Threats

This week's post will focus on computer threats. This may be a good time to define the difference between a vulnerability, threat and risk as they can easily be confused:

THREAT:  Can be thought of as an attack or something that exploits a vulnerability (either intentionally or unintentionally) that may results in damage or access to data or destroys an asset.  A threat could be a unencrypted computer that is lost.  The person who finds the PC could use one of a number of programs to access the machine without knowing the password.

VULNERABILITY:  Weaknesses that can be exploited by threats to gain unauthorized access to an asset.  Examples of a vulnerability could be the absence of a encryption on a laptop or a mis-configured router allowing all traffic in and out of an organization.

RISK:  "Risk is a measureof the extent to which an entity is threatened by a potential circumstance or event, and is typically a function of:  (i) the adverse impacts that would arise if the circumstanceor event occurs; and (ii)the likelihood of occurrence. Information security risks are those risks that arise from the loss of confidentiality, integrity, or availability of information or information systems and reflect the potential adverse impacts to organizational operations (i.e., mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation" (Guide for Conducting Risk Assessments, 2012).

 


This diagram of threats, vulnerabilities and potential risks may make these terms easier to understand:

I hope this helps us all understand the differences between the terms so we all use the terms correctly.


References:

Guide for Conducting Risk Assessments. (2012, September). Retrieved from National Institute for Standards and Technology Special Publication Series: http://csrc.nist.gov/publications/nistpubs/800-30-rev1/sp800_30_r1.pdf 

Maniscalchi, J. (2009, June 26). Threat vs Vulnerability vs Risk. Retrieved from Digital Threat: http://www.digitalthreat.net/2009/06/threat-vs-vulnerability-vs-risk/

  

The NSA is out of Control Spying on Americans

The NSA has abused the rights of the citizens by illegally intercepting, storing and reviewing their private communications.  The NSA has been secretly granted authority to collect data (defined as voice and electronic information traveling across the Internet) through the Patriot Act in October of 2001.  In March of 2004, a Justice Department review declared that the collection of this data was illegal.  The program was then suspended for some time.  In 2007 the program was authorized to re-start.  Trouble erupted in 2009 when the Justice Department acknowledged that they had collected telephone and other electronic data in a way that exceeded legal limitations.  Later, in October of 2011, the Foreign Intelligence Surveillance Court (FISA) “ruled that the NSA violated the Fourth Amendment at least once” (Lee, 2013).  The ruling associated with the October 2011 violation is secret so specific facts about the ruling are unknown, however many suspect that the NSA defeated some aspect of the minimization rules (Lee, 2013).

            The NSA not only illegally intercepts and secretly stores the telephonic and electronic data of people in the United States, it also requests that companies like Microsoft, Yahoo, Google, Facebook, PalTalk, AOL, Skype YouTube and Apple provide personal information through the use of court orders (Lee, 2013).  Individual users of these programs who have configured their account to restrict access have no way of knowing that their data is being intercepted and analyzed.  This illegally collected data is accessed illegally and may be used against them without their knowledge. 

            The collection of information from these companies has potentially injured their reputation by their users who expect them to protect their data and respect their privacy.  This information has only recently become public.  Facebook has fought off the notion that they had a choice on whether to provide the data, have made public attempts to assure their flock that they have acted responsibly and that they have been vigilant in requests to the government to publicize the activity. Their newsroom report states that they have urged the government “to allow companies to divulge appropriate information about government orders and requests that we receive, in a manner that does not compromise legitimate security concerns” (Ullyot, 2013).  Facebook pledges that they will vigilantly protect their users’ data but also states that they have complied with between 9,000 and 10,000 requests from all government entities between June and December of 2012 (Ullyot, 2013).

            It’s time to look back at this secret activity being handled by the NSA and see how this activity is in direct violation of the Bill of Rights.  The activity violates the First Amendment, “Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech…” (The Bill of Rights).  The collection of data has prohibited our exercise of free speech by collecting and examining the data.   The First Amendment continues to prohibit the restriction of a citizens ability “…to petition the Government for a redress of grievances” (The Bill of Rights). Normally citizens can challenge statutes for constitutionality in court however the activity of the NSA comes from a secret law that cannot be challenged in court.  Furthermore, the FISA court is not a real court; it is an administrative body that listens only to the government and operates in total secrecy. 

            The Fourth Amendment prohibits warrantless search and seizure.  The NSA does not obtain a warrant which would mandate the accused appear before a federal judge.  The process is secret and does not allow the accused an opportunity to represent himself.  In addition, the NSA is permitted to provide only vague assertions that do not demonstrate that the target is a spy, terrorist or any other sort of criminal (Sullum, 2013).      

            The Fifth Amendment is violated because citizens are not provided protection against self-incrimination.  The NSA saves and uses evidence they collect, presumes guilt then investigates.  The individual does not even know he is being investigated.  The Fifth Amendment states “no person shall be held to answer for a capital, or otherwise infamous crime, unless on a presentment or indictment of a Grand Jury … nor shall be compelled in any criminal case to be a witness against himself, nor be  deprived of life, liberty, or property, without due process of law; nor shall private property be taken for public use, without just compensation” (The Bill of Rights).  The NSA’s collection and processing violates the Fifth Amendment.

            The collection and use of data is a violation of the Sixth Amendment as a target is not allowed to confront the NSA and has no right to trial. The Sixth Amendment states that the accused shall “be informed of the nature and cause of the accusation; to be confronted with the witnesses against him; to have compulsory process for obtaining witnesses in his favor, and to have the Assistance of Counsel for his defence” (The Bill of Rights).  The practice of the NSA does not permit an accused person to even know that he is being observed and analyzed.  

            The Ninth Amendment, “The enumeration in the Constitution, of certain rights, shall not be construed to deny or disparage others retained by the people” prohibits the government from restricting freedoms that are not explicitly restricted by the Constitution (The Bill of Rights).  The government may not declare privacy a non-right, which is what they are doing.

            The NSA is permitted to intercept communications if at least one part of the conversation is outside the United States.  Since the requirement specifies that the discrimination occurs, the NSA is allowed to retrieve bulk information then it must sort it out to remove disallowed information.  In some cases this determination cannot be made without the intervention of a human analyst (Lee, 2013).  Interestingly, this counters allegations that the metadata collected is analyzed using a mathematical formula, not through the use of human intervention (Saletan, 2013).  When communications are analyzed by humans there is great potential for illegal activity including the ability to plant evidence or wrongly accuse an innocent person. 

            How many lives or potential terrorist attacks have been prevented by the illegal search and seizure of the information by the NSA?  During the House Intelligence Committee on June 18, 2013, General Alexander said, “The information gathered from these programs provided the U.S. government with critical leads to help prevent over 50 potential terrorist events in more than 20 countries around the world” (Elliott & Meyer, 2013).  The NSA has been able to substantiate the truthfulness of only four threats of the 50.  Of the four known instances where the NSA data was used to solve crimes none relied exclusively on NSA data to solve the case.  In the case of Basaaly Moalin who was convicted of sending $8500 to Somalia, used to support the terrorist group that bombed a mall in Kenya, the case could have been solved by simply getting a court order to retrieve the phone records in question.  The case involving Chicagoan David Coleman Headley who helped plan the 2008 Mumbai terrorist attack used tips from British Intelligence to solve the case.  The case of Najibullah Zazi, the man who plotted to bomb the New York subway system, did not require the warrantless powers of the NSA to find him.  The FBI has authority to monitor email accounts of known terrorists, which they had been doing.  The last case involving a plot on the New York Stock Exchange did not result in prosecution (Elliott & Meyer, 2013).  These cases may cause legal problems for the United States when those accused file lawsuits.

            The collection processes are illegal and they disregard the protections afforded to Americans in the Bill of Rights.  The unrestricted collection of data has not been demonstrated to actually prevent terrorism or other crimes.  The policy was created and executed secretly without disclosing information to the American people.  The founders of our country must be spinning in their graves.  The authority of the NSA to illegally collect data must be reversed and controlled.

                            

 

References

Elliott, J., & Meyer, T. (2013, October 23). Claim on “Attacks Thwarted” by NSA Spreads Despite Lack of Evidence. Retrieved from Pro Publica: http://www.propublica.org/article/claim-on-attacks-thwarted-by-nsa-spreads-despite-lack-of-evidence

Lee, T. B. (2013, June 12). Here’s everything we know about PRISM to date. Retrieved from The Washington Post: http://www.washingtonpost.com/blogs/wonkblog/wp/2013/06/12/heres-everything-we-know-about-prism-to-date/

Saletan, W. (2013, June 6). Stop Freaking Out About the NSA. Retrieved from The Slate: http://www.slate.com/articles/news_and_politics/frame_game/2013/06/stop_the_nsa_surveillance_hysteria_the_government_s_scrutiny_of_verizon.html

Sullum, J. (2013, November 1). Jacob Sullum: Broad spying law worthy of scrutiny. Retrieved from Omaha World Herald: http://www.omaha.com/article/20131101/NEWS08/131109960/1677

The Bill of Rights. (n.d.). Retrieved from http://www.archives.gov/exhibits/charters/bill_of_rights_transcript.html

Ullyot, T. (2013, June 14). Facebook Releases Data, Including All National Security Requests. Retrieved from Facebook : http://newsroom.fb.com/News/636/Facebook-Releases-Data-Including-All-National-Security-Requests

NSA is Protecting National Security

            The National Security Agency (NSA) is protecting our national security by intercepting and analyzing data within the country in order to determine potential threats.  This practice has many Americans questioning the legitimacy and necessity of this practice.  This information gathering process and scrutiny is necessary to prevent another 9/11 terrorist attack. 

            The NSA analyzes metadata from legally obtained electronic and telephonic communications.  According to Foreign Intelligence Surveillance (FISA) Court Judge Clair Eagan, the purpose of the surveillance of the NSA is to make “connections between known and unknown international terrorist operatives as part of authorized investigations” (Crovitz, 2013).  The process ws designed to protect citizens.

            It is important to understand what data the NSA is gathering.  Many citizens are under the impression that the NSA is recording and listening to every conversation made on the telephone and looking at every email message being sent.  This is not accurate.  The Fourth Amendment prohibits the NSA from listening to the content of calls without a court order.  The NSA collects metadata which includes the phone numbers of the caller and receiver, the date of the call and length of telephone call.  The NSA uses mathematical processes to determine potential threats.  If the data represents a threat, evidence must be presented to the FISA Court to obtain a separate order to investigate these threats (Saletan, 2013). The data gathered during the surveillance makes it possible to determine where threats exist.  It is impossible to quickly determine where threats exist without the use of electronic means due to the high volume of communications.  If this information is not known quickly the potential for terror rises exponentially. 

            The United States is not alone in gathering intelligence.  Many countries employ surveillance programs to evaluate their people as well as other governments, regardless of whether the country is considered an ally or an adversary.  In 2008 a German broadcaster reported that Germany had been monitoring email between industry leaders from Afghanistan, Germany and a journalist (Gewirtz, 2013). Furthermore, it is well known that cameras, known as “cctv” are deployed on every residence throughout London.  Residents of many countries accepted the fact that their activities are being monitored.  Many of these people believe that this monitoring protects them from physical dangers presented by thieves and other non-law abiding citizens.  Foreign countries are watching and listening to our communications within the United States too.  They use this intelligence to gain the competitive edge by stealing proprietary information from US companies.  They learn our military secrets in hopes of beating us at our own game and use the information they learn to influence future policies.  They will likely try to use the recent data about the alleged interception of German Chancellor Angela Maerkel’s cell phone calls as leverage in the future.

              Many citizens are speaking out in favor of preventing the NSA from gathering intelligence.  Changes that prevent the collection of data by the NSA will threaten the security of each person living in the United States and the very security we enjoy today.     Our enemies and our allies are already gathering and using this information. 

            It is important to understand how the NSA has authority to collect metadata.  Two sources allow the collection of data.  First, section 215 of the Patriot Act “gives the government the power to obtain any “tangible thing” from third parties relevant to a terrorist investigation” (Lee, 2013).  This section allows the collection of metadata.  Second, section 702 of the Foreign Intelligence Surveillance Act is “designed to facilitate the acquisition of foreign intelligence information concerning non-U.S. persons located outside the United States” (Logiurato, 2013).  These acts have are evaluated regularly and have been assessed and approved as recently as December of 2012.  These lawful acts allow the US Government to gather information that will help protect the people of this country from a variety of threats.  Some peole will argue that the Fourth Amendment protects them from the watchful eye of the government.  A 1979 Supreme Court decision, known as the third party doctrine, specifies that “users don't have Fourth Amendment rights protecting information they voluntarily turn over to someone else. Courts have said that when you dial a phone number, you are voluntarily providing information to your phone company, which is then free to share it with the government” (Lee, In AP surveillance case, the real scandal is what’s legal, 2013).  Finally, the NSA may not act on threats without a court order by FISA.  These checks and balances that restrict access to protected information without a court order by FISA. 

            We must protect our country against the enemy that is within us and the enemy from afar.  It is important that sophisticated means are used to determine threats so problems can be prevented from happening.  It is time to accept the fact that the NSA is gathering information to protect us.

References

Crovitz, G. L. (2013, September 22). Making the Case for NSA Surveillance—At Last. Retrieved from Wall Street Journal: http://online.wsj.com/news/articles/SB10001424127887323808204579089153571584472

Gewirtz, D. (2013, October 28). Why do allies spy on each other? Retrieved from ZDNet: http://www.zdnet.com/why-do-allies-spy-on-each-other-7000022476/

Lee, T. B. (2013, June 25). Here’s everything we’ve learned about how the NSA’s secret programs work. Retrieved from The Washington Post: http://www.washingtonpost.com/blogs/wonkblog/wp/2013/06/25/heres-everything-weve-learned-about-how-the-nsas-secret-programs-work/

Lee, T. B. (2013, May 14). In AP surveillance case, the real scandal is what’s legal. Retrieved from The Washington Post: http://www.washingtonpost.com/blogs/wonkblog/wp/2013/05/14/in-ap-surveillance-case-the-real-scandal-is-whats-legal/

Logiurato, B. (2013, June 7). Here's The Law The Obama Administration Is Using As Legal Justification For Broad Surveillance. Retrieved from Business Insider: http://www.businessinsider.com/fisa-amendments-act-how-prism-nsa-phone-collection-is-it-legal-2013-6

Saletan, W. (2013, June 6). Stop Freaking Out About the NSA. Retrieved from Slate: http://www.slate.com/articles/news_and_politics/frame_game/2013/06/stop_the_nsa_surveillance_hysteria_the_government_s_scrutiny_of_verizon.html