Secret Service Dubiously Claims, Without Evidence, To Have Uncovered ‘Hidden Telecom Network’ That Could Have Crippled NYC, UN

Overhype

from the very-very-scary dept

The Secret Service says it has uncovered what it’s calling “a network of electronic devices located throughout the New York Tri-state area that were used to conduct multiple telecommunications-related threats directed towards senior U.S. government officials.” The news was announced, in part, over at the right wing propaganda website run by an overt white supremacist billionaire:

There are, however, some red flags that this is being over-hyped for attention and effect. Including a lot of completely unsupported language about what this tech “could be” used for.

In its press release, the Secret Service claims to have discovered around 300 co-located SIM servers and 100,000 SIM cards across multiple sites. The press release makes some vague hints of the networks having connections to known nation state actors:

“While forensic examination of these devices is ongoing, early analysis indicates cellular communications between nation-state threat actors and individuals that are known to federal law enforcement.”

I strongly suspect they stumbled into some mob-connected scam ring or textbot farm, and are over-hyping this for dramatic effect. The announcement is super vague, and while the Secret Service claims this network could have been used to disrupt communications ahead of an upcoming General Assembly UN meeting, there’s no evidence of that, and a lot of the hardware was collected over a 35 mile range:

“These devices were concentrated within 35 miles of the global meeting of the United Nations General Assembly now underway in New York City. Given the timing, location and potential for significant disruption to New York telecommunications posed by these devices, the agency moved quickly to disrupt this network.”

There are a lot of things within 35 miles of the UN, including a plethora of Dunkin’ Donut locations.

While this all sounds scary, it seems extremely unlikely that this collection of 100,000 SIM cards in use over this broad of an area could have ever meaningfully impacted cellular communications in New York City, which sees between nine and twelve million cellular users every day.

The mainstream headline coverage of the find (which again, included no supporting evidence of any kind that NYC was at actual, serious risk), were all appropriately hyperbolic, treating the threat to the UN and NYC itself as some sort of proven. None bothered to ask questions of any network engineers, or point out that the Secret Service provided literally zero supporting evidence for its bolder claims:

Cops routinely lie, and our consolidated corporate mainstream journalism genuinely sucks at pointing that out. But there’s also ongoing evidence of normalcy bias, wherein the press seemingly forgets that the U.S. government has also now been taken over by radical authoritarian zealots who have absolutely zero reservations about lying about everything, constantly.

Filed Under: fraud, scammers, scams, secret service, sim cards, telecom

DHS Oversight Report Says ICE, Secret Service Illegally Deployed Stingray Devices

(Mis)Uses of Technology

from the laws-are-for-the-illegally-surveilled dept

For years, Stingray devices (the most famous brand name for cell site simulators) flew under the radar. Law enforcement had them and used them, but often hid their use under court orders and subpoenas designed to obtain phone records, rather than the precise location of phone owners.

Once information about Stingray devices went mainstream, the feds finally decided to start respecting the Fourth Amendment. In 2015, the DOJ instituted a policy requiring warrants for cell site simulator (CSS) deployment. Sure, it wasn’t codified and it was riddled with exceptions, but it at least created a paper trail for this new-ish form of snooping.

The FBI was far from the only federal agency deploying CSS devices. Documents obtained by Buzzfeed showed DHS agencies were deploying Stingrays hundreds of times a year — all of it happening with very little oversight, guidance, or established policies.

As it turns out, the DHS has its own rules for CSS deployment. But it doesn’t have many rules. And the rules it has, it often ignores. Also, it failed to get the proper paperwork in order before sending agents out with cell tower spoofing equipment.

That’s all contained in a recently released report from the DHS Inspector General. The report [PDF] opens with the bad, but pretty much expected, news that agents working for ICE and the Secret Service have been illegally deploying Stingray devices. (h/t EFF)

The United States Secret Service and U.S. Immigration and Customs Enforcement, Homeland Security Investigations (ICE HSI) did not always adhere to Federal statute and cellsite simulator (CSS) policies when using CSS during criminal investigations involving exigent circumstances. Separately, ICE HSI did not adhere to Department privacy policies and the applicable Federal privacy statute when using CSS. For the cases we reviewed, the Secret Service and ICE HSI obtained required search warrants for [redacted] CSS uses, respectively. However, the Secret Service and ICE HSI did not always obtain court orders required by CSS policies and Federal statute when using CSS during investigations that included exigent circumstances.

It’s unknown how many times policies were violated. That information has been withheld. But what’s in the report still shows a whole lot of abuse.

First, it appears the agencies may have utilized equipment owned by local law enforcement to bypass internal warrant requirements. Second, when exigent circumstances were cited, agents were still required to seek pen register orders within 48 hours of deployment — something they apparently regularly chose not to do. Third, the DHS and its component agencies went ahead with CSS device purchases and deployments without a federally required privacy impact assessment (PIA) in place.

It’s unknown how long these agencies have owned and deployed Stingray devices. What is known is that the DHS followed the DOJ’s lead and instituted a warrant requirement on October 19, 2015, roughly a month after the DOJ put its policy in place. This policy was adopted and written into ICE and Secret Service policies in 2017.

While the DHS agrees with the Inspector General’s recommended fixes, the report shows the agencies examined by the IG making excuses for their failure to follow law and policy. Here’s the Secret Service attempting to pass the buck on its failure to obtain a required court order following an “exigent circumstances” deployment.

Of the [redacted] exigent uses of CSS without warrant or court order, [redacted] were conducted by a field office in support of a local law enforcement agency. In these [redacted] instances, the Secret Service explained that, according to the county prosecutor’s office, the county judges did not understand why the prosecutor’s office sought to file an “emergency pen trap order” and believed it to be unnecessary. Therefore, moving forward, the county prosecutor’s office decided it “would not file” emergency pen trap orders following exigent missions. Although Secret Service explained that the prosecutor’s office sought to file an “emergency pen trap order” for these investigations, its investigative records did not indicate that the exigent circumstances were also emergencies as defined by the Pen Register Statute and included in CSS policies.

It also chose to blame the US Attorney’s Office for its failure to seek pen register orders in cases like these. According to the Secret Service, the USAO felt pen register orders weren’t needed because the collection (via cell site simulator) did not involve cell service providers in any way. That’s an interesting interpretation of the policy, given that nothing in the court order requirement specifies that cell service providers must be part of the process. The warrant/court order allows the search of people’s cell phones. It has nothing to do with searches of cell provider records.

The report notes ICE did the same thing: failed to seek pen register orders following exigent circumstances deployment. Unlike the Secret Service, ICE did not attempt to shift the blame to others. Instead, it offered no comment at all about these failures, nor its apparent unwillingness to properly follow the chain of command when seeking to deploy cell tower spoofers.

ICE HSI’s CSS policy states that supervisory approval should be documented if circumstances permit and requires data deletion following each mission. We identified [redacted] instances in which ICE HSI did not document supervisory approval and [redacted] instances in which ICE HSI did not document data deletion. ICE HSI addressed the supervisory approval issue with an update to its reporting system to ensure CSS approvals are documented.

Unfortunately, the report redacts anything that would show how frequently policies and warrant requirements are ignored. And the counts shown here are only representative of the whole. The IG only took a sampling of investigative records. Depending on what it picked, whatever the numbers are may be under-representative of the overall problem.

While it’s good the IG chose to take a look at this, the decision to prevent the public from knowing how often these illegal searches took place is far less helpful. The public is both paying for these legal violations and being subjected to them. Taxpayers deserve to know just how often these things are happening. But what’s clear is these agencies can’t be trusted with the powers they’ve been given. Some of this broken trust could be rebuilt by simply allowing the entire truth to be told, rather than hidden behind self-serving black bars.

Filed Under: 4th amendment, cell site simulators, dhs, doj, ice, imsi catcher, secret service, stingray, surveillance

Defense Department Latest To Be Caught Hoovering Up Internet Data Via Private Contractors

(Mis)Uses of Technology

from the haystacks-at-wholesale-prices dept

Everyone’s got a hunger for data. Constitutional rights sometimes prevent those with a hunger from serving themselves. But when they’ve got third parties on top of third parties, all Fourth Amendment bets are off. Data brokers are getting rich selling government agencies the data they want at low, low prices, repackaging information gathered from other third parties into tasty packages that give US government agencies the data they want with the plausible deniability they need.

Relying on the third-party doctrine that mostly ignores the Fourth Amendment and the public claims of data brokers that the massive amount of data being hawked to willing buyers cannot, in and of itself, positively ID anyone, federal agencies are amassing haystacks without having to worry too much about upsetting the probable cause cart.

Who’s grabbing all this data from data brokers? Well, it’s DC’s heaviest hitters, including ICE, CBP, the FBI, IRS, Secret Service, and — according to this report from Joseph Cox for Motherboard — the Department of Defense.

Multiple branches of the U.S. military have bought access to a powerful internet monitoring tool that claims to cover over 90 percent of the world’s internet traffic, and which in some cases provides access to people’s email data, browsing history, and other information such as their sensitive internet cookies, according to contracting data and other documents reviewed by Motherboard. 

The report is drawn from the information revealed by Senator Ron Wyden in his letter [PDF] to the Inspectors General of the FBI and DHS, as well as (most relevantly here) the Defense Department’s oversight.

The material reveals the sale and use of a previously little known monitoring capability that is powered by data purchases from the private sector. The tool, called Augury, is developed by cybersecurity firm Team Cymru and bundles a massive amount of data together and makes it available to government and corporate customers as a paid service.

As Cox points out, there are non-privacy violating uses for this data. Analysts and security researchers use this treasure trove to track malicious hackers and/or do due diligence for cyberattack attribution.

How the US military utilizes this data is unknown. Much of it appears to be foreign-facing, which means most collections won’t raise constitutional eyebrows. The procurement record shows the Defense Department is particularly interested in accessing data from collection points around the world, including those found in Europe, the Middle East, Africa, and Asia. But the procurement request also notes the data accessed might originate in North America, which is where plenty of US citizens reside.

Even if the Defense Department makes an effort to steer clear of US persons’ data, there’s no way Team Cymru can guarantee the military won’t end up with plenty of local data in its possession. Its (defensive) statements in response to questions from Motherboard suggests that by the time the data is packaged for sale, the company doing the harvesting (either directly or indirectly) doesn’t have much insight into its country of origin.

“Our platform does not provide user or subscriber information, and it doesn’t provide results that show any pattern of life, preventing its ability to be used to target individuals. Our platform only captures a limited sampling of the available data, and is further restricted by only allowing queries against restricted sampled and limited data, which all originates from malware, malicious activity, honeypots, scans, and third parties who provide feeds of the same. Results are then further limited in the scope and volume of what’s returned,” Team Cymru said in another email. 

If the platform truly laundered data into near-obscurity, it would be useless to those seeking it. So, either Team Cymru is relying on things unsaid to imply it isn’t helping federal agencies bypass constitutional protections, or it’s providing a service that asks end users to do all the analytic heavy lifting. It seems unlikely federal agencies (which include the FBI and DHS) would pay good money for access to a bunch of data that can’t be used to observe “patterns of life” or otherwise assist in pulling needles from Augury’s haystacks.

And a *lot* of money has been spent. Wyden’s letter notes the DoD has been evasive when asked direct questions by the senator.

While I have been able to make public important details about government agencies’ purchase of location data, my efforts to probe and shed light on the government’s purchase of internet browsing records have been frustrated by the Pentagon.

[…]

After DOD refused to release this information without restrictions, my staff learned that public contract information had been posted online, showing that multiple DoD agencies purchased data from data brokers that reveal internet browsing history: The Defense Counterintelligence and Security Agency spent more than $2 million purchasing access to netflow data, and the Defense Intelligence Agency purchased Domain Name System data. My office asked DOD to re-review their decision to maintain the CUI restrictions on the written answers DOD had previously provided, in light of these public contracts. DOD yet again refused, on May 25, 2022.

The Defense Department appears very reluctant to discuss its $2 million contract that allows it to hook itself up to Team Cmyru’s firehose. Rest assured, these government dollars are not being misspent. The DoD is definitely getting what it paid for.

Public contracting records confirm that the Augury tool provides access to “petabytes” of network data “from over 550 collection points worldwide” and “is updated with at least 100 billion new records each day.” The contracting records also confirm that Augury provides access to email data (“IMAP/POP/SMTP pcap data”) and data about web browser activity (“cookie usage,” “UserAgent data” and “URLs accessed”).

For those not familiar with the term used by Wyden, “pcap” is all-encompassing when it comes to internet traffic data.

PCAP data is “everything,” Zach Edwards, a cybersecurity researcher who has closely followed the data trade, told Motherboard in an online chat. “It’s everything. There’s nothing else to capture except the smell of electricity.”

Massive amounts of data, only limited by the government’s desire and Team Cmyru’s internal controls, whatever they actually are. That’s a lot of info on internet users’ habits, all of which can be had for a few million dollars a year, unrestrained by constitutional restrictions. As far as the government is concerned, a bunch of data that can be used to identify people and track their internet habits, if not their actual location (thanks to the wealth of location data generated by devices, apps, and on-the-go software) isn’t a Fourth Amendment issue because there are a few degrees of separation (and, possibly, meaningless “anonymization”) separating data generators from the government agencies buying access to this data.

That the Defense Department is unwilling to speak honestly to Wyden about this data haul signals there’s something questionable about its actions. Hopefully, this pressure will persuade the DoD to terminate its contract with Augury/Team Cmyru and find more constitutionally-sound ways to gather data.

Filed Under: cbp, defense department, dhs, fbi, ice, irs, secret service, third party doctrine

January 6th Committee Once Again Tries To Get The DHS Inspector General To Cooperate With Its Investigation

Failures

from the rogue-agency-within-a-rogue-agency dept

Joseph Cuffari, addressed as the “Honorable” in this letter [PDF] from the House Committee seeking information on the January 6, 2021 raid of the Capitol building in an attempt to overturn election results, has been anything but honorable since being appointed to his position by former president Donald Trump.

The DHS, which oversees the US Secret Service, opened, closed, re-opened, and buried information about a perhaps deliberately abortive attempt to migrate Secret Service members to new mobile devices. The Secret Service had a data migration plan in place. And by that, I mean the Secret Service was going to move agents to new devices. Data migration appeared to be a secondary concern.

Documents obtained by the Project on Government Oversight (POGO) showed the migration went ahead as planned, but without the sort of migration one would expect. Agents were informed the migration was happening and told to create backups. But if one wished to hide their involvement in an insurrection, one might just decide not to back up that data.

Text messages sent and received around the time the Capitol was being raided somehow vanished. So did texts issued by DHS Secretary Chad Wolf (a Trump appointee) and Deputy Secretary Ken Cuccinelli (another Trump appointee) — these apparently being a deliberate deletion unrelated to any planned data migrations that (somehow) failed to migrate crucial data.

Over the course of several months, the DHS Inspector General opened and closed investigations into the missing Secret Service texts. Despite being informed months earlier about the botched migration, DHS IG Cuffari chose to withhold this information from the House Committee investigation of the January 6 insurrection.

The House Committee — now facing calls for Cuffari to recuse himself from this investigation — is demanding more answers from a source that has already demonstrated he’s unwilling to do so. The letter demands Cuffari answer a whole lot of questions about his activities, which apparently include providing very selective oversight of DHS agencies.

Since May 2022, we have written to you on three separate occasions to request documents and information about your conduct as Inspector General: first, following serious allegations that your office censored findings of domestic abuse and sexual harassment by Department of Homeland Security (DHS) employees; second, after you failed to promptly notify Congress of crucial information on the Secret Service’s erasure of text messages related to the January 6, 2021, attack on the U.S. Capitol; and third, after new information emerged on your repeated failures to gather text messages from the Secret Service and other senior officials related to the January 6 attack.

In response to the Committees’ requests, you have refused to produce responsive documents and blocked employees in your office from appearing for transcribed interviews. Your obstruction of the Committees’ investigations is unacceptable, and your justifications for this noncompliance appear to reflect a fundamental misunderstanding of Congress’s authority and your duties as an Inspector General. If you continue to refuse to comply with our requests, we will have no choice but to consider alternate measures to ensure your compliance.

There’s plenty of palpable anger in this letter. It probably bordered on incandescent before it was vetted a half-dozen times by House lawyers. But what does the Committee mean by “alternate measures?” How can it hope to force Cuffari into compliance and honesty?

The real answer is it probably can’t. It can perhaps kick him to the curb and force him to seek more lucrative employment options as a lobbyist or corporate board member, but it can’t lock him up, force him to recuse himself from this investigation, or gun him down on Fifth Avenue with a firearm owned by Donald Trump.

But this is both farce and a tragedy. A Trump appointee charged with overseeing DHS agencies has deliberately refused to do so when investigations might prove inconvenient to his own employment or to his personal savior of choice, Donald Trump.

That leaves the electorate in a lurch. We expect mechanisms to be in place to destroy those who value their own positions and political beliefs over the good of the nation. Cuffari will likely end up bounced out of a job, but he’ll never truly, personally have to answer for ignoring the obligations of his job in favor of his personal preferences.

Filed Under: backups, dhs, inspector general, january 6th, joseph cuffari, secret service

Secret Service Wiped Jan. 6 Insurrection Texts And The DHS Inspector General Helped Cover It Up

Failures

from the all-this-hiding-must-mean-something-to-fear dept

Congressional hearings into the January 6, 2021 raid of the US Capitol building continue, focusing on the actions of Donald Trump and members of his administration as they sought to have Trump’s loss turned into a win.

Congressional investigators are looking into the possible involvement of Trump and Pence’s security teams. But subpoenaed communications from targeted Secret Service members have simply disappeared, something that was first reported early last month. Here’s Ken Klippenstein writing for The Intercept.

The Secret Service erased text messages from January 5 and January 6, 2021, according to a letter given to the January 6 committee and reviewed by The Intercept. The letter was originally sent by the Department of Homeland Security Office of Inspector General to the House and Senate homeland security committees. Though the Secret Service maintains that the text messages were lost as a result of a “device-replacement program,” the letter says the erasure took place shortly after oversight officials requested the agency’s electronic communications.

The Secret Service denied the texts were deleted after they had been requested by the DHS IG.

In a statement to the Washington Post, Secret Service spokesperson Anthony Guglielmi disputed the timeline, saying that some electronic communications had been deleted in January, while the Inspector General made its request in February.

This may be true but it’s not all that helpful. Supposedly the texts were wiped as part of “planned data migration” that occurred on January 27, 2021. The thing about a “data migration” is that data is supposed to “migrate,” not vanish.

And plenty of people, including the DHS itself, had prior notice these texts would need to be preserved. In addition to requests from the National Archives, the chairs of four House Committees informed the DHS (which oversees the Secret Service) and “other relevant agencies” to preserve records related to the January 6 events.

Nine days after this, the Secret Service sent a reminder to employees about the planned data migration, putting them on notice it was up to employees to ensure all data was backed up. This obviously didn’t happen. Whether this was carelessness or something more deliberate remains to be seen.

No one seems to know exactly when the Secret Service discovered the messages were irretrievable, but DHS Inspector General Joseph Cuffari knew for months the US Secret Service was not cooperating with the IG’s investigation into the missing tests. But he apparently decided this was something congressional investigators didn’t need to know about.

A memo [PDF] that was very selectively quoted (two sentences total) by the DHS IG has been obtained by the Project on Government Oversight. It contains five paragraphs vetted and approved for release by Office of the Inspector General’s attorneys — five paragraphs that would have let congressional investigators know the Secret Service was not being cooperative. Instead, the IG decided to cover this up.

Inspector General Joseph Cuffari never sent this detailed alert. Instead, the records show that Cuffari not only failed to alert Congress in a timely way about the erased texts, but failed to adopt his staff’s explicit recommendations that he do so.

His office had known of the missing texts for weeks, if not longer, at this point. According to a key paragraph of the April 1 alert, which is not public and appears for the first time here:

“On February 23, 2022—more than 2 months after OIG renewed its requests for select Secret Service employees’ text messages—Secret Service claimed inability to extract text message content due to an April 2021 mobile phone system migration, which wiped all data.”

That unsent paragraph continues:

“Secret Service caused significant delay by not clearly communicating this highly relevant information at the outset of its exchanges with OIG during this reporting period. Moreover, Secret Service has not explained why it did not preserve the texts prior to the migration.”

As POGO points out, this refusal to forward this report left congressional investigators in the dark, forced to piece together the problem with the missing Secret Service texts by dealing with two uncooperative entities, the Secret Service and the DHS Inspector General’s office. Well, actually just the DHS Inspector General himself, who was being urged to inform Congress about the Secret Service’s obstruction of the IG’s investigation.

Instead, IG Cuffari waited more than three months to inform Congress that the Secret Service had failed to preserve the texts investigators sought, even as he was pressed to do so by other DHS investigators. And, as was noted earlier, Cuffari had known about the botched migration and missing texts since May of last year, but he chose not to make this information public for another 13 months.

The version that made its way to Congress after massaging by Cuffari is, in retrospect, more about what’s missing than what’s actually there.

[T]he June report contained only two sentences about delayed access to Secret Service records and the January 6 review, and neither mentioned that the agency had admitted to erasing the messages.

Which is all part of a larger DHS Inspector General Office problem: Inspector General Cuffari, who is now facing calls to recuse himself from January 6-related investigations.

Earlier reporting by POGO found that Cuffari had also declined to inform Congress in the fall of 2021 about the Secret Service’s stonewalling access to information related to January 6, despite extensive efforts by multiple attorneys in his office to produce a detailed, six-page management alert about the problem.

[…]

POGO also recently obtained documentation that shows Cuffari’s office never told Congress it had known about then-Acting DHS Secretary Chad Wolf and then-Acting DHS Deputy Secretary Ken Cuccinelli’s deleted texts for over five months.

Self-preservation appears to be the name of the game. A planned data migration made it easy for Secret Service agents, who may have been supportive of Trump’s desire to overturn the election results, to simply allow damning texts to be migrated out of existence. And the DHS Inspector General’s unwillingness to go after Trump administration officials has resulted in him trying to save himself by misleading Congress repeatedly.

Filed Under: dhs, inspector general, january 6th, joseph cuffari, secret service, text messages

Secret Service Latest To Use Data Brokers To Dodge Warrant Requirements For Cell Site Location Data

Privacy

from the it's-just-Supreme-Court-precedent dept

Another federal law enforcement agency has figured out a way to dodge warrant requirements for historical cell site location data. The Supreme Court’s Carpenter decision said these records were covered by the Fourth Amendment. But rather than comply with the ruling, agencies like the CBP and ICE are buying location data in bulk from private companies that collect this data, rather than approach service providers with warrants.

These agencies argue they aren’t violating the Constitution because the data is “pseudonymized” and doesn’t specifically target any single person. But even cops using “reverse” warrants are still using warrants to gather this data. Federal agencies apparently can’t be bothered with this nicety, preferring to collect information in bulk and work backwards to whatever it is they’re looking for.

The Secret Service is the latest federal agency to buy location data from Locate X — one of the companies already providing cell site location data to CBP and ICE. Joseph Cox has the details for Motherboard.

The Secret Service paid for a product that gives the agency access to location data generated by ordinary apps installed on peoples’ smartphones, an internal Secret Service document confirms.

The sale highlights the issue of law enforcement agencies buying information, and in particular location data, that they would ordinarily need a warrant or court order to obtain. This contract relates to the sale of Locate X, a product from a company called Babel Street.

Motherboard uncovered the Secret Service’s warrant evasion through a public records request.

The contract that mentions Locate X stretches from September 28, 2017 to September 27, 2018, according to the document. With the modifications to an existing Secret Service and Babel Street contract, the total amount increased by $35,844 to $1,999,394, the document adds.

This corroborates statements made by a former Babel Street employee, who told journalists at Protocol back in March that the Secret Service was also buying location data, along with CBP and ICE.

This location data isn’t pulled from cell towers. Perhaps this is why agencies feel comfortable ignoring the Carpenter decision. But while there won’t be as many data points, there will still be plenty of data to sift through. Multiple apps collect location data. Some of them sell this data to data brokers who then sell this to marketing firms and/or the US government.

Senator Ron Wyden is, of course, all over this.

“It is clear that multiple federal agencies have turned to purchasing Americans’ data to buy their way around Americans’ Fourth Amendment Rights. I’m drafting legislation to close this loophole, and ensure the Fourth Amendment isn’t for sale,” Wyden’s statement added.

If there’s a loophole, it will be exploited. And federal agencies are going to want this loophole kept open. Since it’s unlikely the government is informing courts about this use of data, there have been no courtroom challenges of this practice, leaving the feds free to operate in this precedent-free void. The government is reading the letter of the Supreme Court’s ruling, feeling the warrant requirement only applies to data collected from service providers. But other courts have read that ruling to cover more than what the justices specified. Federal agencies are playing to the edges of the Fourth Amendment right now and it might come back to hurt them.

Filed Under: 4th amendment, cell site location data, data brokers, secret service, warrants

Secret Service Sends FOIA Requester A Redacted Version Of A Public DOJ Press Release

Failures

from the spinning-secrets-out-of-public-web-pages dept

The government loves its secrets. It loves them so much it does stupid things to, say, “secure the nation…” or “protect the integrity of deliberative processes” or whatever the fuck. We should not trust the government’s reasoning when it chooses to redact information from documents it releases to FOIA requesters. These assertions should always be challenged because the government’s track record on redactions is objectively awful.

Here’s the latest case-in-point: Emma Best — someone the government feels is a “vexatious” FOIA filer — just received a completely stupid set of redactions from the Secret Service. Best requested documents mentioning darknet market Hansa, which was shut down (along with Alpha Bay) following an investigation by US and Dutch law enforcement agencies.

The documents returned to Best contained redactions. This is unsurprising given the nature of the investigation. What’s surprising is what the Secret Service decided to redact. As Best pointed out on Twitter, the Secret Service decided public press releases by the DOJ were too sensitive to be released to the general public.

Here’s one of the redactions [PDF] the Secret Service applied to a press release that can be found unaltered and unedited at the Justice Department’s publicly-accessible website:

And here’s what the Secret Service excised, under the bullshit theory that a publicly-released press statement is somehow an “inter-agency or intra-agency memorandums or letter which would not be available by law to a party other than an agency in litigation with the agency.”

“This is likely one of the most important criminal investigations of the year – taking down the largest dark net marketplace in history,” said Attorney General Jeff Sessions. “Make no mistake, the forces of law and justice face a new challenge from the criminals and transnational criminal organizations who think they can commit their crimes with impunity using the dark net. The dark net is not a place to hide. The Department will continue to find, arrest, prosecute, convict, and incarcerate criminals, drug traffickers and their enablers wherever they are. We will use every tool we have to stop criminals from exploiting vulnerable people and sending so many Americans to an early grave. I believe that because of this operation, the American people are safer – safer from the threat of identity fraud and malware, and safer from deadly drugs.”

Um. Is Jeff Sessions being Yezhoved by the Secret Service? Does the agency consider him to be enough of a persona non grata after his firing by Trump to be excised from the Secret Services’ official recollection of this dark web takedown? This insane conspiracy theory I just made up makes as much sense as anything the Secret Service could offer in explanation for this redaction. The redaction removed nothing but the sort of swaggering statement Attorney Generals always make after a huge bust.

Needless to say, Emma Best is challenging the Secret Service’s redactions. Pithily.

I am appealing the integrity of the redactions, as you withheld public press releases under b5, which is grossly inappropriate.

Yeah. That’s an understatement. The Secret Service has no business redacting publicly-available info. Even if this was a clerical error, it’s so bad it’s insulting. And that’s why you can’t trust the government on things like this: when it’s not being malicious, it’s being stupid.

Filed Under: doj, foia, press release, redactions, secret service, transparency

Trump Administration Wants To Start Sending Secret Service Agents To Polling Stations

Failures

from the Make-America-Grovel-Again dept

Something pretty ugly has been attached as a rider to a routine reauthorization bill. If the bill manages to move forward without this being stripped, future elections would resemble those held by dictatorial governments, where the outcome is assured before the first voter is even intimidated.

President Trump would be able to dispatch Secret Service agents to polling places nationwide during a federal election, a vast expansion of executive authority, if a provision in a Homeland Security reauthorization bill remains intact.

This appears to be the result of Trump’s continued insistence he would have won the popular vote if there hadn’t been so many illegal votes. Of course, the administration has produced no evidence this happened in the last election. The only story that surfaced as a result of this post-election scrutiny was one involving someone who voted twice… for Trump.

Needless to say, state officials overseeing elections are horrified. The intrusion of the law enforcement branch that works closest with the president would give elections the appearance that Secret Service agents are there to prevent voters from voting for the wrong person. Given Trump’s antipathy towards anyone that isn’t white with a red hat, dispatched agents would certainly deter those not matching the chosen description from exercising their rights.

State officials are trying to get the attention of unwary Capitol Hill legislators before it’s too late. The bill with the rider attached has already passed in the House. The Senate is still looking through its two versions of the reauthorization bill — one with the rider attached and one that’s arguably more respectful of voting rights and the citizens exercising them.

“There is no discernible need for federal secret service agents to intrude, at the direction of the president, who may also be a candidate in that election, into thousands of citadels where democracy is enshrined,” according to a letter opposing the provision that was signed by 19 bipartisan secretaries of state and elections commissioners.

The letter — sent to the Senate’s majority leader, Mitch McConnell, and its minority leader, Charles Schumer, on Friday afternoon —requests that the Senate keep the Secret Service provision from the final legislation. The elections officials described the proposal as “unprecedented and shocking.”

“This is an alarming proposal which raises the possibility that armed federal agents will be patrolling neighborhood precincts and vote centers,” according to the letter, which was obtained by the Globe.

Very few people are going to see the presence of federal agents — especially from an agency with close ties to the White House — and think a fair election is in progress. The presence of any federal agents would be cause for concern, if not for the integrity of the election, than for the safety of those voting. Generally, a large law enforcement presence does not indicate safety. It indicates the area they’re guarding may come under attack. Either way, this will do nothing for voter turnout and will definitely dissuade those who aren’t voting for the party in power from casting their vote.

As it stands now, federal law prohibits federal agents for entering polling places. This rider would eliminate a protection put in place to protect Americans from government intrusion into the democratic process. Dispatching the Secret Service to any place Trump feels might be overrun with fake voters would only give citizens the impression the fix is in. And if it’s already been decided, why bother running a federal gauntlet just to show support for your candidates?

Hopefully, common sense will prevail. But given the fact the rider was already approved by one half of legislative branch, relying on common sense seems almost nonsensical.

Filed Under: authoritarianism, donald trump, polling places, secret service, voter fraud

US Secret Service Prefers Belt Sanders And Third-Party Vendors To Cell Phone Encryption Backdoors

(Mis)Uses of Technology

from the 80-grit-backdoor dept

The Christian Science Monitor has posted an interesting article detailing some (but certainly not all) of the ways the US Secret Service can obtain data from locked phones. In all the cases discussed in the article, the data itself wasn’t encrypted, but was otherwise inaccessible without the password.

In addition to using third-party forensic software and hardware (like that of recently-hacked Cellebrite), the Secret Service also engages in a lot of manual labor to recover phone data. In one instance, the Secret Service was able to pull out the phone’s flash memory and grab data from it — although this process took it nearly a week.

A Huawei phone obtained by the agency called for a very unique brute force approach.

In another case, involving a password-locked Huawei H883G phone, agents bought multiple copies of the same model and practiced carefully polishing off material from the back of the device with an automated sander.

Often, agents can apply heat to phones to open them up. But Huawei built this particular model in a way that applying too much heat could damage its memory. So, agents sanded off material from the back of the Huawei H883G device to excise sexually explicit images for a case involving a different New Hampshire man.

What’s not contained in the article are complaints about encryption. Either the Secret Service doesn’t encounter that much of it, or it just doesn’t find it to be that much of an obstacle when it does. Dave Aitel, a former NSA research scientist, is the only person quoted in the article who says anything about encryption — and even he believes the Secret Service’s combination of hardware and software is a better approach than giving government agencies encryption backdoors.

Watering down encryption on phones is “not a good path,” says Dave Aitel, a former National Security Agency research scientist who currently runs the cybersecurity firm Immunity. “The path of hacking is much nicer – from a policy perspective.”

[…]

“If a device is using encryption at rest … that could be problematic, especially if the implementation of the encryption is good,” he said.

It could be problematic, but encryption keeps bad guys out the same way it keeps the good guys out. And there’s nothing covered here that suggests the Secret Service is as opposed to encryption as FBI Director James Comey is. Granted, the Secret Service probably runs into fewer encrypted phones than the FBI does, but even in its more-limited selection, it seems to be making the progress it needs without suggesting the government force companies to give them all-access backdoor keys.

One other somewhat surprising revelation contained in the piece is the fact that small phone manufacturers might (inadvertently) be making more secure phones than the Apples and Samsungs of the world. Why? Because the limited market draws less interest from government contractors who develop cell phone-cracking tools. If there are fewer government buyers interested in cracking Brand X, no company is going to expend research resources trying to find a way around the phone’s built-in protections.

“A cheaper phone that might be less popular, it seems like it’d be easier for the vendors to get into it,” says [James] Darnell of the Secret Service phone lab. “But it’s actually quite the opposite.”

What’s covered here indicates James Comey’s “sky is falling darkening” proclamations are pretty much his alone. Law enforcement at large isn’t demanding encryption backdoors. It’s just the same handful of holdouts, albeit ones with inordinately-large soapboxes.

Filed Under: backdoors, belt sanders, encryption, hacking, secret service

Forty-One Secret Service Employees Punished For Illegally Accessing Congressman's Private Data In Hopes Of Discrediting Him

Legal Issues

from the apparently,-the-Secret-Service-employs-a-lot-of-tiny,-easily-bruised-children dept

When Rep. Jason Chaffetz began asking the Secret Service about its string of high-profile failures, agents were quick to respond… with attempts to undermine the Congressman’s credibility. Eighteen minutes after the hearings started, Secret Service agents — dozens of them — began poring through his 2003 Secret Service application in hopes of finding a few skeletons in his previously-vetted closet.

Even Secret Service Assistant Director Ed Lowery got in on the illegal fun, suggesting via email that “some information [Chaffetz] finds embarrassing needs to get out.” Information did get out, but it had no effect on Chaffetz’s reputation. The only people embarassed were the Secret Service and DHS head Jeh Johnson, who was forced to apologize on its behalf.

Johnson’s press release, detailing the results of the DHS’s investigation of the incident, shows dozens were questioned about this violation of the Privacy Act. Better yet, it shows dozens were punished for their misconduct.

In all, the conduct of 57 Secret Service personnel was reviewed, including 11 at the SES [Senior Executive Service] level. Of those, 41 are receiving some level of discipline. This discipline includes a letter of reprimand to one individual, suspended discipline contingent on no further misconduct for a period of five years, and suspensions from duty without pay for periods of up to 45 days. The one individual found by the Inspector General to have disclosed the private information to an outside source, the Washington Post, has resigned from the Secret Service.

As is often the case, the employee whose misconduct was the worst slipped out the door before the hammer could come down. As for the rest, the sheer number of Secret Service personnel involved shows this agency is no less susceptible to peer pressure and bandwagon jumping than the occupants of the average high school locker room.

Rest assured, this sort of misconduct won’t rear its ugly head again, because top Secret Service officials say Things are being Done.

Like many others I was appalled by the episode reflected in the Inspector General’s report, which brought real discredit to the Secret Service. From Director Clancy, I have been told that tighter processes are now in place to limit access to personally identifiable information and to highlight for employees the consequences of a breach of that data.

I’d love to know what these “tighter processes” are. Hopefully it’s something more than post-login clickwrap saying something to the effect of “user agrees to abide by all policies and statutes” with an “OK” button being the only thing standing between them and dirt on legislators they don’t like.

Filed Under: jason chaffetz, privacy, secret service, surveillance