Category Archives: NSA

The National Security Agency is amongst the most secretive of the US intelligence agencies. It employs genius-level coders and mathematicians in order to break codes, gather information on adversaries, and defend the country against digital threats.

Unsurprisingly, the NSA has always to preferred to work in the dark. But ever since the Snowden leaks in 2013, the organization has gradually increased its public presence. A few years ago, it opened a Twitter account (in fact, it was the first profile Edward Snowden followed when he joined in 2015).

And now, its opened a Github account, and has shared several interesting code repositories under the NSA Technology Transfer Program (TTP). So far, it lists 32 different projects, although some of these are coming soon. Many arent new, either, and have been available for some time. SELinux (Security-Enhanced Linux) for example, has been part of the Linux kernel for years.

Im not surprised the NSAs taken this move. For starters, theres a long and proud tradition of technologies making their way from defense and intelligence environments to the general public. The internet is a brilliant example of that. And engaging with techies via Github is a great way to sanitize its image, and potentially recruit talent.

You can check out the NSAs page here.

Read next: Gillette launches online blade delivery service to take on Dollar Shave Club

Continued here:
The NSA (yes, that NSA) has a Github account now - TNW

The American security agency NSA was very secretive in its operations in the past. But with time, and unwanted revelations coming to the surface, the agency started to open up more front of the common population.

NSA already started their Twitter handle after Snowdens revelation and now theyre all set to make their footprint in the open source community. Their GitHub site now contains 32 open source projects, written by the NSA developers, distributed across two accounts. Some of them are coming soon repositories.

However, the NSAs account isnt brand new. It first appeared in 2015, when the agency open sourced a tool called SIMP (System Integrity Management Platform).

These projects have been shared as a part of the NSA Technology Transfer Program (TTP) which acts as a bridge between patented NSA-developed tech and industry, academic institutions, and other research bodies.

The NSA opening up their treasure will help the general public in many ways. In fact, many of the technologies we are currently using, be it the internet, GPS or your Rayban; various defensebodies have been a wellspring for such things.

Check out NSAs new Github site using this link.

Got something to add? Drop your thoughts and feedback.

Read the rest here:
NSA's GitHub Account Has 32 Open Source Projects For People - Fossbytes

A declassified report from the Defense Department Inspector General has been released, according to the New York Times.

The 60-page report commissioned by Congress assesses 7 of the 40 components that the National Security Agency outlined for their Secure the Net initiative. This initiative was put forth to help improve the security of sensitive systems after the Snowden disclosures in 2013.

The NSA, according to the inspector generals report, had some successes, but the overall initiative did not fully meet the intent of decreasing the risk of insider threats to NSA operations and the ability of insiders to exfiltrate data.

According to the Times, the report details how their efforts fell short, including the failure to reduce the number of privileged users who can access sensitive computer systems; their failure to consistently keep data center machine rooms secure, as well as failing to lock the server racks containing highly classified data; and the failure to fully implement software that would monitor users.

The report also noted the agencys failure to declare an exact number of people with abilities to transfer data. The lists containing this information were kept on spreadsheets that were corrupted and are no longer available.

The inspector generals report noted that NSA CIO Gregory Smithberger told the inspector general that the elimination of all insider risks and threats is not feasible. He told the Times, While the media leak events that led to Secure the Net (STN) were both unforeseen and serious, we consider the extensive progress we made in a short time to be a good news story.

The importance of securing classified information, as the report warns, was underscored the same month the inspector generals report was produced, according to the Times. In August 2016, a group called the Shadow Brokers obtained and auctioned off classified hacking tools allegedly from the NSA some of which were dumped online. Those tools were later seen as part of the global WannaCry ransomware attack.

We welcome the observations and opportunities for improvement offered by the U.S. Defense Departments Inspector General, Vanee Vines, spokesperson for the NSA told the Times. NSA has never stopped seeking and implementing ways to strengthen both security policies and internal controls.

See more here:
Secure the Net initiative found to be an overall failure for NSA - Federal Times

Bradenton Herald

Demand truth from NSA -- or are we slaves to Russia? Bradenton Herald Consider why the National Security Agency decided to keep secret which states' voter rolls and voting software was hacked? Did Reality Winner (her real name!) discover the tip of an iceberg that the NSA and even the intelligence committees of the House ...

Continued here:
Demand truth from NSA -- or are we slaves to Russia? - Bradenton Herald

After a leaked National Security Agency document alleged Russian operatives attempted to hack into a Florida voter polling software company used by Humboldt County in the 2016 presidential election, California Secretary of State Alex Padilla sent a letter to the federal agency Thursday questioning why the state was not notified earlier.

As the chief elections officer in the most populous state in the nation, I am seriously concerned about the NSAs failure to provide timely and critical information to Americas elections officials, Padilla wrote to NSA Director Admiral Michael Rogers. ... We must be prepared and remain vigilant. Proper preparation requires clear and consistent collaboration among federal, state, and local officials. The NSA cannot afford to sit on critical information that could be used to defend against cyber-attacks.

The five-page classified National Security Agency memo from May that was leaked to the news website The Intercept stated Russias military intelligence unit, the GRU, hacked into the Florida-based voting software company, VR Systems, in August 2016. VR Systems provided voter polling software to Hart InterCivic, which the Humboldt County Elections Office contracted with to provide voter e-polling software.

County officials said that there is no evidence that the hacking attempts were successful or that Humboldt County was a target, and that the e-polling software is not involved in vote counting.

Humboldt County is the only county in the state that contracted through VR Systems, according to the Governors Office of Emergency Services.

The Office of Emergency Services and Secretary of States Office offered aid to the county last week to bolster its cyber-security systems, but County Clerk, Recorder and Registrar of Voters Kelly Sanders and Information Technology Division Director Jim Storm said they are confident in the protections already in place.

Yes, [the Secretary of State] did some preliminary checks looking at known email addresses, Storm said to the Times-Standard last week. There was no evidence that we were hacked or anything like that.

Will Houston can be reached at 707-441-0504.

Advertisement

Read more:
Secretary of state expresses 'serious concern' with NSA after hacking document leaked - Eureka Times Standard

New York Times

Post-Snowden Efforts to Secure NSA Data Fell Short, Report Says New York Times The N.S.A. failed to consistently lock racks of servers storing highly classified data and to secure data center machine rooms, according to the report, an investigation by the Defense Department's inspector general completed in 2016. The report was ...

Here is the original post:
Post-Snowden Efforts to Secure NSA Data Fell Short, Report Says - New York Times

A pair of senior U.S. senators is pressing the Trump administration for information about how the Augusta woman at the center of the National Security Agency leak investigation was screened for her security clearance.

Senate Homeland Security and Governmental Affairs Committee Chairman Ron Johnson, R-Wisconsin, and Ranking Member Clair McCaskill, a Missouri Democrat, sent seven questions about Reality Leigh Winner and the governments vetting process to the Office of Personnel Management this week.

Among other things, the senators want to know which federal agency initially screened Winner and when, when her clearance was last reinvestigated and whether those screenings were done by federal employees or contractors? They also want to know the size of the governments current backlog of security clearance reinvestigations.

Winner worked as a federal contractor at a U.S. government agency in Georgia between February and June and had a top-secret security clearance. A federal grand jury has indicted her on a single count of "willful retention and transmission of national defense information for allegedly leaking to the news media a classified NSA report on Russias meddling in the U.S. election system. Before she was indicted, Winner spent months unleashing a tirade of social media posts calling President Donald Trump, among other things, an "orange fascist."

Winner faces up to 10 years in prison and $250,000 in fines, plus up to three years of supervised release and a $100 special assessment. She has pleaded not guilty to the charge. Her next court hearing is set for June 27 in Augusta. TMZ recently publishedvideo of her exercising in an outdoor area of the Lincoln County Jail,wheresheisbeingdetained.

Ms. Winner allegedly chose to put Americans and our national security at risk when she leaked classified materials, Johnson said in a joint statement with McCaskill. It is my hope that OPM will do a thorough review of her security clearance, and determine if it was granted appropriately.

McCaskill said: The leaking of classified information jeopardizes our national security. We need to determine if Ms. Winners security clearance process was handled correctly or if we missed any red flags.

The Office of Personnel Management had no immediate comment Friday.

Gary Davis and Billie Winner-Davis, stepfather and mother of Reality Leigh Winner, spoke to The Atlanta Journal-Constitution about their daughter. Video by Hyosub Shin/AJC. Hyosub Shin/AJC

Go here to see the original:
Senators seek answers about accused NSA leaker's security ... - Atlanta Journal Constitution

Do we have a voting system we can trust, that is accurate, secure and just? This question, raised by the 2016 multi-state recount effort, is roaring back at us louder than ever after the Intercepts publication last week of a leaked National Security Agency report documenting with unprecedented detail a hacking scheme targeting components of the U.S. voting system.

The NSA report shows how the hack first used a spear phishing attack in August on the employees of a company producing voter registration software. Information from that hack was then used in a second phishing email about a week before the election targeting over 100 government employees, presumably local election officials, as the Intercept put it, to trick [them] into opening Microsoft Word documents invisibly tainted with potent malware that could give hackers full control over the infected computers.

Not stated in the report is the fact that infected computers of local elections officials could potentially yield passwords enabling the attack to spread to the full spectrum of election systems under control of those officials. That includes everything from voter rolls to voting machines to vote tabulating and reporting.

Some cybersecurity experts presume the hack was exploratory rather than an actual attack, given the short time until the election. Still, this remains unproven, and the leaked NSA report raises disturbing questions. In particular, how far did this particular hack penetrate into the election system? Were there other successful hacks into the 2016 election? And can we trust our election results going forward?

Todays voting system is a sprawling network of hardware, software and local election officials that integrate voter registration, electronic voting, tabulating vote totals, and reporting these results to precinct, county, state and national centers that compile final vote results.

As voting-security expert Alex Halderman stated in the Intercept article, I would worry about whether an attacker who could compromise the poll book vendor might be able to use software updates ... to also infect the election management system that programs the voting machines themselves. Once you do that, you can cause the voting machine to create fraudulent counts.

The bottom line is this: The voting machines and software must be examined in order to conclude that the vote has not been hacked, and to protect our elections going forward. This was the demand made by the 2016 recount effort. The imperative to do so now is stronger than ever. In fact, the universe of investigation should be expanded, based on this report, to include hardware and software involved in vote tabulation and reporting, as well as voting machines themselves.

The integrity of our elections is paramount. The issue transcends partisan politics. We are all harmed by corruption of our elections and the cynicism it breeds, contributing to the loss of confidence in our political system expressed by 90 percent of Americans according to an AP/NORC poll last year. Hacking is just one part of the problem. Elections are likewise degraded by racially-biased voter suppression, the control of big money and big media over our elections, the suppression of independent and third party voices in debates and media and more. A vote we can believe in is the bedrock foundation of a functioning democracy, as Judge Mark Goldsmith noted in the initial ruling to proceed with the Michigan recount. That bedrock has gone missing.

The urgent need to respond to the NSA revelations of election hacking must not be lost beneath the outrage and political controversy over alleged Russian responsibility for the attack. Fortunately, we don't need to settle the debate over who hacked into our election system in order to proceed urgently to safeguard our elections. In fact, we must protect our elections from all potential interference, whether from foreign state actors, domestic political partisans, gangster networks, lone wolves or private corporations, including companies who control the voting software.

In any event, identifying and punishing the perpetrator/s will not make our future votes secure. Truly solving the problem of hacking may well require the resumption of a long-stalled effort to create an international treaty on cyberwarfare. Perhaps, as Microsoft President Brad Smith suggests, its time for a Geneva Convention on Cybersecurity.

In the meantime, future, and no doubt current, hacking into our election system can and must be stopped by adopting common sense safeguards long advocated by the election integrity movement and advanced by the recount effort. We must end the use of hack-friendly, error-prone electronic voting machines, and revert to hand-marked paper ballots, ideally counted by hand or by optical scanners carefully monitored by cross-checking against paper ballots (a process known as statistical audits). Hand recounts of the paper ballots should be readily available whenever elections are very close, or when legitimate concerns are raised about hacking, corruption or error at any level of the system. These safeguards must be in place in time to secure the 2018 elections.

A vote we can trust must not only be accurate and secure. It must also be just and true to the promise of democracy. That means we must guarantee the unimpeded right to vote and end racist voter suppression schemes that cost millions of Americans the right to vote, including voter ID laws, felon disenfranchisement, and Interstate Crosscheck. It means ending discrimination against alternative parties and independents in getting on the ballot, in the debates and in the media. It means getting big money out of our elections, and enacting improved voting systems like ranked choice voting and proportional representation that give voters the freedom to vote their values instead of their fears. Fixing our broken, unjust election system is no less urgent than fixing hackable electronic voting.

In this age of unprecedented converging crises of our economy, ecology, peace and democracy, we cannot wait to build the America we deserve. To do so, we need a voting system we can trust.

Dr. Stein was the 2016 Green Party Presidential candidate who initiated a multi-state recount effort backed by leading election integrity experts, largely due to concerns about the security of our voting system that are extremely topical in light of recent revelations.

Follow this link:
OPINION: Leaked NSA report rings alarm sounded by 2016 election recount - The Hill (blog)

The Hill

Foreign investigators join NSA in blaming North Korea for Wannacry: report The Hill The BBC is reporting that British-lead international investigation into the origins of Wanna Cry has come to the same conclusions as the NSA and a number of private firms: North Korea was behind the attacks. The Wanna Cry ransomware held hundreds of ... NSA ties North Korea to WannaCry attacks: 5 things to knowBecker's Hospital Review NSA points to North Korea as culprit in WannaCry ransomware attackThe Hankyoreh all 42 news articles »

Read the original post:
Foreign investigators join NSA in blaming North Korea for Wannacry: report - The Hill

The ODNI has released several documents in response to FOIA lawsuits (EFF, ACLU). The EFF scored 18 of these (handy zip link here) and the ACLU seven. The ACLU's batch has proven more interesting (at least initially). One document it obtained shows a tech company challenged a Section 702 surveillance order in 2014. The challenge was shut down by the FISA court, but with the exception of Yahoo's short-lived defiance, we haven't seen any other evidence of ISP resistance to internet dragnet orders.

Included in the ACLU's batch is a 2008 FISA Court transcript [PDF] that's particularly relevant to the NSA's voluntary shutdown of its "about" collection. In it, the NSA discusses its filtering and oversight procedures, which were already problematic nearly a decade ago.

There are some really interesting tidbits to be gleaned from the often heavily-redacted proceedings, including this statement, which makes it clear the NSA engaged in wholly-domestic surveillance prior to the FISA Amendments Act.

THE COURT: All right. Well, what about the non-U.S. person status, which of course is new under the FISA Amendments Act? Are you going to be changing anything in terms of focusing on that?

[REDACTED GOV'T RESPONDENT]: We already sort of do with respect to the U.S. person status is so intertwined with the location of the target [REDACTED] to the extent that in the past NSA.would actually affirmatively identify targeted U.S. persons to us on the sheets, because one of the additional fields that they put in the sheets is basically a blurb, an explanation and a description of the target.

Clearly, we're not allowed to target US persons anymore, so I don't anticipate seeing any such descriptions on the sheets. But again, since the status of the person, the determination of how that is made is so intertwined with the same information upon which NSA relies to make a foreignness determination, that it would be hard for us not to identify such information as we're conducting the reviews.

Which, of course, means the NSA was allowed to target US persons and their communications previously, contradicting statements made by US officials, including President George W. Bush and Vice President Dick Cheney.

It's stated earlier in the transcript that the NSA does a few things to help minimize examination of US persons' communications. But they're not great. The NSA runs spot checks on analysts' transactions, deploys filters, and relies on self-reporting to guard against Fourth Amendment violations. It sounds like quite a bit, but the details show it's not nearly enough. To start with, the filters meant to filter out US persons' communications don't work.

COURT: The NSA minimization procedures, you're stating, 'contain a provision for allowing retention of information because of limitations on NSA's ability to filter communications.' My question I had was is the filter discussed in targeting the same filtering. I just wanted to understand that, and apparently it is. [The rest of the court's question is redacted.]

GOV'T: I think the inclusion of that provision in the minimization procedures was intended to be prophylactic in the event that the filters don't necessarily work, and NSA has represented that it's been their experience with the filters and [redacted] this provision basically captures instances where the filters may not work in every instance.

And there's a good reason why they won't work "in every instance." Further unredacted discussion reveals the NSA partially relies on an IP address blacklist to filter out US persons' communications. This is better than nothing, but still a long way from being a strong positive indicator of a target's (or incidental target's) location.

The court then asks about the limitations of the filters and we get several fully-redacted pages as an answer.

The court also asks about the "about" collection -- where targets are discussed but the communications do not directly involve NSA targets.The judge wants to know how often this is being used rather than the more-targeted "to/from" collection and how often it results in incidental collection. Unsurprisingly, the government can't say how often this happens. This is because the NSA saw no reason to track these searches.

GOV'T: As far as the percentage number, we don't have a number for that, because as I mentioned earlier, when we [redacted] we find to's and froms and [redacted] so we don't categorize those separately to be able to count those communications as abouts.

The court then asks why it's not possible to limit the collection to to's and froms. The government's response is that collecting it all just works better for the NSA, even though it apparently possesses the technical ability to keep these collections separate.

It is technically feasible. The problem with doing so is if you end up discarding a number of communications that are truly to-froms that you should be able to collect but [redacted]...

So by trying to limit us to no abouts, then we end up cutting out those kind of communications as well, truly to-froms. So it would be -- we're not surgical enough to take that out of the equation without impacting our ability to do to-froms effectively.

And later in the discussion, there's a bit of a bombshell about the "about" collection. The NSA shut it down because it couldn't find a way to prevent incidental collection of US persons' communications. In this transcript, the government points out incidental collection is just as likely with to-from targeting.

COURT: Is it more or less likely to pick up U.S.-person information in an about than a to or from?

MR. OLSEN: I don't know the answer in practice. At least from my perspective in theory, I wouldn't see why it would be more likely than a targeted to or from collection where the target's outside the United States where there's a similar possibility that that target would be in communication with someone in the United States, with a U.S. person in the United States.

If this is true, the elimination of the "about" collection doesn't do much to curtail incidental collection. And almost a decade ago, the NSA was already making it "impossible" to comply with Congressional requests for incidental collection numbers by refusing to separate its collections, even with the FISA Court raising questions about its Fourth Amendment implications.

Continue reading here:
2008 FISA Transcript Shows NSA Already Knew It Might Have An Incidental Collection Problem - Techdirt