IC on the Record

The rules change all the time and are subject to layers of oversight. See https://icontherecord.tumblr.com/ - FISA court (judicial) - House / Senate intel committee (legislative) - IC Inspector General (executive, they police the agency itself)

http://icontherecord.tumblr.com/ Really? I didn't realize that our intelligence services were using Tumblr as an official communications channel now.

In related, but largely unimportant news, the federal government has created a tumblr account to post its surveillance-related propaganda: http://icontherecord.tumblr.com/ and it's as ugly as anything you've ever seen come out of the federal government. I still can't believe that someone makes those graphics for a living, and still makes them look that bad.

I dispute that Edward Snowden actually made a formal whistleblowing complaint. He claims he went through the channels, but never specifically stated he actually made the type of complaint that goes to the IG or to the U.S. Congress. We see in 2019 the Executive Branch is going to great lengths to discredit a whistleblower, but it is indisputable that a complaint was made. I have not heard any statement from Snowden claiming that the government was making false statements about this matter. The government did publish an email [1] that Snowden sent to a training coordinator, disputing the ability of executive orders to supersede law. It is possible that the government did this as a distraction and it is not actually what Snowden is referring to. Nevertheless, Snowden never gets specific about his whistleblowing attempt, despite going into great details about other aspects of his story. 1. https://icontherecord.tumblr.com/post/87218708448/edward-j-snowden-ema…

We haven't actually been getting the data to make an informed decision on these, either. It took nearly a year to get any sort of numbers out of the government regarding how many people were being targeted[1] and they still haven't given any numbers on incidental collection. Meanwhile, most of the the media has been claiming that the communications of millions or even billions of people are being swept up, and now the Washington Post is actually looking at the data they've had for the last year and saying the number is more likely to be somewhere around 900k worldwide. I'm not saying that's necessarily a great number, but that's orders of magnitude less than what we've been led to believe. Nor does the article go into much detail on what "incidental" really means versus "targeted" - are these people in contact with the actual targets, or completely unrelated? Is there a better way to protect the privacy of these people without compromising actual intelligence operations? If not, which side should we err on, and how far? These are tough questions to answer - especially without hard facts. It's hard to have an honest debate when we the people are left trying to discern the actual facts somewhere between the secrecy and sensationalism. [1] http://icontherecord.tumblr.com/transparency/odni_transparencyreport_c…

DNI James Clapper has issued an official statement: http://icontherecord.tumblr.com/post/60712026846/statement-by-director… or http://www.dni.gov/index.php/newsroom/press-releases/191-press-release… He manages to twist it into a matter of defense against terrorism: > Our collection of information regarding terrorist financing saves lives. Since 9/11, the Intelligence Community has found success in disrupting terror networks by following their money as it moves around the globe. International criminal organizations, proliferators of weapons of mass destruction, illicit arms dealers, or nations that attempt to avoid international sanctions can also be targeted in an effort to aid America’s and our allies’ interests. > As we have said previously, the United States collects foreign intelligence - just as many other governments do - to enhance the security of our citizens and protect our interests and those of our allies around the world. The intelligence Community’s efforts to understand economic systems and policies and monitor anomalous economic activities is critical to providing policy makers with the information they need to make informed decisions that are in the best interest of our national security.

Mostly true. (They won't deny EVERYTHING because that wouldn't be believable.) If this argument is made convincingly in Congress, the NSA could lose funding, but that's a hard decision to make. Even if I am opposed to individual wars, that doesn't mean I would support complete disarmament. Foreign intelligence (and counter-intelligence) is an important part of any modern military. There needs to be public oversight without crippling US intelligence efforts. It's not clear how to accomplish that oversight. That is the discussion we really need to be having. ==== Edit: Looks like there is an official effort to increase oversight of the NSA. Quoting from a Sept 4 article on http://icontherecord.tumblr.com/ "On August 12, 2013 President Obama directed the establishment of the Review Group on Intelligence and Communications Technologies." Link to the press release about this review group: http://www.whitehouse.gov/the-press-office/2013/08/12/presidential-mem…

A good time to remember the official US Intelligence Community statement and policy/lie on 0days, as given post-heartbleed: When Federal agencies discover a new vulnerability in commercial and open source software – a so-called “Zero day” vulnerability because the developers of the vulnerable software have had zero days to fix it – it is in the national interest to responsibly disclose the vulnerability rather than to hold it for an investigative or intelligence purpose. https://icontherecord.tumblr.com/post/82416436703/statement-on-bloombe… https://news.ycombinator.com/item?id=7575802

Please review the post linked from the beginning of the linked The Intercept article, here: https://icontherecord.tumblr.com/post/155766682978/fact-sheet-on-eo-12… You'll see that SIGINT sharing is not a free-for-all in any manner, it is restricted. It seems dishonest to tell people the Coast Guard can use it to compromise SMS 2FA (I'd be far more worried about other countries compromising SMS 2FA in a close-access scenario, using an "IMSI catcher" or similar device to intercept the incoming message).

Just a heads up, missing from the NYTimes highlights is a conclusion that RT ran anti-fracking activist programming as well, with the suggested goal being to increase dependence on Gazprom oil: http://dailycaller.com/2017/01/06/us-intel-report-confirms-kremlin-pus… To get the most complete information it is usually a good idea to read this kind of report directly: https://icontherecord.tumblr.com/post/155494946443/odni-statement-on-d… The part about the anti-fracking stuff is on page 8.

http://icontherecord.tumblr.com/post/82416436703/statement-on-bloomber… But also, straight from the mouth of a USCYBERCOM strategist speaking to our class the other week. And also, just plain logic. I pointed out here on HN even before the ODNI released the statement I linked above that Heartbleed is far more damaging to the USG itself than any intel value NSA could have hoped to achieve from it. With the other vulns NSA would have stockpiled they don't need Heartbleed, and leaving Heartbleed open would have hurt a lot of USG (and just as importantly, private US) infrastructure, so even going by crazy USG logic the right thing to do would have been to disclose it, just as NSA has fixed other open source security flaws over the years.

There is certainly a lot of things that NSA may do, but the website references FISA 702, but doesn't understand it: http://icontherecord.tumblr.com/topics/section-702 This is not a back door but an order given to a US company AND the person CANNOT be in the US, regardless if the person is a US person or not.