PRISM: Tip of the Cyber Intel Iceberg

PRISM Slide 1When Edward Snowden published information on PRISM – a rather drastic intelligence gathering program in which several (assume All) government agencies such as the FBI and the NSA draw intelligence from major tech companies such as Microsoft, Skype and Facebook – he was immediately revered and reviled by the general populace. Especially within the US armed forces community, the general sentiment seems to be that he’s a traitor and someone needs to go fetch a rope. But really, how much of this is new or even unexpected?

Right after the 2nd World War in March of 1946, a multilateral agreement between the UK, the US, Canada, Australia and New Zealand was signed in which they agreed to cooperate and share intelligence. This was originally intended to be mostly Signals intelligence, but has long since been extended to include much more. This intelligence alliance between those five nations has become known as Five Eyes. It was a secret treaty (allegedly even kept from the Australian PM’s until ’73) but has been exposed for quite some time now. In fact, Canadian Brigadier-General James S. Cox (RET) wrote a rather salacious paper on this treaty, and to illustrate just how well this treaty is working out can be gleaned from the following paragraph in the executive summary of said paper (emphasis mine):

 “The Five Eyes intelligence community grew out of twentieth-century British-American intelligence cooperation. While not monolithic; the group is more cohesive than generally known. Rather than being centrally choreographed, the Five Eyes group is more of a cooperative, complex network of linked autonomous intelligence agencies, interacting with an affinity strengthened by a profound sense of confidence in each other and a degree of professional trust so strong as to be unique in the world.” – “Canada and the Five Eyes Intelligence Community” by Brig-Gen James S. Cox (RET).

This profound sense of confidence in each other likely stems from the fact that they’ve been doing this for over 60 years, and I would hazard that this partnership has had its strength tested a few times. Successfully, from the looks of it. Either way, I think it is a safe assumption that the UK, Canada, New Zealand and Australia are as much to blame for PRISM as the Americans. Funny how none of them have mentioned their unfettered access to this raw data, hmm?

What boggles my mind is how little people seem to care. Maybe the name ECHELON rings a bell? This was an expansion on collection and analysis in the 60’s to this same Five Eyes program. I should stress that the actual gathered (and shared) intelligence included much more than just signals intelligence. We’re talking raw internet data. Raw, meaning absolutely everything that passed through, without any kind of filter. If you said it through any kind of internet-connected medium, through any American provider, service or product, you have definitely been logged there. And even not using any of said American providers, services or products, your traffic could still have been routed through PRISM, depending on where you are, where the servers are that you connected with, or how traffic was routed. And that’s just assuming that this traffic was really only collected in the US, which may not be the case now that we’ve established that at least 4 other countries were actively in on this program.

Now that we’ve firmly established the “who” part of this whodunit –or at least establish who benefits-, its time to look a little closer at what happened.

So what happened with PRISM?
Simply put, since somewhere as early as 2007 the various US intelligence and Law Enforcement agencies used the law to gain access to information harvested by tech giants such as Microsoft, Google, Apple, Yahoo, Facebook, Skype and Youtube. This means that they had access to a multitude of heavily used social media sites such as Facebook, Skype, Twitter and Youtube, but also cloud services such as iCloud, Google Drive and Dropbox. This was all done legally under US laws. Their alleged goal was to monitor foreign communications that take place on US servers, but of course it couldn’t hurt that what they collected included everything under the virtual sun – including stuff on American citizens and US allies.

Edward Snowden brought to light just exactly what is going on, and how it’s done. For those of us who have an IT-technical background, it doesn’t take much imagination. It can be done easily, and not to my surprise, this is what they did. Snowden published a PowerPoint presentation containing 41 slides on this, but interestingly only 5 of those slides were published. The remaining slides are, apparently, so “hot” that nobody wants to burn themselves by publishing it. Both the Guardian’s Glenn Greenwald and the Post’s Barton Gellman have made it clear that the rest of the PowerPoint is dynamite stuff which we’re not going to be seeing any time soon. “If you saw all the slides you wouldn’t publish them,” wrote Gellman on Twitter, adding in a second tweet: “I know a few absolutists, but most people would want to defer judgment if they didn’t know the full contents.”. I think that I speak for most Europeans when I say that I disagree strongly with Gellman, and would very much like to see the remaining slides.

Although the slides that have been published can be easily found without my help, I would be remiss in not adding them here for your enjoyment. Much of the international outrage can be explained by these pictures. And by outrage, I mean by the people, not the other governments. Any outrage on their behalf is geopolitical theatre, because every government in the world is either doing this, or would very much like to. You only have to look at the recently unveiled DGSE (French secret service) surveillance program which operates in exactly the same vein as PRISM.

Without further ado, here are the slides that were published from Snowden’s originally 41 slides:

PRISM Slide 1

 

PRISM Slide 2

 

PRISM Slide 3

 

PRISM Slide 4

 

PRISM Slide 5

 

UPDATE
My apologies. Apparently I had missed the release of 4 more slides by Washington Post around July 1st. Unfortunately these slides don’t really do much but add to the confusion. Nevertheless I would like to share these with you too.

prism slide 6

 

 

prism slide 7

 

prism slide 8

 

prism slide 9

Dutch Military Intelligence dives into Cyber

The Dutch Military Intelligence agency (MIVD) recently released its 2011 yearly report (in Dutch). As is usual, they covered the events of 2011, but also did some forecasting for 2012. Its especially this last bit I was interested in, and im writing this in the hope that you feel the same way.

One of the most interesting facts I extracted from the report is that the MIVD will be focusing the majority of its Cyber Warfare efforts in countering Cyber Espionage. Given that this is probably the most tangible and widely represented cyber activity currently employed, I think this is a wise choice. Add that to the fact that the Netherlands is, by far, the most connected country in Europe (highest internet penetration in Europe with 83%; highest broadband internet penetration in the world with 68% of its connections at 5mbs or faster) it would probably be a safe assumption to say that our economy is critically interwoven with the Internet. Now, I know that there’s a lot to be said about the military defending a mostly commercial and/or civil commodity, but personally I’m happy with this direction. If anything, it’s *a* direction and from what I’ve seen this has not always been the case in the past.

Three other interesting tidbits that were published in the report involved the MIVD’s future collaborative efforts. One of these is a rather obvious and expected one, but it involves their supporting the Dutch Ministry of Defense with their Cyber Operations through involvement with Taskforce Cyber. A less obvious one is their intention to support in ‘cyber-aspects’ of the Dutch military industrial complex. They don’t really go into how they intend to assist, other than that it will involve working with Dutch domestic intelligence agency AIVD. This is too bad because it sounds interesting. Considering the major cyber security breaches in the past at American defense contractors such as Booz-Allen Hamilton, Lockheed Martin, L3 Communications or Northrop Grumman, it certainly sounds pertinent. They don’t mention it specifically, but odds are good that this (and only this) is what the MIVD has in mind when they mention countering cyber intelligence. Lastly, and to me this was the most interesting, they reveal their intentions to collaborate with the AIVD to set up a special SIGINT Cyber Unit (or command – this wasn’t mentioned) to generate shared cyber intelligence. Their goals for this unit are straightforward: Assisting in cyber operations in support of regular military operations, chart threats, provide excellent cyber intelligence at all times, and to assist in attributing cyber attacks.

The report also tickled my interest in ‘cyber semantics’ when the MIVD asserted that offensive cyber operations usually include the same activities as cyber intelligence and/or cyber espionage. They also mention that cyber is increasingly important in counterintelligence, and mentioned that they would be increasingly exploiting social media such as Facebook, Hyves, Twitter et cetera. An interesting side note here is that due to severe upcoming Defense budget cuts and related contract terminations, it’s been observed that everyone in the Dutch armed forces is now suddenly absolutely perfect in every way (article in Dutch), because apparently it’s gotten to the point that calling in sick is now a bad career move. Our troops should be warned that venting their frustrations through social media is probably a bad idea at this time, however much it may be valid criticism.