IT community Sounding Alarm, finally

[Guest guest]

ROBERT X. CRINGELY

http://www.infoworld.com/

 

Posted May 19,2006

 

So it turns out that hacking a Diebold touchscreen

voting machine is

just

slightly harder than opening a box of Cracker Jack and

stealing the

prize inside. All you need is a PC Card, a little

know-how, and a few

minutes alone with the machine to change how it counts

votes. A Diebold

spokesbot said such a hack would require election

officials to be " evil

and nefarious " -- and, of course, such people simply

don't exist. So

everything's hunky-dory. Isn't it great to live in

country where anyone

can grow up to fix an election?

 

--- ---

 

Opinion:

 

Why NSA spying puts the U.S. in danger

Ira Winkler

 

May 16, 2006 (Computerworld)

 

As a former NSA analyst, I'm dismayed by the

continuing revelations of the National Security

Agency's warrantless -- and therefore illegal --

spying. The case involves fundamental issues related

to NSA’s missions and long-standing rules of

engagement. What's even more dismaying is the lack of

public reaction to this.

 

Fundamentally, this is an issue of law. FISA, the

Foreign Intelligence Surveillance Act, was established

in 1978 to address a wide variety of issues revolving

around Watergate, during which a president used

foreign intelligence agencies to collect data on U.S.

citizens. As part of FISA, the NSA has to get

warrants to analyze and maintain collections of data

involving U.S. citizens. FISA has withstood all tests

until now, and it involves a fundamental aspect of the

U.S. Constitution -- its system of checks and

balances.

 

The FISA law allows NSA to request those warrants up

to 72 hours after the fact -- that is, after the data

has been analyzed. And lest you think that the courts

from which such warrants are requested are staffed by

a bunch of liberal, activist, criminal-coddling

judges, they have reportedly turned down only five

warrants in the last 28 years. So when President Bush

says, " If Osama bin Laden is calling someone in the

United States, we want to know about it, " followed by

his nervous laugh, he's laughing at the American

public, since " knowing about it " is a totally

irrelevant issue. FISA blocks no legitimate

acquisition of knowledge.

 

It doesn't even slow the process down. The issue is

not that the NSA cannot examine calls into the U.S.

from terrorist suspects -- FISA provides for that --

but that the agency must justify acting on the results

and keeping the information within 72 hours. The

president claims that the process of getting those

warrants -- of complying with the law -- is too

time-consuming. Normally, that would sound like

simple laziness, but the reality is that the program

is so large that they would need an army of lawyers to

get all the warrants they'd need to be in compliance

with FISA. But the law is the law. No president has

the right to pick and choose which laws they find

convenient to follow.

 

If Bush didn’t like the FISA laws, he could have asked

Congress to amend them. After all, after 9/11

Congress passed a wide variety of laws (without, for

the most part, reading them) that were supposed to

prevent another attack. They could have easily

slipped something modifying FISA into all of that

legislation. They did not, though recent revelations

about this administration's use of signing statements

may indicate that they simply didn't want to raise the

possibility of questions.

 

Ignoring FISA's rules concerning warrants is illegal.

It also weakens national security, since the process

of obtaining the warrants has an effect on quality

control. To date, FBI agents have been sent out to do

thousands of investigations based on this warrantless

wiretapping. None of those investigations turned up a

legitimate lead. I have spoken to about a dozen

agents, and they all roll their eyes and indicate

disgust with the man-years of wasted effort being put

into physically examining NSA " leads. "

 

This scattershot attempt at data mining drags FBI

agents away from real investigations, while destroying

the NSA’s credibility in the eyes of law enforcement

and the public in general. That loss of credibility

makes the NSA the agency that cried wolf -- and after

so many false leads, should they provide something

useful, the data will be looked at skeptically and

perhaps given lower priority by law enforcement than

it would otherwise have been given.

 

Worse, FBI agents working real and pressing

investigations such as organized crime, child

pornography and missing persons are being pulled away

from their normal law enforcement duties to follow up

on NSA leads. Nobody wants another 9/11, of course,

but we experience real crimes on a daily basis that,

over the course of even one year, cause far greater

loss of life and damage than the 9/11 attacks did.

There are children abused on a daily basis to

facilitate online child pornography, yet I know of at

least two agents who were pulled from their duties

tracking down child abusers to investigate everyone

who called the same pizza parlor as a person who

received a call from a person who received an overseas

call. There are plenty of similar examples.

 

We have snakes in our midst, yet we are chasing a

mythical beast with completely unreliable evidence.

 

And now we discover that the NSA is searching through

every possible phone call made in the U.S.. They

claim that the NSA is not receiving any personally

identifying information. Frankly, you have to be a

complete moron to believe that. It is trivial to

narrow down access to a phone number to just a few

members of a household, if not in fact to exactly one

person.

 

The government claims that it got the information

legally since it was given the data or bought it from

the telecom companies. Perhaps, but USA Today reports

that at least one company (Qwest) received threats

from the U.S. government for not cooperating. That’s

extortion -- another crime.

 

Congress is not exercising any backbone at all, and

neither are its constituents -- a.k.a., you. Every

time we receive new information about the NSA domestic

spying program, it gets exponentially worse, and it's

clear that we still have no clue as to the full extent

of the program. More importantly, the courts and

Congress do not appear to have a clue as to the full

extent of the program, and those bodies are

constitutionally required to exercise checks and

balances over the NSA. The actions taken by the

executive branch after 9/11 aren't protecting our

freedom. They are usurping it.

 

So, besides knowing that it's illegal, that is

provides useless information, that it takes law

enforcement agents away from investigating and

preventing crimes actually being committed, and that

it erodes civil liberties, we have no clue how bad it

really is. The arguments I hear for it are that 1) I

have nothing to worry about so I don’t care if they

investigate me, 2) we need to do everything we can to

protect ourselves, or 3) the NSA isn't listening to

the content of the calls, so there's no harm.

 

Addressing the first point, people who did nothing

wrong have been investigated and jailed in this

country and others over the years. Additionally, I

believe that Saddam Hussein would cheerfully agree

with the tired allegation that if you did nothing

wrong, you shouldn’t mind the government looking at

your calls. I think Lenin, Stalin, Hitler and the

Chinese government would also agree with that line of

thought. Is this the company we consent to keep in

the name of safety?

 

To doing everything we can to protect ourselves, we

have, again, pulled law enforcement agents away from

real ongoing crimes to investigate poor and scattered

" intelligence. " This definition of " protection, "

again, leaves us watching for dragons while very real

snakes multiply freely in our midst.

 

And so what if the NSA isn't listening to the calls

themselves? An intelligence agency doesn’t need to

hear your chatter to invade your privacy. By simply

tying numbers together -- an intelligence discipline

of traffic analysis -- I assure you I can put together

a portrait of your life. I'll know your friends, your

hobbies, where your children go to school, if you’re

having an affair, whether you plan to take a trip and

even when you're awake or asleep. Give me a list of

whom you’re calling and I can tell most of the

critical things I need to know about you.

 

Unnerved at the prospect of one person holding that

data? You should be. While I can personally attest to

the fact that the vast majority of NSA employees are

good and honest people, the NSA has more than its

share of bitter, vindictive mid- and senior-level

bureaucrats. I would not trust my personal

information with these people, since I have personally

seen them use internal information against their

enemies.

 

At the same time, we have seen the Bush administration

go after Joesph Wilson, the ambassador who spoke out

against the Bush administration, by leaking

potentially classified information about him. They

vigorously tried to undermine the credibility of

Richard Clarke and others who spoke out against them.

Now consider that the NSA telephone call database is

not classified; there's no legal reason that they

can't use this database as vindictively as they did,

even when the data was potentially classified, as in

releasing the information that Valerie Plame, Wilson’s

wife, worked for the CIA.

 

Over the years, I have defended the NSA and its

employees as reasonable and law abiding. I was all

for invading Afghanistan, deployment of the Clipper

Chip and many other controversial government programs.

NSA domestic spying is against everything I was ever

taught working at the NSA. I might be more for it if

there was any credible evidence that this somehow

provides useful information that couldn’t otherwise be

had. However, the domestic spying program has gotten

so massive that the well-established process of

getting a warrant cannot be followed -- and quantity

most certainly doesn't translate to quality. Quite the

opposite.

 

 

Again, I'm not arguing against allowing the NSA or

other intelligence agencies to collect information on

terrorists. My problem is that they are bypassing

legally required oversight mechanisms. This implies

that the operations are massive, and go well beyond

the scope of looking at terrorists. Not only is this

diminishing what makes America unique and worth

preserving, it removes all quality control and puts

the country at increased risks by moving resources

away from critical investigations of more substantial

threats.

 

I think Sen. Jon Kyl, a strong supporter of the NSA

domestic spying program, said it best: " We have got to

collect intelligence on the enemy. " I fully agree.

But the enemy numbers in the hundreds at best. the NSA

is collecting data on hundreds of millions of people

who are clearly not the enemy. These numbers speak

for themselves.

 

Ira Winkler is president of the Internet Security

Advisors Group. He is a former National Security

Agency analyst and the author of Spies Among Us

(Wiley, 2005).

 

© 2006 Computerworld Inc.