Category Archives: Choke Point

Who is hosting the Hacker’s Servers?

Posted on by

State report reveal 130 compromised websites used in travel-related watering hole attacks

By Bill Gertz

One hundred thirty websites are hosting malicious software on their websites in what the State Department is calling a sophisticated Russian cyber spying operation, according to security analysts.
“These websites include news services, foreign embassies and local businesses that were compromised by threat actors to serve as ‘watering holes,’” according to a report by the Overseas Security Advisory Council distributed this week. A watering hole is a hijacked website used by cyber attackers to deliver malware to unsuspecting victims.
“For example, users may navigate to one of these malicious sites with the intent of checking travel requirements or the status of a visa application and unknowingly download the embedded malware onto their computers,” the report said.
The report identified the locations of the compromised websites as the United States, South America, Europe, Asia, India and Australia.
The report appears to indicate Russian intelligence may be behind the operations. Also, none of the compromised websites are in China, an indication that Beijing’s hackers could be involved.
A total of 15 of the 130 websites used for watering holes were government embassy websites located in Washington, DC, and two were involved in passport and visa services and others are offering travel services.
The embassy targeting suggests some or all of the operations are linked to foreign intelligence services that are breaking into the networks as part of tracking and monitoring of foreign travel.
Another possibility is that the operation are part of information warfare efforts designed to influence policies and publics. Both Russia and China are engaged in significant strategic information operations targeting foreign governments and the private sector.
“The threat actors are likely attempting to gather information from entities with vested interests in international operations,” the report said. “Identified victims in this sector include embassies, defense industrial base groups, and think tanks.”
The report, based on data provided by the security firm iSight Partners, says the watering holes are likely part of cyber espionage operations.
“Analysis indicates this campaign has a global reach, continuing to target users of identified intelligence value long after the initial infection,” the report says.
The compromised websites are increasingly functioning as indirect malicious software attack tools. The compromised sites represent a different method than widely used spear phishing – the use of emails to trigger malicious software downloads.
“Rather than send a malicious email directly to a target of interest, threat actors research and compromise a high-traffic website that will likely be visited by numerous targets of interest,” the report said.
“Watering holes are effective, as they often exploit existing vulnerabilities on a user’s machine,” the report said. More sophisticated threat actors have been observed employing zero-day exploits – those which are previously unknown and evade antivirus and intrusion detection systems (IDS) to successfully compromise victims. Zero-days were used in the widely publicized Forbes.com watering hole in late 2014.”
The hijacked websites appear to be part of a campaign spanning 26 upper-level Internet domains and include affiliations with 21 nations and the European Union.
According to iSight, evidence suggests the campaign is “likely tied to cyber espionage operations with a nexus to the Russian Federation.”
The compromised government websites included those from Afghanistan, Iraq, Jordan, Namibia, Qatar and Zambia. The report recommended not visiting any of those embassy websites or risk being infected with malware.
Technically, the attackers arranged for computer users who visited the compromised websites to be infected with an embedded JavaScript that redirected users to a Google-shortened URL, and then on to websites the mapped their computer systems. This “profiling” is used by cyber spies to identify valuable targets and control that specific victims who are injected with a malware payload.
The profiling is used to identify targets that will produce “high intelligence value” returns, indicating sophisticated cyber spies are involved. The infection also employed a technique called the use of “evercookie” a derivative of the small files that are inserted on computers and can be used by remote servers to tailor information, such as advertisements, to specific user.
While normal cookies can be easily removed, evercookies store data in multiple locations, a method that makes them extremely difficult to find and removed. The use of evercookies also permits long-term exploitation by cyber attackers.
To counter watering hole attacks, users should make sure system and software security updates are applied, and avoid visiting suspicious websites.
In particular, network monitoring should be used to spot unusual activities, specifically geared toward attacks that exploit zero-day vulnerabilities.
“The threat of watering holes is likely to remain high, given their increasing popularity and success in the last year,” the report said.
The report, “Compromised Global Websites Target Unsuspecting Travelers,” was produced by OSAC’s Research & Information Support Center (RISC). It is available for OSAC members at osac.gov. *** But there is more.

SAN FRANCISCO (Reuters) – Hacking attacks that destroy rather than steal data or that manipulate equipment are far more prevalent than widely believed, according to a survey of critical infrastructure organizations throughout North and South America.

The poll by the Organization of American States, released on Tuesday, found that 40 percent of respondents had battled attempts to shut down their computer networks, 44 percent had dealt with bids to delete files and 54 percent had encountered “attempts to manipulate” their equipment through a control system.

Those figures are all the more remarkable because only 60 percent of the 575 respondents said they had detected any attempts to steal data, long considered the predominant hacking goal.

By far the best known destructive hacking attack on U.S. soil was the electronic assault last year on Sony Corp’s Sony Pictures Entertainment, which wiped data from the Hollywood fixture’s machines and rendered some of its internal networks inoperable.

The outcry over that breach, joined by President Barack Obama, heightened the perception that such destruction was an unusual extreme, albeit one that has been anticipated for years.

Destruction of data presents little technical challenge compared with penetrating a network, so the infrequency of publicized incidents has often been ascribed to a lack of motive for attackers.

Now that hacking tools are being spread more widely, however, more criminals, activists, spies and business rivals are experimenting with such methods.

“Everyone got outraged over Sony, but far more vulnerable are these services we depend on day to day,” said Adam Blackwell, secretary of multidimensional security at the Washington, D.C.-based group of 35 nations.

The survey went to companies and agencies in crucial sectors as defined by the OAS members. Almost a third of the respondents were public entities, with communications, security and finance being the most heavily represented industries.

The questions did not delve into detail, leaving the amount of typical losses from breaches and the motivations of suspected attackers as matters for speculation. The survey-takers were not asked whether the attempted hacks succeeded, and some attacks could have been carried off without their knowledge.

The survey did allow anonymous participants to provide a narrative of key events if they chose, although those will not be published.

Blackwell told Reuters that one story of destruction involved a financial institution. Hackers stole money from accounts and then deleted records to make it difficult to reconstruct which customers were entitled to what funds.

“That was a really important component” of the attack, Blackwell said.

In another case, thieves manipulated equipment in order to divert resources from a company in the petroleum industry.

Blackwell said that flat security budgets and uneven government involvement could mean that criminal thefts of resources, such as power, could force blackouts or other safety threats.

At security company Trend Micro Inc. , which compiled the report for the OAS, Chief Cybersecurity Officer Tom Kellermann said additional destructive or physical attacks came from political activists and organized crime groups.

“We are facing a clear and present danger where we have non-state actors willing to destroy things,” he said. “This is going to be the year we suffer a catastrophe in the hemisphere, and when you will see kinetic response to a threat actor.”

So-called “ransomware,” which encrypts data files and demands payment be sent to remote hackers, could also have been interpreted as destructive, since it often leaves information unrecoverable.

A spokesman for the U.S. Department of Homeland Security, SY Lee, said the department did not keep statistics on how often critical U.S. institutions are attacked or see destructive software and would not “speculate” on whether 4 out of 10 seeing deletion attempts would be alarming.

U.S. political leaders cite attacks on critical infrastructure as one of their greatest fears, and concerns about protecting essential manufacturers and service providers drove a recent executive order and proposed legislation to encourage greater information-sharing about threats between the private sector and government.

Yet actual destructive attacks or manipulation of equipment are infrequently revealed. That is in part because breach-disclosure laws in more than 40 states center on the potential risks to consumers from the theft of personal information, as with hacks of retailers including Home Depot Inc and Target Corp.

Under Securities and Exchange Commission guidelines, publicly traded companies must disclose breaches with a potential material financial impact, but many corporations can argue that even deletion of internal databases, theft and manipulation of equipment are not material.

Much more is occurring at vital facilities behind the scenes, and that is borne out by the OAS report, said Chris Blask, who chairs the public-private Information Sharing and Analysis Center for cybersecurity issues with the industrial control systems that automate power, manufacturing and other processes.

“I don’t think the public has any appreciation for the scale of attacks against industrial systems,” Blask said. “This happens all the time.”

 

Hacking, the Cheap Nuke Against France

Posted on by

The widespread global hacking goes unreported both by the victim and by the media. The depths of destruction are not only hard to measure but identifying the hack is just as difficult.

When hacking is visual for all the world to see, it becomes an epic event and more is expected. Hacking is dark, cheap, highly targeted and often leaves only traces that a full team of experts must investigate for months to find. Ask France.

ISIL carries out ‘unprecedented’ hack of French TV network

PARIS // French television network TV5Monde was forced to broadcast only pre-recorded programmes on Thursday after an “unprecedented” hack by self-proclaimed ISIL militants, who also hijacked its websites and social networks.

The Paris-based company, whose programmes are broadcast in more than 200 countries worldwide, was the target of a cyberattack that is “unprecedented for us and unprecedented in the history of television,” TV5Monde boss Yves Bigot said.

“Since 5:00am, we have only been able to put out a single programme on all our channels. For the moment, we are unable to produce our own programmes. We won’t be back up until 2pm,” Mr Bigot added.

“When you work in television… and you find out that your 11 channels are down, of course that’s one of the most dreadful things that can happen to you,” he said.

The hackers took control of the station and its social media operations late Wednesday, blacking out the TV channels and posting documents on its Facebook page purporting to be the identity cards and CVs of relatives of French soldiers involved in anti-ISIIL operations, along with threats against the troops.

“Soldiers of France, stay away from the Islamic State! You have the chance to save your families, take advantage of it,” read one message on TV5Monde’s Facebook page. “The CyberCaliphate continues its cyberjihad against the enemies of Islamic State,” the message added.

TV5Monde regained control of its social networks by 2:00am on Thursday but television broadcasts were likely to take hours, if not days, to return to normal. The attack would have required weeks of preparation, Mr Bigot added.

Its website was still offline at 11am and displaying an “under maintenance” message.

Prime minister Manuel Valls said the hack was an “unacceptable attack on the freedom of information and expression”, voicing “total solidarity with the editorial staff.”

Senior government members flocked to the station to show their support, with interior minister Bernard Cazeneuve saying: “We are up against determined terrorists … we are determined to fight them.”

Foreign minister Laurent Fabius said: “Everything is being done to find those who carried this out, punish them, re-establish the programmes and prevent cyberterrorists threatening freedom of expression in the future.”

The hackers had accused French president Francois Hollande of committing “an unforgivable mistake” by getting involved in “a war that serves no purpose”.

“That’s why the French received the gifts of Charlie Hebdo and Hyper Cacher in January,” it said on the broadcaster’s Facebook page, referring to attacks by gunmen in Paris on the satirical magazine and Jewish supermarket that left 17 people dead over three days.

France is part of a US-led military coalition carrying out air strikes against ISIL in Iraq and Syria, where the jihadist group has seized swathes of territory and declared a “caliphate”.

Close to 1,500 French nationals have left France to join the militants’ ranks in Iraq and Syria, where they represent almost half the number of European fighters present, according to a report released last Wednesday by the French Senate.

Extremists have become increasingly adept at using the internet to spread propaganda and attack media outlets.

In February, the Twitter feed of Newsweek was briefly hacked and threats were made against president Barack Obama’s family.

And in the immediate aftermath of the Charlie Hebdo attacks, hackers claiming to be Islamists hijacked hundreds of French websites, flooding them with militant propaganda.

“We are putting out an emergency programme so that we’re not left with a black screen. We don’t have emails. The whole IT system is down,” TV5Monde’s human resources director, Jean Corneil, said.

There is California and then the Rest of the Country

Posted on by
by Kevin D. Williamson
California’s drought provides a useful lesson. I am glad California is having a drought. Not because I hate California (I love California) or Californians (I hate them only a little, for what they’ve done to California) or Central Valley farmers (some of my best friends . . .) or even Governor Jerry Brown, droll disco-era anachronism that he is, but because the episode presents an excellent illustration of the one fundamental social reality that cannot be legislated away or buried under an avalanche of government-accounting shenanigans and loan guarantees or brought to heel by politicians no matter how hard the ladies and gentlemen in Sacramento and Washington stamp their little feet: scarcity.
California has X amount of water at its disposal, and it has politicians in charge of overseeing how it gets divvied up. Which politicians? The same ones responsible for the current sorry state of California’s water infrastructure, of course. Should be a hoot.
The main claimants are these: Farmers, who by some estimates consume about 80 percent of the water used in California. Agriculture is a relatively small component of California’s large and diverse economy, but California nonetheless accounts for a large share of the nation’s agricultural output. Both of those things are, in a sense, the good news: If market-rate water costs were imposed on California farms, as they should be, then any higher costs could be passed along — not only to consumers, but up and down the supply chain — in a very large global market, where they should be digested more easily. People with lawns, including people with the very large and complex lawns known as golf courses, who account for an extraordinary amount of California’s non-agricultural water use.
In arid Southern California, and especially in the golf-loving desert resort communities of the Coachella Valley, keeping the grass green often accounts for more than half — and sometimes much more than half — of residential water use. How thirsty is grass? Consider that 200 square feet of California swimming pool uses less water over the course of three years than does 200 square feet of California lawn. (Yes, I know: volume versus surface area, but the math still works out.) And about half of the water used on lawns is lost to the wind, because sprinkler systems spray water in the air rather than on the grass. The goddamned delta smelt, a.k.a. “the world’s most useless fish,” whose comfort and happiness demanded the dumping of some 300 billion gallons of fresh water into the San Francisco Bay — and thence into the Pacific Ocean — in 2009 and 2010. That’s enough fresh water to cover the state of New Jersey nearly three inches deep. The smelt’s delicious friend, the salmon, is a co-claimant.
Governor Brown’s response is a textbook example of the central planner’s fatal conceit. He issued an executive order imposing 25 percent cuts on the state’s 400 local water agencies, which supply about 90 percent of Californians’ water but do not supply the farms that consume most of the state’s water. That 25 percent figure looks bold and authoritative, but when was the last time you saw the production, consumption, or price of a scarce commodity in the real world move by such neat increments?
When something disturbs the equilibrium of the world’s oil markets — which happens every single day — then the markets make minuscule, complex adjustments, and continue to make them around the clock — the markets never sleep — with producers and consumers both modifying their behaviors to accommodate the new economic realities as they emerge. Amazingly (but not amazingly), this happens with no Governor Brown in charge of the process. You’ve never seen the price of pork bellies or soybeans simply jump 25 percent and stay there indefinitely, or rice or wheat consumption fall by neat round numbers. But Governor Brown imagines that he can rationally manage by fiat the consumption of the most important commodity in the world’s seventh-largest economy. Good luck with that. Governor Brown’s solution/non-solution has been criticized for failing to impose serious new restrictions on farmers. There are several reasons for this: First, Governor Brown probably does not want to reinforce the impression that his administration is an instantiation of insular coastal soy-latte progressivism staffed by feckless urbanites of the sort who believe that grapes come from Trader Joe’s and who are therefore willing to see the state’s rural interior gutted; second, and to give a decent if often foolish man proper credit, Governor Brown probably is not much inclined to impose heavy new burdens on the state’s relatively poor and downwardly mobile agricultural corridor, and to see large numbers of the poorest Californians thrown out of work; third, farmers already have seen their water allowances docked.
Among tragedies of the commons, California’s water situation is Hamlet, a monumental work fascinating for all of the possibilities it raises and not given to easy resolution. But even given the underlying complications, from the hydrological to the legal (California’s system of water rights is remarkably complex), the fundamental problem is that nobody knows what a gallon of water in California costs. Water allocations are made mainly through politics rather than through markets, with the state’s legal regime explicitly privileging some water uses over others. There are two possible ways to allocate water in California: The people in Sacramento, Governor Brown prominent among them, can pick and choose who gets what, with all of the political shenanigans, cronyism, inefficiency, and corruption that brings. Or Californians can get their water the same way they get most everything else they need and value: by buying it on the open market.
This is an excellent opportunity to apply the cap-and-trade model that many progressives favor when it comes to carbon dioxide emissions, with an important difference: This deals with real, physical scarcity, not artificial scarcity created by regulation. (Incidentally, it here bears repeating that notwithstanding the inaccurate proclamations of Governor Brown and President Obama, California’s drought almost certainly is not the result of global warming; the climate models supporting the scientific consensus on global warming predict wetter winters for California, not the drier winters that have produced the current crisis. California’s climate is complex, but a great deal of it is dominated by desert and arid to semi-arid Mediterranean conditions.)

As the economist Alex Tabarrok puts it: “California has plenty of water — just not enough to satisfy every possible use of water that people can imagine when the price is close to zero.” As noted, the water-rights picture is complicated, but it is not so complicated that California could not 1) calculate how much water is available for consumption; 2) subtract preexisting claims; 3) auction off the remainder, with holders of preexisting water rights allowed to enter that market and trade their claims for money.
A gallon of water used to green up a lawn in Burbank and a gallon of water used to maintain a golf course in Palm Springs and a gallon of water used to irrigate almonds in Chico would be — and should be — on exactly the same economic and political footing. As Professor Tabarrok notes, San Diego residents use about twice as much water per capita as do residents of Sydney, a city whose climate is comparably arid and whose residents are comparably well-off, a situation that is almost certainly related to the fact that San Diegans pay about one half of a cent per gallon for household water. Governor Brown wants to be the man who decides what is and is not a good use of California’s water; in defending his decision not to impose further restrictions on farmers, he said: “They’re not watering their lawn or taking long showers. They’re providing most of the fruits and vegetables of America and a significant part of the world.” That is no doubt true. But the only way to discover what that is really worth — not in sentimental, good-enough-for-government-work terms, but in cold-eyed dollar terms — is to allow real prices for water to emerge. My own suspicion is that California’s almonds and avocados will remain in high demand when the water used in their cultivation is properly priced on an open market. Relatively small gains in the efficiency of agricultural irrigation would go a long way toward helping California live with the water it has. So would converting a few million suburban lawns to desert landscaping. So would ceasing to dedicate large amounts of fresh water to political projects of dubious value. Which to choose? Before that question can be answered, there is the prior question: “How to choose who chooses?” The rational answer is that water consumers should choose how water gets used, provided that each of them pays the real price for his choices. California’s largest crop is grass — by which I do not mean marijuana, but lawns. Until the day comes when a ton of fresh-cut grass fetches a higher price than a ton of avocados, my guess is that California’s farmers will do fine under a market-based water regime. But maybe not. Everyone has his own favorite drought bugaboo: suburban lawns, almond farms, the delta smelt, golf courses, illegal marijuana cultivation, etc.
Given enough time, somebody will figure out a way to blame this all on the Koch brothers, illegal immigrants, or the Federal Reserve. But the fact is that nobody knows — nobody can know — what the best use of any given gallon of water in California is. Californians can put their money where their parched mouths are, or they can let Governor Brown play Ceres-on-the-Bay, deciding which crops grow and which do not. Whether the commodity is water or education or health care, if you care about something, put a price tag on it. You can’t afford for it to be cheap, and you sure as hell can’t afford for it to be free.*** Now look at the legislative issues in your state to determine what similar actions are being taken. While you’re at it, how does your state compare to the others fiscally?

States across the U.S. share the common goal of economic prosperity, but they differ vastly in how they set out to achieve it. The latest edition of the American Legislative Exchange Council- Arthur Laffer Rich States, Poor States competitiveness index examines policies that maximize economic growth and assesses which states are on the path to prosperity and which are more likely headed to the poorhouse.
For the eighth consecutive year, Utah has remained #1. Rounding out the top 10 for 2014 are: North Dakota, Indiana, North Carolina, Arizona, Idaho, Georgia, Wyoming, South Dakota and Nevada. At the other end of the spectrum, New York obtained the lowest ranking at #50. Working backward, Vermont ranked 49, preceded by Minnesota, Connecticut, New Jersey, Oregon, California, Montana, Maine, and Pennsylvania.

 states Alec

The rankings are a combination of past economic performance (economic growth, net migration and employment) and forward-looking policy variables such as taxes, debt, and the presence of right-to-work laws.

States at the top earned their rankings by implementing policies that energized their economies, attracted businesses and entrepreneurs, and expanded employment and income. So what are these energizing policies that could help states at the bottom boost their economies? Based on both past and present rankings, low income taxes and right-to-work laws provide the most bang for the buck.

Analysis provided alongside last year’s rankings showed economic growth in the nine states with no personal income tax averaged 62 percent from 2003 to 2013 while the nine highest income tax states grew by an average of only 47 percent. And states with no income tax experienced twice the rate of population growth (14 percent) as the highest income tax states (7 percent).

The growth gap between high-tax and low-tax states translates into more than a $100 billion in lost annual output for big, bottom-ranking states like California (#44) and New York (#50). And while it may seem counterintuitive, tax revenue increased substantially more in the nine states with no income tax than it did in the highest income tax states. Lower taxes produce a larger economic pie, and a larger pie means bigger slices for all—including the state tax revenue.

States with right-to-work laws that prevent workers from being coerced to pay union dues attract more businesses and workers, which in turn grow their economies. Compared to forced-union states, right-to-work states experienced twice the rate of employment growth from 2003–2013, one-quarter higher income growth, and one-third greater output growth. What’s more, right-to-work states experienced a 3 percent increase in net migration, while forced-union states suffered a 1 percent loss in net migration.

Competition is inherent in any ranking, and competition among the states is a good thing. Fortunately for states at the bottom of the rankings, research and analysis such as Rich States, Poor States provides an open playbook for prosperity.

Tracking Phone Calls Long Before the Patriot Act

Posted on by

U.S. secretly tracked billions of phone calls for decades

Starting in 1992, the Justice Department amassed logs of virtually all telephone calls from the USA to as many as 116 countries, a model for anti-terror surveillance after Sept. 11, 2001.

WASHINGTON — The U.S. government started keeping secret records of Americans’ international telephone calls nearly a decade before the Sept. 11 terrorist attacks, harvesting billions of calls in a program that provided a blueprint for the far broader National Security Agency surveillance that followed.

For more than two decades, the Justice Department and the Drug Enforcement Administration amassed logs of virtually all telephone calls from the USA to as many as 116 countries linked to drug trafficking, current and former officials involved with the operation said. The targeted countries changed over time but included Canada, Mexico and most of Central and South America.

Federal investigators used the call records to track drug cartels’ distribution networks in the USA, allowing agents to detect previously unknown trafficking rings and money handlers. They also used the records to help rule out foreign ties to the bombing in 1995 of a federal building in Oklahoma City and to identify U.S. suspects in a wide range of other investigations.

The Justice Department revealed in January that the DEA had collected data about calls to “designated foreign countries.” But the history and vast scale of that operation have not been disclosed until now.

The now-discontinued operation, carried out by the DEA’s intelligence arm, was the government’s first known effort to gather data on Americans in bulk, sweeping up records of telephone calls made by millions of U.S. citizens regardless of whether they were suspected of a crime. It was a model for the massive phone surveillance system the NSA launched to identify terrorists after the Sept. 11 attacks. That dragnet drew sharp criticism that the government had intruded too deeply into Americans’ privacy after former NSA contractor Edward Snowden leaked it to the news media two years ago.

More than a dozen current and former law enforcement and intelligence officials described the details of the Justice Department operation to USA TODAY. Most did so on the condition of anonymity because they were not authorized to publicly discuss the intelligence program, part of which remains classified.

The DEA program did not intercept the content of Americans’ calls, but the records — which numbers were dialed and when — allowed agents to map suspects’ communications and link them to troves of other police and intelligence data. At first, the drug agency did so with help from military computers and intelligence analysts.

That data collection was “one of the most important and effective Federal drug law enforcement initiatives,” the Justice Department said in a 1998 letter to Sprint asking the telecom giant to turn over its call records. The previously undisclosed letter was signed by the head of the department’s Narcotics and Dangerous Drugs Section, Mary Lee Warren, who wrote that the operation had “been approved at the highest levels of Federal law enforcement authority,” including then-Attorney General Janet Reno and her deputy, Eric Holder.

The data collection began in 1992 during the administration of President George H.W. Bush, nine years before his son, President George W. Bush, authorized the NSA to gather its own logs of Americans’ phone calls in 2001. It was approved by top Justice Department officials in four presidential administrations and detailed in occasional briefings to members of Congress but otherwise had little independent oversight, according to officials involved with running it.

The DEA used its data collection extensively and in ways that the NSA is now prohibited from doing. Agents gathered the records without court approval, searched them more often in a day than the spy agency does in a year and automatically linked the numbers the agency gathered to large electronic collections of investigative reports, domestic call records accumulated by its agents and intelligence data from overseas, it even use 800 numbers for business too!

The result was “a treasure trove of very important information on trafficking,” former DEA administrator Thomas Constantine said in an interview.

The extent of that surveillance alarmed privacy advocates, who questioned its legality. “This was aimed squarely at Americans,” said Mark Rumold, an attorney with the Electronic Frontier Foundation. “That’s very significant from a constitutional perspective.”

Holder halted the data collection in September 2013 amid the fallout from Snowden’s revelations about other surveillance programs. In its place, current and former officials said the drug agency sends telecom companies daily subpoenas for international calling records involving only phone numbers that agents suspect are linked to the drug trade or other crimes — sometimes a thousand or more numbers a day.

Tuesday, Justice Department spokesman Patrick Rodenbush said the DEA “is no longer collecting bulk telephony metadata from U.S. service providers.” A DEA spokesman declined to comment.

HARVESTING DATA TO BATTLE CARTELS

The DEA began assembling a data-gathering program in the 1980s as the government searched for new ways to battle Colombian drug cartels. Neither informants nor undercover agents had been enough to crack the cartels’ infrastructure. So the agency’s intelligence arm turned its attention to the groups’ communication networks.

Calling records – often called “toll records” – offered one way to do that. Toll records are comparable to what appears on a phone bill – the numbers a person dialed, the date and time of the call, its duration and how it was paid for. By then, DEA agents had decades of experience gathering toll records of people they suspected were linked to drug trafficking, albeit one person at a time. In the late 1980s and early 1990s, officials said the agency had little way to make sense of the data their agents accumulated and almost no ability to use them to ferret out new cartel connections. Some agents used legal pads.

“We were drowning in toll records,” a former intelligence official said.

The DEA asked the Pentagon for help. The military responded with a pair of supercomputers and intelligence analysts who had experience tracking the communication patterns of Soviet military units. “What they discovered was that the incident of a communication was perhaps as important as the content of a communication,” a former Justice Department official said.

The military installed the supercomputers on the fifth floor of the DEA’s headquarters, across from a shopping mall in Arlington, Va.

The system they built ultimately allowed the drug agency to stitch together huge collections of data to map trafficking and money laundering networks both overseas and within the USA. It allowed agents to link the call records its agents gathered domestically with calling data the DEA and intelligence agencies had acquired outside the USA. (In some cases, officials said the DEA paid employees of foreign telecom firms for copies of call logs and subscriber lists.) And it eventually allowed agents to cross-reference all of that against investigative reports from the DEA, FBI and Customs Service.

The result “produced major international investigations that allowed us to take some big people,” Constantine said, though he said he could not identify particular cases.

In 1989, President George H.W. Bush proposed in his first prime-time address using “sophisticated intelligence-gathering and Defense Department technology” to disrupt drug trafficking. Three years later, when violent crime rates were at record highs, the drug agency intensified its intelligence push, launching a “kingpin strategy” to attack drug cartels by going after their finances, leadership and communication.

THE START OF BULK COLLECTION

In 1992, in the last months of Bush’s administration, Attorney General William Barr and his chief criminal prosecutor, Robert Mueller, gave the DEA permission to collect a much larger set of phone data to feed into that intelligence operation.

Instead of simply asking phone companies for records about calls made by people suspected of drug crimes, the Justice Department began ordering telephone companies to turn over lists of all phone calls from the USA to countries where the government determined drug traffickers operated, current and former officials said.

Barr and Mueller declined to comment, as did Barr’s deputy, George Terwilliger III, though Terwilliger said, “It has been apparent for a long time in both the law enforcement and intelligence worlds that there is a tremendous value and need to collect certain metadata to support legitimate investigations.”

The data collection was known within the agency as USTO (a play on the fact that it tracked calls from the U.S. to other countries).

The DEA obtained those records using administrative subpoenas that allow the agency to collect records “relevant or material to” federal drug investigations. Officials acknowledged it was an expansive interpretation of that authority but one that was not likely to be challenged because unlike search warrants, DEA subpoenas do not require a judge’s approval. “We knew we were stretching the definition,” a former official involved in the process said.

Officials said a few telephone companies were reluctant to provide so much information, but none challenged the subpoenas in court. Those that hesitated received letters from the Justice Department urging them to comply.

After Sprint executives expressed reservations in 1998, for example, Warren, the head of the department’s drug section, responded with a letter telling the company that “the initiative has been determined to be legally appropriate” and that turning over the call data was “appropriate and required by law.” The letter said the data would be used by authorities “to focus scarce investigative resources by means of sophisticated pattern and link analysis.”

The letter did not name other telecom firms providing records to the DEA but did tell executives that “the arrangement with Sprint being sought by the DEA is by no means unique to Sprint” and that “major service providers have been eager to support and assist law enforcement within appropriate bounds.” Former officials said the operation included records from AT&T and other telecom companies.

A spokesman for AT&T declined to comment. Sprint spokeswoman Stephanie Vinge Walsh said only that “we do comply with all state and federal laws regarding law enforcement subpoenas.”

Agents said that when the data collection began, they sought to limit its use mainly to drug investigations and turned away requests for access from the FBI and the NSA. They allowed searches of the data in terrorism cases, including the bombing of a federal building in Oklahoma City that killed 168 people in 1995, helping to rule out theories linking the attack to foreign terrorists. They allowed even broader use after Sept. 11, 2001. The DEA’s public disclosure of its program in January came in the case of a man charged with violating U.S. export restrictions by trying to send electrical equipment to Iran.

At first, officials said the DEA gathered records only of calls to a handful of countries, focusing on Colombian drug cartels and their supply lines. Its reach grew quickly, and by the late 1990s, the DEA was logging “a massive number of calls,” said a former intelligence official who supervised the program.

Former officials said they could not recall the complete list of countries included in USTO, and the coverage changed over time. The Justice Department and DEA added countries to the list if officials could establish that they were home to outfits that produced or trafficked drugs or were involved in money laundering or other drug-related crimes.

The Justice Department warned when it disclosed the program in January that the list of countries should remain secret “to protect against any disruption to prospective law enforcement cooperation.”

At its peak, the operation gathered data on calls to 116 countries, an official involved in reviewing the list said. Two other officials said they did not recall the precise number of countries, but it was more than 100. That gave the collection a considerable sweep; the U.S. government recognizes a total of 195 countries.

At one time or another, officials said, the data collection covered most of the countries in Central and South America and the Caribbean, as well as others in western Africa, Europe and Asia. It included Afghanistan, Pakistan, Iran, Italy, Mexico and Canada.

The DEA often — though not always — notified foreign governments it was collecting call records, in part to make sure its agents would not be expelled if the program was discovered. In some cases, the DEA provided some of that information to foreign law enforcement agencies to help them build their own investigations, officials said.

The DEA did not have a real-time connection to phone companies’ data; instead, the companies regularly provided copies of their call logs, first on computer disks and later over a private network. Agents who used the system said the numbers they saw were seldom more than a few days old.

The database did not include callers’ names or other identifying data. Officials said agents often were able to identify individuals associated with telephone numbers flagged by the analysis, either by cross-referencing them against other databases or by sending follow-up requests to the phone companies.

To keep the program secret, the DEA sought not to use the information as evidence in criminal prosecutions or in its justification for warrants or other searches. Instead, its Special Operations Division passed the data to field agents as tips to help them find new targets or focus existing investigations, a process approved by Justice Department lawyers. Many of those tips were classified because the DEA phone searches drew on other intelligence data.

That practice sparked a furor when the Reuters news agency reported in 2013 that the DEA trained agents to conceal the sources of those tips from judges and defense lawyers. Reuters said the tips were based on wiretaps, foreign intelligence and a DEA database of telephone calls gathered through routine subpoenas and search warrants.

As a result, “the government short-circuited any debate about the legality and wisdom of putting the call records of millions of innocent people in the hands of the DEA,” American Civil Liberties Union lawyer Patrick Toomey said.

A BLUEPRINT FOR BROADER SURVEILLANCE

The NSA began collecting its own data on Americans’ phone calls within months of Sept. 11, 2001, as a way to identify potential terrorists within the USA. At first, it did so without court approval. In 2006, after The New York Times and USA TODAY began reporting on the surveillance program, President George W. Bush’s administration brought it under the Foreign Intelligence Surveillance Act, which allows the government to use secret court orders to get access to records relevant to national security investigations. Unlike the DEA, the NSA also gathered logs of calls within the USA.

The similarities between the NSA program and the DEA operation established a decade earlier are striking – too much so to have been a coincidence, people familiar with the programs said. Former NSA general counsel Stewart Baker said, “It’s very hard to see (the DEA operation) as anything other than the precursor” to the NSA’s terrorist surveillance.

Both operations relied on an expansive interpretation of the word “relevant,” for example — one that allowed the government to collect vast amounts of information on the premise that some tiny fraction of it would be useful to investigators. Both used similar internal safeguards, requiring analysts to certify that they had “reasonable articulable suspicion” – a comparatively low legal threshold – that a phone number was linked to a drug or intelligence case before they could query the records.

“The foundation of the NSA program was a mirror image of what we were doing,” said a former Justice Department official who helped oversee the surveillance. That official said he and others briefed NSA lawyers several times on the particulars of their surveillance program. Two former DEA officials also said the NSA had been briefed on the operation. The NSA declined to comment.

There were also significant differences.

For one thing, DEA analysts queried their data collection far more often. The NSA said analysts searched its telephone database only about 300 times in 2012; DEA analysts routinely performed that many searches in a day, former officials said. Beyond that, NSA analysts must have approval from a judge on the Foreign Intelligence Surveillance Court each time they want to search their own collection of phone metadata, and they do not automatically cross-reference it with other intelligence files.

Sen. Patrick Leahy, D-Vt., then the chairman of the Senate Judiciary Committee, complained last year to Holder that the DEA had been gathering phone data “in bulk” without judicial oversight. Officials said the DEA’s database was disclosed to judges only occasionally, in classified hearings.

For two decades, it was never reviewed by the Justice Department’s own inspector general, which told Congress it is now looking into the DEA’s bulk data collections.

A SMALLER SCALE COLLECTION

Holder pulled the plug on the phone data collection in September 2013.

That summer, Snowden leaked a remarkable series of classified documents detailing some of the government’s most prized surveillance secrets, including the NSA’s logging of domestic phone calls and Internet traffic. Reuters and The New York Times raised questions about the drug agency’s own access to phone records.

Officials said the Justice Department told the DEA that it had determined it could not continue both surveillance programs, particularly because part of its justification for sweeping NSA surveillance was that it served national security interests, not ordinary policing. Eight months after USTO was halted, for example, department lawyers defended the spy agency’s phone dragnet in court partly on the grounds that it “serves special governmental needs above and beyond normal law enforcement.”

Three months after USTO was shut down, a review panel commissioned by President Obama urged Congress to bar the NSA from gathering telephone data on Americans in bulk. Not long after that, Obama instructed the NSA to get permission from the surveillance court before querying its phone data collection, a step the drug agency never was required to take.

The DEA stopped searching USTO in September 2013. Not long after that, it purged the database.

“It was made abundantly clear that they couldn’t defend both programs,” a former Justice Department official said. Others said Holder’s message was more direct. “He said he didn’t think we should have that information,” a former DEA official said.

By then, agents said USTO was suffering from diminishing returns. More criminals — especially the sophisticated cartel operatives the agency targeted — were communicating on Internet messaging systems that are harder for law enforcement to track.

Still, the shutdown took a toll, officials said. “It has had a major impact on investigations,” one former DEA official said.

The DEA asked the Justice Department to restart the surveillance program in December 2013. It withdrew that request when agents came up with a new solution. Every day, the agency assembles a list of the telephone numbers its agents suspect may be tied to drug trafficking. Each day, it sends electronic subpoenas — sometimes listing more than a thousand numbers — to telephone companies seeking logs of international telephone calls linked to those numbers, two official familiar with the program said.

The data collection that results is more targeted but slower and more expensive. Agents said it takes a day or more to pull together communication profiles that used to take minutes.

The White House proposed a similar approach for the NSA’s telephone surveillance program, which is set to expire June 1. That approach would halt the NSA’s bulk data collection but would give the spy agency the power to force companies to turn over records linked to particular telephone numbers, subject to a court order.

In the Artic, NATO vs. Putin

Posted on by
4/3/2015 – OFFUTT AIR FORCE BASE, Neb.  — Two B-52 Stratofortresses from the 5th Bomb Wing, Minot Air Force Base, N.D., and a pair from the 2nd Bomb Wing, Barksdale Air Force Base, La., completed today simultaneous, roundtrip sorties from their U.S. bases to the Arctic and North Sea regions, respectively.

The training mission, coined POLAR GROWL, allowed the aircrews to hone their navigation skills and enhanced their ability to work with Allied partners, while demonstrating U.S. Strategic Command capacity.

“These flights, demonstrating the credible and flexible ability of our strategic bomber force in internationally-recognized flight information regions, are the culmination of months of planning and coordination,” said Adm. Cecil D. Haney, U.S. Strategic Command commander. “They are one of many ways we demonstrate interoperability, compliance with national and international protocols and due regard for the safety of all aircraft sharing the air space.”

Each of the two legs of POLAR GROWL provided unique training opportunities, all while testing the bomber force’s command and control apparatus’ ability to support two synchronized flight paths. The bomber crews flying the North Sea route participated in dissimilar air intercept maneuvers with fighter aircraft flown by the Royal Canadian Air Force, the U.K.’s Royal Air Force and the Royal Netherlands Air Force. In addition to conducting dissimilar air intercept maneuvers with Royal Canadian Air Force fighters, bomber crews on the Arctic leg of the mission transited around the North Pole, providing the crews invaluable training in polar navigation.

“Today’s dynamic global security environment is an interdependent world where international partnerships are foundational,” Haney continued. “Exercises and operations such as these bomber flights enable and enhance relationships with our Allies and partners, and allow others to understand what capabilities U.S. Strategic Command brings to the equation.”

The U.S. regularly conducts combined training and theater security cooperation engagements with Allies and partners. The combined training provided in POLAR GROWL follows the participation of B-52s in NATO Exercise NOBLE JUSTIFICATION in October 2014 and the deployment of B-52s and B-2s to RAF Fairford, U.K., in June 2014, both of which provided occasions to train alongside U.S. Allies and partners.

“The long-range nature of the mission, coupled with the opportunity to interact, in real-time, with Allied aircraft was an invaluable experience that simply can’t be replicated out of the cockpit,” said Maj. Nathan Barnhart, 343rd Bomb Squadron instructor radar navigator. “Training like this ensures we are ready to respond to any and all mission directives across the globe.”

Flown in support of both U.S. European Command and U.S. Northern Command, POLAR GROWL was specifically designed to demonstrate U.S. commitment to Allies and enhancement of regional security, and not directed at any country.

Additionally, U.S. forces conduct all flights in accordance with the procedures outlined in the International Civil Aviation Organization international standards and recommended practices. By conducting flights that follow the ICAOs fundamental objectives, regional safety is enhanced to prevent any chance of misunderstanding.

The B-52 Stratofortress is capable of delivering large payload of precision nuclear or conventional ordnance over long ranges, while also providing decision makers the ability to rapidly project military power and generate decisive effects.

*** The United States and NATO is performing these operations because of Putin.
For the interactive map go here.
Russia has been ramping up its military presence in the Arctic, reopening abandoned Soviet-era bases, boosting its troop presence, building new facilities, and refurbishing infrastructure and air fields across a region that stretches from Russia’s borders with Norway and Finland to the seas off Alaska. The push reflects a new emphasis under President Vladimir Putin on the Arctic as a region of strategic importance that is also rich in oil and gas reserves.
The push comes as melting sea ice opens up those Arctic energy resources, prompting a scramble by Russia and other Arctic nations — Denmark, Canada, the United States, and Norway – to stake competing territorial claims. Mouse over and click each dot to see details of Russia’s Arctic expansion.
***
Putin is being quite shrewd while Jens Stoltenberg, the newly assigned Secretary General of NATO was real stupid.

Oslo (AFP) – Russian ships docked at what was once a secret Norwegian naval base in the Arctic have prompted concern from the NATO country’s former top military leaders, anxious about its resurgent eastern neighbour roaming nearby.

 

Norway’s jagged Arctic coastline has regained its strategic importance since tensions between Russia and NATO members have spiked to levels not seen since the fall of the Soviet Union.

The rocky relations have led some to criticise the shutting down of Olavsvern Naval Base, a massive complex burrowed into a mountain near the northern town of Tromsoe, that has been closed since 2009.

Shuttering it was driven by the then seemingly reduced threat from Moscow and its massive Northern Fleet based on Russia’s nearby Kola Peninsula.

“We sold the only base worthy of the name that we had up there. It’s pure madness,” former vice admiral Einar Skorgen, who commanded Norway’s northern forces, told AFP.

Skorgen and other critics say Norway has robbed itself of a crucial foothold in the far north, forcing its submarines to travel hundreds of extra miles from their bases to defend the region.

On top of that, three Russian ships have spent the winter docked deep within the mountain hideaway, once a closely guarded military facility.

“We are the only country along with Russia to have a permanent presence in the Barents Sea, where we share a common border. Obviously our navy should be stationed there, including our submarines,” Skorgen said.

“If the ships aren’t there where they are needed, they might as well be scrapped altogether.”

The way the base changed hands and ended up being rented to Russian research vessels — some of them seismic survey ships reportedly linked to state-owned energy giant Gazprom — has added further fuel to their anger.

When no buyers answered the armed forces’ initial advert on Norway’s version of eBay, a Norwegian businessman clinched the deal in 2013 for a mere 40 million kroner ($5 million, 4.6 million euros) — a steal given that NATO ploughed nearly 4 billion kroner into its construction.

“There are no longer any secrets surrounding this base,” said its new landlord Gunnar Wilhelmsen.

“Not since the military and NATO agreed to put it on sale over the Internet, along with photographs of every nook and cranny.”

– Historic ‘blunder’ –

Nonetheless, the potential for Russian military activity aboard research vessels has many military experts worried, particularly former top-ranking officers who are more prone to speaking their mind.

“Russia is a country where the state has a say over all commercial or semi-state business. It’s clear, very few people know what happens on these vessels,” said retired vice admiral Jan Reksten, formerly second in command of the Norwegian military.

He said the sale of Olavsvern was “a double loss” as “Norway’s armed forces lost an important base and now there are Russian vessels docked there.”

In an ironic twist to the tale, the decision to close the base was taken by the leftist government of Jens Stoltenberg, who has gone on to become NATO’s current secretary general and who has warned countries not to lower their guard when it comes to Russia.

Kjell-Ola Kleiven, a blogger writing on security issues in Norway, calls the affair the “biggest blunder in recent history” in an oil-rich country which boasts the world’s largest sovereign wealth fund.

“With 7,000 billion kroner in the bank,” he wrote, “you would have thought that the Norwegian nation had the means and savvy to retain ownership of Olavsvern base.”

Despite the protests, Norway’s current right-wing government has shown no signs of reversing the decision made by its predecessors.

“There are no plans to re-establish military installations in Olavsvern,” Audun Halvorsen, political advisor to the defence minister, told AFP in an email.

“The owner of the site can use it as he sees fit and the armed forces do not have the authority to impose restrictions, nor any mandate to monitor civilian ships that dock there,” he added.

“Any suspected irregular activity is a matter for the police and legal authorities.”