Sunday, December 29, 2013

NSA Snowden Releases Tally Update - 803 Pages

29 December 2013. Add 4 pages to Der Spiegel. Tally now 803 pages (~1.4%) of reported 58,000. NSA head claims 200,000 (~.40% of that released).
24 December 2013. Add 2 pages to Washington Post.
23 December 2013
http://www.adn.com/2013/12/22/3243451/pincus-snowden-still-has-a-road.html
We've yet to see the full impact of former National Security Agency contractor Edward Snowden's unauthorized downloading of highly classified intelligence documents.
Among the roughly 1.7 million documents he walked away with -- the vast majority of which have not been made public -- are highly sensitive, specific intelligence reports, as well as current and historic requirements the White House has given the agency to guide its collection activities, according to a senior government official with knowledge of the situation.
The latter category involves about 2,000 unique taskings that can run to 20 pages each and give reasons for selective targeting to NSA collectors and analysts. These orders alone may run 31,500 pages.
13 December 2013. Add 26 pages to Trojkan (SVT). Tally now 797 pages (~1.4%) of reported 58,000. NSA head claims 200,000 (~.40% of that released). Australia press reports "up to 20,000 Aussie files."
Rate of release over 6 months, 132.8 pages per month, equals 436 months to release 58,000, or 36.3 years. Thus the period of release has decreased in the past month from 42 years.
12 December 2013. Belatedly add 27 pages to Guardian and 18 pages to Washington Post.


21 November 2013. See also EFF and ACLU accounts:
https://www.eff.org/deeplinks/2013/11/nsa-spying-primary-sources
https://www.aclu.org/nsa-documents-released-public-june-2013


3 November 2013
47 42 Years to Release Snowden Documents
Out of reported 50,000 pages (or files, not clear which), about 446 514 pages (>1% 1%) have been released over 5 months beginning June 5, 2012. At this rate, 89 100 pages per month, it will take 47 42 years for full release. Snowden will be 77 72 years old, his reporters hoarding secrets all dead.
NY Times, 3 November 2013:
Whatever reforms may come, Bobby R. Inman, who weathered his own turbulent period as N.S.A. director from 1977 to 1981, offers his hyper-secret former agency a radical suggestion for right now. “My advice would be to take everything you think Snowden has and get it out yourself,” he said. “It would certainly be a shock to the agency. But bad news doesn’t get better with age. The sooner they get it out and put it behind them, the faster they can begin to rebuild.”



Outlet Pages
The Guardian 265
Washington Post 202
Der Spiegel 23
O Globo Fantastico ~87
New York Times 118 (82 joint)
ProPublica 89 (82 joint)
Le Monde 20
Dagbladet 13
NRC Handelsblad 4
Huffington Post 3
CBC 9
The Globe and Mail 18
SVT 2
L'Espresso 3
Trojkan (SVT) 29




Timeline of releases:
29 December 2013. Add 4 pages to Der Spiegel.
24 December 2013. Add 2 pages to Washington Post.
13 December 2013. Add 26 pages to Trojkan (SVT).
12 December 2013. Belatedly add 27 pages to Guardian and 18 pages to Washington Post.
11 December 2013. Belatedly add 25 pages to Guardian.
11 December 2013. Belatedly add 74 pages to Washington Post.
10 December 2013. Add 2 pages to CBC.
10 December 2013. Add 4 pages to CBC (duplicate of previous source).
9 December 2013. Add 3 pages to Trojkan. Add 2 pages to Guardian. Add 82 pages to New York Times and ProPublica (joint).
6 December 2013. Add 3 pages to L'Espresso.
5 December 2013. Add 2 pages to SVT (Swedish TV).
5 December 2013. Add 1 page to Washington Post.
4 December 2013. Add 3 pages to Washington Post.
2 December 2013. Add 3 pages to CBC.
30 November 2013. Add 18 pages to The Globe and Mail.
30 November 2013. Add 3 pages to NRC Handelsblad.
29 November 2013. Add 1 page to CBC.
27 November 2013. Add 3 pages to Huffington Post.
26 November 2013. Add 4 pages to Washington Post.
23 November 2013. Add 1 page to NRC Handelsblad.
23 November 2013. Add 5 pages to New York Times.
22 November 2013. Add 10 pages to Dagbladet.
18 November 2013. Add 6 pages to The Guardian.
17 November 2013. Add two images to Der Spiegel.
4 November 2013. Add 14 pages to Washington Post.
3 November 2013. A reports an additional 54 slides for O Globo Petrobas.
3 November 2013. Add 22 pages to New York Times.
2 November 2013. Add 13 pages to Guardian, 11 are duplicates.
31 October 2013. Add 4 pages to Washington Post.
29 October 2013. Add 3 pages to Der Spiegel
27 October 2013. Add 2 pages to Der Spiegel.
25 October 2013. Add 4 pages to Le Monde.
22 October 2013. Add 5 pages to Le Monde.
21 October 2013. Add 11 pages to Le Monde, 8 are duplicates.
20 October 2013. Add 1 page to Der Spiegel.
13 October 2013. Add 4, 7 and 9 pages to Washington Post.
8 October 2013. Add 7 pages to O Globo: CSE spying on Brazilian ministry, reported 7 October 2013.
6 October 2013. Add Snowden pages published by Washington Post, Der Spiegel, O Globo Fantastico, New York Times, ProPublica. Some are duplicates(*).


5 October 2013
26 Years to Release Snowden Docs by The Guardian
Out of reported 15,000 pages, The Guardian has published 192 pages in fourteen releases over four months, an average of 48 pages per month, or 1.28% of the total. At this rate it will take 26 years for full release.
Edward Snowden will be 56 years old.
Glenn Greenwald will be 72.
Laura Poitras will be 75.
Alan Rusbridger will be 86.
Barton Gellman will be 78.
Julian Assange will be 68.
Chelsea Manning will be 52.
Keith Alexander will be 88.
Barack Obama will be 78.
Daniel Ellsberg will be 108.
This author will be 103.



Number Date Title Pages


The Guardian
265
20 9 December 2013 Spying on Games 2
18 18 November 2013 DSD-3G 6
19 1 November 2013 PRISM, SSO
SSO1 Slide
SSO2 Slide
13*
18 4 October 2013 Types of IAT Tor 9
17 4 October 2013 Egotistical Giraffe 20*
16 4 October 2013 Tor Stinks 23
15 11 September 2013 NSA-Israel Spy 5
14 5 September 2013 BULLRUN 6*
13 5 September 2013 SIGINT Enabling 3*
12 5 September 2013 NSA classification guide 3
11 31 July 2013 XKeyscore 32
10 27 June 2013 DoJ Memo on NSA 16
9 27 June 2013 Stellar Wind 51
8 21 June 2013 FISA Certification 25
7 20 June 2013 Minimization Exhibit A 9
6 20 June 2013 Minimization Exhibit B 9
5 16 June 2013 GCHQ G-20 Spying 4
4 8 June 2013 Boundless Informant FAQ 3
3 8 June 2013 Boundless Informant Slides 4
2 7 June 2013 PPD-20 18
1 5 June 2013 Verizon 4


Washington Post
202

23 December 2013 NSA/CSS Mission 2

11 December 2013 Excessive Collection 9

11 December 2013 SCISSORS 2 7

11 December 2013 SCISSORS 1 4

11 December 2013 Yahoo-Google Exploit 6

11 December 2013 Cable Spying Types 7

11 December 2013 WINDSTOP 1

11 December 2013 Co-Traveler 24

11 December 2013 GSM Tracking 2

11 December 2013 SIGINT Successes 4

11 December 2013 GHOSTMACHINE 4

5 December 2013 Target Location 1

4 December 2013 FASCIA 2

4 December 2013 CHALKFUN 1

26 November 2013 Microsoft a Target? 4

4 November 2013 WINDSTOP, SSO, Yahoo-Google 14

30 October 2013 MUSCULAR-INCENSOR Google and Yahoo 4

14 October 2013 SSO Overview 4

14 October 2013 SSO Slides 7

14 October 2013 SSO Content Slides 9

4 October 2013 Tor 49

4 October 2013 EgotisticalGiraffe 20*

4 October 2013 GCHQ MULLENIZE 2

4 October 2013 Roger Dingledine 2

30 August 2013 Budget 17

29 June 2013 PRISM 8

20 June 2013 Warrantless Surveillance 25*

7 June 2013 PPD-20 18*

6 June 2013 PRISM 1


Der Spiegel
23

29 December 2013 TAO ANT COTTONMOUTH 4

17 November 2013 ROYAL CONCIERGE (DE) ROYAL CONCIERGE (EN) 2

29 October 2013 NSA-CIA SCS 3

27 October 2013 NSA-CIA SCS 2

20 October 2013 Mexico President 1

20 September 2013 Belgacom 3

16 September 2013 SWIFT 3

9 September 2013 Smartphones 5

1 September 2013 French Foreign Ministry 0

31 August 2013 Al Jazeera 0


O Globo Fantastico
~87

7 October 2013 CSE Brazil Ministry 7

8 September 2013 Petrobas ~60

3 September 2013 Brazil and Mexico 20


New York Times
118

9 December 2013 Spying on Games 82*

23 November 2013 SIGINT Strategy 2012-2016 5

3 November 2013 SIGINT Mission 2013 SIGINT Mission 2017 22

28 September 2013 Contact Chaining Social Networks 1

28 September 2013 SYANPSE 1

5 September 2013 BULLRUN 4*

5 September 2013 SIGINT Enabling 3*



ProPublica
89

9 December 2013 Spying on Games 82*

5 September 2013 BULLRUN 4*

5 September 2103 SIGINT Enabling 3*


Le Monde
20

25 October 2013 NSA Hosts FR Spies 4

22 October 2013 Wanadoo-Alcatel 1

22 October 2013 Close Access Sigads 2

22 October 2013 Boundless Informant 2

22 October 2013 PRISM 11


Dagbladet
13

19 November 2013 BOUNDLESSINFORMANT 13


NRC Handelsblad
4

30 November 2013 Dutch SIGINT 3

23 November 2013 SIGINT Cryptologic Platform 1


Huffington Post
3

27 November 2013 Muslim Porn Viewing 3


CBC
9

10 December 2013 NSA-CSEC Partnership 1

10 December 2013 G8-G20 Spying 4*

2 December 2013 G8-G20 Spying 3

29 November 2013 G8-G20 Spying 1


The Globe and Mail
18

30 November 2013 CSEC Brazil Spying 18*


SVT (Swedsh TV)
2

5 December 2013 Sweden Spied Russia for NSA 2


L'Espresso
3

6 December 2013 NSA Spies Italy 3


Trojkan (SVT)
29

11 December 2013 NSA Sweden FRA Relationship 1*

11 December 2013 NSA 5 Eyes Partners 1

11 December 2013 NSA Sweden FRA Agenda 8

11 December 2013 NSA Sweden FRA RU Baltic 1

11 December 2013 NSA GCHQ Sweden FRA COMINT 1

11 December 2013 NSA Sweden FRA  XKeyscore Plan 5

11 December 2013 NSA Sweden FRA XKeyscore Sources 1

11 December 2013 NSA Sweden FRA XKeyscore Tor et al 3

11 December 2013 NSA Sweden FRA XKeyscore Slide 1

11 December 2013 NSA Sweden FRA Quantum 1 1

11 December 2013 GCHQ Sweden FRA Quantum 1

11 December 2013 NSA Sweden FRA Quantum Accomplishments 2

9 December 2013 NSA and Sweden Pact 3*




















Saturday, December 28, 2013

12 Ways of NSA Suspicion!


28 December 2013
12 Ways of NSA Suspicion
List Cryptography Archive
http://www.metzdowd.com/pipermail/cryptography
List cryptography Archive
http://lists.randombit.net/pipermail/cryptography/


1. Partridge in a Pear Tree
I don't mean to call people names. I'm only using Cookie's post as a recent example, of which there are many. Cookie Cutter clearly doesn't want to switch to scrypt, which AFAIK any non-dork can tell improves security against common real attacks, which far outweighs Cookie's concerns about side-channel attacks, and OMG, what was that crazy rant about sprinkling secret data all over RAM? It's just the output of a respected stream cipher! From where I'm sitting, Cookie's position is so lame, it makes me think he may be getting paid to spread FUD.
So, is Cookie a dork or a shill? Do we live in a world where we can't chat intelligently about security because of NSA shills, or is the world really full of that many dorks?


2. Turtle Doves
How can an untraceable pseudonym, such as me, post to a forum?
(Don't say Tor -- Tor is connection based and deliberately low-latency, so the source can be identified with IP packet correlation attacks. Untraceable pseudonyms use anonymizing remailers, which are message-based and deliberately high latency.)


3. French Hens
It's not publically documented, but I hear TSMC added extra transistors to some Xilinx FPGAs, and the last I heard, no one had figured out what they were for.
On Tue, Dec 24, 2013 at 2:43 AM, wrote:
On 23/12/13 19:20 PM, wrote: ... And everyone is trying to reverse-engineer everyone else's designs. All the underpinnings are there. And various parts of the US military and security establishment are quite aware - have, in fact, talked publicly about - the problem of "spiked" chips making it into their supply chains.
Aha. So, are there any case studies of this actually happening? This might shed light on the RDRAND question. If we had a documented case of (say) the Chinese slipping spiked chips in to one of the hot USAF toys, then we'd have some sense of how likely this is.
Then what?
Yet another arms race.
Papers, conferences, budgets, hype, FUD, gosh.


4. Colly Birds
Please do not email me anything that you are not comfortable also sharing with the NSA.


5. Gold Rings
There's multiple archives of this mailing list, and starting you own is trivial:
http://lists.randombit.net/pipermail/cryptography/
https://www.mail-archive.com/cryptography@randombit.net
IMO ease of archiving and ease of passing around archives is one of the biggest strengths of mailing lists.


6. Geese-a-Laying
I'm in the Bitcoin community and we keep on talking about fully decentralized backends to mailing lists/usenet replacements, but until something like that is implemented, best to stick with the tried and true mailing list. When something like that is implemented, it's gonna look rather like a mailing list...
Mailing lists are great infrastructure: a pragmatic centralized core to push messages around/moderate, and a whole host of decentralized infrastructure around them like multiple archiving services and a wide variety of client software to interface with.
I also note that it's a pain in the butt to PGP sign message board posts, this is Cryptography after all...


7. Maids-a-Milking
https://en.bitcoin.it/wiki/Fidelity_bonds - Disclaimer: I invented them. Also "Just use fidelity bonds!" is a standard joke in the Bitcoin developer community, and for good reason.


8. Swans-a-Swimming
I don't think a backdoor is likely to survive a serious audit. Code audits, done right by competent people, are tough.
Though, done right, they are expensive.
If crypto code is open source, most people will use it without careful examination on the assumption that someone else is going to audit it.
But, some people, relying on that code, *are* going to audit it.


9. Ladies Dancing
In any case, as others have pointed out here: Until Snowdonia, the general attitude of big business - the customers for BSAFE - would have been "I don't care that the NSA can read my stuff, they're the good guys, they don't get involved in commerce, I have nothing to hide from them."


10. Lords-a-Leaping
There is historical precedent on switching to old tech. The Battle of the Bulge was a surprise attack because Adolf Hitler -- himself only, and not his generals -- did not trust the crypto and comms anymore. He got suspicious about how many battles were going the enemy's way.
In his last roll of the dice, Hitler sent all the orders by motorcycle riders. Total surprise.


11. Pipers Piping
> It's an interesting question, and one worth studying for pedagogical
> motives. From my experiences from both sides, it is clear that both sides
> failed. But for different reasons.
> Hence, I've concluded that email is unsecurable.
Obviously. It will never be able to escape the non-body header content and third party routing, storage and analysis with any form of patching over today's mail. And it's completely ridiculous that people continue to invest [aka: waste] effort in 'securing' it. The best you'll ever get clients down to is exposing a single 'To:' header within an antique transport model that forces you to authenticate to it in order to despam, bill, censor and control you.
That system is cooked, done and properly fucked. Abandon it. What the world needs now is a real peer to peer messaging system that scales. Take Tor for a partial example... so long as all the sender/recipient nodes [onions] are up, any message you send will get through, encrypted, in real time. If a recipient is not up, you queue it locally till they are... no third party ever needed, and you get lossless delivery and confirmation for free. Unmemorable node address?, quit crying and make use of your local address book. Doesn't have plugins for current clients?, so what, write some and use it if you're dumb enough to mix the old and new mail.
The only real problem that still needs solved is scalability... what p2p node lookup systems are out there that will handle a messaging world's population worth of nodes [billions] and their keys and tertiary data? If you can do that, you should be able to get some anon transport over the p2p for free.
Anyway, p2p messaging and anonymous transports have all been dreamed up by others before. But now is the time to actually abandon traditional email and just do it. If you build it, they will come.


12. Drummers Drumming
With open source code the NSA would be foolish to install a true back door.
i.e. The NSA would be foolish to assume that they could craft a side door in open source code that would withstand the scrutiny of another nations security agency (ANSA). The folk I have encountered that work there (short and old list) are not foolish or stupid. Their data integrity folk are darn good.
I can see weaknesses to establish a class of ability or a time window. For example in the days that RSA and the NSA negotiated the $10M contract FPGA and ASIC attacks were the tools of a rare and limited set of nations and corporations. My memory may be fading but I recall this time frame and believe I heard "smart" folk indicate that this was not clearly beyond the tools of the spooks but was beyond the tool reach of even organized crime at that time. Key concept "at that time".
I make weakness level security decisions all the time. I do not have the world's strongest lock on my home. I have also not replaced the locks on my car. My gym locker lock is an easy to open high school grade combination padlock. Most of these locks I can still open with my eyes closed in moments the same as I could back in high school.
Down the road is a high voltage transformer with a lock on it. OK it looks like a lock but is a seal in the shape of a padlock. It is made of aluminum(?) for the most part and is designed to be cut off with cutters. The same as used to cut heavy aluminum and copper cables. It is tamper evident, it should withstand an attack for a little bit of time with a hammer or bashing with a rock. If a teenager busted in and fried his little brain till it burst the power company clearly is not maintaining an attractive nuisance. There is no master key to be lost. It could be made of more durable material like hardened steel and more but it does not need to be.
My thoughts on this is that if you wish to be NSA proof you have some work to do.
All of this does take me to a couple places:
First is a reminder of the Morris worm attacks. The Dad wrote a book and none in the community addressed these design flaws and bugs Jr. crafted a worm that escaped or was let free on the world. Not zero day, no criminal element, no national security enemy. The BSD folk seem to have learned this lesson.
Second: "Target"... clearly criminals were involved , national interests & government sponsored... not likely. The Price tag of the breach at Target is possibly astounding. Some credit card companies have eviscerated their limits to limit their risk. All they have to do is write a report.... "if Used @ Target establish limits and throttle the limit of abuse and liability". There are many lessons to be learned here.
Third: can wait for the new year.
Forth/Fourth: All things are not equal and too many take two things as all the proof needed to take a product to market. Code reviews and code review tools need work today. The bad guys are looking at the same code you have. Clear, precise, testable.... etc... It is interesting that the word code is used in so many ways.

Sunday, December 15, 2013

By cracking cellphone code, NSA has capacity for decoding private conversations

By cracking cellphone code, NSA has capacity for decoding private conversations

The cellphone encryption technology used most widely across the world can be easily defeated by the National Security Agency, an internal document shows, giving the agency the means to decode most of the billions of calls and texts that travel over public airwaves every day.
While the military and law enforcement agencies long have been able to hack into individual cellphones, the NSA’s capability appears to be far more sweeping because of the agency’s global signals collection operation. The agency’s ability to crack encryption used by the majority of cellphones in the world offers it wide-ranging powers to listen in on private conversations.
U.S. law prohibits the NSA from collecting the content of conversations between Americans without a court order. But experts say that if the NSA has developed the capacity to easily decode encrypted cellphone conversations, then other nations likely can do the same through their own intelligence services, potentially to Americans’ calls, as well.
Encryption experts have complained for years that the most commonly used technology, known as A5/1, is vulnerable and have urged providers to upgrade to newer systems that are much harder to crack. Most companies worldwide have not done so, even as controversy has intensified in recent months over NSA collection of cellphone traffic, including of such world leaders as German Chancellor Angela Merkel.
The extent of the NSA’s collection of cellphone signals and its use of tools to decode encryption are not clear from a top-secret document provided by former contractor Edward Snowden. But it states that the agency “can process encrypted A5/1” even when the agency has not acquired an encryption key, which unscrambles communications so that they are readable.
Experts say the agency may also be able to decode newer forms of encryption, but only with a much heavier investment in time and computing power, making mass surveillance of cellphone conversations less practical.
“At that point, you can still listen to any [individual person’s] phone call, but not everybody’s,” said Karsten Nohl, chief scientist at Security Research Labs in Berlin.
The vulnerability outlined in the NSA document concerns encryption developed in the 1980s but still used widely by cellphones that rely on technology called second-generation (2G) GSM. It is dominant in most of the world but less so in the wealthiest nations, including the United States, where newer networks such as 3G and 4G increasingly provide faster speeds and better encryption, industry officials say.
But even where such updated networks are available, they are not always used, because many phones often still rely on 2G networks to make or receive calls. More than 80 percent of cellphones worldwide use weak or no encryption for at least some of their calls, Nohl said. Hackers also can trick phones into using these less-secure networks, even when better ones are available. When a phone indicates a 3G or 4G network, a voice call might actually be carried over an older frequency and susceptible to decoding by the NSA.
The document does not make clear if the encryption in another major cellphone technology — called CDMA and used by Verizon, Sprint and a small number of foreign companies — has been broken by the NSA as well. The document also does not specify whether the NSA can decode data flows from cellular devices, which typically are encrypted using different technology.
The NSA has repeatedly stressed that its data collection efforts are aimed at overseas targets, whose legal protections are much lower than U.S. citizens’. When questioned for this story, the agency issued a statement, saying: “Throughout history nations have used encryption to protect their secrets, and today terrorists, cyber criminals, human traffickers and others also use technology to hide their activities. The Intelligence Community tries to counter that in order to understand the intent of foreign adversaries and prevent them from bringing harm to Americans and allies.”
German news magazine Der Spiegel reported in October that a listening station atop the U.S. Embassy in Berlin allowed the NSA to spy on Merkel’s cellphone calls. It also reported that the NSA’s Special Collection Service runs similar operations from 80 U.S. embassies and other government facilities worldwide. These revelations — and especially reports about eavesdropping on the calls of friendly foreign leaders — have caused serious diplomatic fallouts for the Obama administration.
Cellphone conversations long have been much easier to intercept than ones conducted on traditional telephones because the signals are broadcast through the air, making for easy collection. Police scanners and even some older televisions once were able to routinely pick up people talking on their cellphones, as a Florida couple did in 1996 when they recorded an overheard conversation involving then-House Speaker Newt Gingrich.
Digital transmission and encryption have become almost universally available in the United States, and they are now standard throughout much of the world. Governments typically dictate what kind of encryption technology, if any, can be deployed by cellphone service providers. As a result, cellular communications in some nations, including China, feature weak encryption or none at all.
A5/1 has been repeatedly cracked by researchers in demonstration projects for more than a decade.
The encryption technology “was designed 30 years ago, and you wouldn’t expect a 30-year-old car to have the latest safety mechanisms,” said David Wagner, a computer scientist at the University of California at Berkeley.
Collecting cellphone signals has become such a common tactic for intelligence, military and law enforcement work worldwide that several companies market devices specifically for that purpose.
Some are capable of mimicking cell towers to trick individual phones into directing all communications to the interception devices in a way that automatically defeats encryption. USA Today reported Monday that at least 25 police departments in the United States own such devices, the most popular of which go by the brand name Harris StingRay. Experts say they are in widespread use by governments overseas, as well.
Even more common, however, are what experts call “passive” collection devices, in which cell signals are secretly gathered by antennas that do not mimic cellphone towers or connect directly with individual phones. These systems collect signals that are then decoded in order for the content of the calls or texts to be understood by analysts.
Matthew Blaze, a University of Pennsylvania cryptology expert, said the weakness of A5/1 encryption is “a pretty sweeping, large vulnerability” that helps the NSA listen to cellphone calls overseas and likely also allows foreign governments to listen to the calls of Americans.
“If the NSA knows how to do this, presumably other intelligence agencies, which may be more hostile to the United States, have discovered how to do this, too,” he said.
Journalists Marc Ambinder and D.B. Grady reported in their 2013 book “Deep State: Inside the Government Secrecy Industry” that the FBI “has quietly removed from several Washington, D.C.- area cell phone towers, transmitters that fed all data to wire rooms at foreign embassies.”
The FBI declined to comment on that report.
Upgrading an entire network to better encryption provides substantially more privacy for users. Nohl, the German cryptographer, said that breaking a newer form of encryption, called A5/3, requires 100,000 times more computing power than breaking A5/1. But upgrading entire networks is an expensive, time-consuming undertaking that likely would cause interruptions in service for some customers as individual phones would be forced to switch to the new technology.
Amid the uproar over NSA’s eavesdropping on Merkel’s phone, two of the leading German cellphone service providers have announced that they are adopting the newer, stronger A5/3 encryption for their 2G networks.
They “are now doing it after not doing so for 10 years,” said Nohl, who long had urged such a move. “So, thank you, NSA.”
One of those companies, Deutsche Telekom, is the majority shareholder of T-Mobile. T-Mobile said in a statement this week that it was “continuously implementing advanced security technologies in accordance with worldwide recognized and trusted standards” but declined to say whether it uses A5/3 technology or plans to do so for its 2G networks in the United States.
AT&T, the largest provider of GSM cellphone services in the country, said it was deploying A5/3 encryption for parts of its network. “AT&T always protects its customers with the best encryption possible in line with what their device will support,” it said in a statement.
The company already deploys stronger encryption on its 3G and 4G networks, but customers may still wind up using 2G networks in congested areas or places where fewer cell towers are available.
Even with strong encryption, the protection exists only from a phone to the cell tower, after which point the communications are decrypted for transmission on a company’s internal data network. Interception is possible on those internal links, as The Washington Post reported last week. Leading technology companies, including Google and Microsoft, have announced plans in recent months to encrypt the links between their data centers to better protect their users from government surveillance and criminal hackers.

Friday, December 13, 2013

NSA leaders split on giving amnesty to Snowden

NSA leaders split on giving amnesty to Snowden
ByJohn Miller CBS News December 12, 2013, 7: 29 PM
CBS News learned Thursday that the information National Security Agency leaker Edward Snowden has revealed so far is just a fraction of what he has. In fact, he has so much, some think it is worth giving him amnesty to get it back.
Rick Leggett is the man who was put in charge of the Snowden leak task force by Gen. Keith Alexander, who heads the NSA. The task force's job is to prevent another leak like this one from happening again. They're also trying to figure out how much damage the Snowden leaks have done, and how much damage they could still do.
Snowden, who is believed to still have access to 1.5 million classified documents he has not leaked, has been granted temporary asylum in Moscow, which leaves the U.S. with few options.
JOHN MILLER: He's already said, "If I got amnesty, I would come back." Given the potential damage to national security, what would your thought on making a deal be?
RICK LEGGETT: So, my personal view is, yes, it's worth having a conversation about. I would need assurances that the remainder of the data could be secured, and my bar for those assurances would be very high. It would be more than just an assertion on his part.
MILLER: Is that a unanimous feeling?
LEGGETT: It's not unanimous.
Among those who think making a deal is a bad idea is Leggett's boss, Gen. Keith Alexander.
GEN. KEITH ALEXANDER: This is analogous to a hostage-taker taking 50 people hostage, shooting 10 and then say, "If you give me full amnesty, I'll let the other 40 go." What do you do?
MILLER: It's a dilemma.
GEN. ALEXANDER: It is.
MILLER: Do you have a pick?
GEN. ALEXANDER: I do. I think people have to be held accountable for their actions. … Because what we don't want is the next person to do the same thing, race off to Hong Kong and to Moscow with another set of data, knowing they can strike the same deal.
We asked Gen. Alexander, Leggett and former NSA Director Michael Hayden why the Russians would give Snowden amnesty if they already have Snowden's information, and they said they would be sadly disappointed in the intelligence services if they hadn't gotten that material.
The question is, for damage control, what's the difference between a couple of foreign governments having it -- that's bad -- or having it out there in the newspapers or across many other governments?
You can see more of this story Sunday on "60 Minutes."

Thursday, December 12, 2013


The Cryptologic Provider of
Intelligence from Global High-Capacity
Telecommunications Systems
TOP SECRET//COMINT//NOFORN
TOP SECRET//COMINT//NOFORN
[Comment Annotation]
3
Agenda
Organizational Information
Programs
Corporate
Foreign
Unilateral
POC’s
UNCLASSIFIED//FOR OFFICAL USE ONLY
UNCLASSIFIED//FOR OFFICAL USE ONLY
7
Today’s Cable Program
Three Access
Portfolios
WINDSTOP (2nd Party)
Foreign
Corporate
BLARNEY - FISA
FAIRVIEW
STORMBREW
OAKSTAR
PRISM
FAA
Unilateral
TOP SECRET//COMINT//NOFORN
TOP SECRET//COMINT//NOFORN
8
Got Fiber??
UNCLASSIFIED//FOR OFFICIAL USE ONLY
UNCLASSIFIED//FOR OFFICIAL USE ONLY
9
President’s Daily Brief Sources
CY2010 through mid-May
TOP SECRET//COMINT//NOFORN
TOP SECRET//COMINT//NOFORN
1
BLARNEY
6
FAIRVIEW
8
STORMBREW
10
TAO
11
INCENSER
15
NSA ReporBng of GCHQ DS 200
RF
27%
PROTECTED
6%
ENDPOINT
6%
CABLE
61%
21
2
nd
Party Accesses
!
DS-200
– is NSA’s reporting of GCHQ’s “special source”
collection
!
DS-200B
– MUSCULAR
!
20 Gbit TURMOIL capacity
!
Tasking worked cooperatively with GCHQ counterparts
!
IP Subnet promotion in place
!
!
TOP SECRET//COMINT//REL
TOP SECRET//COMINT//REL
22
MUSCULAR
(DS-200B)
Operational July 2009
(S//REL USA,GBR) Large international access located in
United Kingdom
Four TURMOIL T16s at 2.5Gb each - total ingest 10Gb
LPTs installed May 2010 increase ingest to 20Gb
Tasking worked cooperatively with GCHQ counterparts
Partner to assume total control/responsibility for systems
IP Subnet promotion in place, VoIP in the works
TOP SECRET//COMINT//REL-USA,GBR
TOP SECRET//COMINT//REL-USA,GBR
The NSA's three types of cable interception programs
7 Pages
- Contributed by
Matt DeLong
,
Washington Post
- Oct 31, 2013
Print Notes
http://www.documentcloud.org/notes/print?docs[]=813466
1 of 3
12/11/2013 11:42 AM
Print Notes
http://www.documentcloud.org/notes/print?docs[]=813466
2 of 3
12/11/2013 11:42 AM
Print Notes
http://www.documentcloud.org/notes/print?docs[]=813466
3 of 3
12/11/2013 11:42 AM

Edward Snowden, The Dark Prophet!!!!

Edward Snowden, The Dark Prophet
Of interest for Snowden's unprecedented email interview by Time:
In an interview with Time conducted via e-mail in early December, Snowden explained his answers to those big questions, even as he allowed for the fact that the U.S. public he sees himself serving may not ultimately agree. The privacy of regular citizens, he believes, is a universal right, and the dangers of mass surveillance litter the dark corners of the 20th century. “The NSA is surely not the Stasi,” he argued, in reference to the notorious East German security service, “but we should always remember that the danger to societies from security services is not that they will spontaneously decide to embrace mustache twirling and jackboots to bear us bodily into dark places, but that the slowly shifting foundation of policy will make it such that mustaches and jackboots are discovered to prove an operational advantage toward a necessary purpose.”
“The NSA is surely not the Stasi,” he argued, in reference to the notorious East German security service, “but we should always remember that the danger to societies from security services is not that they will spontaneously decide to embrace mustache twirling and jackboots to bear us bodily into dark places, but that the slowly shifting foundation of policy will make it such that mustaches and jackboots are discovered to prove an operational advantage toward a necessary purpose.”
From Russia, Snowden does not defend every story that has been written, but he says he tried to design his actions to ensure that he was not the ultimate arbiter of what should and should not become public. “There have of course been some stories where my calculation of what is not public interest differs from that of reporters, but it is for this precise reason that publication decisions were entrusted to journalists and their editors,” he told Time. “I recognize I have clear biases influencing my judgment.”
Snowden’s hope, he continued, is that the disclosure will force five distinct civic bodies—the public, the technologist community, the U.S. courts, Congress and the Executive Branch—to reconsider the path ahead. “The President,” Snowden wrote, “could plausibly use the mandate of public knowledge to both reform these programs to reasonable standards and direct the NSA to focus its tremendous power toward developing new global technical standards that enforce robust end-to-end security, ensuring that not only are we not improperly surveilling individuals but that other governments aren’t either.”
But the court rulings and briefing books that undergird the surveillance programs have long been so highly classified and technically complex that they remained opaque to the public. Snowden believed that the standard for review needed to be different, with transparent public debate and open court proceedings. In the tradition of other national-security whistle-blowers, who have played a role in the messy American system of checks and balances by leaking the Pentagon Papers and the details of President George W. Bush’s warrantless wiretapping program, Snowden decided he had an individual obligation to defy his government and his own contractual obligations. “What we recoil most strongly against is not that such surveillance can theoretically occur,” he wrote to Time, “but that it was done without a majority of society even being aware it was possible.”
As for the technologists like him, it is important that they know as well what is being done, so they can invent new ways to protect citizens. “There is a technical solution to every political problem,” Snowden argued. One of the NSA programs he revealed, called Bullrun, described a $250 million annual effort to engage with “the U.S. and foreign IT industries to covertly influence and/or overtly leverage their commercial products’ designs,” providing the spies a back door to encrypted communications. Though the law-enforcement purpose of such an effort is clear, as terrorists and foreign powers experiment with encryption, Snowden believes private citizens also have a right to create unbreakable encryption software. “In general, if you agree with the First Amendment principles, you agree with encryption. It’s just code,” he wrote in an e-mail to Time. “Arguing against encryption would be analogous to arguing against hidden meanings in paintings or poetry.”



http://poy.time.com/2013/12/11/runner-up-edward-snowden-the-dark-prophet
Edward Snowden, The Dark Prophet
He pulled off the year's most spectacular heist. Exiled from his country, the 30-year-old computer whiz has become the doomsayer of the information age
By Michael Scherer @michaelscherer Dec. 11, 2013
To avoid surveillance, the first four Americans to visit Edward Snowden in Moscow carried no cell phones or laptops. They flew coach on Delta from Washington with tickets paid for by Dutch computer hackers. After checking into a preselected hotel not far from Red Square, they waited for a van to pick them up for dinner.
None could retrace the ride that followed, driven by anonymous Russian security men, nor could any place the side door of the building where the trip ended. They passed through two cavernous ballrooms, the second with a painted ceiling like the Sistine Chapel, and emerged into a smaller space with salmon-colored walls and oil paintings in golden frames—like Alice in Wonderland, remembers one of the group. There at the bottom of the rabbit hole, in rimless glasses, a black suit and blue shirt with two open buttons at the collar, stood the 30-year-old computer whiz who had just committed the most spectacular heist in the history of spycraft.
By all accounts, Snowden was delighted to see his countrymen, though over the next six hours he did not partake of the wine. At one point, Ray McGovern, a former CIA analyst, recited from memory in Russian an Alexander Pushkin poem, “The Prisoner,” which he had learned back in his days spying on the Soviet Union. “We have nothing to lose except everything, so let us go ahead,” said Jesselyn Radack, a former Justice Department attorney, quoting Albert Camus’s warning at the dawn of the nuclear age. Another attendee, the whistle-blowing FBI agent Coleen Rowley, compared Snowden to Benjamin Franklin, who as postmaster general in 1773 helped leak letters from American officials who were secretly collaborating with British authorities.
Even Snowden’s Russian lawyer, Anatoly Kucherena, raised his glass for a toast. Coming from a man with close ties to the Kremlin and a knack for misleading the press, Kucherena’s words captured the surreal nature of Snowden’s Moscow exile. “Ed, I am going to give you the biggest gift that I can probably give,” he told Snowden through an interpreter. “I’m writing a novel about you.”
The gathering had been called to deliver an award, given by four dissident veterans of the U.S. national-security apparatus to one of their own. But for Snowden it was something more, a chance to reaffirm to the world the purpose of his actions, for which he has been charged in absentia with theft and violations of the Espionage Act. Since escaping his country in late May with tens of thousands of its most secret documents—“one of everything,” jokes one person with access to the stash—Snowden has chosen to lie low. No Twitter account. No television interviews. No direct contacts with U.S. authorities. He held his tongue as Kucherena boasted to the press about Snowden’s new Internet job in Moscow, his new Russian girlfriend and his dire money troubles. Most of that is fiction, like the novel, according to several people who communicate regularly with Snowden.
But he has nonetheless begun to figure out a life for himself in Russia, where he has been granted asylum for at least one year. He is learning Russian, recently read Fyodor Dostoyevsky’s Crime and Punishment and spent weeks living with his WikiLeaks protector, Sarah Harrison, who has since flown to Berlin, fearing that she could face criminal charges if she returns to her native Britain. Most important, he has been able to spend time on the Internet, his lifelong home, where he has watched through encrypted and anonymized connections as his leaks roil the world—diplomatic crises, congressional reform efforts, new federal lawsuits, financial damage to U.S. technology companies and an as yet uncertain harm to U.S. national interests, including documented changes in the way terrorists communicate online. “This increases the probability that a terrorist attack will get through,” says General Keith Alexander, the director of the National Security Agency (NSA). “I think it’s absolutely wrong.”
For Snowden, those impacts are but a means to a different end. He didn’t give up his freedom to tip off German Chancellor Angela Merkel about the American snoops on her cell phone or to detail the ways the NSA electronically records jihadi porn-watching habits. He wanted to issue a warning to the world, and he believed that revealing the classified information at his fingertips was the way to do it. His gambit has so far proved more successful than he reasonably could have hoped—he is alive, not in prison, and six months on, his documents still make headlines daily—but his work is not done, and his fate is far from certain. So in early October, he invited to Moscow some supporters who wanted to give him an award.
After the toasts, some photographs and a brief ceremony, Snowden sat back down at the table, spread with a Russian buffet, to describe once again the dystopian landscape he believes is unfolding inside the classified computer networks on which he worked as a contractor. Here was a place that collected enormous amounts of information on regular citizens as a precaution, a place where U.S. law and policy did not recognize the right to privacy of foreigners operating outside the country, a place where he believed the basic freedoms of modern democratic states—“to speak and to think and to live and be creative, to have relationships and to associate freely”—were under threat.
“There is a far cry between legal programs, legitimate spying, legitimate law enforcement—where it is targeted, it’s based on reasonable suspicion, individualized suspicion and warranted action—and the sort of dragnet mass surveillance that puts entire populations under a sort of an eye and sees everything, even when it is not needed,” Snowden told his colleagues. “This is about a trend in the relationship between the governing and governed in America.”
That is the thing that led him to break the law, the notion that mass surveillance undermines the foundations of private citizenship. In a way, it is the defining critique of the information age, in which data is increasingly the currency of power. The idea did not originate with Snowden, but no one has done more to advance it. “The effect has been transformative,” argues Julian Assange, the founder of WikiLeaks, who has been helping Snowden from the confines of the Ecuadorean embassy in London. “We have shifted from a small group of experts understanding what was going on to broad public awareness of the reality of NSA mass surveillance.” If Facebook’s Mark Zuckerberg is the sunny pied piper of the new sharing economy, Snowden has become its doomsayer.
The Information Grid
When electronic surveillance began, with the invention of the telegraph and radio, the only way to record an intercept was with ink and paper. Now there are technologies that allow for the wholesale copying, sorting and storage of billions of records a day—everything that passes through a fiber-­optic cable, for instance, or gets beamed through the airwaves. By itself, this is a revolutionary development. But its real power comes from the way regular people have changed their behavior. In the 19th century, humans rarely produced electronic signals. Now almost every part of daily existence can cast off bits and bytes.
The cell phone in your pocket records your movements and stores that information with your service carrier. The e-mail, chat and text messages you create map your social relations and record your thoughts. Credit-card purchases show spending habits and tastes. Mass-transit databases note when you board subways and buses with fare cards. The search terms you enter into your ­laptop—preserved­ by Google in ways that can be used to identify your computer for a standard period of nine months—may tell more about your deepest desires than anything you would ever admit to a friend or lover.
Then there are the emerging technologies that will soon add even more information to the grid: The wearable-computing devices that monitor your pulse. The networked surveillance cameras rigged with facial-recognition software. The smart meters that record what time of night you turn out the lights. Retail companies like Nord­strom and Apple have debuted technologies that use your cell phones to track how long you linger before any single display. The possibilities are dizzying, and your information funds the whole enterprise. “Surveillance is the business model of the Internet,” explains Bruce Schneier, a security technologist who has access to some of the documents Snowden provided.
Snowden’s theft revealed a massive, secret U.S. national-security state—$52.6 billion a year, with more than 30,000 employees at the NSA alone—struggling to come to grips with this new surveillance potential in the wake of the 2001 terrorist attacks. Electronic intelligence historically focused on foreign governments and their public officials, but the hijackers who took down the World Trade Center were private individuals, born abroad and living in the homeland. So as the rubble still smoldered, the great arrays set up by the NSA turned inward and shifted focus. The subjects of collection grew to include patterns within entire populations and historical data that could literally retrace the steps of individuals years before they became suspects. The challenge, explained one NSA document made public by Snowden, was to “master global ­networks and handle previously unimagined volumes of raw data for both passive and active collection.”
So new databases were built, and ground was broken on a massive classified data center in the Utah desert that will need as much as 1.7 million gal. (6.4 million L) of water a day just to keep the computer servers cool. And the data was collected. Since 2006 the U.S. government has gathered and stored transaction records of phone calls made in America. For a time, the government sucked up similar metadata on Internet traffic as well. Cellular location data, mostly from foreign-owned phones, has also been collected, with some 5 billion records a day absorbed by databases that can later be used to reconstruct a person’s movements or find out who joins a meeting behind closed doors.
One NSA document released by Snowden estimated that 99% of the world’s Internet bandwidth in 2002 and 33% of the world’s phone calls in 2003 passed through the U.S., an accident of history that proved a gold mine to sift through, with or without the cooperation of American companies. The agency hacked overseas cables and satellites and surreptitiously sucked information transiting among foreign cloud servers of U.S. technology companies like Google and Yahoo. It harvested and stored hundreds of millions of contact lists from personal e-mail and instant-messaging accounts on services like Yahoo and Facebook. A program called Dishfire sucked up years’ worth of text messages from around the world, and a database by the name of Tracfin captured credit-card transactions. “High performance computing systems must extract meaning from huge data sets and negate data encryption and computer access controls,” reads a 2007 classified NSA mission statement released by Snowden. “Fortunately, information management and mining is central to the Internet age.”
The NSA is not the only one playing the game. It just does it better, on a grander scale, than anyone else, at least so far. Russia and China have similar surveillance infrastructures, say current and former U.S. officials, and petty dictatorships the world over have been buying their ­technology on the open market. When rebels overthrew Libyan strongman Muammar Gaddafi in 2011, they found a device from the French company Amesys that allowed the dictator to gather up and search in bulk the Internet traffic generated by his people. No Libyan activist had been safe to send an unencrypted e-mail or post a Facebook comment. The company’s sales pitch, later leaked to WikiLeaks, began with a slide that read, “From lawful to massive interception.”
Privacy Protections
With all this information now public, the important questions are easy to spot: What should distinguish democratic governments from totalitarian ones in an era of mass surveillance? Are privacy protections a human right or just a convenience of nationality? Can the massive U.S. ­national-security apparatus be trusted to make the right choices in secret when the next crisis comes? Even President Obama encourages the conversation as he continues to seek Snowden’s imprisonment. “I think it’s healthy for our democracy,” he said just weeks before the White House refused to confirm or deny its role in rerouting the plane carrying Bolivian President Evo Morales after a false rumor that Snowden was on board.
In an interview with Time conducted via e-mail in early December, Snowden ­explained his answers to those big questions, even as he allowed for the fact that the U.S. public he sees himself serving may not ultimately agree. The privacy of regular citizens, he believes, is a universal right, and the dangers of mass surveillance litter the dark corners of the 20th century. “The NSA is surely not the Stasi,” he argued, in reference to the notorious East German security service, “but we should always remember that the danger to ­societies from security services is not that they will spontaneously decide to embrace mustache twirling and jackboots to bear us bodily into dark places, but that the slowly shifting foundation of policy will make it such that mustaches and jackboots are discovered to prove an operational advantage toward a necessary purpose.”
Snowden’s hope, he continued, is that the disclosure will force five distinct civic bodies—the public, the technologist community, the U.S. courts, Congress and the Executive Branch—to reconsider the path ahead. “The President,” Snowden wrote, “could plausibly use the mandate of public knowledge to both reform these programs to reasonable standards and direct the NSA to focus its tremendous power toward developing new global technical standards that enforce robust end-to-end security, ensuring that not only are we not improperly surveilling individuals but that other governments aren’t either.”
As for the technologists like him, it is important that they know as well what is being done, so they can invent new ways to protect citizens. “There is a technical solution to every political problem,” Snowden argued. One of the NSA programs he revealed, called Bullrun, described a $250 million annual effort to engage with “the U.S. and foreign IT industries to covertly influence and/or overtly leverage their commercial products’ designs,” providing the spies a back door to encrypted communications. Though the law-­enforcement purpose of such an effort is clear, as terrorists and foreign powers experiment with encryption, Snowden believes private citizens also have a right to create unbreakable encryption software. “In general, if you agree with the First Amendment principles, you agree with encryption. It’s just code,” he wrote in an e-mail to Time. “Arguing against encryption would be analogous to arguing against hidden meanings in paintings or poetry.”
America In the Dark
The NSA, for its part, has always prided itself on being different from the intelligence services of authoritarian regimes, and it has long collected far less information on Americans than it could. The programs Snowden revealed in U.S. ­surveillance agencies, at least since the 1970s, are subject to a strict, regularly audited system of checks and balances and a complex set of rules that restrict the circumstances under which the data gathered on Americans can be reviewed. As a general rule, a court order is still expected to review the content of American phone calls and e-mail ­messages. Unclassified talking points sent home with NSA employees for Thanksgiving put it this way: “The NSA performs its mission the right way—­lawful, compliant and in a way that protects civil liberties and privacy.” Indeed, none of the Snowden disclosures published to date have revealed any ongoing programs that clearly violate current law, at least in a way that any court has so far identified. Parts of all three branches of government had been briefed and had given their approval.
But the court rulings and briefing books that undergird the surveillance programs have long been so highly classified and technically complex that they remained opaque to the public. Snowden believed that the standard for review needed to be different, with transparent public debate and open court proceedings. In the tradition of other national-security whistle-blowers, who have played a role in the messy American system of checks and balances by leaking the Pentagon Papers and the details of President George W. Bush’s warrantless wiretapping program, Snowden decided he had an individual obligation to defy his government and his own contractual obligations. “What we recoil most strongly against is not that such surveillance can theoretically occur,” he wrote to Time, “but that it was done without a majority of society even being aware it was possible.”
At the time Snowden went public, the American people had not just been kept in the dark; they had actively been misled about the actions of their government. The provision of the 2001 Patriot Act that allowed for the collection of American phone records, for instance, was publicly described as analogous to a grand jury subpoena by the Department of Justice, suggesting individual secret warrants. But secret interpretations told a different story. “Tell me if you’ve ever seen a grand jury subpoena that allowed the ­government on an ongoing basis to collect the records of millions of ordinary Americans,” said Oregon Senator Ron Wyden, a longtime critic of the programs, in a recent speech.
In a 2012 speech, NSA director Alexander said, “We don’t hold data on U.S. citizens,” a statement he apparently justified with an unusual definition of the word hold. Months later, National Intelligence Director James Clapper told Congress in an open session that the NSA did not “collect” any type of data on millions of Americans. After the Snowden documents were leaked, Clapper apologized for his “clearly erroneous” answer, saying he was only giving the “least untruthful” response possible in an unclassified setting. “When someone says ‘collection’ to me, that has a specific meaning, which may have a different meaning to him,” Clapper said.
Intelligence officials have now been forced to join the public debate, and Obama has authorized the declassification of thousands of pages of documents. Nonetheless, current and former government officials say the way Snowden went about leaking his documents and the documents he selected will cause clear harm to his country’s legitimate interests. “We have seen, in response to the Snowden leaks, al-Qaeda­ and affiliated groups seeking to change their tactics,” warned Matthew Olson, director of the National Counterterrorism Center, in July. Snowden has maintained that he did not download information that would put other intelligence officials in danger or give up sources and specific methods to foreign rivals of the U.S. But his disclosures were also not limited to revealing the mass surveillance of otherwise innocent civilian populations.
While in Hong Kong, Snowden gave an interview and documents to the South China Morning Post describing NSA spying on Chinese universities, a disclosure that frustrated American attempts to embarrass China into reducing its industrial-espionage efforts against U.S. firms. A story that showed up in Der Spiegel, using Snowden documents, showed how British spies working with the U.S. used fake Linked­In accounts to install malware on the computers of foreign telecom providers. Other stories have given details on NSA spying operations on traditional surveillance targets like diplomatic delegations at international summits. And many of the most controversial disclosures in the Snowden documents concern not mass surveillance but the targeting of foreign leaders. “They’re being put out in a way that does the maximum damage to NSA and our nation,” says Alexander. “And it’s hurting our industry.”
American technology and telecommunications companies, some of which have long histories of cooperating with the NSA, have also suffered as a result, and they are scrambling to increase encryption of their systems and assure foreign customers of their commitment to privacy. A December paper by eight U.S. technology giants, including Apple, Facebook and Google, called on the U.S. government to end to “bulk data collection of Internet communications” and “limit surveillance to specific, known users for lawful purposes.” In India, government officials may soon be barred from using e-mail with servers located in the U.S., and recent estimates say the risk to American firms in the emerging marketplace for cloud computing could reach $180 billion. In a recent earnings call, Robert Lloyd—­president of development for Cisco Systems, a provider of Internet hardware—said the revelations were already affecting overseas sales. “It’s certainly causing people to stop and then rethink decisions, and that is, I think, reflected in our results,” he said.
From Russia, Snowden does not defend every story that has been written, but he says he tried to design his actions to ­ensure that he was not the ultimate arbiter of what should and should not become public. “There have of course been some stories where my calculation of what is not public interest differs from that of reporters, but it is for this precise reason that publication decisions were entrusted to journalists and their editors,” he told Time. “I recognize I have clear biases influencing my judgment.”
That question of judgment is at the heart of the issues Snowden has raised. Polls still show Americans largely conflicted about the programs that have been revealed. Since the disclosures, a majority of Americans say they believe their privacy rights have been violated. But polls also show continued willingness to give up limited amounts of privacy as part of efforts to combat terrorism.
The most striking numbers show a generation gap in the way people think about Snowden. Just 35% of Americans ages 18 to 30 say Snowden should be charged with a crime, compared with 57% of those 30 and older, according to a November poll by the Washington Post and ABC News. And 56% of young adults say he did the “right thing,” compared with 32% of their elders. Younger people, who are moving away from Facebook and embracing technologies like Snapchat, which destroys messages after a few seconds, have also been shown to spend far more time than their elders tightening privacy settings on phones and apps. “Snowden is an effect, not a cause,” says General Michael Hayden, a recently retired director of both the NSA and CIA. “This new generation has a different take on where the appropriate line is.”
The shifts could have far greater implications than just what apps people choose for their smartphones. Historically, the Fourth Amendment of the Constitution, which offers no protections for non­citizens outside the country, has been the source of privacy protections under U.S. law. But the rhetoric now coming from European governments and even senior officials of the Obama Administration points to broader, as yet undefined rights, which several countries are now seeking to codify in ­international law at the U.N. “We must use the unprecedented power that technology affords us responsibly, while respecting the values of privacy, government transparency and accountability that all people share,” said National Security Adviser Susan Rice in a December speech.
Growing Up Online
The fourth American to attend Snowden’s October awards ceremony was Thomas Drake, who, like Snowden, was a veteran of the NSA and a former contractor for Booz Allen Hamilton. For years after the Sept. 11 attacks, Drake sounded alarm bells with Congress and the military about the NSA’s behavior, eventually deciding to give unclassified information about certain programs to a reporter for the Baltimore Sun. For this, he was charged under the Espionage Act on flimsy ­charges that fell apart in court but still caused Drake years of hardship. When the Americans walked in for dinner in Moscow, ­McGovern remembers that Snowden looked past him and focused on Drake, whom Snowden had never met before but had long regarded as a role model. “I was an inspiration to him,” Drake acknowledges. “He represents, for me, the future.”
Like Snowden, Drake grew up online, living his life inside the nascent Internet, finding friendships and forming an identity. His first computer, in the 1980s, was an Atari 8-bit. “I lived a double life, the virtual life in this digital space, in this transnational space,” says Drake, who is now 56. “It was unbelievable, this culture of sharing information.”
For Snowden, a high school dropout with a GED who grew up just miles from the NSA’s headquarters in Maryland, the Internet was also always a source of identity. His father, a Coast Guard officer, and his mother, a clerk in federal court, separated when he was young. As a teen, he spent years playing games online. As a young CIA employee in Switzerland, he vented and socialized regularly on anonymous chat boards. In this virtual space, national borders mattered less, and electronic privacy mattered more. By the time he had risen to become a senior technical consultant for the CIA, working as a Dell contractor, those values remained. “The one thing you resisted was this authoritarian power that wanted to own you,” says Drake, who will quote Star Trek and Tron to explain his values. “I was with the user.”
At some point in the coming months or years, Snowden’s fate will be decided. It is not clear if his asylum in Russia will be renewed. He continues to receive financial support from abroad, and a team of lawyers around the world is working on his behalf, pursuing other asylum applications and waiting on offers of negotiation from the U.S. authorities. Though the Department of Justice has promised not to apply the death penalty, no other offers of leniency have been forthcoming.
As the dinner wound down, ­Harrison, Snowden’s WikiLeaks adviser, explained to the group why she had put her life in legal jeopardy to help Snowden. “There needs to be another narrative,” she said in reference to Chelsea Manning, the U.S. Army private formerly known as Bradley, who leaked massive amounts of documents and was sentenced to 35 years in prison. “There needs to be a happy ending. People need to see that you can do this and be safe.”
Snowden, a libertarian activist who gave up his freedom only to live at the whim of an authoritarian state, has not fully succeeded in that regard. But he will not be the last of his kind, either. Both Assange and Laura Poitras, one of the first journalists Snowden contacted, say his efforts have already emboldened other leakers. “What Snowden did was really empowering,” says Poitras. “I mean, think of all the people who have security clearance. There are hundreds of thousands, millions of them. They see that this is really a historic moment, and they are starting to question their belief in the job they were asked to do.”
It is an odd corollary to this new era of mass surveillance: the same technologies that give states vast new powers increase the ability of individuals on the inside to resist. Those dynamics are fixed, a code that underpins the world we now inhabit. That is what Snowden ultimately realized and exploited, a matter of simple physics. His example is the most consequential and dramatic, but it is unlikely to be the last.
—with ­reporting by Simon Shuster/Berlin