IC on the Record

DNI James Clapper has issued an official statement: http://icontherecord.tumblr.com/post/60712026846/statement-by-director-of-national-intelligence or http://www.dni.gov/index.php/newsroom/press-releases/191-press-releases-2013/926-statement-by-director-of-national-intelligence-james-r-clapper-on-allegations-of-economic-espionage

He manages to twist it into a matter of defense against terrorism:

> Our collection of information regarding terrorist financing saves lives. Since 9/11, the Intelligence Community has found success in disrupting terror networks by following their money as it moves around the globe. International criminal organizations, proliferators of weapons of mass destruction, illicit arms dealers, or nations that attempt to avoid international sanctions can also be targeted in an effort to aid America’s and our allies’ interests.

> As we have said previously, the United States collects foreign intelligence - just as many other governments do - to enhance the security of our citizens and protect our interests and those of our allies around the world. The intelligence Community’s efforts to understand economic systems and policies and monitor anomalous economic activities is critical to providing policy makers with the information they need to make informed decisions that are in the best interest of our national security.

We haven't actually been getting the data to make an informed decision on these, either. It took nearly a year to get any sort of numbers out of the government regarding how many people were being targeted[1] and they still haven't given any numbers on incidental collection. Meanwhile, most of the the media has been claiming that the communications of millions or even billions of people are being swept up, and now the Washington Post is actually looking at the data they've had for the last year and saying the number is more likely to be somewhere around 900k worldwide. I'm not saying that's necessarily a great number, but that's orders of magnitude less than what we've been led to believe. Nor does the article go into much detail on what "incidental" really means versus "targeted" - are these people in contact with the actual targets, or completely unrelated? Is there a better way to protect the privacy of these people without compromising actual intelligence operations? If not, which side should we err on, and how far?

These are tough questions to answer - especially without hard facts. It's hard to have an honest debate when we the people are left trying to discern the actual facts somewhere between the secrecy and sensationalism.

[1] http://icontherecord.tumblr.com/transparency/odni_transparencyreport_cy2013

Mostly true. (They won't deny EVERYTHING because that wouldn't be believable.)

If this argument is made convincingly in Congress, the NSA could lose funding, but that's a hard decision to make. Even if I am opposed to individual wars, that doesn't mean I would support complete disarmament. Foreign intelligence (and counter-intelligence) is an important part of any modern military. There needs to be public oversight without crippling US intelligence efforts. It's not clear how to accomplish that oversight. That is the discussion we really need to be having.

====

Edit: Looks like there is an official effort to increase oversight of the NSA. Quoting from a Sept 4 article on http://icontherecord.tumblr.com/

"On August 12, 2013 President Obama directed the establishment
of the Review Group on Intelligence and Communications
Technologies."

Link to the press release about this review group:
http://www.whitehouse.gov/the-press-office/2013/08/12/presidential-memorandum-reviewing-our-global-signals-intelligence-collec

I dispute that Edward Snowden actually made a formal whistleblowing complaint. He claims he went through the channels, but never specifically stated he actually made the type of complaint that goes to the IG or to the U.S. Congress. We see in 2019 the Executive Branch is going to great lengths to discredit a whistleblower, but it is indisputable that a complaint was made.

I have not heard any statement from Snowden claiming that the government was making false statements about this matter.

The government did publish an email [1] that Snowden sent to a training coordinator, disputing the ability of executive orders to supersede law. It is possible that the government did this as a distraction and it is not actually what Snowden is referring to. Nevertheless, Snowden never gets specific about his whistleblowing attempt, despite going into great details about other aspects of his story.

1. https://icontherecord.tumblr.com/post/87218708448/edward-j-snowden-email-inquiry-to-the-nsa-office

http://icontherecord.tumblr.com/post/82416436703/statement-on-bloomberg-news-story-that-nsa-knew

But also, straight from the mouth of a USCYBERCOM strategist speaking to our class the other week.

And also, just plain logic. I pointed out here on HN even before the ODNI released the statement I linked above that Heartbleed is far more damaging to the USG itself than any intel value NSA could have hoped to achieve from it.

With the other vulns NSA would have stockpiled they don't need Heartbleed, and leaving Heartbleed open would have hurt a lot of USG (and just as importantly, private US) infrastructure, so even going by crazy USG logic the right thing to do would have been to disclose it, just as NSA has fixed other open source security flaws over the years.

A good time to remember the official US Intelligence Community statement and policy/lie on 0days, as given post-heartbleed:

When Federal agencies discover a new vulnerability in commercial
and open source software – a so-called “Zero day” vulnerability
because the developers of the vulnerable software have had zero days
to fix it – it is in the national interest to responsibly
disclose the vulnerability rather than to hold it for an investigative
or intelligence purpose.

https://icontherecord.tumblr.com/post/82416436703/statement-on-bloomberg-news-story-that-nsa-knew

https://news.ycombinator.com/item?id=7575802