Apparently, the NSA, in their zeal to listen to everyone, has been successfully inserting back doors into encryption protocols for years, ProPublica has learned.

How’d they learn this?

Many users assume — or have been assured by Internet companies — that their data is safe from prying eyes, including those of the government, and the N.S.A. wants to keep it that way. The agency treats its recent successes in deciphering protected information as among its most closely guarded secrets, restricted to those cleared for a highly classified program code-named Bullrun, according to the documents, provided by Edward J. Snowden, the former N.S.A. contractor.

Thank you, Edward Snowden. Back doors are horrible ideas, because they invariably fall to nefarious use. Even, as we’ve seen, inside supposedly trusted organizations like the NSA.

Among the technologies compromised by the NSA is SSL, which you rely on every day to keep your browser traffic safe when banking, shopping, or accessing other private services online. I am reminded of what former Lavabit CEO Ladar Levison wrote when he shut down his secure email service out of the fear that the spooks would infest it: “Without Congressional action or a strong judicial precedent, I would strongly recommend against anyone trusting their private data to a company with physical ties to the United States.”

The Feds are, obviously, not happy about the publication of this information, but you know what? Fuck them. This is security apparatus run wild, and it must be both disclosed and stopped. ProPublica, for their part, published a clear and well reasoned article detailing why they chose to publish:

The story, we believe, is an important one. It shows that the expectations of millions of Internet users regarding the privacy of their electronic communications are mistaken. These expectations guide the practices of private individuals and businesses, most of them innocent of any wrongdoing. The potential for abuse of such extraordinary capabilities for surveillance, including for political purposes, is considerable. The government insists it has put in place checks and balances to limit misuses of this technology. But the question of whether they are effective is far from resolved and is an issue that can only be debated by the people and their elected representatives if the basic facts are revealed.

[…]

There are those who, in good faith, believe that we should leave the balance between civil liberty and security entirely to our elected leaders, and to those they place in positions of executive responsibility. Again, we do not agree. The American system, as we understand it, is premised on the idea — championed by such men as Thomas Jefferson and James Madison — that government run amok poses the greatest potential threat to the people’s liberty, and that an informed citizenry is the necessary check on this threat. The sort of work ProPublica does — watchdog journalism — is a key element in helping the public play this role.

Finally: What to do now?

Good question. It’s not completely clear which implementations have been compromised by the NSA, but Bruce Schneier has a great bit in the Guardian today about placing this in perspective, and about what you can do to keep your own data safe from prying eyes — even eyes ostensibly on the same side as you are. The gist is this:

First, Properly implemented strong cryptography still works as advertised. The NSA doesn’t have special math it can deploy; trap-door algorithms are still trap doors. Multiplication is and will remain orders of magnitude easier than factoring.

Second and no less important: Open source security software is better. The NSA has obviously been influencing proprietary solutions, and will continue to do so; with open source software, though, an army of privacy-advocate neckbeards are perusing every commit. This is a good thing.

Bruce has, obviously, more concrete suggestions; go read the bit.

David Good’s parents come from different countries – hardly unusual in the US where he was raised. But the 25-year-old’s family is far from ordinary – while his father is American, his mother is a tribeswoman living in a remote part of the Amazon. Two decades after she left, David realised he had to find her.

Go. Read. Now. This is extraordinary.

Via MeFi.

The Good News is that the ACLU has won its case before Anna Brown in re: the Constitutionality of the mysterious, un-auditable, un-checkable “no-fly” list. I’m sure the gummit will appeal, but don’t look for many judges to be swayed by their utter bullshit argument.

On the other hand, there’s the Bad News, regarding the terrorism case against Adel Daoud. Daoud was caught up in one on the FBI’s many “let’s invent a terror scheme and arrest an idiot!” plans. Daoud’s lawyers have, sensibly, insisted on seeing some of the evidence against their client — specifically, that which was obtained via FISA and which supposedly establishes Daoud (a clearly not-terribly bright high school student) as the agent of a foreign power. The Feds refused, saying it was classified.

Think on that for a minute.

Well, it gets worse, because the judge sided with the Feds. It’s a giant due process problem that we can only hope will be overturned on appeal.

First: The IRS announced today that all legally married gay couples will be considered married for tax purposes, regardless of where they live.

In other words, two Californians who move to Alabama won’t lose their status just because of their zip code.

Second: Ending years of vague and contradictory statements, the DOJ has announced it will not challenge states that legalize marijuana, and will basically leave them alone as long as certain guidelines are followed (which generally have to do with keeping it away from minors, suppressing illegal cartel activity, and related goals). It’s not as much of a clear win as the first one (individual USAs will still be able to be dicks if they want to, basically), but it’s still a step in the right direction.

Due to chicanery and poor judgement by energy companies, it can now be said that Louisiana literally sucks.

(Note: I am not really sorry about the joke.)

“It Says Here On Your Resume, Mr. Zimmerman, That You Shot A Boy?“

You might cross a border one day and find them gone.

Via BoingBoing, we find this quote from the New York Times 30 years ago:

No laws define the limits of the N.S.A.’s power. No Congressional committee subjects the agency’s budget to a systematic, informed and skeptical review. With unknown billions of Federal dollars, the agency purchases the most sophisticated communications and computer equipment in the world. But truly to comprehend the growing reach of this formidable organization, it is necessary to recall once again how the computers that power the N.S.A. are also gradually changing lives of Americans – the way they bank, obtain benefits from the Government and communicate with family and friends. Every day, in almost every area of culture and commerce, systems and procedures are being adopted by private companies and organizations as well as by the nation’s security leaders that make it easier for the N.S.A. to dominate American society should it ever decide such action is necessary.

“The NSA’s state surveillance programs are anti-democratic and unconstitutional. They could be the most serious attacks on free speech we’ve ever seen..”

Before you pillory the young private, you should read both his statement in court as well as Quinn Norton’s excellent essay.

Again, via TechDirt, we find this story about NSA critic Jennifer Granick’s dinner with Keith Alexander. You really ought to read the whole thing (which is full of links not reproduced in quotes here).

In general, Granick’s argument isn’t particularly novel, but it’s devastating to Alexander’s “we really have to do these things to keep you safe” line. (“The General seemed convinced that if only I knew what he knew, I would agree with him.” That reasoning is rhetorically and logically bankrupt, but it doesn’t stop intel types from spouting it whenever challenged.)

I have no doubt that Gen. Alexander loves this country as much as I do, or that his primary motivation is to protect our nation from terrorist attacks. “Never again,” he said over dinner. But it may be that our deep differences stem from a fundamental disagreement about human nature. I think Gen. Alexander believes that history is made by great individuals standing against evil. I believe that brave people can make a difference, but that larger inexorable forces are often more important: history, economics, political and social systems, the environment. So I believe that power corrupts and that good people will do bad things when a system is poorly designed, no matter how well-intentioned they may be. More than once, my dinner companions felt the need to reassure the DIRNSA that none of us thought he was a bad man, but that we thought the surveillance policies and practices were bad, and that eventually, inevitably, those policies and practices would lead to abuse.

It’s utterly unsurprising that Alexander is sure the abuses will be minor, and that these awesome powers are required, but men are not angels, and abuses are rampant.

How does a good man sit across from you at the dinner table and assure you the government is properly constrained, when in reality it lies and disregards even the most anemic purported safeguards? The easy answer is that he’s not a good man after all. Some people will call me naïve, but I disagree with that conclusion. In any case, it’s a simplistic view that masks the truth about systems of power, a truth we must understand and respect if we are to fix this surveillance nightmare we are just beginning to uncover.

Of course, we see mission creep – once you build the mousetrap of surveillance infrastructure, they will come for the data. First it was counterterrorism, then it was drug investigations, then it was IRS audits. Next it will be for copyright infringement.

And of course, there also will be both “inadvertent” and intentional abuse, inevitable but difficult to discover. Bored analysts do things like spy on women using surveillance cameras and listen to American GIs overseas having phone sex with their loved ones back home.

Granick concludes:

Liberty and security are the hard-won results of democratic process and limited government power. A system of mass surveillance puts innocent people at risk, and is, in itself, an abuse of liberty. Inevitably, it leads to further abuses. When the justification is counter-terrorism, and that’s your only concern, there is no countervailing interest that justifies slowing you down or stopping you. We are only beginning to learn all the ways in which good men are nevertheless failing to withstand the corrupting force of vast spying abilities. Indeed, the FISA court noted in that 2011 opinion that the government’s collection of tens of thousands of purely domestic communications, hidden from the court for years, could be a crime. (Footnote 15) The good people at NSA have literally pulverized the Fourth Amendment, government accountability, freedom of expression, rule of law, and so many other equally critical components of the American system.

The journalist who’s done most of the first-line reporting on the Snowden saga is a guy named Glenn Greenwald. Over the weekend, Mr Greenwald’s partner, David Miranda, was detained upon arriving at Heathrow Airport for nine hours on obviously trumped-up reasons. In the UK, nine hours is the legal max before they must charge you, which is not an amazing coincidence. (Mr Greenwald, an American, and Mr Miranda, a Brazilian, make their home in Rio.)

In addition to being detained, though, the Heathrow officials impounded Miranda’s cell phone, laptop, and memory sticks, ostensibly to search for “terrorism” evidence or some other such bullshit; the real reason for both the detention and the confiscation is obviously to harass Mr Greenwald.

This is complete bullshit.

From Greenwald’s column today:

[T]hey obviously had zero suspicion that David was associated with a terrorist organization or involved in any terrorist plot. Instead, they spent their time interrogating him about the NSA reporting which Laura Poitras, the Guardian and I are doing, as well the content of the electronic products he was carrying. They completely abused their own terrorism law for reasons having nothing whatsoever to do with terrorism: a potent reminder of how often governments lie when they claim that they need powers to stop “the terrorists”, and how dangerous it is to vest unchecked power with political officials in its name.

Worse, they kept David detained right up until the last minute: for the full 9 hours, something they very rarely do. Only at the last minute did they finally release him. We spent all day – as every hour passed – worried that he would be arrested and charged under a terrorism statute. This was obviously designed to send a message of intimidation to those of us working journalistically on reporting on the NSA and its British counterpart, the GCHQ.

Before letting him go, they seized numerous possessions of his, including his laptop, his cellphone, various video game consoles, DVDs, USB sticks, and other materials. They did not say when they would return any of it, or if they would.

Fortunately, it’s stirred up quite a bit of inquiry from Labour pols in Britain. What’s not cool is that apparently the White House knew beforehand.

More Guardian coverage here.

If you haven’t seen the widely linked footage of a firefighter reviving an unconscious kitten found in a burning house, well, you oughta make time.

Cat’s name now? Lucky.

Techdirt does the math, consults the statute, and makes it very, very clear that YES, Snowden is a whistleblower.

At this point, I don’t think it’s at ALL hyperbole to say the Internet as it exists today is one of the happiest accidents in human history. Because of its convoluted history, it became a free-for-all space and, in some ways, a lawless frontier. This allowed a billion flowers to bloom based on a very simple foundation, and is anathema to control and censorship; John Gilmore famously distilled this principle as “the net interprets censorship as damage and routes around it.”

Governments — even, or maybe especially, ours — don’t like this lack of control. They don’t like that proper encryption makes it almost impossible to read anything they like. So the NSA is effectively commandeering the Internet, and will continue to push for more invasive surveillance and control unless they are stopped.

Help stop them. Here’s Bruce:

It turns out that the NSA’s domestic and world-wide surveillance apparatus is even more extensive than we thought. Bluntly: The government has commandeered the Internet. Most of the largest Internet companies provide information to the NSA, betraying their users. Some, as we’ve learned, fight and lose. Others cooperate, either out of patriotism or because they believe it’s easier that way.

I have one message to the executives of those companies: fight.

Do you remember those old spy movies, when the higher ups in government decide that the mission is more important than the spy’s life? It’s going to be the same way with you. You might think that your friendly relationship with the government means that they’re going to protect you, but they won’t. The NSA doesn’t care about you or your customers, and will burn you the moment it’s convenient to do so.

We’re already starting to see that. Google, Yahoo, Microsoft and others are pleading with the government to allow them to explain details of what information they provided in response to National Security Letters and other government demands. They’ve lost the trust of their customers, and explaining what they do — and don’t do — is how to get it back. The government has refused; they don’t care.

It will be the same with you. There are lots more high-tech companies who have cooperated with the government. Most of those company names are somewhere in the thousands of documents that Edward Snowden took with him, and sooner or later they’ll be released to the public. The NSA probably told you that your cooperation would forever remain secret, but they’re sloppy. They’ll put your company name on presentations delivered to thousands of people: government employees, contractors, probably even foreign nationals. If Snowden doesn’t have a copy, the next whistleblower will.

This is why you have to fight. When it becomes public that the NSA has been hoovering up all of your users’ communications and personal files, what’s going to save you in the eyes of those users is whether or not you fought. Fighting will cost you money in the short term, but capitulating will cost you more in the long term.

Stephen Colbert visits Vicco, Kentucky.

Make time.

“The NSA abuses its ability to spy on Americans? Unpossible!“

The EFF has a handy rundown of the positively Orwellian bullshit coming out of our “intelligence” community. Here’s an example:

Another tried and true technique in the NSA obfuscation playbook is to deny it does one invasive thing or another “under this program.” When it’s later revealed the NSA actually does do the spying it said it didn’t, officials can claim it was just part of another program not referred to in the initial answer.

This was the Bush administration’s strategy for the “Terrorist Surveillance Program”: The term “TSP” ended up being a meaningless label, created by administration officials after the much larger warrantless surveillance program was exposed by the New York Times in 2005. They used it to give the misleading impression that the NSA’s spying program was narrow and aimed only at intercepting the communications of terrorists. In fact, the larger program affected all Americans.

Via Kottke, we find this article that details the ages of the key participants in the American Revolution as of July 4, 1776.

• Marquis de Lafayette was 18; so was James Monroe
• Gilbert Stuart was 20, as was Aaron Burr
• Alexander Hamilton, 21
• James Madison, 25
• Thomas Jefferson, 33
• John Adams, 40
• Paul Revere, 41
• George Washington, 44
• Samuel Adams, 53

You sort of expect that they were all older men at the time, but that’s really not the case at all.

Turns out they CAN actually read our email. They just promise not to without a really good reason.

Oh, and they get to decide what a good enough reasons is, and they’d don’t have to tell us.