Intellectual Property Law

Ex-Fed: Privacy Advocates Should Go After China, Lay Off NSA

By Kevin Poulsen

WASHINGTON — Internet privacy advocates are doing the right thing by protesting warrantless government surveillance of the internet — they’re just going after the wrong government, a former lawyer for the National Security Agency said Tuesday.

Speaking on panel at the Computers Freedom and Privacy Conference here, one-time NSA general counsel Stuart Baker raised the specter of Chinese government spying, focusing in particular on the so-called GhostNet findings reported by security researchers at the University of Toronto in March.

Those researchers found the a commonly-available Trojan horse called “gh0st” had been deployed against foreign embassies, international news media outlets and non-governmental organizations, primarily in South and Southeast Asia. More than 1,200 computers were targeted, including some at the offices of the Dalai Lama. The researchers traced the network to island of Hainan in China.

“It’s significant, I think, because what was done here can be done to any of us,” said Baker. “The prospect that this can be done to those sorts of sophisticated operations on such a scale, really raises the prospect that all out network tools can be used against us. This is a very troubling development and one that I think privacy organizations should be focused on” instead of worrying about the NSA.

Of course, deploying malware is, at best, a low-rent alternative to wiretapping internet backbones, as the NSA is alleged to do.

Baker, who served as General Counsel of the National Security Agency from 1992-1994, famously led the charge for the controversial Clipper Chip, a hardware encryption device the Clinton administration hoped to see in wide consumer use, which was openly designed to allow the government to obtain users’ private crypto keys with court authorization.

In 2007, Baker’s subsequent work as assistant secretary for policy at the Department of Homeland Security won him a “Big Brother Award” from the non-profit group Privacy International in the category “Worst Government Official.” Baker joked Tuesday that he cleared a space on his mantle for the trophy — which shows a human head being crushed under a jackboot — but Privacy International never delivered it.

Tuesday’s panel, moderated by Threat Leveler Ryan Singel, plumbed the future of “security versus privacy.” Baker ranked China as the biggest threat to privacy, while a show-of-hands at the conference ranked the U.S. as number one, edging out the Chinese government.

Security expert Bruce Schneier said the rivalry between security and privacy is illusory. “Privacy is a part of security,” said Schneier. “There are all sorts of places where we give up privacy to get security ? but the way we do that is with oversight.”

FBI general counsel Valerie Caproni took the occasion to defend the FBI against an upcoming report from the Justice Department’s inspector general addressing the bureau’s use of “national security letters” — a kind of self-signed subpoena, enriched by the Patriot Act, that lets the FBI access phone, internet and bank records without a warrant. Previous investigations have found that the FBI abused its NSL power, and “it will come as no surprise to you that that [new] report will be extremely critical of the FBI,” Caproni said.

But she said that the report, due in two months, only addresses FBI practices prior to 2006, when the bureau made reforms to its process. She defended the tool as critical to the FBI’s mission. “We need NSLs to get the basic building blocks of an investigation,” Caproni said.

Singel wondered if the government’s spying, and other measures, should be credited for the lack of successful terrorist attacks against the U.S. since September 11, 2001. Schneier said that without more disclosure, it’s hard to know; there have been no cataclysmic meteor strikes either, and nobody gives credit to the Bush administration for keeping Earth safe.

“I look at the terrorist plots thwarted, and they seem kind of laughable,” said Schneier. “The latest one about the synagogue bombs, these guys were kind of nut cases. And it seems to me that without an FBI informant giving them fake weapons, they’d still be sitting stoned in the back of a restaurant talking about it.”

“We can certainly say from surveillance that we’ve detected plots and disrupted them,” countered Caproni. “There have been no acquittals of nincompoops on grounds of entrapment since 9/11 … It’s easy to say from the security of this room that these people were just engaged in crazy talk. But crazy talk sometimes results in people getting together and doing crazy things.”

“These things sound unlikely until they happen,” said Baker. “And then they sound inevitable.”

Full post as published by Threat Level on June 02, 2009 (boomark / email).