US spy chief Clapper defends Prism and phone surveillance

[Peter Lemkin]

I think we all should assume any communication that is electronic is being monitored.
I do.
I don't like this further abrogation of my Constitution.
.

Those in power never much liked the Constitution and its 'Bill of Rights', and they slowly let their 'acid' eat it away for the average person. With 9-11-01 [which I firmly believe was a totally false-flag event, meant only to destroy what little was left of our Constitutional Rights and forever more enshrine Endless WARS of 'enemies' of 'convenience' - including US Citizens], the Constitution as 'W' put it was just 'a piece of old paper' - and as Peter Dale Scott put it, was secretly put 'to bed' by COG - Continuity of Government [if you don't know what that really means, look it up on this Forum!]. Jim, I hate to hint this, but the 'Constitution' may only be an artifact of the past...if ever. Certainly, IMO, there are POWERFUL forces afoot who don't give a **** about it or those who'd like to see it still held as the Law of the Land. We have secret laws [fact!] and secret Courts [fact] making secret judgments [fact!], which can not be disclosed to anyone below those in highest 'security' [fact!] - so we now have a totally unaccountable Government, at best; at worst...I hesitate to say...but it is as bad as it can get, if it is so..... - and I believe, sadly, it is so.......now.

[Peter Lemkin]

How Laura Poitras Helped Snowden Spill His Secrets


Olaf Blecker for The New York Times
Documentary filmmaker Laura Poitras in Berlin.


By PETER MAASS

Published: August 13, 2013 385 Comments

• Facebook
  
• Twitter
  
• Google+
  
• Save
  
• E-mail
  
• Share
  
• Print
  
• Single Page
  
• Reprints
  
• 
  

This past January, Laura Poitras received a curious e-mail from an anonymous stranger requesting her public encryption key. For almost two years, Poitras had been working on a documentary about surveillance, and she occasionally received queries from strangers. She replied to this one and sent her public key allowing him or her to send an encrypted e-mail that only Poitras could open, with her private key but she didn't think much would come of it.

Q. & A.: Edward Snowden Speaks to Peter Maass

Why he turned to Poitras and Greenwald.



Readers' Comments

Share your thoughts.

• Post a Comment »
  
• Read All Comments (385) »
  

The stranger responded with instructions for creating an even more secure system to protect their exchanges. Promising sensitive information, the stranger told Poitras to select long pass phrases that could withstand a brute-force attack by networked computers. "Assume that your adversary is capable of a trillion guesses per second," the stranger wrote.
Before long, Poitras received an encrypted message that outlined a number of secret surveillance programs run by the government. She had heard of one of them but not the others. After describing each program, the stranger wrote some version of the phrase, "This I can prove."
Seconds after she decrypted and read the e-mail, Poitras disconnected from the Internet and removed the message from her computer. "I thought, O.K., if this is true, my life just changed," she told me last month. "It was staggering, what he claimed to know and be able to provide. I just knew that I had to change everything."
Poitras remained wary of whoever it was she was communicating with. She worried especially that a government agent might be trying to trick her into disclosing information about the people she interviewed for her documentary, including Julian Assange, the editor of WikiLeaks. "I called him out," Poitras recalled. "I said either you have this information and you are taking huge risks or you are trying to entrap me and the people I know, or you're crazy."
The answers were reassuring but not definitive. Poitras did not know the stranger's name, sex, age or employer (C.I.A.? N.S.A.? Pentagon?). In early June, she finally got the answers. Along with her reporting partner, Glenn Greenwald, a former lawyer and a columnist for The Guardian, Poitras flew to Hong Kong and met the N.S.A. contractor Edward J. Snowden, who gave them thousands of classified documents, setting off a major controversy over the extent and legality of government surveillance. Poitras was right that, among other things, her life would never be the same.
Greenwald lives and works in a house surrounded by tropical foliage in a remote area of Rio de Janeiro. He shares the home with his Brazilian partner and their 10 dogs and one cat, and the place has the feel of a low-key fraternity that has been dropped down in the jungle. The kitchen clock is off by hours, but no one notices; dishes tend to pile up in the sink; the living room contains a table and a couch and a large TV, an Xbox console and a box of poker chips and not much else. The refrigerator is not always filled with fresh vegetables. A family of monkeys occasionally raids the banana trees in the backyard and engages in shrieking battles with the dogs.

Mauricio Lima for The New York Times

Glenn Greenwald, a writer for The Guardian, at home in Rio de Janeiro.

Greenwald does most of his work on a shaded porch, usually dressed in a T-shirt, surfer shorts and flip-flops. Over the four days I spent there, he was in perpetual motion, speaking on the phone in Portuguese and English, rushing out the door to be interviewed in the city below, answering calls and e-mails from people seeking information about Snowden, tweeting to his 225,000 followers (and conducting intense arguments with a number of them), then sitting down to write more N.S.A. articles for The Guardian, all while pleading with his dogs to stay quiet. During one especially fever-pitched moment, he hollered, "Shut up, everyone," but they didn't seem to care.
Amid the chaos, Poitras, an intense-looking woman of 49, sat in a spare bedroom or at the table in the living room, working in concentrated silence in front of her multiple computers. Once in a while she would walk over to the porch to talk with Greenwald about the article he was working on, or he would sometimes stop what he was doing to look at the latest version of a new video she was editing about Snowden. They would talk intensely Greenwald far louder and more rapid-fire than Poitras and occasionally break out laughing at some shared joke or absurd memory. The Snowden story, they both said, was a battle they were waging together, a fight against powers of surveillance that
they both believe are a threat to fundamental American liberties.

Continues.....

http://www.nytimes.com/2013/08/18/magazi...l?hp&_r=1&

[Keith Millea]

Peter stop spamming.. provide the link... anyone can listen online at any time. Heard the interview... they are in a full court press. It's getting interestinger and interestinger.

That isn't spam idiot!

Jeffery,who the fuck are YOU to call Peter's post spamming?Did someone make you Gawd for a day?

[Jeffrey Orling]

Why not just post the link? I read the article this morning before he posted it and the same with the DemocracyNow interview. I don't get it...is it cool to post entire articles?

Please don't call someone an idiot. The CONTENT is not spam... posting long articles is what I thought spamming was. Some sights don't like it and want only the links.

[Jan Klimkowski]

Why not just post the link? I read the article this morning before he posted it and the same with the DemocracyNow interview. I don't get it...is it cool to post entire articles?

Please don't call someone an idiot. The CONTENT is not spam... posting long articles is what I thought spamming was. Some sights don't like it and want only the links.

FFS Jeffrey, now you want to define spam for DPF?

For the avoidance of doubt, it is not spam to post an article which is relevant to the subject matter of the thread.

It is spam to post an article which is irrelevant to the subject matter of the thread.

Jeffrey - the only spam was your post attacking Peter Lemkin.

Here is some archetypal spam:

[Keith Millea]

Why not just post the link? I read the article this morning before he posted it and the same with the DemocracyNow interview. I don't get it...is it cool to post entire articles?

Please don't call someone an idiot. The CONTENT is not spam... posting long articles is what I thought spamming was. Some sights don't like it and want only the links.

This guy has been here for two and a half years and just now comes up with this stupid lame excuse.Jeffery,you're too smart for this bull and we're too smart to fall for it.Sorry,it's just idiotic.....

[Phil Dragoo]

Snowden presents the best-yet flash in the darkened room

Hastings video(s) so many snuff films

A clamp-down after John martyred

(will the veiled sister pray

as the mailed fist

silences)

Nine-Eleven as an exact replica of the Reichstag Fire

Nineteen Communist janitors with their nonexistent accelerants

Was George the Third put on hold

as the printing presses told

Now everyone is gagged

save for Mammon

Get a flight for Moscow

(book it)

Too late for Liberty Bell

(had a clapper--guess who took it)

[ATTACH=CONFIG]5055[/ATTACH]

[Peter Lemkin]

Feds Tell Web Firms to Turn Over User Account Passwords

By Declan McCullagh inShare

Secret demands mark escalation in Internet surveillance by the federal government through gaining access to user passwords, which are typically stored in encrypted form.

The U.S. government has demanded that major Internet companies divulge users' stored passwords, according to two industry sources familiar with these orders, which represent an escalation in surveillance techniques that has not previously been disclosed.
If the government is able to determine a person's password, which is typically stored in encrypted form, the credential could be used to log in to an account to peruse confidential correspondence or even impersonate the user. Obtaining it also would aid in deciphering encrypted devices in situations where passwords are reused.
"I've certainly seen them ask for passwords," said one Internet industry source who spoke on condition of anonymity. "We push back."
A second person who has worked at a large Silicon Valley company confirmed that it received legal requests from the federal government for stored passwords. Companies "really heavily scrutinize" these requests, the person said. "There's a lot of over my dead body.'"
Some of the government orders demand not only a user's password but also the encryption algorithm and the so-called salt, according to a person familiar with the requests. A salt is a random string of letters or numbers used to make it more difficult to reverse the encryption process and determine the original password. Other orders demand the secret question codes often associated with user accounts.

"This is one of those unanswered legal questions: Is there any circumstance under which they could get password information?" Jennifer Granick, Stanford University

A Microsoft spokesperson would not say whether the company has received such requests from the government. But when asked whether Microsoft would divulge passwords, salts, or algorithms, the spokesperson replied: "No, we don't, and we can't see a circumstance in which we would provide it."
Google also declined to disclose whether it had received requests for those types of data. But a spokesperson said the company has "never" turned over a user's encrypted password, and that it has a legal team that frequently pushes back against requests that are fishing expeditions or are otherwise problematic. "We take the privacy and security of our users very seriously," the spokesperson said.
A Yahoo spokeswoman would not say whether the company had received such requests. The spokeswoman said: "If we receive a request from law enforcement for a user's password, we deny such requests on the grounds that they would allow overly broad access to our users' private information. If we are required to provide information, we do so only in the strictest interpretation of what is required by law."
Apple, Facebook, AOL, Verizon, AT&T, Time Warner Cable, and Comcast did not respond to queries about whether they have received requests for users' passwords and how they would respond to them.
Richard Lovejoy, a director of the Opera Software subsidiary that operates FastMail, said he doesn't recall receiving any such requests but that the company still has a relatively small number of users compared with its larger rivals. Because of that, he said, "we don't get a high volume" of U.S. government demands.
The FBI declined to comment.
Some details remain unclear, including when the requests began and whether the government demands are always targeted at individuals or seek entire password database dumps. The Patriot Act has been used to demand entire database dumps of phone call logs, and critics have suggested its use is broader. "The authority of the government is essentially limitless" under that law, Sen. Ron Wyden, an Oregon Democrat who serves on the Senate Intelligence committee, said at a Washington event this week.
Large Internet companies have resisted the government's requests by arguing that "you don't have the right to operate the account as a person," according to a person familiar with the issue. "I don't know what happens when the government goes to smaller providers and demands user passwords," the person said.
An attorney who represents Internet companies said he has not fielded government password requests, but "we've certainly had reset requests if you have the device in your possession, than a password reset is the easier way."

Cracking the codes

Even if the National Security Agency or the FBI successfully obtains an encrypted password, salt, and details about the algorithm used, unearthing a user's original password is hardly guaranteed. The odds of success depend in large part on two factors: the type of algorithm and the complexity of the password.
Algorithms, known as hash functions, that are viewed as suitable for scrambling stored passwords are designed to be difficult to reverse. One popular hash function called MD5, for instance, transforms the phrase "National Security Agency" into this string of seemingly random characters: 84bd1c27b26f7be85b2742817bb8d43b. Computer scientists believe that, if a hash function is well-designed, the original phrase cannot be derived from the output.
But modern computers, especially ones equipped with high-performance video cards, can test passwords scrambled with MD5 and other well-known hash algorithms at the rate of billions a second. One system using 25 Radeon-powered GPUs that was demonstrated at a conference last December tested 348 billion hashes per second, meaning it would crack a 14-character Windows XP password in six minutes.
The best practice among Silicon Valley companies is to adopt far slower hash algorithms designed to take a large fraction of a second to scramble a password that have been intentionally crafted to make it more difficult and expensive for the NSA and other attackers to test every possible combination.
One popular algorithm, used by Twitter and LinkedIn, is called bcrypt. A 2009 paper (PDF) by computer scientist Colin Percival estimated that it would cost a mere $4 to crack, in an average of one year, an 8-character bcrypt password composed only of letters. To do it in an average of one day, the hardware cost would jump to approximately $1,500.
But if a password of the same length included numbers, asterisks, punctuation marks, and other special characters, the cost-per-year leaps to $130,000. Increasing the length to any 10 characters, Percival estimated in 2009, brings the estimated cracking cost to a staggering $1.2 billion.
As computers have become more powerful, the cost of cracking bcrypt passwords has decreased. "I'd say as a rough ballpark, the current cost would be around 1/20th of the numbers I have in my paper," said Percival, who founded a company called Tarsnap Backup, which offers "online backups for the truly paranoid." Percival added that a government agency would likely use ASICs application-specific integrated circuits for password cracking because it's "the most cost-efficient at large scale approach."
While developing Tarsnap, Percival devised an algorithm called scrypt, which he estimates can make the "cost of a hardware brute-force attack" against a hashed password as much as 4,000 times greater than bcrypt.
Bcrypt was introduced (PDF) at a 1999 Usenix conference by Niels Provos, currently a distinguished engineer in Google's infrastructure group, and David Mazières, an associate professor of computer science at Stanford University.
With the computers available today, "bcrypt won't pipeline very well in hardware," Mazières said, so it would "still be very expensive to do widespread cracking."
Even if "the NSA is asking for access to hashed bcrypt passwords," Mazières said, "that doesn't necessarily mean they are cracking them." Easier approaches, he said, include an order to extract them from the server or network when the user logs in which has been done before or installing a keylogger at the client.

Questions of law

Whether the National Security Agency or FBI has the legal authority to demand that an Internet company divulge a hashed password, salt, and algorithm remains murky.
"This is one of those unanswered legal questions: Is there any circumstance under which they could get password information?" said Jennifer Granick, director of civil liberties at Stanford University's Center for Internet and Society. "I don't know."
Granick said she's not aware of any precedent for an Internet company "to provide passwords, encrypted or otherwise, or password algorithms to the government for the government to crack passwords and use them unsupervised." If the password will be used to log in to the account, she said, that's "prospective surveillance," which would require a wiretap order or Foreign Intelligence Surveillance Act order.
If the government can subsequently determine the password, "there's a concern that the provider is enabling unauthorized access to the user's account if they do that," Granick said. That could, she said, raise legal issues under the Stored Communications Act and the Computer Fraud and Abuse Act.
Orin Kerr, a law professor at George Washington University and a former federal prosecutor, disagrees. First, he said, "impersonating someone is legal" for police to do as long as they do so under under court supervision through the Wiretap Act.
Second, Kerr said, the possibility that passwords could be used to log into users' accounts is not sufficient legal grounds for a Web provider to refuse to divulge them. "I don't know how it would violate the Wiretap Act to get information lawfully only on the ground that the information might be used to commit a Wiretap violation," he said.
The Justice Department has argued in court proceedings before that it has broad legal authority to obtain passwords. In 2011, for instance, federal prosecutors sent a grand jury subpoena demanding the password that would unlock files encrypted with the TrueCrypt utility.
The Florida man who received the subpoena claimed the Fifth Amendment, which protects his right to avoid self-incrimination, allowed him to refuse the prosecutors' demand. In February 2012, the U.S. Court of Appeals for the Eleventh Circuit agreed, saying that because prosecutors could bring a criminal prosecution against him based on the contents of the decrypted files, the man "could not be compelled to decrypt the drives."
In January 2012, a federal district judge in Colorado reached the opposite conclusion, ruling that a criminal defendant could be compelled under the All Writs Act to type in the password that would unlock a Toshiba Satellite laptop.
Both of those cases, however, deal with criminal proceedings when the password holder is the target of an investigation and don't address when a hashed password is stored on the servers of a company that's an innocent third party.
"If you can figure out someone's password, you have the ability to reuse the account," which raises significant privacy concerns, said Seth Schoen, a senior staff technologist at the Electronic Frontier Foundation.
Last updated on July 26 at 12 p.m. PT with comments from Orin Kerr. A previous update added comment from Yahoo, which responded after this article was published.
Disclosure: McCullagh is married to a Google employee not involved with this issue.
http://news.cnet.com/8301-13578_3-575955...passwords/

[Magda Hassan]

Why not just post the link? I read the article this morning before he posted it and the same with the DemocracyNow interview. I don't get it...is it cool to post entire articles?

Please don't call someone an idiot. The CONTENT is not spam... posting long articles is what I thought spamming was. Some sights don't like it and want only the links.

We encourage the posting of the full article as there is a tendency for many articles to be moved or removed from their source and for continuity we want have the information here where we can find it again.

[Peter Lemkin]

[TABLE="width: 100%"]
[TR]
[TD="width: 84%"]

Lavabit: A Profile in Corporate Principles and Personal Courage

By Alfredo Lopez [TABLE="width: 100%"]
[TR]
[TD="width: 60%"][/TD]
[TD="width: 40%"] 8/13/13[/TD]
[/TR]
[/TABLE]
[/TD]
[TD="width: 16%"]

[URL="http://www.opednews.com/author/author86187.html"]
[/URL]

[/TD]
[/TR]
[/TABLE]



The term "collateral damage" is most frequently applied to the "non-targeted" death and destruction brought by bombs and guns. But it seems that our government, the master of collateral damage, is now doing it in "non-violent" ways. Take the recent situation at Lavabit.

The Texas-based email provider, specializing in encrypted email services, announced Thursday that it's immediately suspending its services. The crux of the issue is obliquely revealed in the statement by Lavabit's founder and owner Ladar Levison: "I have been forced to make a difficult decision: to become complicit in crimes against the American people or walk away from nearly ten years of hard work by shutting down Lavabit."

Most of us can't be sure what forced Levison's hand but the content and cryptic nature of his explanation speaks volumes. "As things currently stand," he wrote, "I cannot share my experiences over the last six weeks, even though I have twice made the appropriate requests."



One of Lavabit's 350,000 users is Edward Snowdon and, given the frenzied attacks against and investigations of this renowned whistle-blower, it's pretty clear what happened. "Reading between the lines," Wired's Kevin Poulsen writes, "it's reasonable to assume Levison has been fighting either a National Security Letter seeking customer information -- which comes by default with a gag order -- or a full-blown search or eavesdropping warrant."

If that's the case and LavaBit doesn't give up what's being demanded (probably Snowdown emails) Levison faces harsh criminal penalties. If he does give them up he contradicts the very purpose the provider was founded for in the first place and that would probably spell LavaBit's death. It's like forcing someone to play Russian Roulette with bullets in all the chambers. Except that one of those bullets is also aimed at our privacy and our ability to use the Internet the way it was intended.

Not only is this a significant and sobering expansion of the government's attack on secure Internet communications; it also shows the complete disdain the Obama Administration has for people's privacy, specifically in this case the 350,000 Lavabit users who now have no secure email service.

Ladar Levison founded Lavabit in 2004 for one reason: to provide a simple and powerful encrypted email service to anybody who wanted one. People could sign up for a free account or a paid one; the only difference was the amount of storage available to the user on Lavabit's servers.

If there was any doubt about his intentions, Levison's most recent statements make them clear: he considers the indiscriminate collection and inspection of email to be a crime against the American people and he had the skills to develop protocols to resist it. A Lavabit user could send and receive email to an account protecting the content of the email through a powerful encryption algorithm that would turn the email contents into unreadable gibberish unless someone had the proper decryption code to read it as it was written. This is a very popular approach to email that uses, among other methods, an "identification key" installed on a computer that would trigger a "decryption" making the content readable. It's like the code used by spies in movies except more powerful and much more difficult to "crack". Anybody can install such encryption on their email account but Lavabit made it virtually automatic and stored email in encrypted form.

Many people are under the impression that encryption is used only by highly skilled techies and computer savvy communicators. But the fact that 350,000 people were using Lavabit's services belies that perception. In fact, Lavabit is only one of many services that provide such protection.

It's pretty clear that the government wants Ed Swowdon's email and when it noticed that Snowdon used a Lavabit email account to announce a press conference in Russia, they apparently came knocking on Lavabit's door. That's the door Levison is trying to close -- he's now huddled with lawyers figuring out how to resist this attack legally. That resistance is all too rare in this industry. For years now, the federal government has been forcing email providers to give up all kinds of information. In most cases, mainly involving large companies like Google or Verizon, the company does so willingly. But, even those who don't want to give it up are forced to by a bizarre and particuarly nasty Congressionally-approved measure called "The National Security Letter."

These letters, usually written by the FBI or the NSA, are government demands for information -- demands that do not require any prior approval by a court -- even the toothless and completely government-supportive Foreign Intelligence Surveillance Court (FISA). By law a National Security Letter must be "non-content seeking," so it's limited to phone records, email addresses and other identifiers. Some claim that the letters are sometimes much broader although the legally permitted information can set up targets for an investigation which can then be pursued with the other sources of data intelligence the government has.

For the most part, however, we don't know what's in those letters because, if you get one, you can't tell anyone about it. Nobody, not even family or friends let alone the people you work with (even if they are affected by the letter's demands) can ever be told you received a National Security Letter. If you do tell anyone, you go to jail. That prohibition--an astonishing violation of your First Amendment right of free speech, particularly considering that the letter is from a law enforcement agency, not a court--lasts forever unless you go to court and manage to get it lifted--something which rarely happens. But these letters are hardly rare. From 2003 to 2006 alone the Federal Bureau of Investigation issued 192,499 national security letter requests (and the frequency of their use has almost certainly increased since then.)

The other option Wired's Poulsen mentions -- a court order -- is also possible in this particular case. In the end, it doesn't make much difference because this is an attack that was sure to cause collateral damage.

The Facebook page Lavabit maintains, on which it reprinted the statement, is covered with responses that dramatize the blow this represents to the provider's hundreds of thousands of users. Not only have many of these people lost their primary email account, and loads of email and other information they confidently stored on Lavabit's servers, but many wonder if they are effectively losing the ability to send encrypted email.

The answer is "yes", no matter the government's basic intention. Even if the FBI (or whoever is doing this) isn't targeting encryption per se, it sure doesn't give a crap about protecting or respecting it. It's collateral damage -- attacking one "target" while carelessly destroying the ability of hundreds of thousands more to communicate securely.

For those tempted to view this as "one of a kind", consider that hours after the Lavabit story hit, Silent Circle (another privacy-protecting provider) announced it was shutting down its email service. "We see the writing the wall, and we have decided that it is best for us to shut down Silent Mail now," Silent Circle's statement read. "We have not received subpoenas, warrants, security letters, or anything else by any government, and this is why we are acting now."

The most effective form of repression is getting people to react to it before it happens. We can only wonder which other providers will follow.

A question now arises. Is this, in fact, the best way to handle this kind of situation? Were there alternatives available to Lavabit? Was there a way to make sure Lavabit and Levison didn't feel totally alone? That discussion will now undoubtedly ensue and it's one we should all follow and participate in. It's a tactical question for the entire progressive movement because encrypted email is the best way for our movement to communicate. It frustrates surveillance, resists easy reading by unintended readers and allows us to exercise our Fourth Amendment right to privacy in communication: a pillar of any organizing and movement-building.

No matter the opinions to be expressed, one thing must always be kept clear. We can have this discussion because Ladar Levison, faced with an excruciating choice, made a principled decision: he built an email provider to protect privacy and when it could no longer do that he refused to violate its purpose and he shut it down. Compare that principled, selfless response to the "come and get it" responses of so many corporate providers.