Fall guy

From Schneier on Security:

There’s a new article on Edward Snowden in Wired. It’s written by longtime NSA watcher James Bamford, who interviewed Snowden in Moscow.

There’s lots of interesting stuff in the article, but I want to highlight …[snip] … revelations. One is that the NSA was responsible for a 2012 Internet blackout in Syria:

One day an intelligence officer told him that TAO­ — a division of NSA hackers­ — had attempted in 2012 to remotely install an exploit in one of the core routers at a major Internet service provider in Syria, which was in the midst of a prolonged civil war. This would have given the NSA access to email and other Internet traffic from much of the country. But something went wrong, and the router was bricked instead — rendered totally inoperable. The failure of this router caused Syria to suddenly lose all connection to the Internet — although the public didn’t know that the US government was responsible….

Inside the TAO operations center, the panicked government hackers had what Snowden calls an “oh shit” moment. They raced to remotely repair the router, desperate to cover their tracks and prevent the Syrians from discovering the sophisticated infiltration software used to access the network. But because the router was bricked, they were powerless to fix the problem.

Fortunately for the NSA, the Syrians were apparently more focused on restoring the nation’s Internet than on tracking down the cause of the outage. Back at TAO’s operations center, the tension was broken with a joke that contained more than a little truth: “If we get caught, we can always point the finger at Israel.”

Once again, the fall guy. It’s nice to know you can rely on friends.

Watchmen

This is from the latest Crypto-Gram:

Last Month I Briefed Congress on the NSA

One morning in January, I spent an hour in a closed room with six members of Congress: Rep. Lofgren, Rep. Sensenbrenner, Rep. Bobby Scott, Rep. Goodlatte, Rep. Mike Thompson, and Rep. Amash. No staffers, no public: just them. Lofgren had asked me to brief her and a few Representatives on the NSA. She said that the NSA wasn’t forthcoming about their activities, and they wanted me — as someone with access to the Snowden documents — to explain to them what the NSA was doing. Of course, I’m not going to give details on the meeting, except to say that it was candid and interesting. And that it’s extremely freaky that Congress has such a difficult time getting information out of the NSA that they have to ask me. I really want oversight to work better in this country.

Surreal part of setting up this meeting: I suggested that we hold this meeting in a SCIF, because they wanted me to talk about top-secret documents that had not been made public. The problem is that I, as someone without a clearance, would not be allowed into the SCIF. So we had to have the meeting in a regular room.

This really was an extraordinary thing.

First, the Crypto_gram comes from Bruce Schneier, an independent IT security consultant. Second, the SCIF referred to is, according to Wikipedia:

In United States security and intelligence parlance, a Sensitive Compartmented Information Facility (SCIF; pronounced “skiff”) is an enclosed area within a building that is used to process Sensitive Compartmented Information (SCI) types of classified information. SCI is classified information concerning or derived from intelligence sources, methods, or analytical processes, which is required to be handled within formal access control systems established by the Director of National Intelligence (DNI).

In other words, a SCIF is a secure room where you can have secrets available.

I get that Bruce finds it extraordinary that, due to his lack of clearance, they could not use a SCIF. I find it extraordinary that the members of the Senate do not know what the NSA is doing. And, it’s extraordinary that to solve that problem, they ask an independent security consultant? Something is very wrong there.