GCHQ"s cover for Optic Nerve provided by legislation introduced in 2000

GCHQ"s cover for Optic Nerve provided by legislation introduced in 2000
http://hits.theguardian.com/b/ss/guardiangu-feeds/1/H.25.5/63769?ns=guardian&pageName=Article%3Agchq-insists-optic-nerve-program-legal-legislation-2000%3A2051552&ch=World+news&c3=Guardian&c4=NSA+files%2CUS+news%2CData+protection+%28Govt.%2Findustrial+use+of+data%29%2CNSA%2CWorld+news%2CGCHQ+%28News%29%2CCounter-terrorism+and+security+%28UK+news%29%2CUK+news%2CPrivacy+%28News%29%2CYahoo+%28Technology%29%2CInternet%2CTechnology%2CWeb+browsers+%28Technology%29%2CTelecoms+%28Technology%29&c5=Unclassified%2CNot+commercially+useful%2CTechnology+Gadgets%2CCorporate+IT%2CUSA+HSBC&c6=Nick+Hopkins&c7=2014%2F02%2F27+08%3A01&c8=2051552&c9=Article&c10=News&c13=&c19=GUK&c47=UK&c64=UK&c65=GCHQ%27s+cover+for+Optic+Nerve+provided+by+legislation+introduced+in+2000&c66=News&c67=nextgen-compatible&c72=&c73=&c74=&c75=&h2=GU%2FNews%2FWorld+news%2FThe+NSA+files

Section 8 of the Regulation of Investigatory Powers Act permits GCHQ to perform indiscriminate trawls of external data

Giving evidence to MPs before Christmas, Sir Iain Lobban, the director of GCHQ, used the analogy favoured by the security agencies to explain what they do. He likened the gathering of intelligence to building a haystack and said he was “very well aware that within that haystack there is going to be plenty of innocent communications from innocent people”.

The latest revelations from the Edward Snowden files show this haystack also includes webcam images of millions of internet users, some of whom are involved in deeply adult forms of in flagrante “communication”.

Surveillance of this kind puts a new spin on William Hague’s defence of GCHQ’s snooping programmes: “If you have nothing to hide, you have nothing to fear.”

In some ways, the Guardian story about GCHQ’s Optic Nerve operation brilliantly illustrates the tangle that ministers and the intelligence services have got themselves into. And it poses a big question mark over the repeated assertion that mass surveillance is proportionate and necessary.

The agencies do not regard the “unselected surveillance” as revealed by Optic Nerve as snooping. As Lobban said to MPs last November: “My people are motivated by saving the lives of British forces on the battlefield, they are motivated by fighting terrorists and serious criminals. If they were asked to snoop, I would not have the workforce. They would leave the building.”

Nick Pickles, the director of Big Brother Watch, takes a different view. “Secretly intercepting and taking photographs from millions of people’s webcam chats is as creepy as it gets.Orwell’s 1984 was supposed to be a warning, not an instruction manual.”

GCHQ insists the activity is legal. And doubtless it is, if you believe that the Regulation of Investigatory Powers Act, which was passed in 2000, was drafted with this kind of surveillance in mind.

But even the parliamentary intelligence and security committee – not a body known for challenging the agencies with any robustness – is now questioning whether ministers and the agencies can really use Ripa for cover. The collection of webcam material was probably secured by getting an “external warrant” under paragraph four of section 8 of Ripa.

In most Ripa cases, a minister has to be told the name of an individual or firm being targeted before a warrant is granted. But section 8 permits GCHQ to perform more sweeping and indiscriminate trawls of external data if a minister issues a “certificate” along with the warrant. It allows ministers to sanction the collection, storage and analysis of vast amounts of material, using technologies that barely existed when Ripa was introduced.

• The NSA files


• United States


• Data protection


• NSA


• GCHQ


• UK security and counter-terrorism


• Privacy


• Yahoo


• Internet


• Web browsers


• Telecoms

Nick Hopkins

theguardian.com © 2014 Guardian News and Media Limited or its affiliated companies. All rights reserved. | Use of this content is subject to our Terms & Conditions | More Feeds

Technology news, comment and analysis | theguardian.com


Read more about GCHQ"s cover for Optic Nerve provided by legislation introduced in 2000 and other interesting subjects concerning NSA at TheDailyNewsReport.com

Snowden's role provided 'perfect cover' for NSA data theft

Computerworld – Fugitive document leaker Edward Snowden’s role as a systems administrator provided easy access to classified National Security
Agency documents sitting in a file-sharing location on the spy agency’s intranet portal.

The documents were kept in the portal so that NSA analysts and other officials could read and discuss them online, NSA CTO
Lonny Anderson told National Public Radio in an interview Wednesday.

As a contracted NSA systems administrator with top-secret Sensitive Compartmented Information (SCI) clearance, Snowden could
access the intranet site and move especially sensitive documents to a more secure location without raising red flags, Anderson
said.

Thus, Anderson could steal the NSA Power Point slides, secret court orders and classified agency reports that he leaked to
the media. “The assignment was the perfect cover for someone who wanted to leak documents,” Anderson told NPR.

“His job was to do what he did. He wasn’t a ghost. He wasn’t that clever. He did his job,” Anderson said.

Since the leaks, the NSA has taken several steps to plug such holes in its security. For instance, a new ” two-person rule,” which stipulates that two individuals with similar roles and authority must act together to execute specific functions,
including the storing or backing up of data.

Those with privileged access to systems, like system and network administrators, are no longer anonymous on the NSA network
— all of their actions will be observable, Anderson told NPR.

The NSA has also started “tagging” sensitive data and documents to ensure that only people with a need to see a documents
can access it. The document tagging rule also lets security auditors see how individuals with legitimate access to the data
are actually using it, Anderson said.

While NSA employees can still access the intranet used by Snowden to steal documents, new controls won’t allow such thefts
to happen again, he said. “Could someone today do what [Snowden] did? No,” Anderson claimed.

Anderson’s revelations shed a bit more light on how Snowden could access and download tens of thousands of sensitive documents
from the protected NSA systems. It’s still unclear, though, how he managed to download the data onto thumb drives and take
them from the workplace without being noticed.

Security experts have pointed to the Snowden caper as a classic example of how insiders, especially workers with privileged
access to systems, could steal corporate data.

A survey of mostly medium-sized companies by security vendor Symplified earlier this year found that more than half had authorized
network access to 250 or more external partners, contractors and consultants. About 55% of respondents said 1,500 or more
employees have privileged access to corporate applications.

“Insider attacks and unauthorized access happen much more often than you may think,” said Darren Platt, CTO of Symplified.

Platt said an employee, for instance, could download a customer database and take it to a competitor, a contractor could use
his or her access to personnel information for personal gain, or a former employee could access applications as a corporate
spy.

Netflash

Snowden"s role provided "perfect cover" for NSA data theft