In NSA-intercepted data, those not targeted far outnumber …

Ordinary Internet users, American and non-American alike, far outnumber legally targeted foreigners in the communications intercepted by the National Security Agency from U.S. digital networks, according to a four-month investigation by The Washington Post.

Nine of 10 account holders found in a large cache of intercepted conversations, which former NSA contractor Edward Snowden provided in full to The Post, were not the intended surveillance targets but were caught in a net the agency had cast for somebody else.

Many of them were Americans. Nearly half of the surveillance files, a strikingly high proportion, contained names, e-mail addresses or other details that the NSA marked as belonging to U.S. citizens or residents. NSA analysts masked, or minimized, more than 65,000 such references to protect Americans privacy, but The Post found nearly 900 additional e-mail addresses, unmasked in the files, that could be strongly linked to U.S. citizens or U.S.residents.

The surveillance files highlight a policy dilemma that has been aired only abstractly in public. There are discoveries of considerable intelligence value in the intercepted messages and collateral harm to privacy on a scale that the Obama administration has not been willing to address.

Among the most valuable contents which The Post will not describe in detail, to avoid interfering with ongoing operations are fresh revelations about a secret overseas nuclear project, double-dealing by an ostensible ally, a military calamity that befell an unfriendly power, and the identities of aggressive intruders into U.S. computer networks.

Months of tracking communications across more than 50 alias accounts, the files show, led directly to the 2011 capture in Abbottabad of Muhammad Tahir Shahzad, a Pakistan-based bomb builder, and Umar Patek, a suspect in a 2002 terrorist bombing on the Indonesian island of Bali. At the request of CIA officials, The Post is withholding other examples that officials said would compromise ongoing operations.

Many other files, described as useless by the analysts but nonetheless retained, have a startlingly intimate, even voyeuristic quality. They tell stories of love and heartbreak, illicit sexual liaisons, mental-health crises, political and religious conversions, financial anxieties and disappointed hopes. The daily lives of more than 10,000 account holders who were not targeted are catalogued and recorded nevertheless.

In order to allow time for analysis and outside reporting, neither Snowden nor The Post has disclosed until now that he obtained and shared the content of intercepted communications. The cache Snowden provided came from domestic NSA operations under the broad authority granted by Congress in 2008 with amendments to the Foreign Intelligence Surveillance Act. FISA content is generally stored in closely controlled data repositories, and for more than a year, senior government officials have depicted it as beyond Snowdens reach.

The Post reviewed roughly 160,000 intercepted e-mail and instant-message conversations, some of them hundreds of pages long, and 7,900 documents taken from more than 11,000 online accounts.

The material spans President Obamas first term, from 2009 to 2012, a period of exponential growth for the NSAs domestic collection.

See original here:
In NSA-intercepted data, those not targeted far outnumber ...

The NSA Said Edward Snowden Had No Access to Surveillance …

For more than a year, NSA officials have insisted that although Edward Snowden had access to reports about NSA surveillance, he didn't have access to the actual surveillance intercepts themselves. It turns out they were lying.1 In fact, he provided the Washington Post with a cache of 22,000 intercept reports containing 160,000 individual intercepts. The Post has spent months reviewing these files and estimates that 11 percent of the intercepted accounts belonged to NSA targets and the remaining 89 percent were "incidental" collections from bystanders.

So was all of this worth it? The Post's review illustrates just how hard it is to make that judgment:

Among the most valuable contentswhich The Post will not describe in detail, to avoid interfering with ongoing operationsare fresh revelations about a secret overseas nuclear project, double-dealing by an ostensible ally, a military calamity that befell an unfriendly power, and the identities of aggressive intruders into U.S. computer networks.

Months of tracking communications across more than 50 alias accounts, the files show, led directly to the 2011 capture in Abbottabad of Muhammad Tahir Shahzad, a Pakistan-based bomb builder, and Umar Patek, a suspect in a 2002 terrorist bombing on the Indonesian island of Bali. At the request of CIA officials, The Post is withholding other examples that officials said would compromise ongoing operations.

Many other files, described as useless by the analysts but nonetheless retained, have a startlingly intimate, even voyeuristic quality. They tell stories of love and heartbreak, illicit sexual liaisons, mental-health crises, political and religious conversions, financial anxieties and disappointed hopes. The daily lives of more than 10,000 account holders who were not targeted are catalogued and recorded nevertheless.

If Snowden's sample is representative, the population under scrutiny in the PRISM and Upstream programs is far larger than the government has suggested. In a June 26 "transparency report, the Office of the Director of National Intelligence disclosed that 89,138 people were targets of last year's collection under FISA Section 702. At the 9-to-1 ratio of incidental collection in Snowden's sample, the office's figure would correspond to nearly 900,000 accounts, targeted or not, under surveillance.

The whole story is worth a read in order to get a more detailed description of what these intercepts looked like and who they ended up targeting. In some ways, the Snowden intercepts show that the NSA is fairly fastidious about minimizing data on US persons. In other ways, however, the NSA plainly stretches to the limitand probably beyondthe rules for defining who is and isn't a US person. Click the link for more.

1Naturally, the NSA has an explanation:

Robert S. Litt, the general counsel for the Office of the Director of National Intelligence, said in a prepared statement that Alexander and other officials were speaking only about "raw" intelligence, the term for intercepted content that has not yet been evaluated, stamped with classification markings or minimized to mask U.S. identities.

"We have talked about the very strict controls on raw traffic" Litt said. "Nothing that you have given us indicates that Snowden was able to circumvent that in any way.

More here:
The NSA Said Edward Snowden Had No Access to Surveillance ...

The Latest Snowden Leak Is Devastating to NSA Defenders

The agency collected and stored intimate chats, photos, and emails belonging to innocent Americansand secured them so poorly that reporters can now browse them at will.

Edward Snowden's new refugee document granted by Russia is seen during a news conference on August 1, 2013. (Reuters)

Consider the latest leak sourced to Edward Snowden from the perspective of his detractors. The National Security Agency's defenders would have us believe that Snowden is a thief and a criminal at best, and perhaps a traitorous Russian spy. In their telling, the NSA carries out its mission lawfully, honorably, and without unduly compromising the privacy of innocents. For that reason, they regard Snowden's actions as a wrongheaded slur campaign premised on lies and exaggerations.

But their narrative now contradicts itself. The Washington Post's latest article drawing on Snowden's leaked cache of documents includes files "described as useless by the analysts but nonetheless retained" that "tell stories of love and heartbreak, illicit sexual liaisons, mental-health crises, political and religious conversions, financial anxieties and disappointed hopes. The daily lives of more than 10,000 account holders who were not targeted are catalogued and recorded nevertheless."

The article goes on to describe how exactly the privacy of these innocents was violated. The NSA collected "medical records sent from one family member to another, rsums from job hunters and academic transcripts of schoolchildren. In one photo, a young girl in religious dress beams at a camera outside a mosque. Scores of pictures show infants and toddlers in bathtubs, on swings, sprawled on their backs and kissed by their mothers. In some photos, men show off their physiques. In others, women model lingerie, leaning suggestively into a webcam ..."

Have you ever emailed a photograph of your child in the bathtub, or yourself flexing for the camera or modeling lingerie? If so, it could be your photo in theWashington Postnewsroom right now, where it may or may not be secure going forward. In one case, a woman whose private communications were collected by the NSA found herself contacted by a reporter who'd read her correspondence.

Snowden defenders see these leaked files as necessary to proving that the NSA does, in fact, massively violate the private lives of American citizens by collecting and storing contentnot "just" metadatawhen they communicate digitally. They'll point out that Snowden turned these files over to journalists who promised to protect the privacy of affected individuals and followed through on that oath.

What about Snowden critics who defend the NSA? Ben Wittes questions the morality of the disclosure:

Snowden here did not leak programmatic information about government activity. He leaked many tens of thousands of personal communications of a type that, in government hands, are rightly subject to strict controls. They are subject to strict controls precisely so that the woman in lingerie, the kid beaming before a mosque, the men showing off their physiques, and the woman whose love letters have to be collected because her boyfriend is off looking to join the Taliban dont have to pay an unnecessarily high privacy price. Yes, thePosthas kept personal identifying details from the public, and that is laudable. But Snowden did not keep personal identifying details from thePost. He basically outed thousands of peopleinnocent and notand left them to the tender mercies of journalists. This is itself a huge civil liberties violation.

The critique is plausiblebut think of what it means.

Originally posted here:
The Latest Snowden Leak Is Devastating to NSA Defenders

Secret code indicates NSA tracks users of privacy tools, report says

A NSA spying tool is configured to snoop on an array of privacy programs used by journalists and dissidents, according to an analysis of never-before-seen code leaked by an unknown source.

The code, published as part of investigation by two German broadcasters last week, contains tracking specifications for XKeyScore, a powerful NSA program that collects and sorts intercepted data.

[ It's time to rethink security. Two former CIOs show you how to rethink your security strategy for today's world. Bonus: Available in PDF and e-book versions. | Stay up to date on the latest security developments with InfoWorld's Security Central newsletter. ]

XKeyScore came to light in documents leaked by former NSA contractor Edward Snowden, but some observers believe the latest information -- which adds greater detail on how the agency monitors people trying to protect their privacy online -- may have not come from the documents he passed to journalists.

The broadcasters, Norddeutscher Rundfunk and Westdeutscher Rundfunk, did not reveal their source for the code but claimed in a report that former NSA employees and experts "are convinced that the same code or similar code is still in use today,"

The report describes how the code enables XKeyScore to track users connected to The Onion Router, known as TOR, a network that encrypts data traffic through random servers in order to obscure identification of a web surfer.

TOR, a project initially started by the U.S. Navy, is considered a critical privacy enhancing tool and one that has hampered NSA surveillance in the past.

The report contends the NSA is monitoring two TOR servers in Germany. One is run by Sebastian Hahn, a 28-year-old computer science student at the University of Erlangen. The server, known as a Directory Authority, a critical part of TOR's infrastructure, supplies a list of relays in the network to computers connecting to the network.

The NSA's collection of metadata about people connecting to the server puts those people at risk, the report quoted Hahn as saying.

The NSA also tracks the use of non-public TOR relays, which are supplied to users upon request in countries known to actively block TOR relays, such as in China and Iran, the report said.

See original here:
Secret code indicates NSA tracks users of privacy tools, report says

NSA intercepted “startlingly intimate” data on ordinary citizens: Snowden

July 7, 2014 - 14:34 AMT

PanARMENIAN.Net - Ordinary internet users targeted by NSA spying far outnumber the foreigners who are legally monitored, a Washington Post report revealed. The data intercepted includes startlingly intimate material which is automatically retained by the NSA, RT reported.

Analysis of Snowdens data by the U.S. publication has shown the extent to which the spy agency inadvertently gathers the account data of ordinary Americans and non-Americans. Spy-turned-whistleblower Edward Snowden provided the Post with a cache of leaked data from the U.S. National Security Agency.

The data analysis revealed that 9 out of 10 internet users who were caught in NSA data sweeps over a four-year period were not the intended surveillance targets. According to the Post, a strikingly high proportion of the files gathered by the agency contained email addresses, names and addresses of U.S. citizens or residents.

As part of the investigation, the Post reviewed around 160,000 intercepted emails and instant message conversations, as well as 7,900 documents pulled from 11,000 online accounts. The information was collected between 2009 and 2012, spanning President Barack Obamas first term in power.

A large proportion of the data classified as useless by analysts contained startlingly intimate material. This included stories of love and heartbreak, illicit sexual liaisons, mental-health crises, political and religious conversions, financial anxieties and disappointed hopes. The NSA also gathered around 5,000 personal photos.

In some photos, men show off their physiques. In others, women model lingerie, leaning suggestively into a webcam or striking risque poses in shorts and bikini tops.

Even though these files were branded as useless by intelligence analysts, they were still retained by the NSA and can be accessed at any time by analysts should the need arise. In spite of criticism that the NSAs intelligence practices are almost Orwellian in nature, the U.S. government has yet to address the issue of ordinary user data that is inadvertently picked up by the NSAs dragnet spy programs.

The Post writes that incidental collection of third-party data by intelligence programs is unavoidable in most forms of surveillance. Under current American law, the authorities must obtain a warrant from a special surveillance court in order to intercept the communications of an individual. To do this, there must be reasonable evidence the target has valuable information on terrorist organizations or foreign governments that could be of value.

Although a large quantity of the data gathered in the NSAs dragnet programs was inconsequential, some crucial intelligence was gleaned from the files, the Post writes. It cites the 2011 capture of a Pakistan-based bomb builder who was caught as a result of months of tracking communications across dozens of alias accounts.

See the original post here:
NSA intercepted “startlingly intimate” data on ordinary citizens: Snowden

Some files need encryption and some files don’t

Andre De Beer asked if certain files on his hard drive need encryption. Some do and some dont.

If youre like the vast majority of PC users, you have no need to encrypt everything on your hard drive. Before you decide to encrypt anything, ask yourself this: What would you lose if criminals or the NSA got their hands on these files? If the answer is nothing, those files dont need encryption.

[Have a tech question? Ask PCWorld Contributing Editor Lincoln Spector. Send your query to answer@pcworld.com.]

Of course there are exceptions. If youre an accountant, a lawyer, or a spy, you probably should have your entire hard drive encrypted. If everything you work on is confidential, then everything has to be protected.

But what should the rest of us encrypt? Bank statements and legal documents, of course. Any file containing your (or anyone elses) social security number, bank account information, drivers license, or credit card information should be encrypted.

Theres absolutely no reason to encrypt photos and videosunless theyre the type of photos and videos that you want to hide from your family.

Yes, Im aware of the many good arguments for encrypting everything. Multitasking operating systems such as Windows can leak data everywhere. If your entire hard drive is encrypted, those leaks will be encrypted as well.

On the other hand, if your entire hard drive is encrypted, the very act of logging onto Windows effectively opens the vault. Whenever youre at your computer, the private files are accessible. They could be read over public Wi-Fi, or by a co-worker when you take a break.

Thats why I prefer an encrypted vault that I open when I need it and close when I dont. (And I never open it when using public Wi-Fi.)

What encryption program should you use? Not so long ago, I would have said Truecrypt. But nowwell, try these alternatives.

Continue reading here:
Some files need encryption and some files don't

The IRS wages war on open source nonprofits

The IRS has denied one open source software company's request to become a nonprofit.

I'm going to take the most controversial stance I have ever taken:

The IRS is a big bully.

(OK. Maybe that wasn't exactly controversial.)

We're all familiar with the ongoing controversy of the IRS targeting of non-profit organizations that are (potentially) affiliated with a political movement -- most notably conservative ones. But one thing that has, until now, simply not gotten enough attention is the IRS targeting of Open Source non-profit organizations.

That's right. The IRS has, in essence, waged war against not-for-profit groups that make Free and Open Source software.

This week, it was announced that the IRS has officially deniedYorba's -- an organization that focuses on Free Software such as Shotwell and Geary -- request to be a 501(c)(3) non-profit. (You can read the full text of from the IRS here.) This could possibly be a one-time, specific case, one that may not even have any relevance to other organizations.

But the wording that the IRS chose to use in denying their status is deeply troubling.

"You have a substantial nonexempt purpose because you develop software published under open source compatible licenses that authorize use by any person for any purpose, including nonexempt purposes such as commercial, recreational, or personal purposes, including campaign intervention and lobbying."

What this means: The IRS says that Yorba produces Open Source software that could be used by anyone. It is possible that a commercial company (aka "Not a non-profit") might use that software, in some way, without Yorba's knowledge. Therefore, Yorba cannot possibly be a non-profit.

See the article here:
The IRS wages war on open source nonprofits