Snowden's Poke in Obama's Eye

We got to see Edward Snowden on almost every news outlet, again today, wishing us all a Merry Christmas.  None of those outlets mentioned that he was not in Great Britain for this show, but in Russia, where he is not going to be allowed to speak unless it serves the Russian interests.  For an enlightening interview see Putin's press conference, where he talks about Snowden and spying, saying spying is a normal behavior in almost every country and not to be too concerned about it.   http://www.washingtonpost.com/blogs/worldviews/wp/2013/12/19/putin-on-obama-i-envy-him-because-he-can-do-something-like-this-and-get-away-with-it/

At the same time, he is using Snowden to poke a finger in the eye of the U.S. President, almost every time he thinks he can.  His quote from the press conference was that he envied Obama because he could get away with it.  Then he jabs him with another Snowden interview, just to see if he will.

 Obama has done the same thing, so they are like two kindergarten children smacking each other, out of spite.  Billie Jean King, who Obama sends to Russia to represent the U.S.,  is not going to make him any friends in a town where the mayor has threatened to arrest any openly gay person.  We shall see when the time comes, how that works out for either of them, but Snowden is something else.

Snowden is a daily reminder that Obama acts like every other world leader when he spies.  The Chinese, Russians, Israelis, French, Germans, and British have all gotten caught spying, probably more than once, in the last few years.   The world expected something else from Obama, and we have to wonder what that was.  Maybe that was why he managed to get a Nobel Peace Prize before his Presidential jet ever got warmed up.  The world thought he was different.  Putin is telling us, he wasn't.        Amazon books:   

Snowden Critiques without merit

Matt Crowley at the Wall Street Journal, noted today [ http://blogs.wsj.com/washwire/2013/12/22/snowden-criticizes-u-s-panel-overseeing-surveillance/ ] that Edward Snowden, criticized the presidential panel reviewing U.S. surveillance programs, saying it was a hand-picked group by the government [and it ]  only suggested cosmetic changes".  Crowley added that this report came from a Sunday Brazilian TV report, actually done by e-mail through a U.S. attorney.  You may remember that Snowden offered to trade information about U.S. involvement in spying for sanctuary in Brazil, but he is now backtracking because he found out that could be construed as traitor-like behavior.  Throughout all of this, the Russians are lurching to save themselves the possible difficulty of having reporters show up at his door when the Olympics are going on in Sochi.  They may have to say no to the International press, or send them off to interview Pussy Riot instead.  They are finally out of jail after criticizing the government.

Snowden shows his age and experience with this type of criticism.  The complicated issues the Panel had to try to resolve, were largely born from September 11.  We were willing to put away some freedom to prevent airplanes from plowing into the buildings our spouses lived in all day, and most of us haven't forgotten why we did.  Mine was in the Pentagon, in the wing where the plane hit and I certainly wanted to get even with someone for what they did that day.  It took four hours to find that she wasn't one of the casualties in her office, where several people died.  Snowden was 18.

So, he turns spy, figures out how to get hired by NSA, hacking the account of the person who developed the selection criteria, and systematically steal a million pages of documents (not a million documents, as some are saying).  Then, he runs to China, pretending that he can protect what he takes with him from the Intelligence Services of China and Russia.  He is older by that time, but obviously not a lot smarter.

The ACLU is advertising its stance, saying that Snowden should be considered innocent, until proven guilty, something they seldom do for the Intelligence Community.  Any whiff of impropriety by someone in CIA, NSA or the FBI and the ACLU is off and running.

If Snowden is innocent of anything, it is because he is not able to comprehend what he has done.  It's coming to him.  Spying has a cost, and most spies don't die happy.  The Chinese didn't want him to stay.  The Russians are trying to give him incentive to move somewhere else.  Nobody wants him, because nobody trusts his motivation.  Spies will never be trusted by anyone, regardless of how much good they may think they have done.  Remember Benedict Arnold, the war hero gone bad.

In 1985, Ronald Pelton, former NSA analyst and contractor, was giving information about the same kinds of communications programs to the Russians.  He finally admitted that some of the things he gave them "might have caused some personal jeopardy" to people in the programs.  Snowden will realize that some of the things he has given to the press are more than issues about perceived abuses of monitoring.  They will hurt the country and a few individuals too.

Having Snowden critique the President's Panel is like having a spy, in any other time, saying how easy it is to steal from a democracy.  It is.  We are far more open and trusting than most of the other countries of the world.  We share information.  We debate, in public, about things Russia and China never let their own citizens speak about.  Yes, there are other things we do to protect our citizens that we don't talk about, but that is largely because the other countries don't play by the same rules.  We need to keep quiet about those things.

He fled to China where the Chinese have internal records of every citizen of their country -- police, their equivalent of the CIA and FBI, IRS and 36 other agencies put information in those files.  He hides in Russia, where the press has been beaten up for complaining about the administration of government, corruption is rampant, and crime is as bad as it is in China.  I hope he stays forever.    Amazon books:   

Security Takes Backseat on Obamacare

In a final surrender to public criticism of the Obamacare website, news stories focused on the appointment of a Kurt DelBene, formally the Microsoft Office lead, to oversee the development of the website.  Considering his status in such a large company, odds are, he has a bigger job than helping the CMS folks out with a website that is still broken.  Why anyone with this pedigree would agree to a task like that, is beyond me.

A New York Daily news piece quoted the HHS Secretary said his focus would be on increasing system stability, redundancy and capacity, and the user interface.  Tacked on the end, like the HHS security has been all along, is a short piece that adds he will continue to "prioritize security and privacy issues."

“Kurt will ... focus on increasing system stability, redundancy and capacity, and building on improvements to the user interface, while continuing to prioritize security and privacy issues,” U.S. Health and Human Services Secretary Kathleen Sebelius said in a blog posting.

http://www.nydailynews.com/news/politics/microsoft-executive-named-oversee-obamacare-website-article-1.1550918#ixzz2npl7bHRI

The kinds of changes that are being made will continue to change the ability to secure this data.  Change is usually not a security officer's friend.  We are already seeing indications of fraud in user registrations, no doubt started by the mills that create phony Medicare and Medicaid customers and treat them with fictitious doctors, multiple times, until somebody in law enforcement finally takes up the case.  There are millions of dollars in fraud that can't seem to be stopped, and this will make those numbers seem small.

Years ago, a risk assessment of the IRS electronic filing system told the CIO the risks to deploy the system were too great and it should be postponed until it could be fixed.  At that time, he didn't even want to see the report and did not look at it.  In the first year, there was a fraud in Texas that got a few people $8 Million in refunds that they weren't entitled to.  That was only one of many.  The problem didn't affect the IRS very much, but it did affect tax payers who had "already been paid" for their refund.

The people who accept risk today are accepting risks for data they don't own, don't control, and affect every man, woman and child in the U.S. who pays taxes or receives Social Security.  Identity thieves were not even thought about when electronic filing was introduced, but now it is an advanced and sophisticated crime, not fairly portrayed in the movie by the same name.  Gangs of good hackers in Eastern Europe are exceptionally good at creating credit cards and bank accounts in somebody else's name.  All they need is raw data.

So, while HHS plays games with our data, we will hear about it in a few months, when the bills start coming in.   Then, maybe we can get HHS to tell some of the people who had their data stolen that they got hacked.  If they know....    Amazon books

NSA on 60 Minutes

There seem to be differences of opinion about the NSA story on Edward Snowden at http://www.cbsnews.com/news/nsa-speaks-out-on-snowden-spying/  if you missed it.  There are still a few people out there who believe Snowden was a patriot trying to expose a bad government who spies on its own people.  I don't like NSA, but most of those who believe that Snowden did what he is accused of because he had a patriotic streak are misguided, at best.

If you follow this story on 60 Minutes, you will notice a couple of things:  (1) Snowden planned to work for NSA long before he was hired by them.  The story says he hacked the computer of the person who put together the screening criteria for new people.  That is careful planning and way beyond those "How to Get a Job in a Government Agency" articles.  (2) He used different names of people to steal information because he knew the systems he was on were monitored.  (3) He stole 1.2 million pages of material, which is time-consuming and risky.  He put himself at risk every day, planned it out, and got away with it for the time being.  (4) The Intelligence Community was worried that the controls on computer systems would allow this to happen in other places.

This isn't the way patriots work.  This is the stuff of spies.  In the old days, spies could get a few files and get them out of the country.  Now they just take computers.

You would think, that computer security would be the best at places that have the most to lose.            Amazon books:  

Obamacare Website (4)

Just when it seems like we have heard all about the Obamacare website, something new happens.   Politico, from the 12th, revives the discussion about security of the website, and makes us wonder about the future of the leadership in HHS.  From my days working on the Hill, they probably crossed a line that is not crossed very often.

The Politico story is at http://images.politico.com/global/2013/12/12/hhstoissa.html

House Oversight and Government Reform Committee Chairman, Darrell Issa, issued a subpoena to MITRE for the security review of the website.  As most of us know, they only issue a subpoena if they have asked for the document and not received it from HHS.  One could reason that has happened.  It isn't that unusual that someone ignores a request for documents, especially when there have been so many over the matter of the website construction and management.  The system is an IT nightmare, and however much we are assured it works for most people, it isn't secure enough to be used by most of those people and HHS knows it.  They have accepted the risk and they are diligently working on remedial correction of the deficiencies.  That, at least, is what they want us to think.

However, when the subpoena is issued, they have less wiggle room.  Politico speculates that it was because HHS was afraid the Committee would release the information to the public.  Actually, Congress has released sensitive information to the public in every administration and by both political parties, so that should not come as a surprise to anyone.  In this case, they wouldn't unless they thought it was the only way to keep consumers of the service from putting their data at risk.  There are always two sides to this story, and this is the side of HHS:

“As you are aware, MITRE shares our assessment regarding the risks from public disclosure of these documents and has warned, most recently in its letter of December 4, 2013, that the information they contain ‘could be used to hack the system … and may pose a risk to the confidentiality of consumer information accessible through healthcare.gov if disclosed,” Esquea wrote, further offering to let a third party determine whether their publication could imperil the website.

While we all might share this concern, I wonder why they allow the risk of operating the website to begin with.  Testimony on this, so far, indicates there were almost no serious security deficiencies, to the point that the system was allowed to operate with some known "minor" risk elements, and an incomplete report from MITRE.  All the good Committee is trying to do is find out how serious those minor things really are.  They will find it hard to justify releasing risk information while the system still operates, and shouldn't do that.

On the other hand, if MITRE and the HHS staff feel hackers might be able to exploit existing vulnerabilities in the system, why didn't they think they were serious enough to not stop it from going operational?  It isn't risk to HHS.  It is risk to my data and millions of others who are the potential users of the systems.  Who said that could be done?

You can read HHS' full response below and wonder how serious this really is.  Hackers are far brighter than most political appointees, especially in their chosen fields.  If there were vulnerabilities so serious that MITRE did not think they should be made public, we can almost say for certain that hackers already know about them.  It is certainly not something where they needed to wait for a published report.

But, what will come back to haunt them one day, is putting in writing that they don't trust the Members of Congress to protect information they are given.  You might say it in a back room or office, even at a party caucus.  Saying it in writing is never smart.

Congress gets Top Secret information almost every day and when I worked in both the Senate and House, it was being protected pretty well.  They surely can handle this kind of risk assessment and appreciate the sensitivity of it.  The sentiment that they might not, will not be well received by any member of either party.  Amazon books:  

The Chinese Propaganda Machine

Nobody is perfect.

According to an article published today by PBS, one of the smaller parts of the Chinese propaganda machine, tried to justify the unearthly smog in Beijing by describing some of the benefits to China.  To me, this has the same ring as the doctor who said, "That tumor is malignant.  Good thing we caught this early."

The example used was the ability to mask sensors which might be used to target Beijing with missiles, or observe it from outer space.  If they really think it is such a good idea, they might want to increase the smog, not only in Beijing, but also in all the other major cities of China.  We would certainly have a hard time launching missiles towards those big cities, if we decided to do that.  Probably nobody has had that idea, since the Boxer Rebellion, but it could happen.

Maybe the military group that thought up this brilliant justification knows something we don't.  If they do, the Chinese have decided to mask their assault by fogging up their capital.  Once the attack is over, they will let the civilians breathe again.  You have to admit, they are really clever.  Amazon books:  

Information about China

There is a helpful tutorial on China's power structure, put together by Reuters.  It shows the relationships between the political leaders, the military, the Communist Party and social structure of the country.  If you have never seen it before, it is worth a look.

http://connectedchina.reuters.com/

Snowden's no Whistleblower

There was a BBC article over the weekend repeatedly describing Snowden as a whistleblower.  That is wishful thinking by the writers, who will not be named, because they aren't alone.  Many of the people in the public press describe him that way.   Whistleblowing is "making a disclosure evidencing illegal or improper government activities".  In a broad context, that means I can say the government is doing something improper and become a whistleblower.  That is what has lead to the use of the term in almost every venue from Civil Rights violations to the hallowed halls of OSHA, where the improper use of a thermostat can qualify for a whistleblower report.  The new DODD-FRANK provisions allow the reporting of wrongdoing by businesses.  That will be even more interesting, but none of this is whistleblowing in the context of Edward Snowden.

It takes more than a public disclosure of something a person thinks should be public to be named a whistleblower.  A lot of what the Federal government does would not make the public happy, if they were provided every detail.   The reason you don't see 10,000 whistleblower cases every year in the public is common sense of most people who see government wrong-doing.

Most of them work for the government and bring those matters to the attention of people they work for.  In my time working for the government, I reported a few things that were either criminal or unethical.  None of them were welcome information to the people who got the reports, but in only one of those cases did any type of recrimination occur.  Even in that case, I didn't need whistleblower protection because the matter never became public, and the person who was named was "taken care of" although still employed.  At the time,  I didn't like that, and it became the central reason I retired from government.  Being away from government for several years has changed my mind about what was done.

We need a Whistleblower Protection Act for Federal employees who see wrongdoing and report it, only to find themselves ostracized and discriminated against.  Especially, where the government is doing something classified and the matter being reported on requires the use of classified information.  There are two sides to this.

First, the public disclosure of classified information, by definition, harms the United States.  Newspapers don't seem to mind this, but a few government people who give them information have forgotten that part.   There is no longer very much discipline in handling disclosures of classified information, regardless of their source.  We have gotten the idea that it is OK, when it isn't.  Find out who is doing it and prosecute them.

This isn't new, by any means, but the scope is new.  There are, even without Snowden, enough disclosures every day to cause us significant harm.  Our enemies love it; our friends don't trust us, and the people inside government get the idea that nobody cares.  That would be because there aren't enough who do.

Agencies that think Whistleblower Protection is something they can ignore need to remember that part too.   Every time they ignore a  whistleblower internally, they run the risk of having someone take things to the public that shouldn't be there.  There are some famous cases of this in the last few years.  However, the Whistleblower Protection Act specifically exempts the kind of person Snowden was - a contractor, not a Federal employee, and an Intelligence Community employee - neither one of which get protection.  President Obama widened those exemptions.

We should start thinking about protecting our country instead of the individual rights of newspaper reporters and people who give classified information to the press.  The only ones who appreciate our situation are the Russians and Chinese who have both benefited from what he gave to them, and already do a good deal more to prevent the same thing from happening in their own countries.  Amazon books:  

Chinese Justice: No Good Deed Goes Unpunished

Over the weekend, The Financial Times had an interesting article about Chinese justice [Tom Mitchell, China link emerges in case of Irish gangster, Financial Times, Noverber 30/December 2 2013]   which tells more about China than the Chinese media controls would normally allow.  The story concerns a Hong Kong investigator named Danny Tsang Chi-fai who helped Ireland catch a drug dealer/counterfeiter named Paul Meehan, or Dr. Coke, as he was known in the papers.

The Irish were investigating a less well-known area of counterfeit cigarettes, and the article mentions that 1 in 7 cigarettes sold in Ireland is counterfeit.  That seems like a lot of counterfeiting, but my only experience with that sort of thing was helping with an investigation of smuggling real cigarettes from North Carolina into New York, which is hardly in the ball park with the scale of this.  The EU is saying they have 10 billion euros worth of them imported each year.

Along the way, the Irish police found guns, cocaine, grenades, heroin, and a little bit of marijuana in with the cigarettes and changed their priority on the investigation.  They got help on the investigation from Tsang, who was apparently getting paid by someone else, probably a cigarette manufacturer, though a small company, Douglas Consulting, now closed up [See Lana Lamb, Hong Kong private eye 'abandoned' by Northern Irish police, South China Morning Post, 3 December 2013].

So, here we have a private investigator, running an investigation on counterfeit cigarettes, working for the Irish police (and others) and he is arrested and charged with dealing in counterfeit cigarettes and put in jail for 10 years.  The Chinese benefit from puffing the story that Tsang was abandoned by the Irish Police, who would be hard-pressed to get him out of jail, to discourage others from helping with these types of investigations.  These kinds of investigations cause trouble for local political leaders who have counterfeit cigarette operations in their towns, among the thousands of things being counterfeited in China.

Politics, family and crime are mixed in China in ways that encourage a local police official to arrest an investigator to keep others from following behind and ruining a good thing.  In my first book, I compared this kind of conduct to the HBO series The Sopranos.  They are more like the mafia than any business in the West.  Tsang must have stepped on some big toes to get 10 years for a crime he was not involved in.  His company is now out of business, but you can bet the business of counterfeit cigarettes is not. Amazon books: