Snowden files show NSA's AURORAGOLD pwned 70% of world's mobe networks The NSA, and its British counterpart GCHQ, snooped on innocent telco employees and standards bodies to tap into mobile phone networks worldwide, according to the latest leak from the Edward Snowden archive. The mobile tapping system, dubbed AURORAGOLD, successfully cracked 701 of an estimated 985 cellular networks worldwide, …
Oh, but they *weren't* doing wrong! After all, as they said: "NSA collects only those communications that it is authorized by law to collect in response to valid foreign intelligence and counterintelligence requirements..."
Of course the fact is that the laws their actions were authorised under were so broad and sweeping and the "valid foreign intelligence and counterintelligence requirements" so far-reaching that they had virtual carte blanche to do what the hell they liked.
@Graham Marsden: In addition to the sweeping laws, we have the special "secret FISA court" that even if they were acting outside those sweeping laws, very few if any of us proles would even be able to find out about it. And if someone did, they would probably go to jail. Like Chelsea Manning, Julian Assange, et al.
@Phil Koenig: The fact that most FISC proceedings have been kept secret may or may not mean they are not doing the job the Congess intended. The fact the you, or I, do not know about it has no evidentiary value whatever. What has been released, though, suggests they are doing it to a significant degree, and cases headed for the Supreme Court are likely to clarify that and, perhaps, modify what they do going forward.
Manning went to prison for copying and releasing to Wikileaks a large quantity of classified material, including private diplomatic correspondence that was quite embarrassing to the US government and certainly did nothing to promote peace in the Middle East or anywhere else. Assange has so far skipped not only jail, but questioning in a matter that might or might not bring him jail time. Et al? Edward Snowden surely would be facing some prison time, for the exact same offense as Manning, if he were to return to US jurisdiction but does not seem to be inclined that way.
@tom dial: "...to a significant degree". Heh. I'll have to remember that handy phrase. :D
Making a lot of assumptions there about legality and appropriateness that I daresay you're not in a position to make. Unless you're truly a national intelligence insider with special personal access to details the rest of us do not have. The evidence *I've" seen - as just one of the perhaps slightly more informed than most riff-raff - suggests otherwise.
What Manning exposed was widespread breaches of both US/military policy as well as international law. The evidence *I've* seen is that this "embarrassment" was a good thing, and virtually no one in the domestic intelligence field, military or civilian sphere were physically harmed by those revelations either. As for whether or not it "promoted peace" - I'd say it certainly had some positive impact since revealing the duplicity of the USA in such matters is important for the other parties to know about in order to make sound decisions. And oftentimes those sound decisions do not go the way the USA would like them to go. Oh well.
Assange may as well have been be in jail for the last 2 years. The amount of money the UK spends making sure he stays there is surely at least a couple of orders of magnitude higher than what would be spent keeping him in prison, too.
The bottom line is that digital technology has been an enabler of many things, and a catalyst for societal paradigm-shifts in many areas, including law-enforcement and surveillance. Unfortunately the dimwits in the USA who write and enforce the laws are mostly either A) clueless about the serious societal implications about the implications of this paradigm-shift especially wrt to individual privacy and freedom and its effect on a democracy in general, and/or B) so indebted and/or entrapped by larger powerful military-industrial-political forces that they simply are afraid to say "No" to them. The net result is a disturbingly quick descent into the kind of dystopian society that was formerly only written about in science-fiction.
"The fact that most FISC proceedings have been kept secret may or may not mean they are not doing the job the Congess intended."
One thing it does mean is that there is something very wrong with US concepts of democracy. Very occasionally there may be a case for holding court proceedings in camera (and no, that doesn't mean putting them on TV) but a secret court to quasi-legalise actions which appear to be non-constitutional cannot be justified in an open society.
The question of whether NSA operates constitutionally or not will be decided in due course by the US Supreme Court, not in the comment section of a UK based technical news web site. Aside from that, it is clear that the Congress intended and authorized the FISC to operate in secret, for reasons some might disagree with and which certainly are open to abuse. The silent implication that a court dealing with national security matters is unique to the US, however, is incorrect.
LOL, look at all the angry down votes because Tom posted a few and simply verifiable facts! I guess they'll be really upset to hear the ECHR judged that GCHQ hasn't breached any human rights (http://www.bbc.com/news/uk-30345801), despite Amnesty International's righteous shrieking. Did El Reg miss that story?
To be honest Matt, I am unsurprised by these sorts of decision. The real question we should be asking is "Are the laws that underlie these powers reasonable where the ability to compromise communications of those in legitimate surveillance also means that all those communications from people that are not targets of surveillance should remain entirely obscured and not made vulnerable as a consequence of legitimate operations?". That's a much more pertinent question to my mind.
To a first approximation, foreign intelligence is the result of combining and analyzing data from a variety of sources, some of them foreign, about the capabilities, assets, intentions, and plans of foreign nations, groups, and individuals thought to have an impact on the US, its capabilities, assets, public and private organizations, citizens, and residents. That covers a lot, and it is far from obvious that the laws, executive orders, and the agency instructions and regulations that derive from them, actually are overly broad. The NSA and other nations' similar signals intelligence agencies play a significant role in intelligence production. The NSA diffesr from many others in being ratherl better funded than most and having more of their internal activities exposed, by Congressional oversight committees, by authors such as James Bamford, by whistleblowers such as William Binney, and lastly, by Edward Snowden and those who publish the materials he copied and removed illegally.
AURORAGOLD appears to be an activity aimed at developing, maintaining, and upgrading the NSA's capability to collect and analyze data from cell phone communications, an activity clearly a prerequisite to theiir foreign intelligence mission. Nothing in it surprised me, nor should it have surprised anyone who knows anything about history, let alone anyone who has paid the least attention to the news over the last year and a half. The most disturbing thing in the documents linked and reported upon here and by the Intercept is the apparent intent to inject vulnerabilities into communication systems. It is to be hoped that Bruce Schneier is correct, and they are waiting passively to identify and exploit design and implementation weaknesses.
All that you touch
All that you see
All that you taste
All you feel.
All that you love
All that you hate
All you distrust
All you save.
All that you give
All that you deal
All that you buy,
beg, borrow or steal.
All you create
All you destroy
All that you do
All that you say.
All that you eat
And everyone you meet
All that you slight
And everyone you fight.
All that is now
All that is gone
All that's to come
and everything under the sun is in a giant NSA data center in Wyoming.
All that's to comeand everything under the sun is in a giant NSA data center in Wyoming. …. Ben Bonsall
That may be their plan, but it is quite delusional, BB. And a sign that both critical strategic and tactical intelligence is missing in those and/or that which is providing them with viable actionable information for intelligent missions and virtually real theatres of operation. It does though open up opportunities for the supply of that which is needed to be seeded and fed into systems.
However, for whenever lunatics are in the halls, is such a nonsense default par for a crashing course of failed programs and perverted projects with subversion and coercion in full attendance.
Nice post, by the way, Phil Koenig. Credit where credit is due and all that.
This post has been deleted by its author
"it's much more likely you are just chaff, more noise to be discarded to get at the really interesting signal."
At one time our phone number was a fat finger away from a local travel agents' with the resulting crop of wrong number calls.
Now suppose one of them was from someone, rightly or wrongly suspected by TPTB of being a terrorist phoning to book a trip to see his granny in Pakistan/join a terrorist training camp/take his kids to Disney. All this meta-data harvesting then means that I'd then be a terrorist suspect. Given that at the time I was working on a gig that required security clearance that could then have led to a sudden cut in the household income.
OK, that's one negative outcome with a low probability. But once you ramp up the volume by mass surveillance the probability of someone being wrongly suspected becomes non-negligible. And the outcomes could be considerably worse than losing security clearance. We've had at least one example of what the Met can do when they wrongly suspected someone. They killed them.
"..... All this meta-data harvesting then means that I'd then be a terrorist suspect....." Yes, but in your highly-contrived scenario, a simple bit of background investigation would reveal your innocence without anyone being carted off to a Gulag, Gitmo or 'dark site'. It's called due process and it does exist, respite your desire to believe otherwise.
".....Given that at the time I was working on a gig that required security clearance that could then have led to a sudden cut in the household income....." Why assume the cut would be automatic? It is much more likely they would put an investigation in place without alerting you, to see if you were a security risk and catch any fellow conspirators. Seriously, try granting the authorities with at least a modicum of intelligence even if doing so upsets your paranoid fantasies.
"....But once you ramp up the volume by mass surveillance the probability of someone being wrongly suspected becomes non-negligible....." Correct, so if it was anything at all to be worried about where are the hundreds of wrongly-convicted terrorists? At worst and being generous, there are a less than a dozen since 9/11, and their convictions resulted due to field intelligence in Afghanistan, Iraq or Pakistan, not wrongly dialled numbers on tapped lines. If you want to pretend otherwise then please do supply some details of the hundreds you want to insist were so entrapped.
"Correct, so if it was anything at all to be worried about where are the hundreds of wrongly-convicted terrorists?"
Guantanamo.
" It's called due process and it does exist"
Not in Guantanamo it doesn't, as has been well documented.
"......Not in Guantanamo it doesn't, as has been well documented." The only fact around Gitmo that seems to be well documented is the number of what you would like to call "innocents" released who immediately returned to terror (http://www.judicialwatch.org/blog/2014/12/oops-u-s-offers-5-mil-reward-al-qaeda-terrorist-released-gitmo/).
You're wrong.
http://www.andyworthington.co.uk/guantanamo-habeas-results-the-definitive-list/
http://www.usnews.com/news/national/articles/2007/08/30/justice-department-lawyers-refuse-detainee-cases
Also, I didn't call them innocents. I just think they should be accorded legal rights so we can determine whether they are innocent or not.
"... I just think they should be accorded legal rights so we can determine whether they are innocent or not." The Gitmo detainees already do have legal rights and due process as non-uniformed combatants, inline with the Geneva Convention. The US courts ruled in Hamdan v. Rumsfeld in 2006 that Gitmo detainees were entitled to the minimal protections listed under Common Article 3 of the Geneva Conventions, not US civil law. But, before you celebrate, you need to understand that Common Article 3 in no way whatsoever includes a provision for trial under civil law, US or otherwise. But, the US and UK have fallen over backwards to give (IMHO) even the scummiest terrorist supporters a fair trial. Moazzam Begg is one example, though in his case it seems clear to me that he is at least a supporter of Islamic extremism (his pushing of such vile material as spewed from Anwar al-Awlaki before al-Awlaki got droned is an example - http://www.theguardian.com/commentisfree/cifamerica/2010/nov/15/international-criminal-justice-yemen). Even if the US courts could not prove Begg to be an actual terrorist, and the UK's that he facilitates terror (http://www.cnn.com/2014/10/01/world/europe/uk-begg-syria-charges/index.html), in a real war he would have been locked up for the duration as many Nazi propagandists and sympathisers were in WW2. Do you want to argue that we were wrong to lock up the likes of Oswald Mosely (http://en.wikipedia.org/wiki/Oswald_Mosley#Internment) on the grounds of "free speech"?
But then that is the real political problem - we're not in a "real war", and Obambi promised on the election trail that he would close Gitmo and give all the detainees trials. Only he found out when he got into office that wasn't actually either legally possible nor desirable from a security viewpoint. This is shown by Obambi signing the National Defence Authorization Act which "prohibits transfer of any Guantanamo detainee to a country where returnees have reengaged in terrorist activity and requires certification from the receiving country that it has taken steps to prevent such activity".
Hence all his backroom deals with Third World countries to take Gitmo detainees, trying to keep them as far away from trouble in the Middle East and Afghanistan as possible, and at the same time make it look like Obambi is keeping his election promise. The simple truth is there is a number of hardcore AQ and Taliban members in Gitmo that even Obambi will hesitate to release in such a way, but he might have an executive get-out after the Bergdahl fiasco (http://www.politico.com/story/2014/06/bowe-bergdahl-deal-criticized-afghanistan-barack-obama-107312.html). No, we don't deal with terrorists, do we, Mr Presidunce? Not unless it means you can offload some of those hardcore Gitmo prisoners....
"But then that is the real political problem - we're not in a "real war", and Obambi promised on the election trail that he would close Gitmo and give all the detainees trials. Only he found out when he got into office that wasn't actually either legally possible nor desirable from a security viewpoint."
here, we are entirely in agreement MB. I suspect we believe there are different motivations behind gitmo and its associated legislation, and Obamas failure to make good on his rather ambitious promise, but the resultant is the same - a legal mess that's near impossible to untangle in any elegant manner.
"Do you want to argue that we were wrong to lock up the likes of Oswald Mosely (http://en.wikipedia.org/wiki/Oswald_Mosley#Internment) on the grounds of "free speech"?'
Actually, yes. My natural inclination is not to "inter" anyone who hasn't actually committed a crime. The mere idea of an "internment camp" in the modern age gives me the shivers. Bear in mind that making violent threats, inciting violence, certain forms of racist/hate speech and a fair few other similar things are, and have long been, illegal in the UK. It should not, in my opinion, be illegal to speak critically against the country you reside in, no matter how misguided the stance you take may be. It's a fundamental example of the freedoms our version of civilisation provides and one of the very things we are "fighting" for in the "war on terror" surely?
The suspension of Habeas Corpus is, I believe, never a good thing.
"......we are entirely in agreement MB......" Er, no. You are whining about how terrible it is we keep these people locked up, whereas I am quite happy for them to be locked up.
".....a legal mess that's near impossible to untangle in any elegant manner......" No, there is no legal mess at all. US civilian law does not applying they are not on US soil in Gitmo. Even the Third Article of the Geneva Convention does not insist they just be released because people like you have got your knickers in a twist. The legal issues have been examined and satisfied, otherwise useful idiots like the ACLU would have brought successful legal actions to close Gitmo - they have tried and failed to do so. You can justifiably claim there is a moral issue but not a legal one, and moral issues are simply a matter of perspective. Obambi's desire to close Gitmo is not for legal not so-called "moral" reasons, but simply political expediency - he thinks it is a vote-winner with his base.
".....My natural inclination is not to "inter" anyone who hasn't actually committed a crime....." But the US and UK governments have a legal imperative to also protect their citizens, even you. That legal imperative is enshrined in international law (read, for example, Articles 1, 5 and 6 of the Convention on the Prevention and Punishment of the Crime of Genocide, GA Res 260 A (III), 9 December 1948; Articles 2 and 9 of the International Covenant on Civil and Political Rights, GA Res 2200A (XXI), 16 December 1966, 999 UNTS 171; and Articles 1, 2 and 5 of the European Convention for the Protection of Human Rights and Fundamental Freedoms 1950, 213 UNTS 222; ETS 5). You are claiming "foul" in ignorance of the law simply because it suits you. Your willingness to push such ignorant views as both factual and moral is what should make you shiver.
"Seriously, you think anyone would be the slightest bit interested in you?" ~ Matt Bryant
"Anyone who believes that Snow boy's illegal disclosure of security ops is a good thing will be thinking much differently soon when their bank account is emptied, their credit cards compromised, their personal identity information is stolen and they end up going through years of headaches trying to sort it all out." ~ Matt Bryant.
Which is it? Are they interested in and/or protecting us as individuals or not? Your argument seems to be flaccid.
"Sticking a downvote is not a reply....." Oh I did reply, it's just El Mod seems to have thought it too damaging for your fragile ego to survive reading the facts I posted. I'll just post the links and we'll see if you can join the dots and understand why the GCHQ and NSA have better things to look into than your paranoid delusions.
Team Poison and the IS media jihad - http://www.birminghammail.co.uk/news/midlands-news/birmingham-hacker-junaid-hussain-syria-7291864
Jihadi John, "brave Muslim warrior" who likes hacking the heads off bound hostages - http://www.bbc.com/news/uk-31641569
Emwazi, poster child for "the abusive harassment of the Security Services", and CAGE - http://guerillamedianetwork.com/%E2%80%8Bisis-killer-jihadi-john-radicalized-by-uk-govt-claims-charity/).
CAGE, Amnesty International, Gita Saghai and the Moazzam Begg issue - http://www.gatestoneinstitute.org/1167/amnesty-international-whitewashes-terrorism-suspends-whistleblower
back then the thread was a local attacker trying to get into the wireless connection from the base station to the mobile station.
Actual security never was an issue on GSM. It was, at best, be more secure than the analogue networks before it. There is no security against rouge base stations, there is no security against an attacker working at the phone company.
Maybe instead of having kickstarters for more of the same kind of bland touchscreen phone, we should do some research on mobile networks which offer some resilience against such a central attacker.
@Christian Berger: my understanding is there are various grassroots efforts going on today specifically to address this issue of cellular base station hacking / rogue base-station operation - often named for the devices most famously used to perpetrate this, the "Stingray" from US company Harris.
Including efforts by the platform vendors to include methods of detecting such rogue base stations right from the native mobile OS itself.
I am aware of various projects from simple "rouge base station detectors" to research into implementation and standard defects in GSM.
However if we could only siphon a small percentage of the money we spend on touchscreen phones, we might be able to find ways to circumvent the intrinsic problems of cellular networks. For example it's trivial to track a telephone in use, just by measuring when its transmission bursts arrive at various antennas. That's simple triangulation. Maybe, for example, we could combine direct sequence spread spectrum with public key cryptography. That way we could communicate without others being able to detect it. This would easily solve quite a bit of the problems of cellular networks.
This post has been deleted by its author
@dan1980: In fact, studies have been done (ie this one by New America: http://securitydata.newamerica.net/nsa/analysis) that essentially came to the conclusion that the widespread warrantless data-trawling and "metadata" collection done by the spooks as enabled by the various fear-mongering post-9/11 laws have resulted in virtually zero capturing and prosecution of any bad guys they claimed it was designed to target.
Some of us are not surprised..
"And yet, even with all this capability they have bugger all to show for it in terms of preventing the threats that they tell us all they are there to combat." Oh Dan, if only you read some real news for once. You could start by going and checking the current series of arrests of wannabe jihadis in the UK, caught before they could get their jollies with IS - do you really think they were caught by chance?
And, as I have pointed out to you many times, the threats are more than real. There is the violent threat to Western countries and their allies (http://www.thereligionofpeace.com/pages/thelist.htm), there is also the espionage threat (even your heroes like Shneier have stopped denying that exists - https://www.schneier.com/blog/archives/2013/02/more_state-spon.html) and the e-crime threat (El Reg has been reporting on it for years - http://www.theregister.co.uk/2005/11/29/cybercrime/), so for you to deny any threat is, IMHO, simply to hilariously and stupidly blinkered for words.
Hi, Matt Bryant,
Why is it that your posts, which appear to be very clearly pushing and pimping/lauding and defending the values and virtues of current struggling exclusive executive administrative shenanigans, have certainly at least one commentard here on El Reg, thinking you might not be unfamiliar with the value of great deception, which of course ideally, is never discovered and uncovered to be a fabless sub-prime fiction, one/a few of which can be read about in the short document where the following is found right at the beginning and end of the first page ……
The operator who actually fabricated the traffic was offered immunity from prosecution to entice him to reveal all he knew about the matter, to determine that he indeed worked alone, and to help in identifying all bogus traffic. Consequently, subsequent revelations and admissions of wrongdoing did not result in court-martial, nor in any other kind of formal punishment. The operator involved, therefore, and others peripherally involved in one way or another, will not be referred to by name in the narrative. Nor is it considered pertinent or necessary to mention his branch or service - or locations or names of sites involved. Their mention would serve no useful purpose. ……Fabrication of Traffic - It Can and Did Happen [Approved for Release by NSA on 09-27-2007, FOIA Case # 51633]
In Magic Quantum Communications Circles with Sublime Internetional Networks, are real fact and virtual fiction after SMARTR Processing, one and the same and deliver quite wholly different streams of information and … Advanced Enhanced Intelligence …… for Future Presentation of Media Related Tales and Trails …… Brilliant CyberSpaced Journeys.
Or do you not think and imagine that is what Super IntelAIgent Service Servers do with the time in their hands with their hearts and minds. North, South, East or West, is that not what intelligent beings do for public and private enterprise and pirate systems of commerce for profitable gain?
AURORAGOLD asks the Deep Dive question [on Page 46 of 63] …. “Are SIGINT targets taking up this technology? How fast?”
That is actually two questions, which can definitely probably maybe be answered quite definitively ... “But of course, and certainly some time ago.” Such then suggests and it would be wise to accept such as undeniable fact, rather than hope and imagine it to be nothing more than an uncomfortable fiction, that the AURORAGOLD system and its processes are already comprehensively hacked and future plans for the program fully understood and catered for.
And readily available for forward marketing and zeroday trading and broader banded exploitation and development to interested parties is but one likely lucrative live possibility in such an event and reality.
...with all the capabilties of the various spooks in the West, the world is not a safer place.
With advance warning the Boston Bombers slip right past, ISIS beheads with impunity, and many corporate and government networks are compromised almost daily. And Benghazi happens, again with some fore warnings...
The 800 pound gorilla in the room is that big league evil, like big league crime before it, assumes that all tech is compromised and use old school manual methods.
On top of that, resources are wasted in the US by bugging AP reporters, and using the IRS to go after political enemies. Many of the *sucesses* touted are sting operations that would never have happened without prodding, by the FBI in many cases...
We need human beings in the field to combat these serious threats, not massive data slurping that has so far been of a questionable nature with minimal success.
Now, since I have some Dev capacity on the updated infra, I think I'm going to take *all* of AMFM's posts, and see if I can figure out the algorythm.
The single largest *offensive* bit in here is that the NSA appears to have gone some way out of their way to put Hmmmmm.. lets be polite, "additional unapproved software" on private corporate hardware somewhere. Perhaps since I'm in the industry it offends more.
And, is it me or is AMFM getting *far* more readable in my old age?
They can't beat the 'Game' without the 'Cheat Codes'.
I thought they were brilliant mathematicans and coders, but it seems that they have to stand on the shoulders of more creative people to be able to do their 'So Called Job'....what a very poor show indeed.
".....they are acting illegally in many many other states." <Yawn> Yes, and you have the relevant court decisions to hand to back up that whimsy? Thought not. Bits you missed regarding TEMPORA - firstly, the taps done on cables on British soil are covered by warrants, therefore totally legal; secondly, where taps are on foreign soil (such as at Seeb in Oman) they are done with the full cooperation of the local authorities, therefore also legal.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
