NYPD Covertly Tracked Cell Phones

Posted on February 11, 2016February 11, 2016 by Denise Simon

New York police have covertly tracked cell phones, group says

Reuters: New York City’s police have made extensive use of covert devices to track cell phones without obtaining warrants since 2008, a civil liberties group said on Thursday, revealing how frequently law enforcement in the largest U.S. city has employed the technology.

The New York Civil Liberties Union released files that showed the New York Police Department used “cell site simulators” to track nearby cell phones more than a 1,000 times over the past eight years.

The American Civil Liberties Union has identified 60 local, state and federal agencies that have adopted the devices in recent years, but the group has said there are likely far more. The extent of the devices has largely been shrouded in secrecy, as departments and private manufacturers such as Harris Corp have refused to disclose information about their use.

U.S. Representative Jason Chaffetz of Utah, a Republican, has introduced a bill to require warrants for the use of cell site simulators.

The documents released on Thursday were obtained by the NYCLU through a Freedom of Information Law request.

The NYPD does not have a written policy on using the surveillance devices and does not obtain warrants when doing so, according to the NYCLU.

Instead, the department seeks “pen register” orders, which have been used for decades to gather information on specific phone numbers. The orders are issued by judges but require a lower standard than the probable cause needed for warrants.

The NYPD’s practice is less stringent than the one adopted last year by the U.S. Department of Justice, which calls for warrants except in emergency situations.

“We still have concerns that this military equipment is being used in a civilian context,” said Mariko Hirose, an NYCLU attorney. “At the very least, they should be using warrants and with a strict privacy policy that is written.”

The NYPD did not immediately respond to a request for comment.

The devices mimic cell towers and intercept signals from nearby phones to gather information. That data can include locations of calls, numbers that are called or texted and even the content of communications, the NYCLU said.

The simulators can also sweep up information from nearby “bystander” phones.

The documents do not indicate what data police collected. The simulators were used to investigate a wide range of crimes, including murder, rape and drug trafficking.

No New York court has yet tackled the question of whether the warrantless use of such devices is constitutional, Hirose said.

She said the NYCLU could have difficulty establishing the legal standing to bring such a challenge, which would probably have to come from a criminal defendant specifically targeted by a simulator.

Yikes, there is more:

Intercept: The NYPD has used cell-site simulators, commonly known as Stingrays, more than 1,000 times since 2008, according to documents turned over to the New York Civil Liberties Union. The documents represent the first time the department has acknowledged using the devices.

The NYPD also disclosed that it does not get a warrant before using a Stingray, which sweeps up massive amounts of data. Instead, the police obtain a “pen register order” from a court, more typically used to collect call data for a specific phone. Those orders do not require the police to establish probable cause. Additionally, the NYPD has no written policy guidelines on the use of Stingrays.

Stingrays work by imitating cellphone towers. They force all nearby phones to connect to them, revealing the owners’ locations. That means they collect data on potentially hundreds of people. They are small enough to fit in a suitcase, or be mounted on a plane.

When they were originally developed in 2003, Stingrays were designed for military use. But in the past decade, they have increasingly been purchased by law enforcement agencies. According to the ACLU, Stingrays are used by at least 59 police departments in 23 states, and at least 13 federal agencies, including the DEA, FBI, and the IRS. Because most departments withhold information about Stingrays, these numbers likely underrepresent the total.

In December, The Intercept published a secret U.S. government catalogue of cellphone surveillance technology, including Stingrays and “dirt-boxes.” The advertisements boast that many of the items can spy on “up to 10,000 targets.”

Stingrays have long been a topic of concern for privacy activists. “Cell-site simulators are powerful surveillance devices that can track people, including in their homes, and collect information on innocent bystanders,” said Mariko Hirose, a senior staff attorney at the NYCLU. “If they are going to be used in communities the police should at minimum obtain a warrant and follow written policies.”

Instead, law enforcement agencies have fought to keep Stingrays secret, even dropping criminal cases to avoid disclosing anything about them. The FBI has forced local police agencies to sign Stingray-related non-disclosure agreements, claiming that criminals and terrorists who know about Stingrays could take countermeasures against them.

The increasing use of Stingrays, coupled with the lack of transparency, has alarmed civil liberties groups. “I think it’s critical to have transparency about the use of technology like Stingrays,” said Faiza Patel, an attorney with the Brennan Center for Justice. “That’s what allows courts, the public, and our elected officials to weigh in on the proper rules.”

In September, the Department of Justice issued guidelines requiring its officers to seek probable cause warrants before using a Stingray. But the guidelines only applied to federal law enforcement agencies, not to state and local police, who have fought such a change. In one ongoing court case, the state of Maryland has argued that anyone who turns on their phone consents to having his or her location tracked.

In November, Senator Ron Wyden, D-Ore., and Rep. Jason Chaffetz, R-Utah, introduced the GPS Act, a bill that would extend the Department of Justice’s guidelines to all law enforcement agencies. “Buying a smartphone shouldn’t be interpreted as giving the government a free pass to track your movements,” Wyden said.

See the government catalogue here:

Top photo: “nypd” by Nick Allen, used under CC BY 2.0/ cropped and color corrected from original.

Contact the author:

ISIS, Islamic State has a Help Desk

Posted on February 11, 2016February 11, 2016 by Denise Simon

The Islamic State in Iraq and Syria (ISIS) uses a 34-page manual to instruct its followers on how to stay invisible on the Internet.

The Arabic document was translated and released this week by analysts at the Combating Terrorism Center, an independent research group at the U.S. Military Academy at West Point. It includes warnings to avoid Instagram because it is owned by Facebook, and Dropbox because former secretary of State Condoleezza Rice sits on its board of investors. Famous government leaker Edward Snowden has also criticized Dropbox over its privacy, the document notes.

Users are also directed to use Apple’s encrypted FaceTime and iMessage features over regular unencrypted text and chat features. More here.

New ISIS ‘help desk’ to aid hiding from authorities

TheHill: The Islamic State in Iraq and Syria (ISIS) has opened up a new technical “help desk” that instructs terrorists on how to hide from Western authorities, according to researchers.

The Electronic Horizon Foundation (EHF) was launched on Jan. 30 as a joint effort of several of the top ISIS cybersecurity experts, the Middle East Media Research Institute (MEMRI) said in a new report.

While researchers have previously uncovered an ISIS “help desk” and 34-page manual that help extremists encrypt their communications, MEMRI said the EHF takes these services to an “alarming” new level.

“Jihadis have long sought technical information, which has been confined in the past to various password-protected jihadi forums,” said the MEMRI report, shared exclusively with The Hill. “However, the freedom and ease by which they can now obtain that information is alarming, especially when such information is shared over private and secure channels.”

The EHF operates on the encrypted messaging platform Telegram but also maintains a Twitter account that disseminates information and directs followers to its secure Telegram channel.

The group’s self-stated goal is clear: “Spreading security and technical awareness among the monotheists.”

According to an announcement celebrating the EHF launch, ISIS has spent a year establishing the group with the goal of “unifying the technical and security efforts, and uniting the ranks of the mujahideen’s supporters.”

It brings together several technical support entities, such as the Information Security channel on Telegram and the “Islamic State Technician,” an ISIS security specialist thought to be behind a leading password-protected technical forum.

The announcement, which the MEMRI translated, was also direct that the EHF had been formed “due to the electronic war and tight surveillance imposed by the Western intelligence apparatuses over Internet users, and their tracking and following of the mujahideen and their supporters, and targeting them based on their data and information, which they share over the Internet.”

EHF pledged to provide resources to help combat this surveillance.

“It is time to face the electronic surveillance, educate the mujahideen about the dangers of the Internet, and support them with the tools, directives and security explanations to protect their electronic security, so that they don’t commit security mistakes that can lead to their bombardment and killing,” the announcement said.

As of early this week, the EHF Telegram account had over 2,200 members.

MEMRI said EHF has not posted much yet, “but it is expected to take the lead nonetheless in content posted as time goes by.”

If the group follows in the footsteps of its creators, its content will be “defensively-oriented,” such as tutorials on mobile phone security, instead of “offensively-oriented,” such as instructions on launching cyberattacks, MEMRI said.

In the wake of the terror attacks in Paris and San Bernardino, Calif., law enforcement officials have cautioned that potential terrorists are increasingly using encryption to hide from investigators, a phenomenon they call “going dark.”

The warnings have led to some calling for legislation that would guarantee government access to encrypted data, although momentum on Capitol Hill for such a bill has cooled in recent months.

“I don’t think we’re any closer to a consensus on that than we were, I think, six months ago,” Rep. Adam Schiff (D-Calif.), the House Intelligence Committee’s top Democrat, said last week. “Or if there is a consensus, it is that a legislative solution, I think, is very unlikely.”

IS Encryption Guide by AlyssaBereznak

Hillary Emails Back in the News, Again

Posted on February 11, 2016February 11, 2016 by Denise Simon

Yoga and wedding arrangements? Not so much..

State Dept: Top Official Didn’t Know About Hillary’s Server, Even Though He Was On Email Discussing It

DailyCaller: A spokesman for the State Department insisted during a press conference on Wednesday that Patrick Kennedy, the Under Secretary of Management at the department, was not aware Hillary Clinton maintained a private server in her home while she was secretary of state.

But that claim — made by spokesman Mark Toner — is a curious one given that emails published by The Daily Caller last month show that Kennedy was involved in an August 2011 email exchange with two of Clinton’s top aides and another State Department official in which Clinton’s private email server was discussed.

Whether Kennedy knew about Clinton’s private server is a key point in the ongoing email kerfuffle. In his role, the 42-year veteran manages all facets of State Department business, including personnel matters, logistics, information technology, and budgetary issues. He is also the official who has served as the State Department’s main point of contact with Clinton, her attorneys, and her aides throughout the ongoing email scandal. He sent the letters requesting that Clinton and her aides hand their emails over to the State Department.

Given his central position at State, it would stand to reason that Kennedy should have known — and should have been informed — that Clinton was using a private email server housed in her New York residence.

As one reporter put it during Wednesday’s press briefing: “How could he not know if he’s responsible for both [Diplomatic Security] and for the people who do the technical and computer stuff at State?”

But Kennedy knowing about the server would also raise questions about why the career diplomat allowed Clinton to use an email system was vulnerable to outside threats. Not to mention the risks posed by Clinton’s sending and receiving of classified information.

Kennedy’s name popped up on Wednesday when Fox News’ Catherine Herridge reported that he was one of the State Department officials who handled 22 “top secret” emails found on Clinton’s server. Clinton and her aides, Jake Sullivan, Huma Abedin, Cheryl Mills, and Philippe Reines all either sent the sensitive emails, received them, forwarded them, or commented on them.

The State Department has determined that the emails are so sensitive that they will be withheld from the Clinton records being released in batches at the end of each month since June.

Fox’s Herridge also reported that Kennedy told the House Select Committee on Benghazi during an interview earlier this month that he knew about Clinton’s personal email account from the beginning of her tenure, but that he was not aware of the “scope” of its use for government business.

A spokesperson for the Committee declined to comment on matters involving private interviews.

During Wednesday’s questioning, Toner said three times that Kennedy, who frequently emailed with Clinton about work-related issues, did not know about Clinton’s private server.

“He’s spoken to it before — or we’ve spoken to it before — that he did not have knowledge of the computer server that she set up in her residence,” said Toner, who also stated that Kennedy told the Benghazi Committee that he did not know about the server.

“What his knowledge or what his awareness at the time — other than what he has said already, or what we have said already — which is that he was not aware of her having a private server at her home,” Toner said later in the press briefing.

But an Aug. 30, 2011 email chain obtained by TheDC last month through a FOIA lawsuit shows that Kennedy was involved in a conversation that explicitly mentioned Clinton’s server.

In the email, Stephen Mull, then-executive secretary at State, thanked Cheryl Mills for alerting him to problems that Clinton was having sending emails on the personal Blackberry that she used to send and receive work email. The Blackberry was “malfunctioning,” Mull noted, “possibly because of [sic] her personal email server is down.”

Kennedy was copied on that email as well as on a response from Abedin. On top of indicating that Kennedy was made aware of Clinton’s use of a personal server, the emails also show that Abedin, Clinton’s deputy chief of staff and an official on her presidential campaign, vetoed a proposal to set Clinton up with a second Blackberry equipped with a State.gov email address.

“Doesn’t make a whole lot of sense,” Abedin said in response to the proposal. Clinton was never provided a State Department-issued Blackberry. Why Kennedy did not intervene at that time is anybody’s guess.

TheDC reached out to the State Department to find out more about the apparent inconsistency between Toner’s comments on Wednesday and the August 2011 emails. Perhaps Kennedy didn’t see the email? Perhaps he assumed that another email server that was linked to Clinton’s Blackberry was being discussed by Stephen Mull, the executive secretary of State?

But the agency provided few additional details.

“Today the State Department indicated that comments made by Under Secretary Kennedy to the Benghazi Committee were being misconstrued. Beyond that, we are not going to speak to this further,” ‎‎a State Department official told TheDC.

Hat tip Chuck!

The Double Life of a FL. Congressman

Posted on February 11, 2016February 11, 2016 by Denise Simon

Hello Ethics Committee….

Email Shows Concern About Alan Grayson’s Hedge Fund

Email correspondence from June 2015 between Representative Alan Grayson and his campaign manager at the time involves concern among his staff about the political damage Mr. Grayson’s hedge fund could cause his Senate bid.

For just a few additional facts on Grayson, his scandals and his history, go here. Even the Huffington Post has several items on his highly contested and perhaps even violent marriage, annulment or divorce.

Alan Grayson’s Double Life: Congressman and Hedge Fund Manager

WASHINGTON — The hedge fund manager boasted that he had traveled to “every country” in the world, studying overseas stock markets as he fine-tuned an investment strategy to capitalize on global companies’ suffering because of economic or political turmoil.

But the fund manager had an even more distinctive credential to showcase in his marketing material in June 2013: He was a “U.S. congressman,” Representative Alan Grayson, Democrat of Florida, a member of the House Foreign Affairs Committee. Now he is also among the leading Democratic candidates for one of Florida’s United States Senate seats.

This highly unusual dual role — a sitting House lawmaker running a hedge fund, which until recently had operations in the Cayman Islands — has led to an investigation of Mr. Grayson by the House Committee on Ethics.

The inquiry has become public, but emails and marketing documents obtained by The New York Times show the extent to which Mr. Grayson’s roles as a hedge fund manager and a member of Congress were intertwined, and how he promoted his international travels, some with congressional delegations, to solicit business.

Interviews and the documents show that Mr. Grayson told potential investors in his hedge fund that they should contribute money to the fund to capitalize on the unrest he observed around the world, and to take particular advantage when there was “blood in the streets.”

The emails also show how Mr. Grayson’s work for the hedge fund — which had $16.4 million in assets as of October and only for investors since it was established — at times interfered with his other duties. In August 2015, after Mr. Grayson introduced legislation calling for larger annual increases in Social Security benefits, he signed off on a plan to highlight the proposal at an event in Tampa, Fla., emails obtained by The Times show. But the plan was scuttled, two former aides said, when economic turmoil in China sent stock markets tumbling globally and Mr. Grayson had to turn his attention to the fund.

Ken Scudder, a spokesman for Mr. Grayson, disputed that account. “There has never been any time when Representative Grayson’s investment activities have disrupted any of his work, whether official or campaign-related,” he said.

Mr. Grayson says he has done nothing wrong. “Here is something that is not true: that I somehow traded on my membership as a U.S. congressman to get clients for this fund,” Mr. Grayson said in an interview. He added that in the last year he had refunded the full original investments put in by his two outside investors in a fund that had faced steep losses — leaving only Mr. Grayson and a family trust invested in the fund.

Mr. Grayson has closed the Cayman Islands branches of the hedge fund, and in September, after the ethics complaint was filed, he changed the name of the fund from the Grayson Fund to the Sibylline Fund, LP. He did so, he said, to try to assuage critics who said he was violating congressional ethics rules by naming a professional business after himself. Although Mr. Grayson said he did not agree that the name was a violation, “there was no point in arguing about it any longer.”

But Mr. Grayson’s activities have long concerned his campaign aides. In private emails in June, Mr. Grayson’s aides pleaded with him to close the hedge fund, convinced that its focus on investing in nations hit by political or economic strife, and its ties to the Cayman Islands, a notorious tax haven, sharply conflicted with his image as a scold of Wall Street — even if he had not done anything wrong.

“This is going to be the drip, drip, drip story that never goes away,” Doug Dodson, Mr. Grayson’s Senate campaign manager until the end of 2015, wrote in a June email to Mr. Grayson, saying his political opponents would “try to make you look like a hypocrite and a fraud and not the populist you claim to be.” Read the whole summary here.

Possibly up to 30 Accounts on Hillary’s Server?

Posted on February 10, 2016February 10, 2016 by Denise Simon

Official: Top Clinton aides also handled ‘top secret’ intel on server

FNC: EXCLUSIVE: At least a dozen email accounts handled the “top secret” intelligence that was found on Hillary Clinton’s server and recently deemed too damaging for national security to release, a U.S. government official close to the review told Fox News.

The official said the accounts include not only Clinton’s but those of top aides – including Cheryl Mills, Huma Abedin, Jake Sullivan and Philippe Reines – as well as State Department Under Secretary for Management Patrick Kennedy and others.

A second source not authorized to speak on the record said the number of accounts involved could be as high as 30 and reflects how the intelligence was broadly shared, replied to, and copied to individuals using the unsecured server.

The State Department recently confirmed that the messages in question include the most sensitive kind of intelligence. On Jan. 29, Fox News first reported that some emails on Clinton’s server were too damaging to release in any form. The State Department subsequently announced that 22 “top secret” emails were being withheld in full; these were the messages being handled by more than a dozen accounts.

Kennedy recently told the House Benghazi Select Committee that he knew about Clinton’s personal email account from the beginning, but did not understand the “scope,” thinking it was for reaching husband Bill Clinton and their daughter Chelsea — and not for the exclusive handling of State Department business. Kennedy’s testimony appears to conflict with emails released through the Freedom of Information Act that show he routinely sent and received government business from the Clinton account.

Fox News has asked the State Department to comment on the email accounts that shared the highly classified information, and how it was that Kennedy did not understand the “scope” of Clinton’s personal email being used for government business.

A spokesman for the intelligence community inspector general, which has been reviewing the classification of the Clinton server emails, had no comment.

*** From ABC and the White House last year:

President Obama Knew Hillary Clinton’s Private Email Address, But Not Details of Server

President Obama exchanged emails with Secretary of State Hillary Clinton at her private address — @clintonemail.com — but did not know the details of her account or how she would comply with administration policy and federal records law, the White House said today.

“Yes, he was aware of her email address. He traded emails with her,” Obama spokesman Josh Earnest told ABC’s Jonathan Karl. “But he was not aware of her personal email server or that she was using it exclusively for all her business.”

Asked how often Obama and Clinton emailed, Earnest said he “would not describe the number as large.”

In an interview Saturday, Obama said he learned of his secretary of state’s private email address use through recent news reports, “the same time everybody else learned it.”

Earnest explained that the president was referring to details of her email system and the fact that she had not been in compliance with State Department policy for nearly six years after failing to submit the records for transfer to government computers.

Clinton has called for the public release of 55,000 emails turned over to the State Department for archiving. Her team handpicked the messages off her private server that pertained to official business; Clinton’s camp said roughly 10 percent were of a personal nature and not handed over.

“I’m glad that Hillary [has] instructed that those emails about official business need to be disclosed,” Obama said Saturday.

Earnest said an independent, third-party review of Clinton’s private server should not be required, but suggested that the White House would not oppose one if she elected to do so.

The former Secretary of State has remained mum on the email controversy. She has yet to explain why she exclusively used private email through a server built inside her New York home while Secretary of State, or why it took six years to submit the records as required under the department policy she oversaw.

*** Some emails being withheld could have Obama’s communication exchanges included:

“We can confirm that later today, as part of our monthly [Freedom of Information Act] productions of former secretary Clinton’s emails, the State Department will be denying in full seven email chains”, he said.

In the past few months, Clinton had been facing issues of trustworthiness during surveys as a result of evidence of the existence of top secret material in her private email server.

Clinton has encouraged the State Department to release her email as quickly as possible and, when delays have occurred, her campaign has been quick to point out that they do not control the schedule, which was set by the court and government bureaucrats.

Officials in the State Department have asked for additional time to vet the messages because of the recent snowstorm that hit Washington.

“This seems to be over-categorization run amok”, it said in statement.

So far, officials haven’t really described what’s in the emails or even if Clinton sent them.

The presidential hopeful has acknowledged that her choice to make use of a personal email server at her Nyc house was a blunder. We feel no differently today. But as is often the case with the Democratic presidential candidate, she dodged the question and gave an inconsistent answer.

The State Department is separately withholding 18 e-mails comprised of eight e-mail chains between Clinton and President Barack Obama, Kirby said. Such operations are widely discussed publicly, including by top USA officials, and State Department officials debated McCullough’s claim.

The AP reported last August that one focused on a forwarded news article about the classified US drone program run by the Central Intelligence Agency.