Why Silicon Valley sticks up for Snowden

By Peter Swire

Published: January 30, 2014

Is Edward Snowden a whistle-blower or a traitor? There is a vast cultural divide between Silicon Valley and Washington on this issue, and the reasons reveal much about the broader debates about what to do in the wake of his leaks.

In terms of my own perspective, I have written about privacy and the Internet for two decades, working closely with both civil liberties groups and Internet companies. On the government side, I first worked with intelligence agencies in the late 1990s when I chaired White House task forces on encryption and Internet wiretap laws.

As a member of President Barack Obamas Review Group on Intelligence and Communications Technologies, I spoke with numerous people in the intelligence community. Not one said that Snowden was a whistle-blower. The level of anger was palpable.

Part of the anger arises from the daily routine of working with classified materials. Merely carrying a cellphone into a secure facility by mistake amounts to a security violation. Thousands of security officers enforce the rules, and people can and do get fired when they are not scrupulous with classified materials.

Intelligence officers see Snowden as a serial destroyer of classified secrets. He plotted for months to violate the law on a massive scale. He has tipped off foreign adversaries about numerous programs that will require countless hours of work to revise; many will not regain their previous effectiveness.

Even though Snowden rejected all the existing options for a whistle-blower including congressional committees or avenues within the National Security Agency the view from Silicon Valley and privacy groups is much different. Last fall, I asked the leader of a Silicon Valley company about the whistle-blower-vs.-traitor debate. He said that more than 90 percent of his employees would call Snowden a whistle-blower.

Part of that reaction is based on the view that this robust national debate about NSA programs would not be happening had Snowden not leaked what he did.

The Silicon Valley concern about the NSA arises to some extent from a philosophy of anti-secrecy libertarianism. A well-known slogan there is that information wants to be free.

See the article here:
Why Silicon Valley sticks up for Snowden

Report puts Snowden-like leaks as No. 2 threat to US security

WASHINGTON Insiders like Edward Snowden who leak secrets about sensitive U.S. intelligence programs pose a potentially greater danger to national security than terrorists, Americas spy chiefs warned Wednesday in their annual report to Congress on global security risks.

For the first time, the risk of unauthorized disclosures of classified material and state-sponsored theft of data was listed as the second-greatest potential threat to America in a review of global perils prepared by the U.S. intelligence community. The risk followed cyberattacks on crucial infrastructure but was listed ahead of international terrorism.

U.S. officials previously have said it will cost billions of dollars to repair or revamp communications surveillance systems in the wake of the disclosures by Snowden, a former contract employee at a National Security Agency listening post in Hawaii who began leaking classified documents to the media in June and who later fled to Russia.

Appearing before the Senate Intelligence Committee, James Clapper, the director of national intelligence, said the leaks represent the most damaging theft of intelligence information in our history. He urged Snowden to return the material, saying he made the nation less safe and its people less secure.

Weve lost critical foreign intelligence collection sources, including some shared with us by valued partners, Clapper said. Terrorists and other adversaries of this country are going to school on U.S. intelligence sources, methods and tradecraft, and the insights that they are gaining are making our job much, much harder.

Army Lt. Gen. Michael Flynn, who directs the Defense Intelligence Agency, said the leaks had endangered the lives of intelligence operatives and troops. Matt Olsen, heads of the National Counterterrorism Center, said they had made it tougher to track al-Qaida and its affiliates.

What weve seen in the last six to eight months is an awareness by these groups of our ability to monitor communications and specific instances where theyve changed the ways in which they communicate to avoid being surveilled, Olsen said.

Investigators believe Snowden copied 1.7 million documents from NSA servers, the largest breach of classified material in U.S. history, although only a fraction have been disclosed so far. Last summer, a military judge sentenced Army Pvt. Chelsea Manning, who was born Bradley Manning, to 35 years in prison for sending 750,000 classified diplomatic cables, military field reports and other material to WikiLeaks.

Both Snowden and Manning have been condemned by critics as traitors and hailed by supporters as whistle-blowers who exposed government wrongdoing.

Only critics spoke at the hearing. Sen. Susan Collins, R-Maine, said the classified documents Snowden downloaded, if printed out, would form a stack more than three miles high.

More here:
Report puts Snowden-like leaks as No. 2 threat to US security

Tech Giants, Telcos Get OK to Release Stats on NSA Spying

In Obamas speech 10 days ago outlining surveillance reforms, the president promised he would allow corporations like Google, Apple and Microsoft to be more transparent with their customers about NSA spying.

We will also enable communications providers to make public more information than ever before about the orders that they have received to provide data to the government, the president said.

Today, we learned what that means. The Justice Department announced(.pdf)that for the first time corporate America may publicly report a broad range of vague and inexact figures about the number of secret orders they receive from the Foreign Intelligence Surveillance Court.

The companies may begin reporting the number of FISA orders in bands of 1,000. Each company can also report the number of accounts affected collectively by the FISA orders, but, also, only in ranges of 1,000.

Companies were previously blocked from disclosing any of that information.

The change strikes an appropriate balance between the competing interests of protecting national security and furthering transparency, said Deputy Attorney General James Cole in a letter to the general counsels of Yahoo, Microsoft, LinkedIn, Google and Facebook, who had fought for the right to disclose FISA counts to their customers.

The guidelines are roughly the same that already apply to another type of secret order, called a National Security Letter.After a private deal with Google last summer, the government allowed the media giant to report the number of National Security Letters it received and the number of accounts affected by them, all in ranges of 1,000. For 2012, the latest year in which figures were available, Google had said it received 0-999 National Security Letters affecting 1000-1999 accounts.

National Security Letters allow the government to get detailed information on Americans finances and communications without oversight from a judge. The FBI has issued hundreds of thousands of NSLs and has even been reprimanded for abusing them.

FISA orders are potentially broader. FISA orders were issued to telcos under the bulk telephone metadata program NSA whistleblower Edward Snowden disclosed in June.

The companies may publish the figures one every six months, with a six-month delay in reporting periods. The government also ordered a two-year delay for companies to report snooping stats following the first order that is served on a company for a platform, product, or service (whether developed or acquired) for which the company has not previously received such an order.

Excerpt from:
Tech Giants, Telcos Get OK to Release Stats on NSA Spying

Baffle thy enemy: The case for Honey Encryption

12 hours ago by Nancy Owano Credit: Symantec

(Phys.org) Database breaches are making today's headlines, revealing events where thieves scoff up millions of passwords. Security experts meanwhile think about, talk about and work towards fighting against such crimes. A fresh twist in the security arsenal might be to simply baffle criminals by unleashing a flood of data that appears real but is fake. "Honey Encryption" is an approach being proposed to protect sensitive data. You beat attackers by making it difficult to figure out if the password or encryption key they are trying to steal is correct or incorrect.

A discussion about the approach on Wednesday in Threatpost said the tool results in the attacker seeing a plausible-looking password or encryption key which is actually incorrect, and the attacker cannot tell the information is incorrect. The two people behind this Honey Encryption approach is Ari Juels, former chief scientist at computer security company RSA, and Thomas Ristenpart, an assistant professor at the University of Wisconsin.

As it is now, a criminal intruder, with each try of an incorrect key, sees gibberish. The unsuccessful try clearly indicates it is not what he or she wants. With honey encryption, however, trying to guess the password or encryption key becomes mystifying; the attacker is dealing with thousands of, say, fake credit card numbers, and each one looks plausible. A report about their work in MIT Technology Review said Juels was convinced that "by now enough password dumps have leaked online to make it possible to create fakes that accurately mimic collections of real passwords."

In October, Juels had said that "Honeywords and honey-encryption represent some of the first steps toward the principled use of decoys, a time-honored and increasingly important defense in a world of frequent, sophisticated, and damaging security breaches." He said that the honeywords and honey encryption are joint work, respectively, with Ron Rivest and Tom Ristenpart. He said honey-encryption creates "ciphertexts that decrypt under incorrect keys to seemingly valid (decoy) messages."

The Honey Encryption system, meanwhile, will be the subject of a paper later this year when Juels and Ristenpart present their "Honey Encryption: Security Beyond the Brute-Force Bound" at the Eurocrypt conference in May, an event that is focused on cryptographic techniques, in Copenhagen.

Explore further: Research trio crack RSA encryption keys by listening to computer noise

2014 Phys.org

(Phys.org) A trio of researchers in Israel has discovered that it is possible to crack 4096-bit RSA encryption keys using a microphone to listen to high-pitch noises generated by internal computer components. ...

IBM inventors have received a patent for a breakthrough data encryption technique that is expected to further data privacy and strengthen cloud computing security.

Link:
Baffle thy enemy: The case for Honey Encryption

International Journal on Cryptography and Information Security ( IJCIS) – Video


International Journal on Cryptography and Information Security ( IJCIS)
International Journal on Cryptography and Information Security ( IJCIS) is an open access peer reviewed journal that focuses on cutting-edge results in applied cryptography and Information...

By: AIRCC

Read more:
International Journal on Cryptography and Information Security ( IJCIS) - Video