Monitoring NSA in de VS en erbuiten, deel 10

quote:

Overheid wil meer invloed op Fox-IT na overname door Britten - rtlz.nl

De Nederlandse overheid is toch niet gerust op de Britse overname van cybersecuritybedrijf Fox-IT, dat staatsgeheimen beveiligt. De staat wil meer zeggenschap hebben over de bedrijfsvoering van het belangrijkste onderdeel van Fox-IT: de cryptografieafdeling.


Dat blijkt uit een brief (pdf) die de Militaire Inlichtingen- en Veiligheidsdienst (MIVD) heeft gestuurd aan Fox-IT. De tekst is gepubliceerd door NRC Handelsblad, die de brief boven water kreeg met een beroep op de Wet openbaarheid van bestuur.

De overheid wil zeggenschap over besluiten en benoemingen bij de cryptografieafdeling, genaamd Fox Crypto, en wil bij eventuele verkoopplannen als eerste de aandelen ervan kunnen verkopen. Als Fox-IT niet instemt met deze voorwaarden, zou het zijn opdrachten voor de overheid kunnen kwijtraken.

Directeur Onno Eichelsheim van de MIVD schrijft op 23 mei 2016, zo'n halfjaar na de overname door NCC Group, aan Fox-IT dat het bedrijf 'alle lopende en nieuwe' staatsopdrachten moet onderbrengen bij Fox Crypto. Dat onderdeel mag van de MIVD niet meer worden verkocht, niet fuseren, splitsen, of ontbonden worden en ook geen nieuwe bestuurders krijgen, zonder dat de minister van Defensie hier vooraf toestemming voor geeft.

Verder wil de overheid ook als eerste aandelen kunnen kopen en moet het ict-systeem van Fox Crypto worden gescheiden van Fox-IT. Als laatste voegt Eichelsheim toe dat de MIVD ogenblikkelijk op de hoogte moet worden gesteld als er 'technologie, kennis en ervaring' naar Groot-Brittannië of andere landen wordt gebracht.

Een klein deel van de 270 werknemers van Fox-IT, rond de 35 mensen, heeft toegang tot de beveiligde cryptografie-afdeling van het gebouw.

Ronald Prins, ceo van Fox-IT, zegt tegen NRC dat de onderhandelingen over deze voorwaarden nog steeds lopen, maar dat zijn bedrijf wel bereid is om mee te werken.

Eerder zei Prins tegen RTL Z dat de overname niet betekent dat staatsgeheimen in gevaar komen. "Dat je aandelen bezit in een Nederlands bedrijf betekent niet dat je hier zomaar binnen kunt lopen. Ze kunnen niet opeens zeggen: in het volgende doosje dat je voor de overheid maakt moet dit achterdeurtje zitten."

Fox-IT werd door NCC Group overgenomen voor 135 miljoen euro. Met de overname zegt Fox-IT sneller internationaal te kunnen uitbreiden. Prins is door de overname zo'n 40 miljoen euro rijker geworden.

Bron: www.rtlz.nl

quote:

Trump v US intelligence: growing feud puts NSA's legislative priority at risk

Reauthorization of measure permitting sweeping surveillance in danger as intelligence community has been blamed for leaks about Trump and Russia

The escalating feud between Donald Trump and US intelligence is now putting the top 2017 legislative priority of the intelligence agencies at risk.

At the end of the year, a broad legal authority permitting sweeping surveillance is set to expire. The National Security Agency considers the authority, known as Section 702 of the Foreign Intelligence Surveillance Act (Fisa), pivotal to fighting terrorism and stopping espionage. Civil libertarians consider the measure – the wellspring of the NSA’s Prism and “upstream” mass communications-data collection – unconstitutional.

The typical balance of power on Capitol Hill over surveillance is such that opponents of renewing Section 702 face strong political headwinds. The measure was reauthorized with minimal challenge in 2012.

Now the Republican chairman of the House intelligence committee has thrown reauthorization into question after extensive leaking about Trump and Russia that the president and his Capitol Hill allies have blamed on the US intelligence community.

Asked at a Tuesday press conference about the renewal of section 702 in light of ongoing leaks concerning Trump and Russia, Devin Nunes said, “I think it’s very problematic.”

He continued: “I’ve expressed this concern to the IC [intelligence community]. We have sent them many followup questions as it relates to intelligence that’s been collected. And we expect prompt answers. I think we also expect unprecedented answers from them of the information that we’re going to be asking for.”

First passed in 2008 to give legal cover to George W Bush-era warrantless surveillance, Section 702 permits the NSA to collect communications and associated data from targets it reasonably believes to be non-Americans overseas suspected of contact with a foreign power, even if they are in communication with Americans. The surveillance does not require a court order specifying its targets, purposes, or time frame; only the re-approval of the attorney general and the director of national intelligence.

NSA interception of communications between Russian officials or suspected operatives and Trump’s associates would not necessarily involve using Section 702. The NSA or FBI can acquire such communications under the terms of the original 1978 Fisa law. Because of a provision in the law about understanding the foreign-intelligence value of the intercepted communications, neither agency would necessarily have to purge references to Americans.

It is not only the NSA that values Section 702 ardently. FBI director James Comey last year called the surveillance activities permitted by Section 702 “far more important” than the bulk domestic phone-records data program that Congress curtailed in 2015. The FBI is permitted to warrantlessly search through the NSA’s troves of foreign-focused data with few restrictions.

Last week, as the House judiciary committee began hearings over the expiring provision, the Trump administration told Reuters it favors Section 702 reauthorization.

“We support the clean reauthorization and the administration believes it’s necessary to protect the security of the nation,” an anonymous official said.

Trump’s nominee for director of national intelligence, Dan Coats, testified that he agreed Section 702 is the “crown jewels” of US intelligence and the intelligence community “also sees it that way, the entire community”.

Throughout Barack Obama’s presidency and the Edward Snowden leaks, the vast majority of national-security-focused Republicans embraced the measure without reservation, with Republicans on the intelligence committee leading the way.

Nunes himself has been a full-throated defender of Section 702. Last year, he and colleague Lynn Westmoreland of Georgia took point in opposing a civil-libertarian effort to block it through an amendment to a defense-spending bill.

Citing the then-recent case of Orlando nightclub murderer Omar Mateen, Nunes and Westmoreland circulated a letter to colleagues claiming the loss of 702 would deprive the intelligence community of “the authorities it needs to detect and stop terrorist attacks.”

But since then, Nunes has become a crucial ally to Trump. Nunes served on Trump’s transition team, a closeness that has raised questions about Nunes’ independence as his committee investigates Trump associates’ ties to Russia.

Nunes has ardently defended Trump’s first national security adviser, Michael Flynn, and implied without evidence that the intelligence agencies abused their surveillance powers in leaking accounts of Flynn’s December conversations with Russian ambassador Sergey Kislyak that proved to be his downfall.

Trump has blamed the intelligence agencies for the leaks, in particular the FBI and NSA, and his administration has suggested that career intelligence officials are in league with former Obama officials. He has recently taken to claiming, baselessly, that Obama ordered Trump to be surveilled, an act that would be illegal if true.

“There is no evidence to support that claim” of Obama ordering Trump to be wiretapped, a US official told the Guardian over the weekend.

But Nunes has given the accusation credence. His committee on 1 March added the “possible leaks of classified information” that Trump wants investigated to its inquiry on Russian measures to interfere with the 2016 election, which the intelligence agencies publicly assessed in January were for Trump’s benefit.

“Typically we’ve had great trust with our intelligence agencies,” Nunes said on Tuesday.

“And I continue to have that trust, but we have to verify, in fact, that all of the tools that are in place, that we oversee, are being used ethically, responsibly and by the law. And if anybody has abused those, we want to know about that. And that’s part of the reason why it’s important for us to know whether or not, as some press reports have indicated, the Department of Justice or any other agency tried to get the warrant on anybody related to the Trump campaign or any other campaign for that matter.”

Adam Schiff, the top Democrat on the House intelligence committee, said the authority under Section 702 would be preserved when asked by the Guardian on Tuesday about Nunes’ comments. But he did not rule out potential reforms to the law if necessary.

“Section 702 has been a far more impactful and important counterterrorism program and tool,” Schiff said during a press conference on Capitol Hill.

“That doesn’t mean though that we shouldn’t explore whether there are ways to improve any of the protections in existing law or whether there are any changes that we need to make to the structure of the program.”

Schiff said the intelligence committee had been engaged in periodic briefings with members, given the law is poised to sunset this year. Should any questions come up in the same context that are pertinent to the Russia investigation, he added, they “ought to be answered so members understand how the program works [and] that it’s conducted in a lawful way.”

quote:

OM: 3,6 miljoen versleutelde berichten van criminelen gekraakt | NOS

De Nederlandse politie en het Openbaar Ministerie zeggen toegang te hebben gekregen tot 3,6 miljoen versleutelde berichten van criminelen. Volgens het OM zijn de berichten goed voor bewijsmateriaal in tientallen strafrechtelijke onderzoeken.

Het gaat om onderzoeken naar liquidaties, gewapende overvallen, drugshandel, witwaspraktijken, pogingen tot moord en andere vormen van georganiseerde misdaad. De berichten kunnen leiden tot grote en beslissende doorbraken in strafzaken, zegt het OM.

De berichten stonden op servers in Canada en waren van het Nederlandse bedrijf Ennetcom. In september vorig jaar kreeg het Openbaar Ministerie van een rechter in Toronto toestemming om een kopie van de servers naar Nederland te halen. Het gaat in totaal om 7 terabyte aan data. De berichten zijn naar eigen zeggen gekraakt met digitale sleutels die de opsporingsdiensten eerder in het onderzoek in handen hadden kregen.

Ennetcom wordt door het OM gezien als de grootste aanbieder van versleutelde communicatie aan criminelen in Nederland en is ook werkzaam in andere delen van West-Europa en Zuid-Amerika.

Ennetcom garandeerde zijn klanten anonimiteit, waardoor het bedrijf grote populariteit geniet. Hiervoor werd gebruikgemaakt van geprepareerde BlackBerry-telefoons met speciale software die voor 1500 euro per stuk werden verkocht. Daarnaast waren de microfoon en camera vaak uit het toestel verwijderd.

De telefoons waren uitgerust met PGP, wat staat voor Pretty Good Privacy. Deze technologie versleutelt berichten. Het gebruik hiervan is niet illegaal.

PGP is een veelgebruikte methode om veilig te communiceren en wordt niet alleen door criminelen maar ook door bijvoorbeeld journalisten en klokkenluiders gebruikt. Bij PGP worden berichten door elkaar gehusseld, zodat ze alleen leesbaar zijn voor mensen met een bepaalde encryptiesleutel.

Het netwerk bestond uit ongeveer 40.000 geregistreerde telefoons die met elkaar communiceerden en is vorig jaar april offline gehaald. De eigenaren kregen toen van de politie hierover een bericht op hun toestel. Het is niet duidelijk of al deze telefoons werden gebruikt door criminelen, het OM vermoedt van wel omdat voor zover bekend niemand gebruik heeft gemaakt van het verschoningsrecht.

De eigenaar van Ennetcom werd toen ook aangehouden, hij heeft daarna een tijdje vastgezeten en is nu weer vrij in afwachting van het vervolg van de zaak. Volgens het OM is het aannemelijk dat hij wist dat deze telefoons aan criminelen werden verkocht. Dat betekent, redeneert het Openbaar Ministerie, dat hij daarmee crimineel geld ontving, waardoor hij wordt verdacht van witwaspraktijken.

Uit een vertrouwelijk rapport van het Nederlands Forensisch Instituut bleek eind 2015 dat het instituut middelen heeft om PGP-berichten op BlackBerry-telefoons te kraken. Het NFI kon door middel van een speciale zoekmachine, die Hansken wordt genoemd, de berichten doorzoeken.

Bron: nos.nl

quote:

'NSA hackt banken en monitort internationale geldstromen'

De NSA heeft ingebroken bij banken en een partij die internationale betalingen verwerkt, waarmee de geheime dienst geldstromen in de gaten kan houden. Dat blijkt uit informatie die een hackersgroep vandaag publiceert.

Het gaat naar verluidt om dezelfde hackersgroep die eind vorig jaar al staatsgeheime malware van de NSA publiceerde: de Shadow Brokers.

De authenticiteit van deze NSA-malware is toen door onder andere NSA-klokkenluider Edward Snowden en verschillende beveiligingsexperts bevestigd.

Midden-Oosten1
Ditmaal publiceert Shadow Brokers informatie over hoe de NSA zou hebben ingebroken bij Eastnets, een bedrijf dat internationale Swift-betalingen verwerkt. Swift is het systeem waarmee banken internationale betalingen regelen.

Uit de gelekte documenten blijkt dat de NSA zich richt op banken uit de Verenigde Arabische Emiraten, Qatar en Bahrein. Ook investeringsbanken uit het Midden-Oosten komen regelmatig in het datalek voor.

Ook een Belgische bank is aangevallen, zo blijkt uit de gelekte data. Die bevatten verschillende Belgische ip-adressen bij onder andere Belgacom en Easynet.

Gelekte exploits zijn legitiem

De NSA zou hebben ingebroken via lekken in netwerkapparatuur, zoals routers en servers. Daarna hebben ze via kwetsbaarheden in de Windows-software toegang gekregen tot het Swift-systeem.

Het is niet de eerste keer dat de NSA in verband wordt gebracht met het Swift-bankensysteem. In gelekte NSA-documenten van Edward Snowden werd al beschreven hoe de geheime dienst het internationale betalingsverkeer in de gaten houdt.

Volgens beveiligingsonderzoeker Rik van Duijn van DearBytes is het lastig om met zekerheid te zeggen dat het om de NSA gaat: "Maar daar is wel een sterke indicatie voor. De gelekte hackmethoden zijn in ieder geval legitiem, en de systemen die zijn aangevallen, zoals Windows 8, zijn ook nog eens redelijk nieuw."

Van Duijn zegt dat er naar de NSA wordt gewezen omdat er opnieuw gebruik wordt gemaakt van dezelfde kwetsbaarheden die de dienst al eerder misbruikte om de een belangrijke firewall te hacken.

Financiering voor terrorisme

Het is mogelijk dat de NSA zich met name op banken uit het Midden-Oosten richt om terrorismefinanciering in de gaten te houden, zo stelt terrorisme-expert Rico Briedjal: "Je hebt geld nodig om professionele aanslagen te plannen en uit te voeren."

Briedjal snapt dan ook dat geheime diensten geïnteresseerd zijn in het analyseren van de geldstromen binnen het Midden-Oosten: "Dat is de bron van het islamitisch terrorisme, en je wilt als inlichtingendienst zo dicht mogelijk bij de bron zitten."

Swift-systeem

Het is niet de eerste keer dat het Swift-systeem wordt aangevallen. Eerder hackten criminelen de nationale bank van Bangladesh en kregen toen toegang tot het Swift-systeem. Op deze manier stalen ze 72 miljoen euro.

Swift en Eastnets hebben nog niet gereageerd op schriftelijke vragen.

quote:

NSA stopt met verzamelen mails over buitenlandse doelwitten | NOS

De Amerikaanse inlichtingendienst NSA stopt met het verzamelen van e-mails van Amerikanen waarin buitenlanders worden genoemd die onder surveillance staan.

Voortaan worden er alleen e-mails onderschept die direct naar of door zo iemand zijn gestuurd. Volgens de NSA neemt hierdoor de kans af dat mailwisselingen van burgers die verder niets met deze personen te maken hebben worden onderschept.

Ook zegt de NSA dat het de grote meerderheid van internetdata die op die manier zijn verzameld zal vernietigen. Het besluit kwam als een verrassing voor privacy-voorvechters die al langer betoogden dat de dataverzameling van de NSA te breed was en onwettig.

In 2011 oordeelde de rechter al dat de dataverzameling van de NSA een schending van de grondrechten van burgers opleverde. De geheime dienst paste toen zijn werkwijze aan en bewaarde de gegevens op een plek waar niet alle werknemers toegang toe hadden. Vorig jaar bleek dat die aanpassing niet goed werkte en daarom zou de NSA besloten hebben om helemaal met verzamelen van de data te stoppen.

Bron: nos.nl

quote:

Omstreden aftapwet AIVD na vanavond waarschijnlijk van kracht

De Eerste Kamer gaat vanavond naar verwachting de omstreden wet aannemen waarmee de AIVD het internet op grote schaal mag aftappen. De verzamelde emails en appjes mogen drie jaar worden bewaard, ook als blijkt dat ze niet van belang zijn voor het onderzoek.

Stel, in de Utrechtse wijk Zuilen houdt een terrorismeverdachte zich schuil. De AIVD weet niet precies waar en tapt de hele wijk af om informatie te verzamelen. Bingo: één van de inwoners bezoekt regelmatig extremistische websites.

Dit scenario is na vanavond, als de Eerste Kamer de nieuwe aftapwet aanneemt, toegestaan. Het is een wens van zowel de geheime dienst als het ministerie van Binnenlandse Zaken die in vervulling gaat.

Een wet uit 2002

De huidige Wet op de inlichtingen- en veiligheidsdiensten stamt uit 2002. Toen bestonden de iPhone, Facebook en WhatsApp nog niet. De wet is na vijftien jaar wel toe aan vernieuwing. Daar is zelfs de grootste criticaster Bits of Freedom, dat opkomst voor digitale burgerrechten, het mee eens.

Op dit moment mag de AIVD alleen maar een gerichte tap plaatsen, bijvoorbeeld op de internetverbinding van een laptop of telefoon. Met de nieuwe wet mag de geheime dienst ook op grote schaal het internet aftappen, zoals de hierboven beschreven stadswijk of alle internetcommunicatie tussen Nederland en Syrië.

Om op grote schaal af te tappen moet de AIVD wel altijd toestemming vragen aan een nieuwe toetsingscommissie, die bestaat uit rechters en technici.

Data over data

De AIVD verzamelt met deze internettaps metadata, zoals met wie je communiceert, waar je bent en welke sites je bezoekt. Metadata geven een gedetailleerd beeld van iemands leven, maar tonen meestal niet de inhoud van communicatie. Deze is bij onder andere WhatsApp - zowel het chatten, bellen als media delen - versleuteld met end-to-end-encryptie.

Als er aanleiding is om de inhoud van communicatie van een doelwit in te zien, kan de geheime dienst onder andere proberen om de persoon te hacken om zo de end-to-end-encryptie te omzeilen.

De AIVD krijgt drie jaar om verzamelde gegevens te doorzoeken op relevante data. Dat betekent dat gegevens van onschuldige burgers voor maximaal drie jaar in een database van de AIVD kunnen staan.

Een sleepnet

Er is veel kritiek op de nieuwe wet. Zowel de toezichthouder CTIVD als regeringsadviseur Raad van State vinden het toezicht op de nieuwe wet niet voldoende en de bewaartermijn van drie jaar te lang. Privacywaakhond Autoriteit Persoonsgegevens stelt zelfs dat de wet in strijd is met het Europees Verdrag voor de Rechten van de Mens.

"De wetenschap dat geheime diensten kunnen meeluisteren zorgt ervoor dat je wel twee keer nadenkt wat je zegt of deelt met anderen", zegt David Korteweg van Bits of Freedom. "Het leidt tot zelfcensuur en beperkt de vrijheid voor afwijkende opvattingen. Surveillance op deze schaal hoort in een vrije samenleving als Nederland niet thuis."

Aangenomen

Vannacht tussen 00.05 en 00.15 wordt er in de Eerste Kamer over de wet gestemd. De verwachting is dat de wet wordt aangenomen, vertelt politiek verslaggever Fons Lambie: "Als alle partijen uit de Tweede Kamer die voor de wet stemden vanavond opnieuw voor stemmen, dan wordt de wet gemakkelijk aangenomen."

In de Tweede Kamer stemden alleen de SP, GroenLinks, D66, Partij voor de Dieren, Groep Kuzu/Öztürk en Klein tegen. De rest van de partijen stemden voor.

quote:

Court to hear challenge to GCHQ bulk hacking of phones and computers

Privacy International, which has argued that agency’s surveillance breaches human rights, takes case to appeal court

A challenge to GCHQ’s use of non-specific warrants to authorise the bulk hacking of smartphones, computers and networks in the UK is starting at the court of appeal.

The case, brought by the campaign group Privacy International (PI), is the latest twist in a protracted battle about both the legality of bulk surveillance and the primacy of civil courts over an intelligence tribunal that operates partly in secret.

The original claim dates back to 2014 and was brought at the investigatory powers tribunal (IPT) following revelations by the American whistleblower Edward Snowden who exposed the extent of surveillance carried out by the US’s National Security Agency and the UK’s GCHQ.

The IPT hears complaints about government surveillance and the intelligence services. Some of its hearings are held behind closed doors.

PI, along with seven internet service providers, argued that computer network exploitation (CNE) carried out by GCHQ, the government monitoring station in Cheltenham, breaches human rights.

At the first hearing, Ben Jaffey QC, for PI, argued that since the 18th century the common law has opposed the use of such non-specific warrants.

In February last year, however, the IPT ruled that the legal regime under which warrants were issued for the agency to carry out equipment interference, or hacking, in the UK was compatible with the European convention on human rights. The decision said that warrants do not need to be “defined by reference to named or identified individuals”.

Frustrated at the outcome, PI launched a judicial review of the IPT’s decision in the high court because there was, effectively, no right of appeal from the tribunal. In February this year, the high court ruled in favour of GCHQ and the Foreign Office, rejecting the judicial review challenge.

On Thursday, the next stage of the legal battle goes before the court of appeal. In advance of the hearing, Scarlet Kim, a legal officer at PI, said: “The [IPT] unlawfully sanctioned the UK government’s use of sweeping powers to hack hundreds or thousands of people’s computers and phones with a single warrant. Rather than debate the necessity and proportionality of their expansive hacking powers, the government is instead arguing that the UK courts should have no jurisdiction to review the legality of the tribunal’s decisions.

“Too often, the government justifies intrusive surveillance powers by telling the public that ‘if you have nothing to hide, you have nothing to fear’. We throw that mantra back to the government: ‘If you have nothing to hide about your hacking, you have nothing to hide from our courts.’”

If PI loses the case it could be ordered to pay up to £25,000 of the government’s legal costs under a “protective costs order” that caps its liabilities. To pay for the challenge, the organisation has launched a crowdfunding appeal through the website CrowdJustice.

In its appeal, PI argues: “Hacking actually makes us less safe because it compromises the technology that is increasingly embedded into the fabric of our lives. By hacking our devices, the government is choosing to take advantage of security holes, which leaves us all more vulnerable to future cyber-attacks. By hacking, the government has deliberately chosen to make our technology less secure than it can be.”

Welcoming the IPT judgment in 2015, the then foreign secretary, Philip Hammond, said: “A proper balance is being struck between the need to keep Britain safe and the protection of individuals’ privacy.”

He added: “The ability to exploit computer networks plays a crucial part in our ability to protect the British public. Once again, the law and practice around our security and intelligence agencies’ capabilities and procedures have been scrutinised by an independent body and [have] been confirmed to be lawful and proportionate.”

quote:

U.K. Police Investigation of Snowden Leak Journalists Enters Fourth Year

A secretive British police investigation focusing on journalists who have worked with Edward Snowden’s leaked documents is still active more than four years after it was launched, The Intercept has learned.

The investigation – codenamed “Operation Curable” – is being led by a counter-terrorism unit within London’s Metropolitan Police, under the direction of the force’s chief of Specialist Operations, Mark Rowley. The Metropolitan Police confirmed the status of the investigation last week in response to a Freedom of Information Act request.

The disclosure that the probe remains active prompted criticism on Monday from the National Union of Journalists, the U.K.’s largest journalists’ organization. Sarah Kavanagh, a spokesperson for the group, said that news reports based on the Snowden documents had exposed unlawful covert surveillance activities in the public interest.

“The media are often the only group in society able to reveal the intelligence and security forces have exceeded their legitimate powers and remit,” Kavanagh said. “The Met Police should be condemned for keeping journalists under investigation because they worked on the Snowden leaks. The investigation should be halted immediately. Journalism is not a crime.”

The origins of the investigation can be traced back to May 2013, when National Security Agency contractor Snowden turned over a cache of classified documents about government surveillance to journalists including Intercept co-founder Glenn Greenwald, who was at that time working for British news organization The Guardian. Among the documents were details about mass surveillance programs operated by the U.K.’s largest spy agency, Government Communications Headquarters.

In August 2013, detectives from the Metropolitan Police used a counter-terrorism law to detain and interrogate David Miranda, Greenwald’s partner, while he was passing through London’s largest airport. Miranda was carrying a batch of encrypted Snowden documents to aid Greenwald’s reporting on the files. The police seized Miranda’s possessions – including a mobile phone, laptop, camera, and flash drives – and began a criminal investigation.

British authorities argued that publishing the Snowden files was itself a terrorist act, thereby explicitly conflating journalism with terrorism. Prior to Miranda’s arrival in London, a memo authored by the Metropolitan Police and domestic spy agency MI5 was circulated to U.K. border entry points. It asserted that “the disclosure [of the Snowden documents], or threat of disclosure, is designed to influence a government and is made for the purpose of promoting a political or ideological cause. This therefore falls within the definition of terrorism.”

In December 2013, one of the London force’s most senior officers, Cressida Dick, was questioned about the case during a parliamentary hearing. She acknowledged that the force’s investigation was looking at whether reporters at The Guardian had committed criminal offenses – some carrying potential 10-year prison sentences – for their role in revealing secret surveillance operations exposed in the documents. “We need to establish whether they have or haven’t [committed offences],” Dick said. “That involves a huge amount of scoping of material.”

Later, however, the Metropolitan Police attempted to keep all details about the case secret. In early 2015, the force refused to confirm or deny whether the investigation existed, and stated that revealing such details could help terrorists and be “detrimental to national security.” The force eventually backed down on this position and admitted the probe remained ongoing, following an intervention from the U.K.’s Information Commissioner’s Office, which enforces freedom of information laws in the country.

Given that the investigation has been active for more than four years, it appears likely that it has required a substantial amount of resources at a time when the Metropolitan Police has faced budget cuts and had to respond to a spate of terror attacks in London. The force has declined to provide any information about the amount of funds spent on the probe, or to disclose the number of officers working on it, insisting that it does not hold records of these details.

A spokesperson for the Metropolitan Police said in a statement that the investigation “was launched in order to protect life and national security.” The spokesperson added: “As would be as expected we do not put a time limit on an investigation, and the priority is that it is thorough and establishes all of the relevant facts. This is a complex investigation and enquiries continue. No arrests have been made to-date.”

Last year, a judge ruled that the U.K.’s counter-terrorism legislation did not sufficiently protect the rights of journalists, after Miranda sued the police for detaining him at the London airport. The judge found that Schedule 7 of the Terrorism Act – the power used to target Miranda and seize his possessions – was “not subject to adequate safeguards against its arbitrary exercise” and was “incompatible” with Article 10 of the European Convention on Human Rights, which protects the right to “receive and impart information and ideas without interference by public authority and regardless of frontiers.”

quote:

German government wants ‘backdoor’ access to every digital device: report

Germany’s Interior Minister wants to force tech and car companies to provide the German security services with hidden digital access to cars, computers, phones and more, according to a media report from Friday.

The RedaktionsNetzwerk Deutschland (RND) reported that Thomas de Maizière had written up a draft proposal for the interior minister conference, taking place next week in Leipzig, which he has called “the legal duty for third parties to allow for secret surveillance.”

According to the RND, the proposal would “dramatically extend” the state’s powers to spy on its citizens.

The Interior Minister has been motivated to propose a new law by the fact that it is becoming ever more difficult for the intelligence agencies to break through the security systems which protect privacy on digital devices.

For example, the modern locking systems on cars are so intelligent that they even warn a driver if their car is shaken a little bit. De Maizière wants the new law to ensure that these alerts would not be sent out to a car owner if the police determined it to be justified by their investigation.

But the parameters of the proposed law are reportedly much wider. De Maizière also wants the security services to have the ability to spy on any device connected to the internet. Tech companies would have to give the state "back door" access to private tablets and computers, and even to smart TVs and digital kitchen systems.

The security services would need the authorization of a judge to hack into any of these devices.

The proposal was met with astonishment by digital activists and politicians on Friday.

The draft law is “a frontal attack on the digital and physical security of all citizens,” Frank Rieger, spokesman for the Chaos Computer Club (CCC) told netzpolitik.org. “Access to the IT system of a car means danger to life and limb - it is a literal kill switch.”

“The Interior Minister's plans sounds like an Orwellian nightmare. Soon all flats in Germany will be equipped with devices which are potential wiretaps,” Konstantin von Notz, deputy faction leader of the Green Party, told Spiegel.

“We need to think really hard about the fact that we are a country with two dictatorships in its recent history. Do we want to live in a land where there is no privacy and where the state can interfere wherever it is technologically possible?” he asked.

quote:

UK mass digital surveillance regime ruled unlawful

Judges say snooper’s charter lacks adequate safeguards around accessing personal data

Appeal court judges have ruled the government’s mass digital surveillance regime unlawful in a case brought by the Labour deputy leader, Tom Watson.

Liberty, the human rights campaign group which represented Watson in the case, said the ruling meant significant parts of theInvestigatory Powers Act 2016 – known as the snooper’s charter – are effectively unlawful and must be urgently changed.

The government defended its use of communications data to fight serious and organised crime and said that the judgment related to out of date legislation. Minister Ben Wallace said that it would not affect the way law enforcement would tackle crime.

The court of appeal ruling on Tuesday said the powers in the Data Retention and Investigatory Powers Act 2014, which paved the way for the snooper’s charter legislation, did not restrict the accessing of confidential personal phone and web browsing records to investigations of serious crime, and allowed police and other public bodies to authorise their own access without adequate oversight.

The three judges said Dripa was “inconsistent with EU law” because of this lack of safeguards, including the absence of “prior review by a court or independent administrative authority”.

Responding to the ruling, Watson said: “This legislation was flawed from the start. It was rushed through parliament just before recess without proper parliamentary scrutiny.

“The government must now bring forward changes to the Investigatory Powers Act to ensure that hundreds of thousands of people, many of whom are innocent victims or witnesses to crime, are protected by a system of independent approval for access to communications data. I’m proud to have played my part in safeguarding citizens’ fundamental rights.”

Martha Spurrier, the director of Liberty, said: “Yet again a UK court has ruled the government’s extreme mass surveillance regime unlawful. This judgement tells ministers in crystal clear terms that they are breaching the public’s human rights.”

She said no politician was above the law. “When will the government stop bartering with judges and start drawing up a surveillance law that upholds our democratic freedoms?”

The Home Office announced a series of safeguards in November in anticipation of the ruling. They include removing the power of self-authorisation for senior police officers and requiring approval for requests for confidential communications data to be granted by the new investigatory powers commissioner. Watson and other campaigners said the safeguards were “half-baked” and did not go far enough.

The judges, headed by Sir Geoffrey Vos, declined to rule on the Home Office claim that the more rigorous “Watson safeguards” were not necessary for the use of bulk communications data for wider national security purposes.
The judges said the appeal court did not need to rule on this point because it had already been referred to the European court of justice in a case which is due to be heard in February.

Watson launched his legal challenge in 2014 in partnership with David Davis, who withdrew when he entered the government as Brexit secretary in 2016. The European court of justice ruled in December 2016 that the “general and indiscriminate retention” of confidential personal communications data was unlawful without safeguards, including independent judicial authorisation.

Security minister Ben Wallace responded to the ruling saying: “Communications data is used in the vast majority of serious and organised crime prosecutions and has been used in every major security service counter-terrorism investigation over the last decade. It is often the only way to identify paedophiles involved in online child abuse as it can be used to find where and when these horrendous crimes have taken place.”

He said the judgment related to legislation which was no longer in force and did not change the way in which law enforcement agencies could detect and disrupt crimes.

“We had already announced that we would be amending the Investigatory Powers Act to address the two areas in which the court of appeal has found against the previous data retention regime. We welcome the fact that the court of appeal ruling does not undermine the regime and we will continue to defend these vital powers, which Parliament agreed were necessary in 2016, in ongoing litigation,” he said.

quote:

UK has six months to rewrite snooper's charter, high court rules

Judges say Investigatory Powers Act is incompatible with EU law after legal challenge by Liberty

The British government must rewrite its mass data surveillance legislation because it is incompatible with European law, the high court has ruled.

Judges have given ministers and officials six months to redraft the 2016 Investigatory Powers Act, labelled the snooper’s charter by critics, following a crowdfunded challenge by the human rights group Liberty.

Ministers had already accepted that some aspects of the act do not comply with EU law and needed to be revised. They wanted until April next year to introduce new rules.

On Friday, however, Lord Justice Singh and Lord Justice Holgate said legislation must be drawn up by the start of November.

Lawyers for Liberty argued in February that the act violates the public’s right to privacy by allowing the storage of and access to internet data.

The government accepted the act was inconsistent with EU law because access to retained data was not limited to the purpose of combating “serious crime” and was not subject to prior review by a court or other independent body.

The case was the first stage of Liberty’s legal challenge against the act and was funded by supporters who raised more than £50,000.

The Home Office announced a series of new safeguards last year in anticipation of the ruling. They included removing the power of self-authorisation for senior police officers, and requiring approval for requests for confidential communications data to be granted by the investigatory powers commissioner. Liberty said the safeguards did not go far enough.

The group has launched another fundraising effort for the next stage of its case, which includes challenging rules on bulk interception of digital communications.

It argues that the powers to intercept communications in bulk and create files known as personal datasets undermine free speech, privacy and patient confidentiality, legal privilege and journalists’ sources.

Speaking after the ruling, Liberty’s director, Martha Spurrier, said: “Police and security agencies need tools to tackle serious crime in the digital age, but creating the most intrusive surveillance regime of any democracy in the world is unlawful, unnecessary and ineffective.”

The latest ruling follows an appeal court decision in January against previous surveillance rules in the 2014 Data Retention and Investigatory Powers Act, which expired at the end of 2016.

Three senior judges concluded that Dripa was inconsistent with EU law following a challenge by the Labour deputy leader, Tom Watson, and campaigners, who were supported by Liberty.

quote:

Omstreden databedrijf Cambridge Analytica stopt na Facebookschandaal

Cambridge Analytica gooit de handdoek in de ring en vraagt faillissement aan. Het bedrijf stopt na weken onder vuur te hebben gelegen over het misbruik van via Facebook verkregen data.

Het bedrijf sluit de deuren omdat Cambridge Analytica veel klanten verloor in de afgelopen weken. Daarnaast stapelden de juridische kosten in het Facebook-onderzoek zich op.

'Volledig onderzoek'

Halverwege maart werd ceo Alexander Nix op non-actief gesteld. Nix onthulde dat het bedrijf in het geheim meewerkte aan verkiezingscampagnes en deed uitspraken over de inzet van prostituees. Het bedrijf startte een ‘volledig, onafhankelijk onderzoek’.

Het databedrijf stelde zeer nauwkeurige dataprofielen op van miljoenen mogelijke kiezers. Die werden dan vervolgens bestookt met berichten via Facebook. Volgens Facebook heeft Cambridge Analytica daar in 2015 zonder toestemming gebruikersdata van het sociale netwerk voor toegepast, waarmee het vervolgens een voordeel had bij het bereiken van Amerikaanse kiezers.

'Ethisch juist gehandeld'

Zelf is het bedrijf zich - volgens een verklaring - van geen kwaad bewust. Het bedrijf stelt slachtoffer te zijn geworden van ongefundeerde beschuldigingen. "Onze activiteiten zijn niet alleen legaal, maar ook nog breed geaccepteerd als een standaardcomponent van online adverteren, zowel in de politieke als commerciële arena."

Het bedrijf stelt dat de werknemers ethisch en wettelijk juist hebben gehandeld, maar dat door de doorlopende aandacht van de media voor het schandaal, vrijwel alle klanten vertrokken zijn. Daarna is geconcludeerd dat het onhaalbaar was om door te gaan.

Storm over Facebook

Begin april meldde Facebook dat er privegegevens van ongeveer 87 miljoen gebruikers met het omstreden bureau gedeeld zijn. Na de onthullingen volgde een storm van kritiek op Facebook.

Facebook-topman Mark Zuckerberg moest veelvuldig excuses aanbieden en bezwoer dat gebruikersdata veilig is bij Facebook. Hij moest ook verschijnen voor een commissie van het Amerikaanse congres, wordt binnenkort nog verwacht bij het Europees Parlement en de Britten hebben aangegeven dat hij ook daar tekst en uitleg moet komen geven. De ex-ceo van Cambridge Analytica weigerde dat.

Facebook past voorwaarden aan

Naar aanleiding van het schandaal heeft Facebook nu zijn algemene voorwaarden bijgewerkt. De update is bedoeld om alles duidelijker en helderder te maken door eenvoudiger taal te gebruiken, stelt het bedrijf. Onlangs werden de privacy-instellingen ook al beter zichtbaar en werd het voor gebruikers simpeler om gegevens te wissen.

Werknemers van het bedrijf hoorden woensdag dat het voorbij was. Ze moesten hun computers inleveren. Ook SCL Group, de Britse afdeling van Cambridge Analytica, stopt ermee.

quote:

Britse inlichtingendienst werkte in strijd met mensenrechten

De bevoegdheden van de Britse inlichtingendiensten gingen te ver en waren in strijd met de mensenrechten. Dat oordeelt het Europees Hof voor de Rechten van de Mens. De uitspraak is een overwinning voor de burgerrechtenbewegingen en journalistenorganisaties die de zaak hadden aangespannen.

De zaak was aangespannen naar aanleiding van documenten die via de Amerikaanse klokkenluider Edward Snowden naar buiten werden gebracht. Daarin stond veel informatie over de handel en wandel van de Britse inlichtingendienst.

Het hof oordeelt dat inlichtingendiensten wel op grote schaal privé-informatie mogen verzamelen, maar dat er te weinig toezicht was.


Journalisten

Daarnaast was er ook te weinig aandacht voor het beschermen van vertrouwelijke informatie van journalisten. Er waren niet genoeg waarborgen om te garanderen dat die informatie veilig werd bewaard.

Op een ander punt vingen de klagers bot. Volgens het hof was er niets mis met de informatie-uitwisseling met andere landen.

Overigens gaat dit vonnis over een wet uit 2000. Inmiddels is de inlichtingenwet aangepast. Volgens de Britse regering is de privacy nu beter geregeld. Het Hof voor de Rechten van de Mens heeft daar niet naar gekeken en velde er dus geen oordeel over.

quote:

GCHQ data collection regime violated human rights, court rules

quote:

Jim Killock, executive director of Open Rights Group, said: “Viewers of the BBC drama the Bodyguard may be shocked to know that the UK actually has the most extreme surveillance powers in a democracy. Since we brought this case in 2013, the UK has actually increased its powers to indiscriminately surveil our communications whether or not we are suspected of any criminal activity. In light of today’s judgment, it is even clearer that these powers do not meet the criteria for proportionate surveillance and that the UK government is continuing to breach our right to privacy.”

quote:

Kritiek toezichthouder op uitvoering inlichtingenwet: 'Te veel is onrechtmatig'

Een halfjaar nadat de nieuwe, omstreden wet op de inlichtingendiensten is ingevoerd, gaat nog lang niet alles goed. Dat concludeert de toezichthouder, die tegelijk met de introductie van de nieuwe wet is opgericht.

In de afgelopen zes maanden trapte die toezichthouder een op de twintig keer op de rem. Het gaat daarbij om inlichtingendienst AIVD of MIVD die toestemming vraagt om bijvoorbeeld een mogelijke terrorist af te tappen of te hacken.

"Een op de twintig verzoeken is onrechtmatig, dat vinden wij te veel. We zijn nu niet tevreden, er waren behoorlijk wat problemen", zegt voorzitter Mariëtte Moussault van de Toetsingscommissie Inzet Bevoegdheden.

Voordat de commissie zich over een verzoek buigt, moet de minister van Binnenlandse Zaken of Defensie al zijn handtekening hebben gezet. Dat betekent dat die ministers dus hebben ingestemd met een hack of tap die volgens de onafhankelijke toezichthouder in strijd met de wet is.

'Aanloopproblemen'

Volgens de ministeries van Binnenlandse Zaken en Defensie gaat het om aanloopproblemen. "Er waren wat aanloopproblemen omdat het allemaal nieuw was, maar die zijn grotendeels opgelost", laat Binnenlandse Zaken weten in een reactie.

Die conclusie durft Moussault nog niet te trekken. "Dat is te kort door de bocht. Op sommige punten is er een voorzichtige positieve ontwikkeling. Ik hoop over een halfjaar te kunnen zeggen dat het inderdaad opstartproblemen waren." Volgens de toetsingscommissie zijn er nog een aantal "aandachtspunten" die moeten worden opgelost.

_{Sinds de eerste conceptversie van de nieuwe inlichtingenwet is er veel protest tegen de wet. Op een consultatie kwamen honderden reacties, en studenten van de Universiteit van Amsterdam wisten met ruim 400.000 handtekeningen een referendum af te dwingen. Bij het referendum stemde een kleine meerderheid van 49,5 procent van de stemmers tegen, 46,5 procent stemde voor. Het kabinet voerde de wet desondanks in, maar werkt nu aan wijzigingen om tegemoet te komen aan de kritiek.}

De verzoeken werden onder meer afgekeurd als de inlichtingendiensten iets wilden doen dat volgens de toezichthouder niet door de beugel kon. In andere gevallen was niet goed genoeg uitgelegd waarom een zogenoemde bijzondere bevoegdheid moest worden ingezet.

"Soms leggen de inlichtingendiensten bijvoorbeeld niet goed uit waarom er een tap moet worden geplaatst die ook een non-target treft", zegt Moussault. Een 'non-target' is iemand die niet het doelwit is van de inlichtingendienst, maar in dit geval wel wordt getroffen door bijvoorbeeld een internettap, zoals een huis- of echtgenoot. Op dat punt worden verzoeken inmiddels beter gemotiveerd.

Ook gebeurt het dat er te weinig technische informatie wordt gegeven over een geplande hackoperatie. "Zo'n hack levert ook risico's op voor het doelwit", zegt voorzitter Moussault. Daar wordt soms te weinig informatie over gegeven.

"Maar in andere gevallen vinden we simpelweg dat een hack of tap te ver gaat", zegt Moussault. Om welke redenen verzoeken het meest worden afgekeurd, is onbekend.

Niet alleen werden er verzoeken afgekeurd: een op de tien verzoeken van de AIVD werd bovendien niet direct beoordeeld, omdat de toetsingscommissie te weinig informatie kreeg om tot een goed oordeel te komen. In die gevallen werd het ministerie om meer informatie gevraagd. In een klein aantal gevallen besloten de diensten om een verzoek in te trekken nadat er om meer informatie werd gevraagd.

Statistieken gecensureerd

Hoe vaak de inlichtingendiensten een verzoek tot tappen of hacken indienen, is niet bekend. De toetsingscommissie wilde dat bekendmaken, maar werd teruggefloten door het ministerie. In een rapport dat vanmiddag naar de Tweede Kamer wordt verzonden, zijn de statistieken weggelakt. Volgens de ministeries zijn de statistieken staatsgeheim.

De cijfers mogen wel worden vrijgegeven bij het jaarverslag van de toetsingscommissie, dat volgend jaar wordt gepubliceerd. Volgens de inlichtingendiensten geven de statistieken te veel prijs voor kwaadwillenden als ze op halfjaarlijkse basis worden vrijgegeven

"Wij hanteren het principe dat we zo transparant mogelijk willen zijn", zegt Moussault van de toezichthouder. "Maar het is uiteindelijk aan de ministers om te bepalen wat wel en niet openbaar wordt."

Grootschalige hacks

Moussault en haar collega's verbazen zich ook over de regels rond grootschalige hacks. Na kritiek op de nieuwe tapbevoegdheden voor de inlichtingendiensten - door de tegenstanders een 'sleepnet' genoemd - kwamen daarvoor extra waarborgen. Zo moeten de geheime diensten opnieuw toestemming vragen als ze afgetapte datasets willen bekijken.

Maar dat is niet zo bij grootschalige hacks, waarbij grote hoeveelheden gegevens kunnen worden buitgemaakt. Daar kunnen de inlichtingendiensten in struinen zonder dat ze opnieuw om toestemming hoeven te vragen. Volgens voorzitter Moussault komt dat in de praktijk voor. "Het verschijnsel is ons opgevallen", zegt ze.

Of de wet moet worden aangepast, is niet aan de toetsingscommissie, zegt ze. "Maar we snappen niet waarom er in de wet een verschil is tussen de toestemming voor grootschalige hacks en taps."

quote:

GCHQ boosts powers to launch mass data hacking

Expanded intelligence gathering is ‘a grave threat’ warn rights groups

The UK’s intelligence agencies are to significantly increase their use of large-scale data hacking after claiming that more targeted operations are being rendered obsolete by technology.

The move, which has alarmed civil liberty groups, will see an expansion in what is known as the “bulk equipment interference (EI) regime” – the process by which GCHQ can target entire communication networks overseas in a bid to identify individuals who pose a threat to national security.

A letter from the security minister, Ben Wallace, to the head of the intelligence and security committee, Dominic Grieve, quietly filed in the House of Commons library last week, states: “Following a review of current operational and technical realities, GCHQ have … determined that it will be necessary to conduct a higher proportion of ongoing overseas focused operational activity using the bulk EI regime than was originally envisaged.”

The expansion of EI is likely to prove highly controversial.

“The bulk equipment interference power permits the UK intelligence services to hack at scale by allowing a single warrant to cover entire classes of property, persons or conduct,” explained Scarlet Kim, legal officer at Privacy International, which has taken the government to court over GCHQ’s hacking activities abroad. “It also gives nearly unfettered powers to the intelligence services to decide who and when to hack.”

Potential targets can be extremely large, Kim suggested. “Hacking presents unique and grave threats to privacy and security,” she said. “It’s not just directed at computers and phones, but can target communications networks and their underlying infrastructure, permitting surveillance against whole groups or countries, or across numerous jurisdictions.”

When the government was piloting the Investigatory Powers Act through parliament two years ago, Lord Anderson, the government’s independent reviewer of terrorism legislation, stated in his Report of the Bulk Powers Review that “Bulk EI [equipment interference] is likely to be only sparingly used”.

However, the intelligence services claim that the widespread use of encryption means that targeted hacking exercises are no longer effective and so more large-scale hacks are becoming necessary. Anderson’s review noted that the top 40 online activities relevant to MI5’s intelligence operations are now encrypted.

“This is really alarming to hear because at the time [when the legislation was passing through parliament] there were really robust assurances that these would be sparingly used,” said Hannah Couchman, policy and campaigns officer at Liberty. “Something that was the exception is moving towards the norm and that’s deeply problematic for us.”

Wallace’s letter concedes that the intelligence agencies will not be able to determine some of the consequences of a bulk hacking exercise, claiming: “It is not always possible to adequately foresee the extent of all interferences with privacy to a sufficient degree … at the point of issue of a warrant.”

Instead, the investigatory powers commissioner will be able to make an assessment of the warrant’s impact after the hack has taken place. “This is too little, too late,” said Couchman, who questioned whether the expansion of bulk equipment interference would see more intelligence being traded with other countries, in return for information they have gathered on UK citizens.

“The fact that you have the review only after the privacy has been infringed upon demonstrates how worrying this situation is,” Couchman added. “With bulk powers, the state can hoover up and keep enormous quantities of data about an enormously wide range of people. Bulk equipment interference powers allow a broad range of hacking activities, including accessing computers and mobile phones. Imagine what the average person has on their devices.”

A government spokesman said: “Equipment interference is subject to the world-leading oversight of the investigatory powers commissioner and any bulk equipment interference warrant must be approved by an independent judicial commissioner before it can be issued.”

quote:

Apple and WhatsApp condemn GCHQ plans to eavesdrop on encrypted chats

GCHQ ‘ghost protocol’ would seriously undermine user security and trust, says letter

A GCHQ proposal that would enable eavesdropping on encrypted chat services has been condemned as a “serious threat” to digital security and human rights.

In an open letter signed by more than 50 companies, civil society organisations and security experts – including Apple, WhatsApp, Liberty and Privacy International – GCHQ was called on to abandon its so-called “ghost protocol”, and instead focus on “protecting privacy rights, cybersecurity, public confidence, and transparency”.

The proposal was first mooted by two senior intelligence officials, Ian Levy, the technical director of the UK’s national cyber security centre, and Crispin Robinson, head of cryptanalysis (the technical term for codebreaking) at GCHQ, in November 2018.

The pair put forward a technique that would avoid breaking encryption, instead requiring encrypted messaging services to – in effect – “cc” the encrypted message to a third recipient, at the same time as sending it directly. Levy and Robinson argued that the proposal was “no more intrusive than the virtual crocodile clips” which are used today in wiretaps of non-encrypted communications.

Opposing the plan, the letter argues that “to achieve this result, their proposal requires two changes to systems that would seriously undermine user security and trust.

“First, it would require service providers to surreptitiously inject a new public key into a conversation in response to a government demand. This would turn a two-way conversation into a group chat where the government is the additional participant, or add a secret government participant to an existing group chat.

“Second, in order to ensure the government is added to the conversation in secret, GCHQ’s proposal would require messaging apps, service providers, and operating systems to change their software so that it would 1) change the encryption schemes used, and/or 2) mislead users by suppressing the notifications that routinely appear when a new communicant joins a chat.”

While GCHQ’s proposal stops short of calling for “back doors” to encryption, which experts have argued inherently introduce security flaws that can be exploited by hackers, its opponents argue that it does almost as much damage by undermining trust in security altogether.

“The overwhelming majority of users rely on their confidence in reputable providers to perform authentication functions and verify that the participants in a conversation are the people they think they are, and only those people. The GCHQ’s ghost proposal completely undermines this trust relationship and the authentication process,” the letter argues.

Replying, the NCSC’s Ian Levy said: “We welcome this response to our request for thoughts on exceptional access to data - for example to stop terrorists. The hypothetical proposal was always intended as a starting point for discussion.

“We will continue to engage with interested parties and look forward to having an open discussion to reach the best solutions possible.”

Apple, one of the signatories to the letter, is no stranger to this argument. The company endured a widely publicised standoff with the FBI in 2015 and 2016 over the company’s refusal to breach a different sort of encryption, that which protects the contents of a locked iPhone. Eventually, the FBI backed down, finding another way into the device without Apple’s help.

quote:

Australian Police Raid Journalist’s Home Over Surveillance Article

SYDNEY, Australia — The Australian authorities on Tuesday searched the home, computer and cellphone of a journalist who wrote an article last year detailing top-secret correspondence between government ministries over a plan to allow intelligence agencies to surveil Australian citizens.

The journalist, Annika Smethurst, the political editor for The Sunday Telegraph of Sydney, which is one of Australia’s most-read newspapers, was in her home in Canberra, the capital, on Tuesday morning when Australian Federal Police officers arrived with a warrant to search her house and belongings.

The police said in a statement that the warrant was related “to the alleged publishing of information classified as an official secret, which is an extremely serious matter that has the potential to undermine Australia’s national security.” The police added that no arrests were “expected today as a result of this activity.”

It was believed to be the first such action against an Australian journalist in more than a decade. The Australian union for journalists, the Media, Entertainment and Arts Alliance, called the raid “an outrageous attack on press freedom.”

“Australians are entitled to know what their governments do in their name,” the union’s president, Marcus Strom, said in a statement. “That clearly includes plans by government agencies to digitally spy on Australians by hacking into our emails, bank accounts and text messages.”

It is against the law in Australia for government officials to disclose classified or secret information. That allows the police to investigate leaks to journalists.

The Rupert Murdoch-owned News Corp. Australia, the parent company of The Sunday Telegraph, said that Ms. Smethurst had complied with the warrant. News Corp. called the raid “outrageous and heavy handed.”

“This raid demonstrates a dangerous act of intimidation towards those committed to telling uncomfortable truths,” the company said in a statement. “What’s gone on this morning sends clear and dangerous signals to journalists and newsrooms across Australia. This will chill public interest reporting.”


In April 2018, Ms. Smethurst reported that a top-secret proposal to expand the powers of the Australian Signals Directorate, the equivalent of the National Security Agency in the United States, was to be submitted for ministerial approval. She wrote that the proposal would allow “cyber spooks to target onshore threats without the country’s top law officer knowing.”

In the article, she quoted Mike Pezzullo, then the secretary of the Department of Home Affairs, as advocating “further legislative reform” to help law enforcement agencies combat “online, cybercrime and cyber-enabled criminal threats facing Australia.”

Under current law, the signals directorate cannot gather intelligence on Australian citizens. But the Australian Federal Police and the Australian Security Intelligence Organization, the country’s domestic spy agency, have the power to do so with a warrant. They can also turn to the signals directorate for technical guidance.

Since the article was published, there has been no formal government proposal for legislative amendments on the issue.

While the police are allowed to investigate leaks to journalists, members of the media do have some recourse. Legislation passed in recent years gives journalists protection from having to disclose their sources. But courts can decide that the public interest in learning the identities of sources outweighs any adverse effect of disclosure.

quote:

Barr says the US needs encryption backdoors to prevent “going dark.” Um, what?

"The FBI says they're 'going dark.' Well yeah, because they've been staring at the sun."

On July 23, in a keynote address at the International Conference on Cyber Security at Fordham University, US Attorney General William Barr took up a banner that the Justice Department and Federal Bureau of Investigation have been waving for over a decade: the call for what former FBI director James Comey had referred to as a "golden key."

Citing the threat posed by violent criminals using encryption to hide their activities from law enforcement, Barr said that information security "should not come at the expense of making us more vulnerable in the real world." He claimed that this is what is happening today.

"Service providers, device manufacturers, and application developers are developing and deploying encryption that can only be decrypted by the end user or customer, and they are refusing to provide technology that allows for lawful access by law enforcement agencies in appropriate circumstances," Barr proclaimed.

And this, he said, was making it increasingly difficult for law enforcement to surveil criminal activity. This blindspot is what also was allowing criminals to make their information and communications "warrant proof... extinguishing the ability of law enforcement to obtain evidence essential to detecting and investigating crimes," and allowing "criminals to operate with impunity, hiding their activities under an impenetrable cloak of secrecy."

In other words, the lawful surveillance capabilities of the government are "going dark," according to AG Barr.

"The net effect is to reduce the overall security of society," he continued. "I am here today to tell you that, as we use encryption to improve cybersecurity, we must ensure that we retain society's ability to gain lawful access to data and communications when needed to respond to criminal activity." AG Barr closed by saying that US citizens should accept encryption backdoors because backdoors are essential to our security.

In response, Gen. Michael Hayden, former director of the National Security Agency, said, "Not really."

Regardless of the accuracy of Barr's claims, encryption is certainly far more prevalent than it was even five years ago—back when freshly minted memoirist Edward Snowden gave the world a look at the workings of US intelligence agencies' digital surveillance capabilities. For better or worse, Snowden's data dump continues to shake up not just the world's view of communication privacy—it upended the world's view of information security in general.

Snowden's impact on the de jure of mass surveillance was perhaps less than he would have hoped for. But his revelations had wide-ranging effects on the tech industry and on the development of Internet and security standards. While Snowden opened up a dialogue about intelligence policy, "some of the most significant reforms were technical, not legal."

That's according to Ben Wizner of the American Civil Liberties Union, who has acted as Snowden's attorney. "The proliferation of encryption was rapidly accelerated," he says. "And the Internet is more secure today than it was in 2013. Technology companies realized that they had been operating under the wrong threat model."

After Snowden, Internet and technology firms could no longer ignore the threat posed by state-funded actors to their customers, said Mark Rumold, senior staff attorney at the Electronic Frontier Foundation (EFF). He went on:

. Companies recognized guarding against state surveillance is a bottom line issue for them... It is a question of financial interest to these companies to be able to convince their users that their data is secure with them, so we saw a lot of companies take steps to roll out encryption in various ways and I think that there's no question that this enhances security and privacy.

Just how much those steps have hindered legal surveillance and investigation—attempts by law enforcement and intelligence agencies operating under the authority of a court-approved warrant—is in dispute. As information security professional Robert Graham pointed out in a recent blog post, there is no evidence of a surge in crime corresponding to the use of encryption. Such claims, he says, are "based on emotional anecdotes rather than statistics."

Even allegedly hard data presented by the government has been routinely inflated. In December 2017, FBI Director Christopher Wray claimed in Congressional testimony that, in the 2017 fiscal year, the bureau "was unable to access the content of approximately 7,800 mobile devices" using available tools. Wray made this proclamation a year after the government's highly public battle over encryption with Apple in the wake of the tragedy in San Bernardino, California. But that figure was vastly larger than the 880 devices the FBI had cited a year before, and a Washington Post investigation found that the number of inaccessible devices in 2017 was actually about 1,200 according to an FBI internal estimate.

So, is surveillance really "going dark"? Or is this, as Graham suggested, "a Golden Age of Surveillance," where even more privacy is required? Joseph Lorenzo Hall, Chief Technologist at the Center for Democracy and Technology (CDT), leans toward the latter.

"The FBI says they're 'going dark'," Hall told Ars. "Well yeah, because they've been staring at the sun."

Fixing overexposure

Much of the Internet has become more secure over the past five years. The Snowden revelations may not have directly caused the rise of secure Web protocols, but they sure helped motivate protocol development. While the threat of a "global observer" on the Internet had been theorized before Snowden, his evidence of that sort of capability immediately triggered a response from the technical community.

"The engineering community took the succession of Snowden revelations really seriously," Hall told Ars. Just 11 months after the first of the leaks, the Internet Engineering Task Force put out RFC 7258, "stating that pervasive monitoring is an attack," Hall noted.

To be fair, the Internet in 2014 had practically nowhere to go but up in terms of protecting privacy. Almost all of the fundamental building blocks of the Internet were, at the time, "almost completely insecure" since their creation, Hall explained. That's "because we were experimenting with them. And now we're retroactively having to go back and put security back on."

That shift in perception of the threat of mass surveillance was followed by significant improvements in securing Web traffic. That included much more security-focused operations at major Internet service providers. Two particular changes were accelerated by the Snowden revelations: adoption of secure HTTP (HTTPS) and TLS encryption by major Internet services, and the development of Transport Layer Security (TLS) 1.3.

HTTPS has had the biggest effect so far, and the changes in TLS will further close the door on surveillance. In 2013, less than 30% of Web traffic was encrypted, and less than 10% of websites supported secure connections. By 2017, more than half of the Web supported HTTPS, and today over 70% of Web traffic is encrypted, based on data from Google and Let's Encrypt. As of April 2019, 91% of webpages visited by US users were secured. Internationally, about 85% of webpages visited were encrypted.

Adoption of encryption for email traffic—both between client and server and from provider to provider—also grew dramatically as a direct result of the Snowden revelations. In early 2014, only about a quarter of the email traffic between Google and other providers was encrypted. Now, it's over 75%.

The adoption of encryption has had major implications for both the intelligence community and law enforcement, at least in terms of "traditional" Internet traffic. Much of the metadata we examined in our 2014 project with NPR that was usable for surveillance by the NSA's XKeyscore system has become much less accessible. We re-staged the tests recently, using ourselves as the victim. Many of the identifiers and other content we were able to pick out of passive traffic collection in 2014 have been dramatically reduced. That isn't to say that they're gone—they're just concealed within encrypted HTTPS and TLS traffic now, at least for standard Web and email traffic.

This practical consideration may be directly responsible for the NSA dropping "about" collection (searching the contents of traffic for communications that mention specific keywords or identifiers for persons of interest). But there are still other ways to gather surveillance data from Internet traffic that won't be going dark any time soon.