Ah, Yahoo has Been Secretly Sweeping Your Emails

Posted on October 4, 2016October 4, 2016 by Denise Simon

Primer: Report: Yahoo hack may have compromised up to 3B accounts

Exclusive: Yahoo secretly scanned customer emails for U.S. intelligence

SAN FRANCISCO (Reuters) – Yahoo Inc last year secretly built a custom software program to search all of its customers’ incoming emails for specific information provided by U.S. intelligence officials, according to people familiar with the matter.

The company complied with a classified U.S. government directive, scanning hundreds of millions of Yahoo Mail accounts at the behest of the National Security Agency or FBI, said two former employees and a third person apprised of the events.

Some surveillance experts said this represents the first case to surface of a U.S. Internet company agreeing to a spy agency’s demand by searching all arriving messages, as opposed to examining stored messages or scanning a small number of accounts in real time.

It is not known what information intelligence officials were looking for, only that they wanted Yahoo to search for a set of characters. That could mean a phrase in an email or an attachment, said the sources, who did not want to be identified.

Reuters was unable to determine what data Yahoo may have handed over, if any, and if intelligence officials had approached other email providers besides Yahoo with this kind of request.

According to the two former employees, Yahoo Chief Executive Marissa Mayer’s decision to obey the directive roiled some senior executives and led to the June 2015 departure of Chief Information Security Officer Alex Stamos, who now holds the top security job at Facebook Inc.”Yahoo is a law abiding company, and complies with the laws of the United States,” the company said in a brief statement in response to Reuters questions about the demand. Yahoo declined any further comment.

Through a Facebook spokesman, Stamos declined a request for an interview.

The NSA referred questions to the Office of the Director of National Intelligence, which declined to comment.

The demand to search Yahoo Mail accounts came in the form of a classified directive sent to the company’s legal team, according to the three people familiar with the matter.

U.S. phone and Internet companies are known to have handed over bulk customer data to intelligence agencies. But some former government officials and private surveillance experts said they had not previously seen either such a broad directive for real-time Web collection or one that required the creation of a new computer program.

“I’ve never seen that, a wiretap in real time on a ‘selector,'” said Albert Gidari, a lawyer who represented phone and Internet companies on surveillance issues for 20 years before moving to Stanford University this year. A selector refers to a type of search term used to zero in on specific information.

“It would be really difficult for a provider to do that,” he added.

Experts said it was likely that the NSA or FBI had approached other Internet companies with the same demand, since they evidently did not know what email accounts were being used by the target. The NSA usually makes requests for domestic surveillance through the FBI, so it is hard to know which agency is seeking the information.

Reuters was unable to confirm whether the 2015 demand went to other companies, or if any complied.

Alphabet Inc’s Google and Microsoft Corp, two major U.S. email service providers, did not respond to requests for comment.

CHALLENGING THE NSA

Under laws including the 2008 amendments to the Foreign Intelligence Surveillance Act, intelligence agencies can ask U.S. phone and Internet companies to provide customer data to aid foreign intelligence-gathering efforts for a variety of reasons, including prevention of terrorist attacks.

Disclosures by former NSA contractor Edward Snowden and others have exposed the extent of electronic surveillance and led U.S. authorities to modestly scale back some of the programs, in part to protect privacy rights.

Companies including Yahoo have challenged some classified surveillance before the Foreign Intelligence Surveillance Court, a secret tribunal.

Some FISA experts said Yahoo could have tried to fight last year’s directive on at least two grounds: the breadth of the demand and the necessity of writing a special program to search all customers’ emails in transit.

Apple Inc made a similar argument earlier this year when it refused to create a special program to break into an encrypted iPhone used in the 2015 San Bernardino massacre. The FBI dropped the case after it unlocked the phone with the help of a third party, so no precedent was set.

Other FISA experts defended Yahoo’s decision to comply, saying nothing prohibited the surveillance court from ordering a search for a specific term instead of a specific account. So-called “upstream” bulk collection from phone carriers based on content was found to be legal, they said, and the same logic could apply to Web companies’ mail.

As tech companies become better at encrypting data, they are likely to face more such requests from spy agencies.

Former NSA General Counsel Stewart Baker said email providers “have the power to encrypt it all, and with that comes added responsibility to do some of the work that had been done by the intelligence agencies.”

SECRET SIPHONING PROGRAM

Mayer and other executives ultimately decided to comply with the directive last year rather than fight it, in part because they thought they would lose, said the people familiar with the matter.

Yahoo in 2007 had fought a FISA demand that it conduct searches on specific email accounts without a court-approved warrant. Details of the case remain sealed, but a partially redacted published opinion showed Yahoo’s challenge was unsuccessful.

Some Yahoo employees were upset about the decision not to contest the more recent directive and thought the company could have prevailed, the sources said.

They were also upset that Mayer and Yahoo General Counsel Ron Bell did not involve the company’s security team in the process, instead asking Yahoo’s email engineers to write a program to siphon off messages containing the character string the spies sought and store them for remote retrieval, according to the sources.

The sources said the program was discovered by Yahoo’s security team in May 2015, within weeks of its installation. The security team initially thought hackers had broken in.

When Stamos found out that Mayer had authorized the program, he resigned as chief information security officer and told his subordinates that he had been left out of a decision that hurt users’ security, the sources said. Due to a programming flaw, he told them hackers could have accessed the stored emails.

Stamos’s announcement in June 2015 that he had joined Facebook did not mention any problems with Yahoo. (http://bit.ly/2dL003k)

In a separate incident, Yahoo last month said “state-sponsored” hackers had gained access to 500 million customer accounts in 2014. The revelations have brought new scrutiny to Yahoo’s security practices as the company tries to complete a deal to sell its core business to Verizon Communications Inc for $4.8 billion.

(Reporting by Joseph Menn; Editing by Jonathan Weber and Tiffany Wu)

European Union Approved Deportation of Afghanis

Posted on October 3, 2016October 3, 2016 by Denise Simon

Primer: FORT BENNING, Ga. (AP) — Seven Afghan military students in four states have been absent without leave since earlier this month, military officials said.

U.S. Navy Defense Press Operations Cmdr. Patrick L. Evans said in an email Thursday that four students left their posts without leave over the Labor Day weekend, the Columbus Ledger-Enquirer reported (http://bit.ly/2dcWkt2 ). Two of the students were at Fort Benning in Georgia, while one was at Fort Lee in Virginia and the other in Little Rock, Arkansas. More here from CNS.

The European Union and Afghanistan reach an arrangement to tackle migration issues

Yesterday, the European Union and Afghanistan reached an important political arrangement, “The EU-Afghanistan Joint Way Forward on Migration issues”, to effectively tackle the challenges in both the European Union and Afghanistan linked to irregular migration. This is the result of a constructive dialogue based on partnership and a willingness to enhance dialogue and bilateral cooperation in this area. A dialogue at the level of senior officials is foreseen to take place on 4 October to begin the implementation process. (For more information: Maja Kocijancic – Tel.: + 32 229 86570; Natasha Bertaud – Tel.: +32 229 67456; Tove Ernst – Tel.: +32 229 86764)

Guardian: The EU has signed an agreement with the Afghan government allowing its member states to deport an unlimited number of the country’s asylum seekers, and obliging the Afghan government to receive them.

The deal has been in the pipeline for months, leading up to a large EU-hosted donor conference in Brussels this week. According to a previously leaked memo, the EU suggested stripping Afghanistan of aid if its government did not cooperate.

The deal, signed on Sunday, has not been made public but a copy seen by the Guardian states that Afghanistan commits to readmitting any Afghan citizen who has not been granted asylum in Europe, and who refuses to return to Afghanistan voluntarily.

It is the latest EU measure to alleviate the weight of the many asylum seekers who have arrived since early 2015. Afghans constituted the second-largest group of asylum seekers in Europe, with 196,170 applying last year.

While the text stipulates a maximum of 50 non-voluntary deportees per chartered flight in the first six months after the agreement, there is no limit to the number of daily deportation flights European governments can charter to Kabul.

With tens of thousands set to be deported, both sides will also consider building a terminal dedicated to deportation flights at Kabul international airport.

The agreement, Joint Way Forward, also opens up the deportation of women and children, which at the moment almost exclusively happens from Norway: “Special measures will ensure that such vulnerable groups receive adequate protection, assistance and care throughout the whole process.”

If family members in Afghanistan cannot be located, unaccompanied children can be returned only with “adequate reception and care-taking arrangement having been put in place in Afghanistan”, the text says.

The EU has negotiated the agreement with the Afghan government as part of the run-up to this week’s Brussels donor conference, where international donors will pledge aid for Afghanistan for the coming four years. Some Afghan officials seem to have felt strong-armed. The Afghan minister for refugees and repatriation, Sayed Hussain Alemi Balkhi, refused to sign the document, leaving the duty to a deputy.

Still, Afghanistan, whose domestic revenue only constitutes 10.4% of GDP, is so dependent on foreign aid that the government may have had little choice.

Liza Schuster, a Kabul-based migration expert, said the deal was an example of “how developed countries are able to push through their agenda in countries where there simply isn’t the capacity in the ministries to push back”. She added that there had been little transparency in the negotiation process.

“There has been no oversight, no consultation, and hardly any mention of it to any of the migrant organisations or rights organisations [in Europe]. There was no chance to mount resistance against it,” Schuster said.

The large exodus of Afghans last year seemed partly triggered by Angela Merkel opening Germany’s doors to almost a million migrants, but it also coincided with a deteriorating security situation, which has not improved since.

On Sunday, the Taliban mounted a strong assault on the northern city of Kunduz, while attacks have also increased in many other parts of the country.

To prevent a migrant flow of the size experienced last year, the deal commits the EU to help fund public awareness campaigns in Afghanistan warning against the dangers of migrating.

However, not all Afghan asylum seekers arrive to Europe from Afghanistan. An unknown number were born or grew up in Iran or Pakistan. If sent to Afghanistan, many are likely to struggle without the social networks that are often a prerequisite to getting work, even for the well-educated. According to Schuster, who has authored a paper on post-deportation experience, destitute people, who do not choose to leave Afghanistan again immediately after deportation, could be ripe targets for recruitment not only by the Taliban but local strongmen commanding militias. In that sense, deportations could add to instability.

“There is not sufficient protection, the level of generalised violence is too high and Kabul is already bursting at the seams,” Schuster said.

“This particular agreement allows European governments to ride straight through all the argumentation that’s been made over the past 15 years that it’s not safe to return people at the moment.”

DoJ’s Side Deal to Destroy the Laptops, EmailGate

Posted on October 3, 2016October 3, 2016 by Denise Simon

Note: to destroy ‘both’ laptops. BREAKING from Catherine Herridge: FBI made side deals with 2 HRC associates to “destroy” their laptops after inspecting them.

The full 3 page letter is here.

On Wednesday, September 28, 2016, Director James Comey testified before the House Judiciary Committee at an oversight hearing on the Federal Bureau of Investigation. At the hearing, members of the House Judiciary Committee pressed Director Comey on his recommendation and the Department of Justice’s decision to not prosecute Secretary Clinton for mishandling classified information through private email servers.

Background:
• On July 5, 2016, Director Comey announced that the FBI does not recommend criminal charges against former State Department Secretary Hillary Clinton, even though federal law criminalizes mishandling classified information with “gross negligence.” Following his announcement, House Judiciary Committee Chairman Bob Goodlatte (R-Va.) and over 200 members of Congress sent a letter to Director Comey pressing for more information regarding the many questions surrounding his recommendation.

• On July 11, 2016, Chairman Goodlatte and House Oversight and Government Reform Committee Chairman Jason Chaffetz (R-Utah) requested that the Department of Justice open an investigation into whether Secretary Clinton committed perjury and made false statements when testifying under oath before Congress. Contrary to statements she made before the House Select Committee on Benghazi hearing in October 2015, Secretary Clinton sent and received emails that were marked classified at the time; her lawyers did not read each email in her personal account to identify all the work-related messages; she used several different servers and numerous devices to send and receive work-related emails; and she did not provide all of her work-related emails to the Department of Justice.

Hearing Takeaways:
• At the hearing, Director Comey defended the FBI’s conclusion of its investigation into Secretary Clinton, but new information casts serious doubts about whether the decision to not prosecute Hillary Clinton was made impartially.

• For example, Cheryl Mills, chief of staff and counselor to Secretary Clinton at the State Department, was granted immunity for the production of her laptop and was able to be in the room with Secretary Clinton while she was interviewed by the FBI. In all of his years in law enforcement, Director Comey admitted that he had never heard of a potential witness representing a subject of an investigation during an interview with investigators.

• The FBI never considered electronically recording Hillary Clinton’s interview with the FBI despite the fact that the Deputy Attorney General issued a memo to all DOJ components encouraging them to do just that in such situations.

Key Videos:

House Judiciary Committee Chairman Bob Goodlatte (R-Va.) challenges the FBI’s conclusions in the Clinton investigation and presses Director Comey on Congress’ perjury referral and the immunity deals provided to key Clinton advisors:

“Hillary Clinton chose to send and receive Top Secret information over a personal, unsecure computer server housed in her various homes and once reportedly placed in a bathroom closet. These actions, without a doubt, opened these communications to hostile interception by our enemies and those who wish America harm …

“We, as Congress and the American people, are troubled how such gross negligence is not punished, and why there seems to be a different standard for the well-connected.”

Representative Trey Gowdy (R-S.C.), a former federal prosecutor, explains why Secretary Clinton should have been prosecuted:

“Intent is awfully hard to prove. Very rarely do defendants announce ahead of time ‘I intend to commit this crime on this date’ … So you have to prove it by circumstantial evidence. Such as whether or not the person intended to set up an email system outside the State Department; such as whether or not the person knew or should have known that his or her job involved handling classified information; whether or not the person was truthful about using multiple devices….

“The way to prove [intent] is whether or not someone took steps to conceal or destroy what they have done. That is the best evidence you have is that they knew it was wrong, that they lied about it.”

Representative John Ratcliffe (R-Texas) presses Director Comey about why Secretary Clinton was not charged with obstruction of justice:

“I want to make sure the record is clear about the evidence that you did not have [in the investigation]:

The FBI did not have the Clintons’ personal Apple server used for Hillary Clinton’s work emails …
An Apple MacBook laptop and thumb drive that contained Hillary Clinton’s email archives was lost …
Two blackberry devices provided didn’t have SIM cards or SD data cards …
13 Hillary Clinton personal mobile devices were lost, discarded, or destroyed with a hammer …
Various sever backups were deleted over time …
After the State Department, and my colleague Mr. Gowdy here notified Ms. Clinton that her records would be sought by the Benghazi Committee, copies of her emails on laptops of both of her lawyers were wiped clean with BleachBit …
After those emails were subpoenaed, Hillary Clinton’s email archives were also permanently deleted from the Platt River Network with BleachBit …
And also after the subpoena, backups of the Platt River server were manually deleted.

“Collectively this list screams obstruction of justice.”

Immigrants Buying Entry into U.S., are Some Terrorists?

Posted on September 30, 2016September 30, 2016 by Denise Simon

…..even if they are corrupt and the money used has been laundered or financed by a terror organization…

Primer:

CIA Director: We ‘have to assume’ terrorist activity in US

‘Impossible to say’ if ISIS has cells here

(CNN) – The director of the CIA said Wednesday despite the government’s best efforts, the likelihood of terrorist activity in the United States is strong.

“So I think we have to assume there’s something here in the states,” said John Brennan, in an interview for CNN’s “Erin Burnett OutFront” that aired Wednesday night. “We have to be relentless in terms of going after them.”

Brennan, who was appointed to lead the CIA shortly before President Barack Obama’s second term, said “it’s impossible to say” whether ISIS has operatives or cells in the United States, and he credited the “tremendous advances in information sharing and interaction between federal officials” in making it difficult for terrorists to operate in the country.

He said he is confident that the US will be “able to remove other senior members” of ISIS, including the organization’s leader Abu Bakr al-Baghdadi.

“His time is limited,” Brennan said of al-Baghdadi. “It’s just a question of whether or not he is going to be removed this week, this month, next month or in the coming months.”

But still, Brennan said “you cannot assume there’s nobody in the homeland.”

“What you need to do is to be able to continue to uncover and use intelligence, what they might be doing here,” he said. More details here.

Immigrant Investor Program:

Progress Made to Detect and Prevent Fraud, but Additional Actions Could Further Agency Efforts

What GAO Found Full report here.

Inspector General Report is here.

The Department of Homeland Security’s U.S. Citizenship and Immigration Services (USCIS) has recently taken steps intended to enhance fraud detection and mitigation activities for the Employment-Based Fifth Preference Immigrant Investor Program (EB-5 Program) and address previous GAO recommendations.

This includes actions such as conducting and planning additional risk assessments to gather additional information on potential fraud risks to the program. For example, USCIS is leveraging overseas staff to investigate potential fraud associated with unlawful sources of immigrant investor funds and is conducting a site visit pilot to help assess the potential risks of fraud among EB-5 program investments. USCIS is also taking steps to collect more information about EB-5 program investments and immigrant investors through new, revised forms and expanding its use of background checks, among other things, to help improve its ability to identify specific incidence of fraud. However, fraud mitigation in the EB-5 Program is hindered by a reliance on voluminous paper files, which limit the agency’s ability to collect and analyze program information. In its review of a nongeneralizable selection of files associated with EB-5 program regional centers and immigrant investors, GAO found that identifying fraud indicators is extremely challenging. For example, many of these files were several thousand pages long and would take significant time to review. According to USCIS documentation, the program anticipates receiving approximately 14 million pages of supporting documentation from its regional-center applicants and immigrant investor petitioners annually. Recognizing these limitations, USCIS has taken preliminary steps to study digitizing and analyzing the paper files submitted by petitioners and applicants to the program, which could help USCIS better identify fraud indicators in the program; however, these efforts are in the early stages.

USCIS has incorporated selected leading fraud risk management practices into its efforts but could take additional actions to help guide and document its efforts. GAO’s Fraud Risk Framework is a set of leading practices that can serve as a guide for program managers to use when developing efforts to combat fraud in a strategic, risk-based manner. USCIS’s actions align with two key components of the Fraud Risk Framework: (1) commit to combating fraud by creating an organizational culture and structure conducive to fraud risk management such as by providing specialized fraud awareness training; and (2) assess risks by planning and completing regular fraud risk assessments. However, USCIS has not developed a fraud risk profile, an overarching document that guides its fraud management efforts, as called for in the Fraud Risk Framework. Instead, USCIS’s risk assessments, spanning multiple years, were developed as separate documents and reports, and there is not a unifying document that consolidates and systematically prioritizes these findings. Without a fraud risk profile, USCIS may not be well positioned to identify and prioritize fraud risks in the EB-5 Program, ensure the appropriate controls are in place to mitigate fraud risks, and implement other Fraud Risk Framework components.

Why GAO Did This Study

Congress created the EB-5 visa category to promote job creation and capital investment by immigrant investors in exchange for lawful permanent residency and a path to citizenship. Participants must invest either $500,000 or $1 million in a business that is to create at least 10 jobs. Upon meeting program requirements, immigrant investors are eligible for conditional status to live and work in the United States and can apply to remove the conditional basis of lawful permanent residency after 2 years. In August 2015, GAO reported on weaknesses in certain USCIS fraud mitigation activities, and made two related recommendations.

GAO was asked to review actions taken by USCIS to address fraud risks in the EB-5 program since its August 2015 report. This report examines the extent to which USCIS (1) has taken steps to enhance its fraud detection and mitigation efforts; and (2) has incorporated selected leading fraud risk management practices into its efforts. GAO reviewed relevant program documentation and information; selected and reviewed a random, nongeneralizable sample of immigrant investor petitions and regional-center applications submitted between fiscal years 2010 and 2014; and compared USCIS’s actions against GAO’s Fraud Risk Framework.

What GAO Recommends

GAO recommends that USCIS develop a fraud risk profile that aligns with leading practices identified in GAO’s Fraud Risk Framework. The Department of Homeland Security concurred with GAO’s recommendation.

DHS Allows Refugees into U.S. with only Testimony, no Documents

Posted on September 29, 2016September 29, 2016 by Denise Simon

Europe, now then the United States…

VIDEO: Obama Administration Official Admits to Allowing Refugees in to U.S. Based on Their Testimony Alone

Cruz questions administration officials on refugee program at Judiciary Committee hearing

WASHINGTON, D.C. – U.S. Sen. Ted Cruz (R-Texas), in today’s Judiciary immigration subcommittee hearing, highlighted serious problems with the Obama administration’s refugee resettlement efforts, including the federal government’s inadequate refugee vetting process. While questioning State Department Principal Deputy Assistant Secretary Simon Henshaw, Department of Homeland Security (DHS) Director León Rodríguez, and Department of Health and Human Services Director Robert Carey, Sen. Cruz specifically noted that the administration’s willful blindness to radical Islamic terrorism has prevented Christian refugees from the Middle East from escaping the genocide of ISIS and has also seriously undermined counterterrorism efforts in the United States.

Moreover, during an exchange with Sen. Cruz, Director Rodríguez acknowledged publicly that refugee applications can be approved based solely on the applicant’s testimony, without any documentation.

Sen. Cruz: Is it true or false that the testimony of the applicant alone can be sufficient for approval?

Director Rodríguez: There are cases where the testimony is not necessarily corroborated by documents…I am acknowledging that, yes, testimony can be the basis for the grant of a refugee…

Watch Sen. Cruz’s full opening remarks and first line of questioning, where Director Rodríguez admits that refugee applications can be approved based on testimony alone, here. Sen. Cruz’s second line of questioning can be viewed here. Below is the full transcript of Sen. Cruz’s opening remarks:

“America has long shown an incredible generosity of spirit welcoming refugees and offering them safe haven. Indeed, I am the son of a refugee who fled prison and torture in Cuba and came to America seeking freedom. But our immigration laws are not a suicide pact. The refugee program should not become a vehicle for terrorists to come murder innocent Americans.

“I and, I think, a great many Americans are deeply concerned by the willful blindness of this administration to the threat of radical Islamic terrorism. That was characterized powerfully just a few minutes ago when our Democratic colleague Senator Al Franken said we should not even ask refugees if they are Muslims. If one is trying to prevent radical Islamic terrorists from coming in, the suggestion from my Democratic colleague that we shouldn’t even ask, to me, is nuts.

“As we look at what is happening in Syria and what is happening in the Middle East, ISIS is evil. They are waging a war of genocide against Christians. They are murdering Jews. They are murdering fellow Muslims, and yet, the refugee program as administered by this administration seems to have an enormous preference for Syrian Muslim refugees and seems to actively keep out Syrian Christian refugees.

“In 2014, the Obama administration admitted 249 refugees from Syria, 224 of those, 89.9 percent, were Muslim, only 13 were Christian – 5.2 percent. In 2015, the Obama administration admitted 2,192 refugees from Syria; 2,149 were Muslim – that’s 98 percent – and only 29, 1.3 percent, were Christian. In 2016 to date, the Obama administration has admitted 11,717 refugees from Syria, of those 11,624 were Muslim – that’s 99.2 percent – and 49 were Christian – that’s 0.41 percent. All told since 2011, 14,267 Syrian refugees have been admitted to the United States and more than 14,000 of them were Muslim. Fewer than 100 were Christian.

“Now, those numbers are not even close to the proportional population in Syria. Ten percent of the pre-war population in Syria was Christian, and yet, 0.68 percent of the refugees being admitted by the administration are Christian.”