Enigma, NSA booth, Def Con XX

“Dissonance gives rise to hermeneutics.” – Claude Levi-Strauss

Even for the murky world of hacking, rife with moral ambiguity, the appearance of NSA at Def Con XX this year in Las Vegas was difficult to parse.

General Keith Alexander, director of NSA and commander of US CyberCommand, delivered a speech entitled “Shared Values, Shared Responsibility” to a standing-room-only crowd. I attended the second half of his speech, rushing over from a panel discussion entitled “Can You Track Me Now? Government and Corporate Surveillance of Mobile Geolocation Data.”

NSA also staffed a booth in the vendor’s area, across the aisle from the Electronic Frontier Foundation. The Agency brought a genuine, operational Enigma console from the National Cryptologic Museum, which was very cool.

Their mission was unambiguous: they were there to build sympathy for the organization and, if possible, to recruit.

“Attention DefCon 20 attendees,” reads their dedicated recruitment page, “If you’re up on your game, you already know the National Security Agency and what we do …. Around here, it’s all about the endgame: keeping you and your family safe and secure, so we can all enjoy the simple things in life, like buying new gear and going to DEF CON®21 – without the threat of harm from foreign adversaries.”

NSA Recruitment Page Screen Capture
Click to Enlarge

“By the way, if you think you saw cool things at DEF CON® 20, just wait until you cross the threshold to NSA, ’cause you ain’t seen nothing yet.”

I got the impression that their planners regard hackers as something like brilliant, troubled orphans who can benefit from an indulgent father-figure stepping in to help direct their energies in productive ways, like fighting the “bad guys,” as General Alexander put it.

Unfortunately, as Dan Kaminsky noted in his talk at the conference, there is a conspicuous lack of consensus regarding who the bad guys actually are.

My father Richard Thieme, who spoke at Def Con for his seventeenth year, noted in his speech that he was stunned to see the NSA booth display a list of the agency’s core values, including “transparency.” Some may find that incongruous.

A common theme of criticism among conference attendees was that law enforcement personnel come to conventions like Black Hat or Def Con to learn, but they give nothing back to the community in return.

At the “Meet the Feds” panel, an audience member identifying himself as a former security employee at a “top-five financial institution” complained that federal security information sharing resources disclose very little useful information to participating organizations, though they absorb large amounts of data.

Celebrity security expert Bruce Schneier made a similar point during his Q and A session, observing that feds have come to Def Con for many years, but they never present papers or tell anyone about what they’re doing. “It’s like a back-and-forth without the forth,” he noted sardonically.

“I’ve spent 20 years trying to get someone from the NSA,” Def Con founder Jeff Moss (aka The Dark Tangent) told CNN. “It’s eye-opening to see the world from their view.” Moss was appointed to the Homeland Security Advisory Council in 2009.

I was troubled to see that NSA was manifestly disingenuous at times. The Agency made a legitimate argument that their mission to promote and defend the Internet has beneficial effects for everyone around the world. But when faced with criticism, their response was, at times, transparent obfuscation.

During General Alexander’s talk, several audience members asked about recent allegations by NSA whistleblowers Thomas Drake, Kirk Wiebe, and William Binney that the agency has conducted massive dragnet communication surveillance across the country since 9/11.

The three have alleged that the information NSA gathers from monitoring Internet traffic and telecommunications allows them to compile detailed profiles of vast numbers of law-abiding American citizens, including information about their relationships and social networks.

General Alexander’s response was that NSA simply could not generate, maintain and analyze files on every American. I felt that this mischaracterized the allegations, implying that the whistleblowers accuse NSA of literally creating static files in an enormous file room somewhere.

At a panel discussion, former NSA official William Binney countered along similar lines, accusing Alexander of playing a “word game” by mischaracterizing their allegations.

I spoke with Trevor Timm of the Electronic Frontier Foundation, who agreed that Alexander’s response was consistent with the way NSA has responded to privacy criticisms in the past. If an automated script or routine is harvesting data, the agency has argued, that does not constitute a surveillance act, until such time as a human actually looks at the report.

General Alexander also argued that the oversight NSA receives from the Senate Select Committee on Intelligence, the Director of National Intelligence and the FISA courts would prevent unconstitutional abuses. This strikes me as unpersuasive on its face, given that NSA unquestionably carried out large numbers of warrantless wiretaps for years in violation of FISA and in spite of oversight.

The EFF launched a lawsuit against private telecom companies for conspiring with NSA to illegally implement warrantless surveillance, and litigation is ongoing. Their case was dealt a setback when the Senate amended FISA to retroactively confer immunity from civil suits to complicit telecom companies.

Timm said NSA staff approached the EFF at their booth and suggested that the two organizations partner on cybercrime issues. Perhaps they are aware of EFF’s direction of projects such as the SSL Observatory, which has played a key role in identifying and analyzing fraudulent HTTPS certificate requests.

While EFF welcomes any overture by NSA to establish a dialog between the organizations, Timm emphasized that for such a relationship to work, NSA would have to show a genuine interest in addressing civil liberties concerns.

Law enforcement action was frustrated at times by the international character of the ring, whose members were scattered around the world and traveled from country to country. Maksym “Maksik” Yastremskiy was busted in Turkey, where undercover Secret Service agents arranged to meet him on a putative buy, Aleksandr “JonnyHell” Suvorov was arrested in Frankfurt, Germany on a US warrant, and Albert Gonzales was arrested and flipped by the Secret Service, who reportedly paid him $75,000 a year to bring down other crackers.

According to Ars Technical, the US government wanted to project the message that “the ‘borderless’ internet won’t save you from prosecution,” but what interests me is that the principle of asymmetry of attack works both ways.

It’s often noted that there is an intrinsic asymmetry in computer security insofar as systems are much easier to attack and to defend. To compromise a system requires only one weakness, while to defend it means to guard against countless possible avenues of attack.

The same is true in cases of criminal prosecution. If the suspect resides in a non-extradition country, wait till they travel. If you can’t get them for the violation you want them for, get them for something else.

The problem, of course, usually lies in knowing who is attacking your system.

It is commonly assumed by technophiles, politicians, policy analysts and reporters that the Internet is an intrinsically pro-democracy medium. This assumption is primarily based on the implicit linkage between widespread access to information, instantaneous communication and grassroots political action.

Because of its decentralized nature, the Internet is currently difficult to censor or control by authoritarian regimes. For example, Saudi political blogger Ahmed Al Omran, in a recent speech, described early attempts by the Saudi government to block access to politically-contentious material by denying access to entire domains. If a WordPress blogger wrote a piece critical of the government, Saudi censors simply blocked the country’s access to every WordPress site. However, they were forced to abandoned this strategy, because the collateral blockage of millions of unoffending blogs caused a considerable popular outcry.

The political uprisings of the Arab Spring have also drawn considerable attention to the use of social networking technology to report injustices and organize mass protests. The political upheaval in Egypt that resulted in the ouster of President Hosni Mubarak was triggered by a video of police officers beating Khaled Said, an innocent civilian who refused to pay a shakedown bribe. The video went viral, and the rest, as they say, is history.

Other politically-oppressed communities have looked to the successes of the Arab Spring as a possible model. Saransh Sehgal reports in Asia Times, for example, that the Free Tibet movement, frustrated by waning international attention, is attempting to gain traction in the digital world.

Phurbu Thinley, a Tibetan journalist based in India, told Sehgal “Social media, when used effectively, [constitute] a powerful tool to promote activism and change, and even to ignite large unprecedented public events. Tibetans are aware of this. Tibetans are aware of the role played by social networks during the uprisings in the Arab world.”

With these examples in mind, we can begin to evaluate the hypothesis that the Internet is intrinsically supportive of democratic mass-movements. To do so, we need to take a closer look at what happened and why, beginning with the observation that the ultimate outcome of Mubarak ouster remains highly ambiguous.

The two primary centers of social organization in Egypt are the military and the mosque. It should therefore come as no surprise that the primary candidates for the recent presidential election were representatives of these two networks. The Nobel peace laureate and neoliberal exile candidate Mohammed ElBaradei was quickly eliminated from the running in favor of Mohamed Morsi of the Muslim Brotherhood and Ahmed Shafik, former commander of the Egyptian air force and holdover stooge of the Mubarak regime.

Now that Morsi has been elected and the Muslim Brotherhood won a majority in the Egyptian parliament, it is not clear that the new civilian government of Egypt will have any real power. The military-controlled Supreme Constitutional Court recently dissolved the parliament, and just after taking office, Morsi precipitated a showdown with the military courts by attempting to nullify the Court’s actions, calling for the parliament to be reconvened. The parliament has subsequently met, despite its uncertain legal status.

The civilian government in Egypt hangs by a thread, and it is not clear that if it prevails, it will seek to instantiate real democratic institutions. ElBaredai has denounced Morsi’s handling of the crisis as unilateral and unlawful, arguing that a monolithic civilian government is not the solution to the problems posed by a monolithic military government.

These historical outcomes raise serious questions regarding what the Internet can and cannot do.

The Berkman Center for Internet & Society of Harvard University analyzed several situations including the case of Egypt, and concluded that decentralized communication technology is supportive of rapid, large-scale events such as the protests at Tahrir Square, but less supportive of the establishment of the persisting social organizations that are crucial to effecting and preserving real long-term change.

In the Center’s study “Political Change in the Digital Age: The Fragility and Promise of Online Organizing,” Etling et. al. differentiate between three kinds of social organization based on their longevity: mobs, social movements, and civil society organizations. In authoritarian regimes, established online communities are subject to surveillance and restriction. Thus flash events may occur, but the persisting networks are much more vulnerable. The Center concludes that promoters of democracy should shift focus to developing tools supportive of those lasting structures.

Even in the absence of widespread surveillance and disruption, mass movements precipitated by social media tend to be diffuse and are therefore subject to rapid decay. A case-in-point is the Occupy Wall Street movement in the United States, which quickly mobilized large numbers of disaffected citizens, but has since struggled to generate persistent outcomes.

Both the short-term success and the long-term failure of the Occupy movement probably derive from the same factor: its generality. By asserting a nebulous critique of widespread corruption, the Occupy movement hoisted a large banner that many could gather under. But when the time came to call for a specific program of reform, it became much more difficult to achieve consensus.

Viral messages and campaigns tend to be general because they tend to be very simple – a short video or slogan. Thus crowds convene on Wall Street or in Tarhir Square to express grievance, but the subsequent development of a complex program of reform lacks the networks of communication and organization necessary to deliberate, reach consensus and implement strategy.

We can therefore tentatively conclude that the Internet and social networking technologies are powerful for triggering and supporting flash-in-the-pan mass actions, but show less evidence for creating and sustaining long-term social movements.

 
In Part Two of this series, I’ll evaluate arguments that the propagation of decentralized information networks are in fact pervaded by asymmetries of power and access, even in politically liberal societies, and have been explicitly conceived as centralized, hierarchical channels of communication and control from the beginning.

The new imaging technology capitalizes on research in the terahertz range of the electromagnetic spectrum, which is close in frequency to the millimeter wave technology in use by the TSA in their new body imaging scanners in many airports.

Law enforcement agencies are actively pursuing such technology for their own use, including the New York Police Department, which is already testing such devices, developed in conjunction with the Pentagon, to check for concealed weapons.

Advocates tout such scanning technology as an improvement over stop-and-frisk, but several privacy groups have raised concerns, citing Fourth Amendment protections.

The potential application of terahertz scanning in consumer electronics raises its own serious privacy concerns. Imagine a world in which an opaque walls are easily seen through by cell phones. Coming soon?

In 2001, Ms. Radack was a Justice Department attorney and specialist in legal ethics. In response to an official inquiry, she advised that the newly captured John Walker Lindh, the so-called “American Taliban,” should not be interrogated without an attorney present — which he then was anyway. When Department officials publicly denied having received any such legal advice, and even destroyed evidence to the contrary, she exposed the deception.

Ms. Radack was not looking for a fight, but only to do the right thing. For her trouble, she was forced out of her Justice Department position, put under criminal investigation, fired from her subsequent job, reported to the state bar, and put on the “no fly” list.

Radack now works for the Government Accountability Project, a legal organization dedicated to supporting whistleblowers, which we looked at recently in a related post on the government’s ongoing abuse of anti-terrorism laws to stifle constitutionally-protected speech.

Mr. Aftergood’s full review is here.

You can read the Chronicle article here.

 
A Case Study

We had been having problems with our upstairs neighbor for over a year. The leaseholder moved out the week we moved in, and set up a couple of subletters (prohibited by our lease). He was telling our management company that he was still in residence, though he “did have housesitters in place from time to time.”

Those “housesitters” were causing a lot of noise problems, like waking us up repeatedly after midnight during the week. We kept complaining and our management company was acting to address the problem, but under San Francisco’s renter-friendly laws, dealing with this kind of thing takes months or years.

One Sunday night as we were trying to sleep, we were startled awake by the audible sounds of two small children above us. We knew very well who was occupying the unit upstairs, and she didn’t have kids. We went up to knock on the door and say, “Excuse us, but … who are you?”

The woman who answered the door had two children under the age of 4. She was just renting the place for a couple of nights, she told us.

Ah, well, that explains it.

Do you know about Airbnb? It’s a hot new service, kind of like Craig’s List, only for-profit. Their website brokers the short-term rental of apartments. Like if you are going to London and don’t want to pay $400 a night in a hotel, you can book a room in someone’s flat for $100 instead.

I used Airbnb extensively last summer, so I knew about the service. I immediately figured the unit upstairs was listed, and it took me two minutes of searching the site to find it, complete with pictures and a profile of the “housesitter.”

We furnished this information to our management company, who agreed that this would at least speed up the process of getting rid of the illegal subletter, since she had thoughtfully given us proof that she was not only occupying the unit, she was renting it out as well.

Our next step was to call Airbnb that morning, to get their assistance in shutting down the illegal rental and in finding alternative arrangements for the residents, who were booked for the next week.

That’s when we found out the bad news about Airbnb.

Think about it from the market point of view for a second. Airbnb earns its income from unit “hosts,” who post listings on their site, and renters, who pay for them. How do the neighbors of the rented-out units fit in?

It immediately became obvious that in Airbnb’s model, they do not fit in, at all. There is no information on Airbnb’s website about what to do, or who to contact, if there’s a problem with a unit rented through their service in your building. If you call their support number, there is no phone tree option for people in our circumstances. They are there for the hosts and the renters.

When I finally got through to someone and explained the problem, he told us a couple of things. First of all, they can’t be expected to learn and enforce the laws and codes specific to every zip code they service, so their expectation is that their hosts are in compliance with local laws and with their rental agreements. After all, it’s in the Terms of Use that they agree to, when they post a listing.

Uh huh.

Second, all Airbnb does is provide a listing service. They have neither the ability nor the responsibility to mediate in conflicts between hosts and their neighbors. We were advised to take it up with the woman with the listing.

You mean, the woman who is illegally renting out the unit, and who is not even on the lease? The one who has lied to us and to our management company in every conversation we’ve had?

In this case, yes.

So, what if I can easily provide verification that the host is in violation of the Airbnb terms of use? I asked. I told them my management company was prepared to confirm that the lease disallows rental of the units, and that the woman in the listing was not even a tenant in this building. And I gave him the phone number and name of our rental agent. Do you think they called?

I didn’t think they would either. So a few days later, when they hadn’t, I asked our rental agent to call them, which she did.

In the meantime, we kept having noise disruptions from our upstairs guest and her kids. Once we went up and very politely, very calmly, tried to explain that she wasn’t in the unit legally, and that we understood it wasn’t her fault, but the building is very poorly noise-insulated and could she please just be mindful of that?

Well, the occupant yelled at us, and told us it wasn’t her problem, and she didn’t care about any of that. “You live in a city,” she yelled, “Get used to it!”

We’re not used to it, so we followed up with Airbnb several times in the next few days, and they assured us that they “took this very seriously.” Mm.

Well, the listing came down in about a week, and the illegal subletter was kicked out by our management company. So that’s nice.

Guess how long it took before we had our next Airbnb-related problem? One month!

One month later, someone kept trying the knob to our apartment at eleven o’clock at night. I’m half-dressed, but I open the door in surprise to see what the hell is going on. “Oh, I thought this led to the lobby,” a person whom I didn’t recognize said.

About ten days later, the same thing happened – a second unfamiliar person tried our doorknob, this time trying to get to the trash area. What could be going on? I asked myself. Sure enough – it took me two minutes to find the new Airbnb listing, for a different apartment in our fourteen-unit building.

 
The Moral of the Story

If you’re a renter or you care about the rental market, you should be aware that this is the situation that we’re all creating for ourselves when we use Airbnb. We’re guaranteeing that a parade of travelers will have access to your apartment building and to the units next to you. And if you have any problems as a result, well, Airbnb would like to assure you that they’re very concerned about the matter.

They’re so concerned, in fact, that six weeks after they took down an illegal listing in our building, they are hosting a second listing in the same building.

In markets like San Francisco and New York City – highly-desirable destinations with expensive hotels – there is going to be an enormous incentive for these rentals, and I think I’m starting to get a sense of the frequency of these issues.

How long will it take until it is common for people in desirable markets to rent three or four apartments, just to let them out with these services? How much of that is already going on?

After all, where is the leaseholder who’s currently renting out her apartment in our building? Her unit’s booked through June, so it’s not like she’s just out of town this week.

If you support Airbnb and services that run with a similar model, you’re supporting the transformation of the apartment rental market into an network of semi-legal pseudo-hotels. These rentals do not pay occupancy taxes, depriving the city of revenue. It’s going to drive rental prices up. It’s going to cause security, maintenance, and cleanliness problems.

Like this case, also in San Francisco, in which an Airbnb host returned home and found their place completely destroyed.

This host doesn’t even know if the person renting their apartment was a man or a woman. I’d love to live next door to someone who rents out their apartment to people without knowing the first thing about them! What could possibly go wrong?

Who are you going to complain to when someone wakes you up in the middle of the night? The hotel-that-is-your-apartment-building probably has no front desk, and there’s currently no option in the Airbnb phone tree for you.

Before you book a room, no matter how much you’re going to save, I encourage you to think about what kind of rental market you want to live in first.

 
Suggestions

It’s entirely possible that Airbnb was caught unprepared for their explosive growth, but now they’re here, and they need to be controlled, and to control themselves. Their success is driving a new kind of market, and it’s huge. Founded in 2007, Airbnb is currently valued at over a billion dollars.

New York is trying to crack down on this market, and recently passed a law which is widely-interpreted as targeting the new business model, making short-term rentals illegal. Thus far the law is widely ignored.

Airbnb needs to provide legitimate resources for people affected by their service. They need to take allegations of TOU violations seriously and investigate them. They need to flag buildings that are known to disallow the use of their service, and they need to set up a service whereby building owners can opt to prohibit listings at their addresses. And they need to be pro-active about ensuring people don’t rent multiple units for the purpose of letting them out through their service.

Occupancy taxes on these rentals are only a matter of time – the laws will simply need to catch up.

If they don’t voluntarily take these actions, then it’s going to be up to our state and federal legislative bodies to make sure it happens. If these checks aren’t placed on services of this kind, the effect is going to be toxic to the rental market, and soon.

Ahmed Al Omran

Last week I saw a talk by Ahmed Al Omran, a Saudi journalist who maintains the excellent Saudi Jeans blog, offering eye-on-the-ground information on the Saudi political scene. The talk was part of the Electronic Frontier Foundation‘s Geek Reading series.

Al Omran was early on the scene in the Saudi blogosphere. His wide readership and use of English, in a post-9/11 Saudi Arabia that is eager to improve its international image, give him some latitude to write critically of his government at times, even when comparable work in Arabic may result in arrest. Al Omran compared his own work to that of blogger Fouad al-Farhan, an Arab-language blogger who was arrested by Saudi authorities until international pressure prompted his release. The two are shown together in this Washington Post article with Al Omran on the far left.

Al Omran’s presentation could perhaps be characterized by short-term sobriety and long-term optimism. He noted a number of factors supportive of movement toward gender equality, representative democracy, freedom of speech, and free access to information in Saudi Arabia, especially including the prevalence of Internet access. He noted that the Saudi government ordered a media blackout on the news of the Iraqi invasion of Kuwait in 1990 – no one in the country knew about it for a week. That would be unthinkable today, he observed, because of the decentralized nature of the Internet and the difficulty in effectively blocking access to sites.

In addition, many young Saudis are abroad earning a higher education – around 60,000 in the US alone, and as many in Europe and elsewhere. Many of these young people become accustomed to free access to information.

However, Al Omran cautioned, we should not be overly optimistic about the short-term. We do not know to what degree exposure to foreign ideas will result in commitment to political reform by the “scholarship generation,” as he called the current wave of students abroad. Many of whom will remain abroad, and many more will return to Saudi Arabia with the intention of leading quiet lives.

The Arab Spring did not effectively reach Saudi Arabia, and one high-profile scheduled protest, the Day of Rage, fizzled badly. Al Omran attributes the failure to reach critical mass to a number of factors, including the relative affluence of Saudi Arabia, the effectiveness of the Saudi education system in discouraging the idea of political reform, and the conservative culture of the country as a whole.

Nonetheless, 70% of Saudi Arabia’s population is under the age of thirty, and many of the nation’s rulers are in their 80s and 90s. Women are making largely-symbolic but significant gains, such as winning the right to vote and run in municipal elections, and a movement working toward the right to drive appears to be gaining traction.

This morning Der Spiegel ran an article (auf Deutsch) on Saudi Princess Basma Bin Saud Al Saud, who has been calling for a constitutional monarchy and greater equality for freedom. So who knows what the future holds? Political reform sometimes comes like bankruptcy – gradually, then suddenly.

The MEK has made public contributions to several prominent figures in American national politics on both sides of the aisle, including Rudy Giuliani and Howard Dean. Author and lawyer Glenn Greenwald, who has been covering the surprisingly-overt support for the MEK in his column, notes that providing such assistance to a terrorist group is a federal crime in the United States, punishable by life in prison.

NBC News recently reported that two Obama Administration sources told them that MEK was responsible for the recent deaths of multiple civilian scientists working for the Iranian nuclear program.

It’s worth noting that under the NDAA act recently signed into law by President Obama, Giuliani and Dean may now be legally detained indefinitely by the US military, with no right to due process, until such time as “hostilities end,” whatever that may mean in this case.