Mediaboss Marketing

Edward Snowden exaggerated his resume, stole test answers and failed training on U.S. surveillance law before he copied an estimated 1.5 million classified documents from the National Security Agency, according to a summary of a House Intelligence Committee report released Thursday.

The committee unanimously adopted the investigative report a day before Oliver Stones Snowden premieres in movie theaters. The film apparently portrays the former NSA contractor as a heroic whistle-blower.

Civil liberties advocates have launched a national publicity campaign calling on President Obama to pardon Snowden, who has been accused of espionage, before he leaves office.

Committee members sent a bipartisan letter to Obama urging him not to pardon Snowden.

The House report provides new details about Snowdens background, and calls into question his self-declared motivations and his work at the NSA before he fled to China and then Russia, where he now lives.

It describes him as a serial exaggerator and fabricator.

Contrary to Snowdens self-portrayal as a principled whistle-blower, the committee said in a statement, he was a disgruntled employee who had frequent conflicts with his managers and was reprimanded shortly before he began downloading the trove of NSA documents.

Release of the digital documents to media groups in 2013 did severe damage to U.S. national security, compromising the intelligence communitys anti-terror efforts and endangering the security of the American people as well as active-duty U.S. troops, the committee said.

The release also led to a public debate about U.S. intelligence powers, and new restrictionson how far the NSA can go in surveillance of U.S. citizens.

Committee members said their two-year investigation found most of the files Snowden took had no civil liberties concerns, but instead revealed spying programs against adversaries and allied governments.

Edward Snowden is no hero hes a traitor who willfully betrayed his colleagues and his country, Rep. Devin Nunes (R-Tulare), the committee chairman, said in a statement.In light of his long list of exaggerations and outright fabrications detailed in this report, no one should take him at his word.

Rep. Adam Schiff (D-Burbank), ranking member of the committee, said the investigation found that Snowdens claims that he acted to defend Americans privacy were self serving and false and that he did profound damage to national security.

While those disclosures did spark a useful public debate, the collateral damage has been extraordinary, Schiff said.

Snowden disputed how he was characterized by the committee, writing on Twitter that "Congress spent two years writing a report to discourage you from going to see" Stone's film.

"Their report is so artlessly distorted that it would be amusing if it weren't such a serious act of bad faith," Snowden wrote.

The 36-page investigative report remains classified, but a three-page summary released by the committee shows that Snowden failed an internal training for NSA employees on Section 702 of surveillance law, which targets foreign Internet traffic.

Part of that training, lawmakers concluded, included privacy provisions in place to protect the rights of U.S. citizens from data collected inadvertently while the NSA vacuumed up online data.

After reviewing Snowden's employment records, the panel found he had engaged in what the summary called a "pattern of intentional lying.

Snowden "obtained new positions at NSA by exaggerating his resume and stealing the answers to an employment test," the summary states.

He claimed to have left [Army] basic training because of broken legs when in fact he washed out because of shin splints, it says. He claimed to have obtained a high school degree equivalent when in fact he never did. He claimed to have worked for the CIA as a senior advisor, which was a gross exaggeration of his entry-level duties as a computer technician. He also doctored his performance evaluations and obtained new positions at NSA by exaggerating his resume and stealing the answers to an employment test.

Snowden has lived openly as a fugitive in Russia since June2013, frequently giving interviews and appearing at conferences via video hookups.

Intelligence officials have said that material he leaked helped Russia and China protect themselves from U.S. surveillance, and taught terrorist groups such as Islamic State to better hide their tracks.

The House report is based on hundreds of secret documents and dozens of briefings with intelligence officials.

The committee concluded that Snowden is not a whistle-blower because he did not try to raise his civil liberties concerns through official channels or with Congress, andmost of the data he stole from NSA computers was not related to privacy concerns.

The report does not outline specific damage to national security but lawmakers said the disclosures exacerbated and accelerated existing trends in the use of encrypted messages by adversaries and terrorist groups.

Lawmakers also expressed concern that intelligence officials have not done enough to prevent future thefts.The Department of Defense has reviewed all 1.5 million documents Snowden removed, but the intelligence community has not conducted such a comprehensivereview.

The government has spent hundreds of millions of dollars and will eventually spend billions to mitigate the damagecaused by the leaks, the committee concluded.

The American Civil Liberties Union, Amnesty International, Human Rights Watch and other organizations have urged Obama to pardon Snowden.

The rest is here:
With 'Snowden' set to open, House panel calls former NSA ...

The Office of Tailored Access Operations (TAO) is a cyber-warfare intelligence-gathering unit of the National Security Agency (NSA). It has been active since at least circa 1998.[1][2] TAO identifies, monitors, infiltrates, and gathers intelligence on computer systems being used by entities foreign to the United States.[3][4][5][6] The NSA terms these activities "computer network exploitation".

TAO is reportedly "now the largest and arguably the most important component of the NSA's huge Signals Intelligence Directorate (SID)[7] (SIGINT), consisting of more than 1,000 military and civilian computer hackers, intelligence analysts, targeting specialists, computer hardware and software designers, and electrical engineers."[1]

A document leaked by former NSA contractor Edward Snowden describing the unit's work says[not in citation given] TAO has software templates allowing it to break into commonly used hardware, including routers, switches, and firewalls from multiple product vendor lines".[8] According to The Washington Post, TAO engineers prefer to tap networks rather than isolated computers, because there are typically many devices on a single network.[8]

TAO's headquarters are termed the Remote Operations Center (ROC) and are based at the NSA headquarters at Fort Meade, Maryland. TAO also has expanded to NSA Hawaii (Wahiawa, Oahu), NSA Georgia (Fort Gordon, Georgia), NSA Texas (San Antonio, Texas), and NSA Colorado (Buckley Air Force Base, Denver).[1]

Since 2013, the head of TAO is Rob Joyce, a 25-plus year employee who previously worked in the NSA's Information Assurance Directorate (IAD). In January 2016, Joyce had a rare public appearance when he gave a presentation at the Usenixs Enigma conference. [9]

In the Remote Operations Center, 600 employees gather information from around the world.[10][11] Their motto is "Your data is our data, your equipment is our equipment - anytime, any place, by any legal means."

Details[citation needed] on a program titled QUANTUMSQUIRREL indicate NSA ability to masquerade as any routable IPv4 or IPv6 host. This enables an NSA computer to generate false geological location and personal identification credentials when accessing the Internet utilizing QUANTUMSQUIRREL.[15]

The NSA ANT catalog is a 50-page classified document listing technology available to the United States National Security Agency (NSA) Tailored Access Operations (TAO) by the Advanced Network Technology (ANT) Division to aid in cyber surveillance. Most devices are described as already operational and available to US nationals and members of the Five Eyes alliance. According to Der Spiegel, which released the catalog to the public on December 30, 2013, "The list reads like a mail-order catalog, one from which other NSA employees can order technologies from the ANT division for tapping their targets' data." The document was created in 2008.[16] Security researcher Jacob Appelbaum gave a speech at the Chaos Communications Congress in Hamburg, Germany, in which he detailed techniques that the simultaneously published Der Spiegel article he coauthored disclosed from the catalog.[16]

The TAO has developed an attack suite they call QUANTUM. It relies on a compromised router that duplicates internet traffic, typically HTTP requests, so that they go both to the intended target and to an NSA site (indirectly). The NSA site runs FOXACID software which sends back exploits that load in the background in the target web browser before the intended destination has had a chance to respond (it's unclear if the compromised router facilitates this race on the return trip). Prior to the development of this technology, FOXACID software made spear-phishing attacks the NSA referred to as spam. If the browser is exploitable, further permanent "implants" (rootkits etc.) are deployed in the target computer, e.g. OLYMPUSFIRE for Windows, which give complete remote access to the infected machine.[17] This type of attack is part of the man-in-the-middle attack family, though more specifically it is called man-on-the-side attack. It is difficult to pull off without controlling some of the Internet backbone.[18]

There are numerous services that FOXACID can exploit this way. The names of some FOXACID modules are given below:[19]

By collaboration with the British Government Communications Headquarters (GCHQ) (MUSCULAR), Google services could be attacked too, including Gmail.[20]

Finding machines that are exploitable and worth attacking is done using analytic databases such as XKeyscore.[21] A specific method of finding vulnerable machines is interception of Windows Error Reporting traffic, which is logged into XKeyscore.[22]

QUANTUM attacks launched from NSA sites can be too slow for some combinations of targets and services as they essentially try to exploit a race condition, i.e. the NSA server is trying to beat the legitimate server with its response.[23] As of mid-2011, the NSA was prototyping a capability codenamed QFIRE, which involved embedding their exploit-dispensing servers in virtual machines (running on VMware ESX) hosted closer to the target, in the so-called Special Collection Sites (SCS) network worldwide. The goal of QFIRE was to lower the latency of the spoofed response, thus increasing the probability of success.[24][25][26]

COMMENDEER [sic] is used to commandeer (i.e. compromise) untargeted computer systems. The software is used as a part of QUANTUMNATION, which also includes the software vulnerability scanner VALIDATOR. The tool was first described at the 2014 Chaos Communication Congress by Jacob Appelbaum, who characterized it as tyrannical.[27][28][29]

QUANTUMCOOKIE is a more complex form of attack which can be used against Tor users.[30]

According to a 2013 article in Foreign Policy, "TAO has become increasingly accomplished at its mission, thanks in part to the high-level cooperation it secretly receives from the 'big three' American telecom companies (AT&T, Verizon and Sprint), most of the large US-based Internet service providers, and many of the top computer security software manufactures and consulting companies."[36] A 2012 TAO budget document claims that these companies, on TAO's behest, "insert vulnerabilities into commercial encryption systems, IT systems, networks and endpoint communications devices used by targets".[36] A number of US companies, including Cisco and Dell, have subsequently made public statements denying that they insert such back doors into their products.[37]Microsoft provides advance warning to the NSA of vulnerabilities it knows about, before fixes or information about these vulnerabilities is available to the public; this enables TAO to execute so-called zero-day attacks.[38] A Microsoft official who declined to be identified in the press confirmed that this is indeed the case, but said that Microsoft can't be held responsible for how the NSA uses this advance information.[39]

Link:
Tailored Access Operations - Wikipedia, the free encyclopedia

PRISM is a clandestine[1]surveillance program under which the United States National Security Agency (NSA) collects internet communications from at least nine major US internet companies.[2][3][4] Since 2001 the United States government has increased its scope for such surveillance, and so this program was launched in 2007.

PRISM is a government code name for a data-collection effort known officially by the SIGAD US-984XN.[5][6] The PRISM program collects stored internet communications based on demands made to internet companies such as Google Inc. under Section 702 of the FISA Amendments Act of 2008 to turn over any data that match court-approved search terms.[7] The NSA can use these PRISM requests to target communications that were encrypted when they traveled across the internet backbone, to focus on stored data that telecommunication filtering systems discarded earlier,[8][9] and to get data that is easier to handle, among other things.[10]

PRISM began in 2007 in the wake of the passage of the Protect America Act under the Bush Administration.[11][12] The program is operated under the supervision of the U.S. Foreign Intelligence Surveillance Court (FISA Court, or FISC) pursuant to the Foreign Intelligence Surveillance Act (FISA).[13] Its existence was leaked six years later by NSA contractor Edward Snowden, who warned that the extent of mass data collection was far greater than the public knew and included what he characterized as "dangerous" and "criminal" activities.[14] The disclosures were published by The Guardian and The Washington Post on June 6, 2013. Subsequent documents have demonstrated a financial arrangement between NSA's Special Source Operations division (SSO) and PRISM partners in the millions of dollars.[15]

Documents indicate that PRISM is "the number one source of raw intelligence used for NSA analytic reports", and it accounts for 91% of the NSA's internet traffic acquired under FISA section 702 authority."[16][17] The leaked information came to light one day after the revelation that the FISA Court had been ordering a subsidiary of telecommunications company Verizon Communications to turn over to the NSA logs tracking all of its customers' telephone calls.[18][19]

U.S. government officials have disputed some aspects of the Guardian and Washington Post stories and have defended the program by asserting it cannot be used on domestic targets without a warrant, that it has helped to prevent acts of terrorism, and that it receives independent oversight from the federal government's executive, judicial and legislative branches.[20][21] On June 19, 2013, U.S. President Barack Obama, during a visit to Germany, stated that the NSA's data gathering practices constitute "a circumscribed, narrow system directed at us being able to protect our people."[22]

PRISM was publicly revealed when classified documents about the program were leaked to journalists of The Washington Post and The Guardian by Edward Snowden at the time an NSA contractor during a visit to Hong Kong.[2][3] The leaked documents included 41 PowerPoint slides, four of which were published in news articles.[2][3]

The documents identified several technology companies as participants in the PRISM program, including Microsoft in 2007, Yahoo! in 2008, Google in 2009, Facebook in 2009, Paltalk in 2009, YouTube in 2010, AOL in 2011, Skype in 2011 and Apple in 2012.[23] The speaker's notes in the briefing document reviewed by The Washington Post indicated that "98 percent of PRISM production is based on Yahoo, Google, and Microsoft".[2]

The slide presentation stated that much of the world's electronic communications pass through the U.S., because electronic communications data tend to follow the least expensive route rather than the most physically direct route, and the bulk of the world's internet infrastructure is based in the United States.[16] The presentation noted that these facts provide United States intelligence analysts with opportunities for intercepting the communications of foreign targets as their electronic data pass into or through the United States.[3][16]

Snowden's subsequent disclosures included statements that government agencies such as the United Kingdom's GCHQ also undertook mass interception and tracking of internet and communications data[24] described by Germany as "nightmarish" if true[25] allegations that the NSA engaged in "dangerous" and "criminal" activity by "hacking" civilian infrastructure networks in other countries such as "universities, hospitals, and private businesses",[14] and alleged that compliance offered only very limited restrictive effect on mass data collection practices (including of Americans) since restrictions "are policy-based, not technically based, and can change at any time", adding that "Additionally, audits are cursory, incomplete, and easily fooled by fake justifications",[14] with numerous self-granted exceptions, and that NSA policies encourage staff to assume the benefit of the doubt in cases of uncertainty.[26][27][28]

Below are a number of slides released by Edward Snowden showing the operation and processes behind the PRISM program.

Slide showing that much of the world's communications flow through the U.S.

Details of information collected via PRISM

Slide listing companies and the date that PRISM collection began

Slide showing PRISM's tasking process

Slide showing the PRISM collection dataflow

Slide showing PRISM case numbers

Slide showing the REPRISMFISA Web app

Slide showing some PRISM targets.

Slide fragment mentioning "upstream collection", FAA702, EO 12333, and references yahoo.com explicitly in the text.

FAA702 Operations, and map

FAA702 Operations, and map. The subheader reads "Collection only possible under FAA702 Authority". FAIRVIEW is in the center box.

FAA702 Operations, and map. The subheader reads "Collection only possible under FAA702 Authority". STORMBREW is in the center box.

Tasking, Points to Remember. Transcript of body: Whenever your targets meet FAA criteria, you should consider asking to FAA. Emergency tasking processes exist for [imminent /immediate ] threat to life situations and targets can be placed on [illegible] within hours (surveillance and stored comms). Get to know your Product line FAA adjudicators and FAA leads.

The French newspaper Le Monde disclosed new PRISM slides (See Page 4, 7 and 8) coming from the "PRISM/US-984XN Overview" presentation on October 21, 2013.[29] The British newspaper The Guardian disclosed new PRISM slides (see pages 3 and 6) in November 2013 which on the one hand compares PRISM with the Upstream program, and on the other hand deals with collaboration between the NSA's Threat Operations Center and the FBI.[30]

Wikimedia Commons keeps copies of the leaked PowerPoint slides, and other associated documents.

PRISM is a program from the Special Source Operations (SSO) division of the NSA, which in the tradition of NSA's intelligence alliances, cooperates with as many as 100 trusted U.S. companies since the 1970s.[2] A prior program, the Terrorist Surveillance Program,[31][32] was implemented in the wake of the September 11 attacks under the George W. Bush Administration but was widely criticized and challenged as illegal, because it did not include warrants obtained from the Foreign Intelligence Surveillance Court.[32][33][34][35][36] PRISM was authorized by the Foreign Intelligence Surveillance Court.[16]

PRISM was enabled under President Bush by the Protect America Act of 2007 and by the FISA Amendments Act of 2008, which immunizes private companies from legal action when they cooperate with U.S. government agencies in intelligence collection. In 2012 the act was renewed by Congress under President Obama for an additional five years, through December 2017.[3][37][38] According to The Register, the FISA Amendments Act of 2008 "specifically authorizes intelligence agencies to monitor the phone, email, and other communications of U.S. citizens for up to a week without obtaining a warrant" when one of the parties is outside the U.S.[37]

The most detailed description of the PRISM program can be found in a report about NSA's collection efforts under Section 702 FAA, that was released by the Privacy and Civil Liberties Oversight Board (PCLOB) on July 2, 2014.[39]

According to this report, PRISM is only used to collect internet communications, not telephone conversations. These internet communications are not collected in bulk, but in a targeted way: only communications that are to or from specific selectors, like e-mail addresses, can be gathered. Under PRISM, there's no collection based upon keywords or names.[39]

The actual collection process is done by the Data Intercept Technology Unit (DITU) of the FBI, which on behalf of the NSA sends the selectors to the US internet service providers, which were previously served with a Section 702 Directive. Under this directive, the provider is legally obliged to hand over (to DITU) all communications to or from the selectors provided by the government.[39] DITU then sends these communications to NSA, where they are stored in various databases, depending on their type.

Data, both content and metadata, that already have been collected under the PRISM program, may be searched for both US and Non-US person identifiers. These kind of queries became known as "back-door searches" and are conducted by NSA, FBI and CIA.[40] Each of these agencies has slightly different protocols and safeguards to protect searches with a US person identifier.[39]

Internal NSA presentation slides included in the various media disclosures show that the NSA could unilaterally access data and perform "extensive, in-depth surveillance on live communications and stored information" with examples including email, video and voice chat, videos, photos, voice-over-IP chats (such as Skype), file transfers, and social networking details.[3] Snowden summarized that "in general, the reality is this: if an NSA, FBI, CIA, DIA, etc. analyst has access to query raw SIGINT [signals intelligence] databases, they can enter and get results for anything they want."[14]

According to The Washington Post, the intelligence analysts search PRISM data using terms intended to identify suspicious communications of targets whom the analysts suspect with at least 51 percent confidence to not be U.S. citizens, but in the process, communication data of some U.S. citizens are also collected unintentionally.[2] Training materials for analysts tell them that while they should periodically report such accidental collection of non-foreign U.S. data, "it's nothing to worry about."[2][41]

According to The Guardian, NSA had access to chats and emails on Hotmail.com, Skype, because Microsoft had "developed a surveillance capability to deal" with the interception of chats, and "for Prism collection against Microsoft email services will be unaffected because Prism collects this data prior to encryption."[42][43][44]

Also according to The Guardian's Glenn Greenwald even low-level NSA analysts are allowed to search and listen to the communications of Americans and other people without court approval and supervision. Greenwald said low level Analysts can, via systems like PRISM, "listen to whatever emails they want, whatever telephone calls, browsing histories, Microsoft Word documents.[31] And it's all done with no need to go to a court, with no need to even get supervisor approval on the part of the analyst."[45]

He added that the NSA databank, with its years of collected communications, allows analysts to search that database and listen "to the calls or read the emails of everything that the NSA has stored, or look at the browsing histories or Google search terms that you've entered, and it also alerts them to any further activity that people connected to that email address or that IP address do in the future."[45] Greenwald was referring in the context of the foregoing quotes to the NSA program X-Keyscore.[46]

Unified Targeting Tool

Shortly after publication of the reports by The Guardian and The Washington Post, the United States Director of National Intelligence, James Clapper, on June 7, 2013 released a statement confirming that for nearly six years the government of the United States had been using large internet services companies such as Facebook to collect information on foreigners outside the United States as a defense against national security threats.[18] The statement read in part, "The Guardian and The Washington Post articles refer to collection of communications pursuant to Section 702 of the Foreign Intelligence Surveillance Act. They contain numerous inaccuracies."[48] He went on to say, "Section 702 is a provision of FISA that is designed to facilitate the acquisition of foreign intelligence information concerning non-U.S. persons located outside the United States. It cannot be used to intentionally target any U.S. citizen, any other U.S. person, or anyone located within the United States."[48] Clapper concluded his statement by stating, "The unauthorized disclosure of information about this important and entirely legal program is reprehensible and risks important protections for the security of Americans."[48] On March 12, 2013, Clapper had told the United States Senate Select Committee on Intelligence that the NSA does "not wittingly" collect any type of data on millions or hundreds of millions of Americans.[49] Clapper later admitted the statement he made on March 12, 2013 was a lie,[50] or in his words "I responded in what I thought was the most truthful, or least untruthful manner by saying no."[51]

On June 7, 2013 U.S. President Barack Obama, referring to the PRISM program[citation needed] and the NSA's telephone calls logging program, said, "What you've got is two programs that were originally authorized by Congress, have been repeatedly authorized by Congress. Bipartisan majorities have approved them. Congress is continually briefed on how these are conducted. There are a whole range of safeguards involved. And federal judges are overseeing the entire program throughout."[52] He also said, "You can't have 100 percent security and then also have 100 percent privacy and zero inconvenience. You know, we're going to have to make some choices as a society."[52] In separate statements, senior Obama administration officials (not mentioned by name in source) said that Congress had been briefed 13 times on the programs since 2009.[53]

On June 8, 2013, Director of National Intelligence Clapper made an additional public statement about PRISM and released a fact sheet providing further information about the program, which he described as "an internal government computer system used to facilitate the government's statutorily authorized collection of foreign intelligence information from electronic communication service providers under court supervision, as authorized by Section 702 of the Foreign Intelligence Surveillance Act (FISA) (50 U.S.C. 1881a)."[54][55] The fact sheet stated that "the surveillance activities published in The Guardian and the Washington Post are lawful and conducted under authorities widely known and discussed, and fully debated and authorized by Congress."[54] The fact sheet also stated that "the United States Government does not unilaterally obtain information from the servers of U.S. electronic communication service providers. All such information is obtained with FISA Court approval and with the knowledge of the provider based upon a written directive from the Attorney General and the Director of National Intelligence." It said that the Attorney General provides FISA Court rulings and semi-annual reports about PRISM activities to Congress, "provid[ing] an unprecedented degree of accountability and transparency."[54] Democratic Senators Udall and Wyden, who serve on the U.S. Senate Select Committee on Intelligence, subsequently criticized the fact sheet as being inaccurate.[clarification needed] NSA Director General Keith Alexander acknowledged the errors, stating that the fact sheet "could have more precisely described" the requirements governing the collection of e-mail and other internet content from U.S. companies. The fact sheet was withdrawn from the NSA's website around June 26.[56]

In a closed-doors Senate hearing around June 11, FBI Director Robert Mueller said that Snowden's leaks had caused "significant harm to our nation and to our safety."[57] In the same Senate NSA Director Alexander defended the program.[further explanation needed] Alexander's defense was immediately criticized by Senators Udall and Wyden, who said they saw no evidence that the NSA programs had produced "uniquely valuable intelligence." In a joint statement, they wrote, "Gen Alexander's testimony yesterday suggested that the NSA's bulk phone records collection program helped thwart 'dozens' of terrorist attacks, but all of the plots that he mentioned appear to have been identified using other collection methods."[57][58]

On June 18, NSA Director Alexander said in an open hearing before the House Intelligence Committee of Congress that communications surveillance had helped prevent more than 50 potential terrorist attacks worldwide (at least 10 of them involving terrorism suspects or targets in the United States) between 2001 and 2013, and that the PRISM web traffic surveillance program contributed in over 90 percent of those cases.[59][60][61] According to court records, one example Alexander gave regarding a thwarted attack by al Qaeda on the New York Stock Exchange was not in fact foiled by surveillance.[62] Several senators wrote Director of National Intelligence Clapper asking him to provide other examples.[63]

U.S. intelligence officials, speaking on condition of anonymity, told various news outlets that by June 24 they were already seeing what they said was evidence that suspected terrorists had begun changing their communication practices in order to evade detection by the surveillance tools disclosed by Snowden.[64][65]

In contrast to their swift and forceful reactions the previous day to allegations that the government had been conducting surveillance of United States citizens' telephone records, Congressional leaders initially had little to say about the PRISM program the day after leaked information about the program was published. Several lawmakers declined to discuss PRISM, citing its top-secret classification,[66] and others said that they had not been aware of the program.[67] After statements had been released by the President and the Director of National Intelligence, some lawmakers began to comment:

Senator John McCain (R-AZ)

Senator Dianne Feinstein (D-CA), chair of the Senate Intelligence Committee

Senator Rand Paul (R-KY)

Senator Susan Collins (R-ME), member of Senate Intelligence Committee and past member of Homeland Security Committee

Representative Jim Sensenbrenner (R-WI), principal sponsor of the Patriot Act

Representative Mike Rogers (R-MI), a Chairman of the Permanent Select Committee on Intelligence.

Senator Mark Udall (D-CO)

Representative Todd Rokita (R-IN)

Representative Luis Gutierrez (D-IL)

Senator Ron Wyden (D-OR)

Following these statements some lawmakers from both parties warned national security officials during a hearing before the House Judiciary Committee that they must change their use of sweeping National Security Agency surveillance programs or face losing the provisions of the Foreign Intelligence Surveillance Act that have allowed for the agency's mass collection of telephone metadata.[77] "Section 215 expires at the end of 2015, and unless you realize you've got a problem, that is not going to be renewed," Rep. Jim Sensenbrenner, R-Wis., author of the USA Patriot Act, threatened during the hearing.[77] "It's got to be changed, and you've got to change how you operate section 215. Otherwise, in two and a half years, you're not going to have it anymore."[77]

Leaks of classified documents pointed to the role of a special court in enabling the government's secret surveillance programs, but members of the court maintained they were not collaborating with the executive branch.[78]The New York Times, however, reported in July 2013 that in "more than a dozen classified rulings, the nation's surveillance court has created a secret body of law giving the National Security Agency the power to amass vast collections of data on Americans while pursuing not only terrorism suspects, but also people possibly involved in nuclear proliferation, espionage and cyberattacks."[79] After Members of the U.S. Congress pressed the Foreign Intelligence Surveillance Court to release declassified versions of its secret ruling, the court dismissed those requests arguing that the decisions can't be declassified because they contain classified information.[80]Reggie Walton, the current FISA presiding judge, said in a statement: "The perception that the court is a rubber stamp is absolutely false. There is a rigorous review process of applications submitted by the executive branch, spearheaded initially by five judicial branch lawyers who are national security experts, and then by the judges, to ensure that the court's authorizations comport with what the applicable statutes authorize."[81] The accusation of being a "rubber stamp" was further rejected by Walton who wrote in a letter to Senator Patrick J. Leahy: "The annual statistics provided to Congress by the Attorney General [...]frequently cited to in press reports as a suggestion that the Court's approval rate of application is over 99%reflect only the number of final applications submitted to and acted on by the Court. These statistics do not reflect the fact that many applications are altered to prior or final submission or even withheld from final submission entirely, often after an indication that a judge would not approve them."[82]

The U.S. military has acknowledged blocking access to parts of The Guardian website for thousands of defense personnel across the country,[83] and blocking the entire Guardian website for personnel stationed throughout Afghanistan, the Middle East, and South Asia.[84] A spokesman said the military was filtering out reports and content relating to government surveillance programs to preserve "network hygiene" and prevent any classified material from appearing on unclassified parts of its computer systems.[83] Access to the Washington Post, which also published information on classified NSA surveillance programs disclosed by Edward Snowden, had not been blocked at the time the blocking of access to The Guardian was reported.[84]

The former head of the Austrian Federal Office for the Protection of the Constitution and Counterterrorism, Gert-Ren Polli, stated he knew the PRISM program under a different name and stated that surveillance activities had occurred in Austria as well. Polli had publicly stated in 2009 that he had received requests from US intelligence agencies to do things that would be in violation of Austrian law, which Polli refused to allow.[85][86]

The Australian government has said it will investigate the impact of the PRISM program and the use of the Pine Gap surveillance facility on the privacy of Australian citizens.[87] Australia's former foreign minister Bob Carr said that Australians shouldn't be concerned about PRISM but that cybersecurity is high on the government's list of concerns.[88] The Australian Foreign Minister Julie Bishop stated that the acts of Edward Snowden were treachery and offered a staunch defence of her nation's intelligence co-operation with America.[89]

Brazil's president, Dilma Rousseff, responded by cancelling a planned October 2013 state visit to the United States, demanding an official apology, which by October 20, 2013, hadn't come.[90] Also, Rousseff classified the spying as unacceptable between more harsh words in a speech before the UN General Assembly on September 24, 2013.[91] As a result, Boeing lost out on a US$4.5 billion contract for fighter jets to Sweden's Saab Group.[92]

Canada's national cryptologic agency, the Communications Security Establishment (CSEC), said that commenting on PRISM "would undermine CSE's ability to carry out its mandate." Privacy Commissioner Jennifer Stoddart lamented Canada's standards when it comes to protecting personal online privacy stating "We have fallen too far behind" in her report. "While other nations' data protection authorities have the legal power to make binding orders, levy hefty fines and take meaningful action in the event of serious data breaches, we are restricted to a 'soft' approach: persuasion, encouragement and, at the most, the potential to publish the names of transgressors in the public interest." And, "when push comes to shove," Stoddart wrote, "short of a costly and time-consuming court battle, we have no power to enforce our recommendations."[93][94]

On 20 October 2013 a committee at the European Parliament backed a measure that, if it is enacted, would require American companies to seek clearance from European officials before complying with United States warrants seeking private data. The legislation has been under consideration for two years. The vote is part of efforts in Europe to shield citizens from online surveillance in the wake of revelations about a far-reaching spying program by the U.S. National Security Agency.[95] Germany and France have also had ongoing mutual talks about how they can keep European email traffic from going across American servers.[96]

On October 21, 2013 the French Foreign Minister, Laurent Fabius, summoned the U.S. Ambassador, Charles Rivkin, to the Quai d'Orsay in Paris to protest large-scale spying on French citizens by the U.S. National Security Agency (NSA). Paris prosecutors had opened preliminary inquiries into the NSA program in July, but Fabius said, " obviously we need to go further" and "we must quickly assure that these practices aren't repeated."[97]

Germany did not receive any raw PRISM data, according to a Reuters report.[98]German Chancellor Angela Merkel said that "the internet is new to all of us" to explain the nature of the program; Matthew Schofield of McClatchy Washington Bureau said, "She was roundly mocked for that statement."[99] Gert-Ren Polli, a former Austrian counter-terrorism official, said in 2013 that it is "absurd and unnatural" for the German authorities to pretend not to have known anything.[85][86] The German Army was using PRISM to support its operations in Afghanistan as early as 2011.[100]

In October 2013, it was reported that the NSA monitored Merkel's cell phone.[101] The United States denied the report, but following the allegations, Merkel called President Obama and told him that spying on friends was "never acceptable, no matter in what situation."[102]

Israeli newspaper Calcalist discussed[103] the Business Insider article[104] about the possible involvement of technologies from two secretive Israeli companies in the PRISM programVerint Systems and Narus.

The Mexican Government after finding out about the PRISM program has started to build its own spying program to spy on its own citizens. According to Jenaro Villamil a writer from Proceso(magazine), CISEN the intelligence agency from Mexico has started to work with IBM and Hewlett Packard to develop its own data gathering software. Facebook, Twitter, Emails and other social network sites are going to be priority."[105]

In New Zealand, University of Otago information science Associate Professor Hank Wolfe said that "under what was unofficially known as the Five Eyes Alliance, New Zealand and other governments, including the United States, Australia, Canada, and Britain, dealt with internal spying by saying they didn't do it. But they have all the partners doing it for them and then they share all the information."[106]

Edward Snowden, in a live streamed Google Hangout to Kim Dotcom and Julian Assange alleged that he had received intelligence from New Zealand, and the NSA has listening posts in New Zealand[107]

At a meeting of European Union leaders held the week of 21 October 2013, Mariano Rajoy, Spain's prime minister, said that "spying activities aren't proper among partner countries and allies". On 28 October 2013 the Spanish government summoned the American ambassador, James Costos, to address allegations that the U.S. had collected data on 60 million telephone calls in Spain. Separately, igo Mndez de Vigo, a Spanish secretary of state, referred to the need to maintain "a necessary balance" between security and privacy concerns, but said that the recent allegations of spying, "if proven to be true, are improper and unacceptable between partners and friendly countries".[108]

In the United Kingdom, the Government Communications Headquarters (GCHQ), which also has its own surveillance program Tempora, had access to the PRISM program on or before June 2010 and wrote 197 reports with it in 2012 alone. But after 2014, the Tempora lost its access to the PRISM programme.[citation needed] The Intelligence and Security Committee of the UK Parliament reviewed the reports GCHQ produced on the basis of intelligence sought from the US. They found in each case a warrant for interception was in place in accordance with the legal safeguards contained in UK law.[109]

In August 2013, The Guardian newspaper's offices were visited by agents from GCHQ, who ordered and supervised the destruction of the hard drives containing information acquired from Snowden.[110]

The original Washington Post and Guardian articles reporting on PRISM noted that one of the leaked briefing documents said PRISM involves collection of data "directly from the servers" of several major internet services providers.[2][3]

Corporate executives of several companies identified in the leaked documents told The Guardian that they had no knowledge of the PRISM program in particular and also denied making information available to the government on the scale alleged by news reports.[3][111] Statements of several of the companies named in the leaked documents were reported by TechCrunch and The Washington Post as follows:[112][113]

In response to the technology companies' denials of the NSA being able to directly access the companies' servers, The New York Times reported that sources had stated the NSA was gathering the surveillance data from the companies using other technical means in response to court orders for specific sets of data.[18]The Washington Post suggested, "It is possible that the conflict between the PRISM slides and the company spokesmen is the result of imprecision on the part of the NSA author. In another classified report obtained by The Post, the arrangement is described as allowing 'collection managers [to send] content tasking instructions directly to equipment installed at company-controlled locations,' rather than directly to company servers."[2] "[I]n context, 'direct' is more likely to mean that the NSA is receiving data sent to them deliberately by the tech companies, as opposed to intercepting communications as they're transmitted to some other destination.[113]

"If these companies received an order under the FISA amendments act, they are forbidden by law from disclosing having received the order and disclosing any information about the order at all," Mark Rumold, staff attorney at the Electronic Frontier Foundation, told ABC News.[116]

On May 28, 2013, Google was ordered by United States District Court Judge Susan Illston to comply with a National Security Letter issued by the FBI to provide user data without a warrant.[117] Kurt Opsahl, a senior staff attorney at the Electronic Frontier Foundation, in an interview with VentureBeat said, "I certainly appreciate that Google put out a transparency report, but it appears that the transparency didn't include this. I wouldn't be surprised if they were subject to a gag order."[118]

The New York Times reported on June 7, 2013, that "Twitter declined to make it easier for the government. But other companies were more compliant, according to people briefed on the negotiations."[119] The other companies held discussions with national security personnel on how to make data available more efficiently and securely.[119] In some cases, these companies made modifications to their systems in support of the intelligence collection effort.[119] The dialogues have continued in recent months, as General Martin Dempsey, the chairman of the Joint Chiefs of Staff, has met with executives including those at Facebook, Microsoft, Google and Intel.[119] These details on the discussions provide insight into the disparity between initial descriptions of the government program including a training slide which states, "Collection directly from the servers"[120] and the companies' denials.[119]

While providing data in response to a legitimate FISA request approved by the FISA Court is a legal requirement, modifying systems to make it easier for the government to collect the data is not. This is why Twitter could legally decline to provide an enhanced mechanism for data transmission.[119] Other than Twitter, the companies were effectively asked to construct a locked mailbox and provide the key to the government, people briefed on the negotiations said.[119] Facebook, for instance, built such a system for requesting and sharing the information.[119] Google does not provide a lockbox system, but instead transmits required data by hand delivery or ssh.[121]

In response to the publicity surrounding media reports of data-sharing, several companies requested permission to reveal more public information about the nature and scope of information provided in response to National Security requests.

On June 14, 2013, Facebook reported that the U.S. government had authorized the communication of "about these numbers in aggregate, and as a range." In a press release posted to its web site, the company reported, "For the six months ending December 31, 2012, the total number of user-data requests Facebook received from any and all government entities in the U.S. (including local, state, and federal, and including criminal and national security-related requests) was between 9,000 and 10,000." The company further reported that the requests impacted "between 18,000 and 19,000" user accounts, a "tiny fraction of one percent" of more than 1.1 billion active user accounts.[122]

That same day, Microsoft reported that for the same period, it received "between 6,000 and 7,000 criminal and national security warrants, subpoenas and orders affecting between 31,000 and 32,000 consumer accounts from U.S. governmental entities (including local, state and federal)" which impacted "a tiny fraction of Microsoft's global customer base."[123]

Google issued a statement criticizing the requirement that data be reported in aggregated form, stating that lumping national security requests with criminal request data would be "a step backwards" from its previous, more detailed practices on its website's transparency report. The company said that it would continue to seek government permission to publish the number and extent of FISA requests.[124]

Cisco Systems saw a huge drop in export sales because of fears that the National Security Agency could be using backdoors in its products.[125]

On September 12, 2014, Yahoo! reported the U.S. Government threatened the imposition of $250,000 in fines per day if Yahoo didn't hand over user data as part of the NSA's PRISM program.[126] It is not known if other companies were threatened or fined for not providing data in response to a legitimate FISA requests.

The New York Times editorial board charged that the Obama administration "has now lost all credibility on this issue,"[127] and lamented that "for years, members of Congress ignored evidence that domestic intelligence-gathering had grown beyond their control, and, even now, few seem disturbed to learn that every detail about the public's calling and texting habits now reside in a N.S.A. database."[128] It wrote with respect to the FISA-Court in context of PRISM that it is "a perversion of the American justice system" when "judicial secrecy is coupled with a one-sided presentation of the issues."[129] According to the New York Times, "the result is a court whose reach is expanding far beyond its original mandate and without any substantive check."[129]

James Robertson, a former federal district judge based in Washington who served on the secret Foreign Intelligence Surveillance Act court for three years between 2002 and 2005 and who ruled against the Bush administration in the landmark Hamdan v. Rumsfeld case, said FISA court is independent but flawed because only the government's side is represented effectively in its deliberations. "Anyone who has been a judge will tell you a judge needs to hear both sides of a case," said James Robertson.[130] Without this judges do not benefit from adversarial debate. He suggested creating an advocate with security clearance who would argue against government filings.[131] Robertson questioned whether the secret FISA court should provide overall legal approval for the surveillance programs, saying the court "has turned into something like an administrative agency." Under the changes brought by the Foreign Intelligence Surveillance Act of 1978 Amendments Act of 2008, which expanded the US government's authority by forcing the court to approve entire surveillance systems and not just surveillance warrants as it previously handled, "the court is now approving programmatic surveillance. I don't think that is a judicial function."[130] Robertson also said he was "frankly stunned" by the New York Times report[79] that FISA court rulings had created a new body of law broadening the ability of the NSA to use its surveillance programs to target not only terrorists but suspects in cases involving espionage, cyberattacks and weapons of mass destruction.[130]

Former CIA analyst Valerie Plame Wilson and former U.S. diplomat Joseph Wilson, writing in an op-ed article published in The Guardian, said that "Prism and other NSA data-mining programs might indeed be very effective in hunting and capturing actual terrorists, but we don't have enough information as a society to make that decision."[132]

The Electronic Frontier Foundation (EFF), an international non-profit digital-rights group based in the U.S., is hosting a tool, by which an American resident can write to their government representatives regarding their opposition to mass spying.[133]

The Obama administration's argument that NSA surveillance programs such as PRISM and Boundless Informant had been necessary to prevent acts of terrorism was challenged by several parties. Ed Pilkington and Nicholas Watt of The Guardian said of the case of Najibullah Zazi, who had planned to bomb the New York City Subway, that interviews with involved parties and U.S. and British court documents indicated that the investigation into the case had actually been initiated in response to "conventional" surveillance methods such as "old-fashioned tip-offs" of the British intelligence services, rather than to leads produced by NSA surveillance.[134] Michael Daly of The Daily Beast stated that even though Tamerlan Tsarnaev, who conducted the Boston Marathon bombing with his brother Dzhokhar Tsarnaev, had visited the Al Qaeda-affiliated Inspire magazine website, and even though Russian intelligence officials had raised concerns with U.S. intelligence officials about Tamerlan Tsarnaev, PRISM did not prevent him from carrying out the Boston attacks. Daly observed that, "The problem is not just what the National Security Agency is gathering at the risk of our privacy but what it is apparently unable to monitor at the risk of our safety."[135]

Ron Paul, a former Republican member of Congress and prominent libertarian, thanked Snowden and Greenwald and denounced the mass surveillance as unhelpful and damaging, urging instead more transparency in U.S. government actions.[136] He called Congress "derelict in giving that much power to the government," and said that had he been elected president, he would have ordered searches only when there was probable cause of a crime having been committed, which he said was not how the PRISM program was being operated.[137]

New York Times columnist Thomas L. Friedman defended limited government surveillance programs intended to protect the American people from terrorist acts:

Yes, I worry about potential government abuse of privacy from a program designed to prevent another 9/11abuse that, so far, does not appear to have happened. But I worry even more about another 9/11. ... If there were another 9/11, I fear that 99 percent of Americans would tell their members of Congress: "Do whatever you need to do to, privacy be damned, just make sure this does not happen again." That is what I fear most. That is why I'll reluctantly, very reluctantly, trade off the government using data mining to look for suspicious patterns in phone numbers called and e-mail addressesand then have to go to a judge to get a warrant to actually look at the content under guidelines set by Congressto prevent a day where, out of fear, we give government a license to look at anyone, any e-mail, any phone call, anywhere, anytime.[138]

Political commentator David Brooks similarly cautioned that government data surveillance programs are a necessary evil: "if you don't have mass data sweeps, well, then these agencies are going to want to go back to the old-fashioned eavesdropping, which is a lot more intrusive."[139]

Conservative commentator Charles Krauthammer worried less about the legality of PRISM and other NSA surveillance tools than about the potential for their abuse without more stringent oversight. "The problem here is not constitutionality. ... We need a toughening of both congressional oversight and judicial review, perhaps even some independent outside scrutiny. Plus periodic legislative revisionsay, reauthorization every couple of yearsin light of the efficacy of the safeguards and the nature of the external threat. The object is not to abolish these vital programs. It's to fix them."[140]

In a blog post, David Simon, the creator of The Wire, compared the NSA's programs, including PRISM, to a 1980s effort by the City of Baltimore to add dialed number recorders to all pay phones to know which individuals were being called by the callers;[141] the city believed that drug traffickers were using pay phones and pagers, and a municipal judge allowed the city to place the recorders. The placement of the dialers formed the basis of the show's first season. Simon argued that the media attention regarding the NSA programs is a "faux scandal."[141][142] Simon had stated that many classes of people in American society had already faced constant government surveillance.

Political theorist, and frequent critic of U.S. government policies, Noam Chomsky argued, "Governments should not have this capacity. But governments will use whatever technology is available to them to combat their primary enemy which is their own population."[143]

A CNN/Opinion Research Corporation poll conducted June 11 through 13 found that 66% of Americans generally supported the program.[144][145][Notes 1] However, a Quinnipiac University poll conducted June 28 through July 8 found that 45% of registered voters think the surveillance programs have gone too far, with 40% saying they do not go far enough, compared to 25% saying they had gone too far and 63% saying not far enough in 2010.[146] Other polls have shown similar shifts in public opinion as revelations about the programs were leaked.[147][148]

In terms of economic impact, a study released in August by the Information Technology and Innovation Foundation[149] found that the disclosure of PRISM could cost the U.S. economy between $21.5 and $35 billion in lost cloud computing business over three years.[150][151][152][153]

Sentiment around the world was that of general displeasure upon learning the extent of world communication data mining. Some national leaders spoke against the NSA and some spoke against their own national surveillance. One national minister had scathing comments on the National Security Agency's data-mining program, citing Benjamin Franklin: "The more a society monitors, controls, and observes its citizens, the less free it is."[154] Some question if the costs of hunting terrorists now overshadows the loss of citizen privacy.[155][156]

Excerpt from:
PRISM (surveillance program) - Wikipedia, the free ...

National Security Agency

Earlier this week, a group calling itself the "Shadow Brokers" announced that it was selling a number of cyber weapons auction-style that it claimed were hacked and stolen from an alleged NSA hacking group dubbed "The Equation Group."

Beside the fact that the National Security Agency getting hacked is eyebrow-raising in itself, the leak of the data and the claim from this mystery group that it's just trying to make money doesn't seem to add up.

Here's why.

According to ex-NSA insiders who spoke with Business Insider, the agency's hackers don't just put their exploits and toolkits online where they can potentially be pilfered. The more likely scenario for where the data came from, says ex-NSA research scientist Dave Aitel, is an insider who downloaded it onto a USB stick.

Instead of a "hack," Aitel believes, it's much more likely that this was a more classic spy operation that involved human intelligence.

"This idea that a group of unknown hackers are going to take on the NSA seems unlikely as well," Aitel told Business Insider. "There's a long arm and a long memory to the US intelligence community, and I don't think anyone wants to be on the other end of that without good reason. I don't necessarily think a million bitcoin is a good-enough reason."

Paul Szoldra/Business Insider

One of the many strange things about this incident is the very public nature of what transpired. When a hacker takes over your computer, they don't start activating your webcam or running weird programs because you'd figure out pretty quickly that something was up and you'd try to get rid of them.

The same is true for the NSA.

If the Shadow Brokers owned the NSA's command and control server, then it would probably be a much better approach to just sit back, watch, and try to pivot to other interesting things that they might be able to find.

Instead, the group wrote on Pastebin, a website where you can store text, that "we follow Equation Group traffic. We find Equation Group source range. We hack Equation Group. We find many many Equation Group cyber weapons," which immediately signals to this alleged NSA hacker group that they have a big problem.

Though this seems problematic, it's probable that the group no longer has access to the server, so it no longer cares about getting back on it. Since the files are years old, this could be the case. But it's still out of the ordinary since any claim like this can be later investigated by the victim, which will be going through everything trying to figure out who they are.

If this was some random hacking group, then it would've been better to keep their mouth shut, especially when their victim is the NSA.

Software exploits are digital gold for hackers, since they often give a key inside a system or network that no one has ever noticed before, and thus, hasn't fixed. Which is why the marketplace for these "zero-day" exploits is so lucrative. We're talking hundreds of thousands to millions of dollars for this kind of code.

Most of the time, an exploit is either found by a security research firm, which then writes about it and reports it to the company so it can fix the problem. Or, a hacker looking for cash will take that found exploit and sell it on the black market.

So it would make sense for a group like Shadow Brokers to want to sell their treasure trove, but going public with it is beyond strange.

"From my perspective, its extremely bizarre behavior," an ex-NSA hacker who spoke on condition of anonymity told Business Insider. "Most groups who either identify or trade in exploits do one of two things. If you identify, like a security research firm [does] ... they'll typically publish their findings. They're really in the best interest of the companies and users who use these products."

The source added: "In the other scenarios, folks who sort of deal in the exploit markets. They quietly sell these things. To come out with this public auction is the more bizarre variance of that that I've ever seen. So it's not clear what the intent here is."

screenshot/The BBC

If you ask ex-NSA contractor Edward Snowden, the public leak and claims of the Shadow Brokers seem to have Russian fingerprints all over them, and it serves as a warning from Moscow to Washington. The message: If your policymakers keep blaming us for the DNC hack, then we can use this hack to implicate you in much more.

"That could have significant foreign policy consequences," Snowden wrote on Twitter. "Particularly if any of those operations targeted US allies. Particularly if any of those operations targeted elections."

Aitel seems to agree, though he criticized Snowden as being, at some level, a "voice piece" for Russian intelligence now, since he lives in asylum in Moscow.

"He has the same theory the DNC hack happened. The US political people got upset. They probably made the NSA do a covert response," Aitel speculated. "This is another response to the NSA's covert response. There's a lot of sort of very public messages here going back and forth, which is interesting to look at."

Aitel also doesn't think that anyone is going to actually pony up the money required to win the auction. And that prediction is probably going to be right, since WikiLeaks claims that it already has the archive.

"We had already obtained the archive of NSA cyber weapons released earlier today," its official Twitter account wrote, "and will release our own pristine copy in due course."

The Shadow Brokers did not respond to an emailed request for comment.

More:
The Shadow Brokers' NSA hack is extremely weird - Business ...

Strings of code were released to the Internet by a group calling themselves "the Shadow Brokers". They claim the code is a tool that can be used to hack into any computer. (Jhaan Elker/The Washington Post)

Some of the most powerful espionage tools created by the National Security Agencys elite group of hackers have been revealed in recent days, a development that could pose severe consequences for the spy agencys operations and the security of government and corporate computers.

A cache of hacking tools with code names such as Epicbanana, Buzzdirection and Egregiousblunder appeared mysteriously online over the weekend, setting the security world abuzz with speculation over whether the material was legitimate.

The file appeared to be real, according to former NSA personnel who worked in the agencys hacking division, known as Tailored Access Operations (TAO).

Without a doubt, theyre the keys to the kingdom, said one former TAO employee, who spoke on the condition of anonymity to discuss sensitive internal operations. The stuff youre talking about would undermine the security of a lot of major government and corporate networks both here and abroad.

Said a second former TAO hacker who saw the file: From what I saw, there was no doubt in my mind that it was legitimate.

[National Security Agency plans major reorganization]

The file contained 300 megabytes of information, including several exploits, or tools for taking control of firewalls in order to control a network, and a number of implants that might, for instance, exfiltrate or modify information.

The exploits are not run-of-the-mill tools to target everyday individuals. They are expensive software used to take over firewalls, such as Cisco and Fortinet, that are used in the largest and most critical commercial, educational and government agencies around the world, said Blake Darche, another former TAO operator and now head of security research at Area 1 Security.

The software apparently dates back to 2013 and appears to have been taken then, experts said, citing file creation dates, among other things.

Whats clear is that these are highly sophisticated and authentic hacking tools, said Oren Falkowitz, chief executive of Area 1 Security and another former TAO employee.

Several of the exploits were pieces of computer code that took advantage of zero-day or previously unknown flaws or vulnerabilities in firewalls, which appear to be unfixed to this day, said one of the former hackers.

The disclosure of the file means that at least one other party possibly another countrys spy agency has had access to the same hacking tools used by the NSA and could deploy them against organizations that are using vulnerable routers and firewalls. It might also see what the NSA is targeting and spying on. And now that the tools are public, as long as the flaws remain unpatched, other hackers can take advantage of them, too.

[Russian government hackers penetrated DNC, stole opposition research on Trump]

The NSA did not respond to requests for comment.

Faking this information would be monumentally difficult, there is just such a sheer volume of meaningful stuff, Nicholas Weaver, a computer security researcher at the University of California at Berkeley, said in an interview. Much of this code should never leave the NSA.

The tools were posted by a group calling itself the Shadow Brokers using file-sharing sites such as BitTorrent and DropBox.

As is typical in such cases, the true identity of whoever put the tools online remains hidden. Attached to the cache was an auction note that purported to be selling a second set of tools to the highest bidder: !!! Attention government sponsors of cyber warfare and those who profit from it !!!! How much you pay for enemies cyber weapons?

The group also said that if the auction raised 1 million bitcoins equivalent to roughly $500million it would release the second file to the world.

The auction is a joke, Weaver said. Its designed to distract. Its total nonsense. He said that bitcoin is so traceable that a Doctor Evil scheme of laundering $1 million, let alone $500 million, is frankly lunacy.

One of the former TAO operators said he suspected that whoever found the tools doesnt have everything. The stuff they have there is super-duper interesting, but it is by far not the most interesting stuff in the tool set, he said. If you had the rest of it, youd be leading off with that, because youd be commanding a much higher rate.

TAO, a secretive unit that helped craft the digital weapon known as Stuxnet, has grown in the past decade or so from several hundred to more than 2,000 personnel at the NSAs Fort Meade, Md., headquarters. The group dates to the early 1990s. Its moniker, Tailored Access Organization, suggests a precision of technique that some officials have likened to brain surgery. Its name also reflects how coding whizzes create exquisite tools from scratch, in the same way a fine tailor takes a bolt of wool and fashions a bespoke suit only the computer geeks more often work in jeans and T-shirts. We break out the Nerf guns and have epic Nerf gun fights, one of the former hackers said.

Some former agency employees suspect that the leak was the result of a mistake by an NSA operator, rather than a successful hack by a foreign government of the agencys infrastructure.

When NSA personnel hack foreign computers, they dont move directly from their own covert systems to the targets, fearing that the attack would be too easy to trace. They use a form of proxy server called a redirector that masks the hackers origin. They use one or more such servers to make it difficult to trace a hack.

NSA is often lurking undetected for years on the ... [proxy hops] of state hackers, former agency contractor Edward Snowden tweeted Tuesday. This is how we follow their operations.

[Edward Snowden, the brand]

At the same time, other spy services, like Russias, are doing the same thing to the United States.

It is not unprecedented for a TAO operator to accidentally upload a large file of tools to a redirector, one of the former employees said. Whats unprecedented is to not realize you made a mistake, he said. You would recognize, Oops, I uploaded that set and delete it.

Critics of the NSA have suspected that the agency, when it discovers a software vulnerability, frequently does not disclose it, thereby putting at risk the cybersecurity of anyone using that product. The file disclosure shows why its important to tell software-makers when flaws are detected, rather than keeping them secret, one of the former agency employees said, because now the information is public, available for anyone to employ to hack widely used Internet infrastructure.

Snowden, Weaver and some of the former NSA hackers say they suspect Russian involvement in the release of the cache, though no one has offered hard evidence. They say the timing in the wake of high-profile disclosures of Russian government hacking of the Democratic National Committee and other party organizations is notable.

Tweeted Snowden: Circumstantial evidence and conventional wisdom indicates Russian responsibility. He said that the disclosure is likely a warning that someone can prove U.S. responsibility for any attacks that originated from this redirector or malware server by linking it to the NSA.

This could have significant foreign policy consequences, he said in another tweet. Particularly if any of those operations targeted U.S. allies or their elections.

Accordingly, he tweeted, this may be an effort to influence the calculus of decision-makers wondering how sharply to respond to the DNC hacks.

In other words, he tweeted, it looks like somebody sending a message that retaliating against Russia for its hacks of the political organizations could get messy fast.

Read more:

WikiLeaks, NSA leaker Edward Snowden clash on Twitter

The NSAs phone records program is over. That doesnt mean the data it collected is gone.

In a major cyber-hack, whom do you call? The White House spells it out.

Read the original here:
Powerful NSA hacking tools have been revealed online - The ...