedia.org/wiki/Parallel_construction
http://www.reuters.com/article/2013/08/05/us-dea-sod-idUSBRE...
"If the intelligence community collects information pursuant to a valid foreign intelligence tasking that is recognised as being evidence of a crime, [it] can disseminate that information to law enforcement, as appropriate." [1]
[1] http://www.theguardian.com/world/2013/aug/06/justice-departm...
EDIT: where I have written "produce" above I had initially written set up, the course of action is as follows. NSA tip off SOA/DICE re: domestic crime, SOA/DICE instruct DEA/IRS to have police stop suspect at location for e.g. "traffic violation" and create a parallel evidence chain - so that source of information cannot be determined.
So, you support the power of the state over the idea of the fourth amendment (warrant process)? Ok, stating that fact would be more effective than this "that's just sad" tripe.
That those protections were developed over centuries of experience is no matter... founders must be rolling over in their graves (again?).
Also, it's spelled "asymmetric", Che.
Yet, reading what you actually have to say, I strongly feel compelled not to waste my time arguing you literally. I attacked you, because I tire of silly accounts with keyboard-warrior usernames showing up and spewing garbage defending the government with little-to-no rationality. It also makes me angry that someone is being paid with tax-payer dollars to post complete crap.
However, in the interest of the general populace, I'll be happy to point out why I disagree:
Have any of the NSA leaks told us anything we don't know?
Yes. The NSA very strongly painted (in what little time they spent talking about their programs) the picture that the program was used mostly for foreign surveillance, and that blanket domestic spying was absurd, paranoid and not of interest to them. The leaks contradict this. (source: http://www.wired.com/threatlevel/2012/07/nsa-chief-denies-do...)
Haven't the majority of the leaks told our foreign enemies how to avoid being tracked more than anything?
No. The "bad guys" with half a brain were savvy to techniques for avoiding government surveillance before the leaks (source: http://www.hstoday.us/industry-news/general/single-article/n...). That is, al-Qaeda, who aren't exactly the most hi-tech organization in existence (to my understanding - please educate me if I am misinformed), are smart enough to realize that encrypting their traffic is a good idea; more organized groups caught on long ago (source: http://www.pcworld.com/article/110841/article.html).
I have yet to see any serious abuse of the NSA's power.
Since you like name-dropping fallacies: "no true Scotsman fallacy." What constitutes a 'serious' abuse of power is subjective, but my ethical reasoning says that vacuuming up most Americans communications online without explicit knowledge or consent is abuse in and of itself. Further, we've already seen the love interest scandal, which clearly constitutes abuse (by my reasoning).
The fact that they know that low level employees were spying on potential love interests means that they have a system in place to track such abuses.
And yet, the fact still stands that they used taxpayer money to fund a system that stored all of that information on people they were supposed to be serving, misled them about how much of it they had, and then abused it. Whether or not they caught it later is irrelevant.
Leaking those kind of emails can be spun to state the opposite, when those emails are direct evidence that such abuses are tracked and presumably punished.
Moronic, illogical nonsense.
I've seen articles that have said "what if they use this power to subvert political dissidents" Well, what if they actually have checks built into this system as they have claimed and this new information proves?
So what? Does that justify having the information in the first place? I think not; I do not care that the state has the right to cut off my left arm to make cat food, if and only if a supervisory committee agrees that doing so is reasonable. The basic violation of a perceived right is the issue.
Wouldn't that make Snowden a spy with his own self interests at heart, not the interests of the American people? Leaking piece-meal like he has is in his interests, not ours.
Yes, perhaps he is. The thing is, what Snowden is or does, is irrelevant, because I only care about his message, since the discussion is concerned with abuse of authority, and Snowden has little-to-no sanctioned authority to abuse. What's that called when you attack the person instead of the message, AsymetricCom? Oh. Right. Ad hominem.
Look at the scope of these systems. The fact that no abuses have come up (locally) is quite telling, imho.
Once again, the concern is that these systems exist in the first place, not that no abuse has been documented.
When this same type of hardware is in the hands of countries like China, we see these abuses. Is China seeing something we don't and just not telling us? I highly doubt it.
What China does or doesn't do is absolutely irrelevant to the issue of the United States government's actions.
In conclusion, you seem to like to act logical when it's convenient, but abandon all signs of it when making your point.
But to address your point directly, about how I only have rights to my body and property, your statement is meaningless without defining "property." Did you even know what you meant when you wrote that? Would you care to elaborate?
However, if we define a right as something legally-sanctioned, I actually have a lot of rights that aren't strictly body or property related. Further, any government that fails to enforce or violates these rights is in the wrong. Check this out: http://www.law.cornell.edu/constitution/billofrights
If you mean in an absolutist, natural sense, nobody has any goddamned rights, because a right is a man-made concept. Which system are we arguing within?
Your attempt at forming a foundation for a creepy, fascist ideology is very illuminating, though.
the only "foundation" I'm forming is that you need to be aware of who you trust your data to, that you can't assert rights to data which you willingly handed over to third parties with a licence to use that data.
>quietly extorted
No business, that I've seen, has ever been "quietly extorted" I would love to see you prove me wrong.
a) The cases where there are NDAs to be signed, then the data gathering is constrained to one user. The purpose of such NDAs is obviously needed in such cases. And I'm sure that if the business in question was cooperating with criminals willingly, they'll break their NDA to let their buddies know that The Man is on to them. Even in the case of Lavabit, they've never stated otherwise and are transparently using the event for personal publicity.
b) In the cases where metadata is gathered such as business records, the businesses say this in their EULA where they say "we cooperate with government requests for data" along with "we respect your data privacy"
But you're here to mitigate and marginalize thought. You don't care about facts or logic. You can cynically muse about the populace at large, but you help foster the stupidity you decry.
Have a nice day.