The WikiLeaks Grand Jury

As Alexa O'Brien reported Tuesday, the US Department of Justice has provided the latest confirmation that the grand jury investigation into WikiLeaks remains currently ongoing. That means it has been actively investigating the whistleblower website now for at least about 26 months (the Guardian first reported back in January 2011 that a subpoena seeking data on WikiLeaks had "appear[ed] to confirm for the first time the existence of a secret grand jury" empanelled to investigate individuals associated with the organisation. Prior to that, in late November 2010, the White House confirmed that there was an "active, ongoing criminal investigation" into WikiLeaks. And in July 2010, the Department of Defence stated that it had requested that the FBI help with an investigation related to WikiLeaks disclosures and that it "go wherever it needs to go").

I've been doing a bit of reading on grand juries, and the time-frame is significant because they do not have an indefinite lifespan. US law states that:

The grand jury shall serve for a term of eighteen months unless an order for its discharge is entered earlier by the court upon a determination of the grand jury by majority vote that its business has been completed. If, at the end of such term or any extension thereof, the district court determines the business of the grand jury has not been completed, the court may enter an order extending such term for an additional period of six months. No special grand jury term so extended shall exceed thirty-six months, except as provided in subsection (e) of section 3333 of this chapter.

From subsection (e) section 3333:

A special grand jury term may be extended by the district court beyond thirty-six months in order that such additional testimony may be taken or the provisions of subsection (b) of this section may be met.

And this from the American Bar Association's riveting Handbook on Antitrust Grand Jury Investigations:

The district court may extend the term of the special grand jury to a total of 36 months... The special grand jury may continue even beyond 36 months if it issues a report, and if the district judge determines that additional testimony is necessary, or that the report needs to be rewritten to comply with the governing statute.

So this means that the WikiLeaks grand jury seems to have been granted at least one six month extension thus far, as it has definitely exceeded the 18 month period already. It also suggests that some time between July this year and January 2014 — about four to ten months from now — the grand jury will either have already wrapped up or it will be close to wrapping up as it reaches the somewhat flexible 36-month cut-off point (see an update on this below). Grand juries, for those unfamiliar with them, do not decide the guilt of a person or persons. What they do is take evidence and make a judgement on whether or not criminal charges can be brought (in the form of an indictment) — in this case against Julian Assange and others affiliated with WikiLeaks.

All things considered, I would expect that within the next year or so it will be crunch time for this long-drawn-out saga. It still seems as if it could swing either way at this point, but it is worth weighing up the influence the broader political climate may have. There is an atmosphere in the United States at the minute that seems to represent a growing fatigue with the punitive national security culture that became pervasive post 9/11. Recent court judgments have gone against the government on issues related to secret surveillance and covert drone strikes, and this makes me wonder whether the tides are changing — albeit only incrementally and to a small degree.

Choosing to prosecute Assange for his role as an editor in publishing classified documents, as if it needs to be said, would be an outrageous decision that would cause an almighty outcry from a cross-partisan range of organisations and in the process damage the standing of the United States globally. Even at the height of the Bush administration's jingoistic reign it would have been an extremely controversial call to make. So for Obama's Justice Department to pursue a prosecution in the months ahead, in an atmosphere that may be tangibly shifting against draconian policies, would be a doubly contentious act that could turn out to be politically kamikaze for Obama personally in terms of his lasting legacy. All of these things will surely factor into any final decision regarding a prosecution, which will no doubt be discussed at the very highest echelons of the administration. But first, of course, we will have to wait to see whether or not the grand jury determines that there are charges to pursue in the first place....

*****

UPDATE, 1 April 2013: Wired.com news editor Kevin Poulsen, who was himself once the subject of a grand jury investigation for hacking into computer systems, tells me: "When a grand jury is up, prosecutors can just roll the case into a new grand jury." Significantly, this means that the 36-month cut-off point is far more flexible than the law I cited above implies, because when the first grand jury runs out of time, a new, second grand jury can effectively take up the investigation and continue its work with a fresh timetable. Poulsen said this occurred in his own case ("I had two GJs in series. Prosecution had a law enforcement witness summarize all previous testimony for the incoming panel"). And the book Grand Jury Practice by Howard W. Goldstein suggests it is not an unusual occurrence. Goldstein notes that "given the increasing complexity of federal investigations, many are not finished before the grand jury's term expires," adding: "information developed in one grand jury may be relevant to another grand jury."

An additional point worth mentioning here is that, according to an analysis of grand jury statistics circulated by WikiLeaks:

it is extremely rare for a grand jury not to indict. In the year 2009, federal grand juries in the United States saw cases involving 69,245 suspects and voted to indict all but 20 of them. (This is denoted by "no true bill returned" in the document.) That is a approximately one in every three thousand five hundred suspects. These statistics are repeated year after year. Given that it is known that he is the target of a grand jury investigation, Julian Assange has in and around a 99.97% chance of being indicted.

Interestingly, the same statistics show that US attorneys declined to prosecute 29,780 suspects in 2009 for reasons such as "stale case," "weak evidence," "minimal federal interest," and "Department of Justice policy." These all sound like strong grounds to halt any future attempt to prosecute WikiLeaks staff for their publishing work — if and when an indictment eventually materialises.

Jack Straw, MI6, and Extraordinary Rendition

There was a very interesting interview aired this evening on Channel 4 News with former UK foreign secretary Jack Straw, which touched on the British government's role in the Iraq War and alleged complicity in kidnappings and torture.

First, some important context.

In 2004, a Libyan Islamist militant anti-Gaddafi fighter Abdel Hakim Belhadj and his pregnant wife were abducted at a Bangkok airport and "rendered" to Libya by American agents. Belhadj was taken to one of Gaddafi's prisons and says he was subjected to torture.

At the time, British government officials were publicly denying any role in so-called "extraordinary rendition" — the practice used frequently by the United States under the George W. Bush administration involving kidnapping terror suspects and taking them to secret locations in third countries where they were sometimes brutally interrogated. But amid the revolution in Libya in 2011, a trove of classifed documents were found during the raid of a government office revealing British spy agency MI6 had in fact played a role in rendition — providing crucial intelligence that resulted in Belhadj being handed over to Gaddafi.

MI6 did not deny involvement when the documents were discovered: instead, UK government sources insisted the agency's actions were part of "ministerially authorised government policy." Then, in April last year, the Sunday Times reported that Jack Straw — foreign secretary between 2001 and 2006 — had been forced by MI6 to admit he had signed off on the secret rendition of Belhadj.

A few days after the Sunday Times report, Belhadj, who is now a military commander in the new Libya, launched legal action against Straw for alleged complicity in illegal rendition and torture.

Now, to the interview.

Tonight, on Channel 4 News, Straw made some eyebrow-raising statements to reporter Alex Thomson in light of the above. Previously he has declined to comment on the Belhadj case, and he told Channel 4 that he wouldn't discuss specifics. But he did make several short remarks that seem significant:

Thomson: It seems extraordinary to have to ask this question... but is the kidnapping and torturing of people by nation states wrong?

Straw: Of course it's wrong and we had no part in that.

Thomson: Are you sure we had no part in it?

Straw: Absolutely. It is wrong. It is absolutely wrong for any of that to have happened.

Thomson: And you are sure that the UK government had no part in it, that's what you just said?

Straw: Well, I'm absolutely sure that I had no part in this, let's just be clear about this OK, and there is going to be a full-scale judicial-led inquiry on the wider issues.

So Straw was clear. "I'm absolutely sure that I had no part in this," he said. Here is what the Sunday Times reported last year:

JACK STRAW, the former Labour foreign secretary, admitted that he had approved the secret rendition of a terrorist suspect to Libya after MI6 showed him evidence proving he had signed off the operation, well placed sources say.

Straw, who faces questioning by police over claims by Abdel Hakim Belhadj that he was tortured in a Libyan prison after being seized in 2004, was confronted by Secret Intelligence Service (MI6) officers after publicly appearing to deny he had authorised rendition.

Asked about Britain’s rendition policy during an interview on BBC Radio 4 last autumn, Straw said: “The position of successive foreign secretaries, including me, is that we were opposed to unlawful rendition, opposed to torture or similar methods and not only did we not agree with it, we were not complicit in it, nor did we turn a blind eye to it."

According to well-placed sources, within days of those comments MI6 officers met Straw. “They reminded him [Straw] that he had signed off on it. He was shown evidence and [then] he did accept that he had signed off on the rendition," said one insider.

Straw has repeatedly declined to comment publicly on the Belhadj case. This weekend a spokesman for him said: “I think that you will readily understand that while an investigation is pending, it is not appropriate for Mr Straw to respond to queries like yours."

And here is a timeline of the key events:

6-8 March 2004: Abdel Hakim Belhadj and his wife Fatima Bouchar are abducted at a Bangkok airport and flown to one of Gaddafi's prisons in Libya.

13 December 2005: Jack Straw, then foreign secretary, tells MPs in response to concerns about rendition: "Unless we all start to believe in conspiracy theories and that the officials are lying, that I am lying, that behind this there is some kind of secret state which is in league with some dark forces in the United States, and also let me say, we believe that Secretary Rice is lying, there simply is no truth in the claims that the United Kingdom has been involved in rendition full stop, because we have not been."

4 September 2011: Documents are found by Human Rights Watch inside the abandoned office Gaddafi's former intelligence chief, Moussa Koussa. One file contained hundreds of secret letters and faxes that UK spy agency MI6 and US spy agency the CIA had sent to Koussa, some revealing "evidence that British intelligence agencies mounted their own 'rendition' operation in collaboration with Muammar Gaddafi's security services." One document showed MI6 counter-terror chief Mark Allen boasting to Koussa about helping render Belhadj in 2004. “The intelligence was British," Allen wrote, adding that assisting in rendering Belhaj by providing information about his movements was “the least we could do for you and for Libya."

5 September 2011: Straw tells BBC Radio 4 in response to the discovery of the documents: “The position of successive foreign secretaries, including me, is that we were opposed to unlawful rendition, opposed to torture or similar methods and not only did we not agree with it, we were not complicit in it, nor did we turn a blind eye to it."

8 April 2012: Extensive details on the rendition of Belhadj and his wife emerge in a special report published by the Guardian. It opens: "Just when Fatima Bouchar thought it couldn't get any worse, the Americans forced her to lie on a stretcher and began wrapping tape around her feet. They moved upwards, she says, along her legs, winding the tape around and around, binding her to the stretcher. They taped her stomach, her arms and then her chest. She was bound tight, unable to move."

15 April 2012: The Sunday Times reports that following Straw's Radio 4 appearance in September 2011, officers from MI6 met with him. A source told the newspaper: "They reminded him [Straw] that he had signed off on it [the rendition of Belhadj]. He was shown evidence and [then] he did accept that he had signed off on the rendition."

18 April 2012: Belhadj launches legal action against Straw over alleged complicity in illegal rendition and torture.

14 March 2013: Straw claims in an interview aired by Channel 4 News that he is "absolutely sure that I had no part in this [extraordinary rendition and torture]."

*****

It doesn't take a genius to see that something does not add up here. There are clear inconsistencies between statements made publicly by Straw and the secret documents, and Straw's Channel 4 interview today contradicted both the secret documents and the claims published by the Sunday Times. The long-delayed judge-led inquiry into the UK's involvement in rendition cannot begin soon enough.

*****

UPDATE, 4 April 2013: It is reported that Straw and former MI6 spy chief Mark Allen say "they cannot respond to allegations of conspiracy in the torture of a prominent Libyan dissident [Hakim Belhadj], pleading the need to protect official secrets." Court documents seen by the Guardian show the former foreign secretary is arguing that the law means he "can neither confirm or deny [MI6] operations," claiming he cannot plead in the case without "causing real harm to the public interest."

However, Straw does explicitly deny misleading parliament in 2005 with his statement that Britain had not "been involved in rendition full stop." Straw claims, according to the Guardian's report, that:

it was 'readily apparent' ... that the committee at the time was discussing 'extraordinary rendition' — that is, rendition specifically carried out for the purposes of torture.

This denial strikes me as tenuous in the extreme, because when you read Straw's full 2005 statement to the parliamentary committee it is not at all clear that when he is talking about rendition he is only talking about rendition in the context of torture. Indeed, he even says at one point that "rendition is a term of art which covers a variety of activities," before going on to add: "there simply is no truth in the claims that the United Kingdom has been involved in rendition full stop, because we have not been." Of course, we now know that the UK was involved in rendition, at the time when Straw was the foreign secretary and thus the responsible minister.

*****

UPDATE II, 22 December 2013: A long-delayed UK government report on British spy agencies' complicity in rendition and torture is finally released on 19 December. The report finds that MI6 turned a "blind eye" to the torture of detainees and was not under any obligation to report breaches of the Geneva Convention. In response to the publication of the report, Jack Straw issues yet another denial, saying in a statement to parliament:

as Foreign Secretary, I acted at all times in a manner that was fully consistent with my legal duties and with national and international law, and that I was never in any way complicit in the unlawful rendition or detention of individuals by the United States or any other state.

The following day, on 20 December, the UK High Court rejects Abdel Hakim Belhadj's rendition and torture case against the government, which Straw was reported to have signed off on. Astonishingly, the judge says that while Belhadj appears to have a "potentially well-founded claim that the UK authorities were directly implicated in the extraordinary rendition," the case cannot proceed because pursuing it would "jeopardise national security." Belhadj is now trying to appeal against the decision.

*****

UPDATE III, 12 November 2015: Citing ongoing Supreme Court proceedings, The Guardian reports that Straw and former MI6 spy Sir Mark Allen "could avoid prosecution over complicity in the rendition and torture" of Belhadj and his wife by claiming immunity in the case.

Spy Trojan Seller on Ethics, Authoritarians, & 'Bad Guys' vs. 'Good Guys'

Headquartered out of a modern industrial estate in Andover, England, Gamma Group sells controversial advanced surveillance technologies to intelligence and law enforcement agencies in countries across the world. The company has been the source of widespread news coverage over the last couple of years due to its spy trojan tools — designed to secretly infiltrate computers, monitor communications and siphon data from hard drives — which security researchers say they believe are being used by authorities in a host of countries with poor human rights records, including: Bahrain, Brunei, Ethiopia, Indonesia, Mongolia, Singapore, Turkmenistan, and the United Arab Emirates.

Recently, I had an interesting and at times revealing back-and-forth email exchange with Gamma's Germany-based spokesman, Martin J. Muench. It is significant enough that I feel it is worth reproducing here, mainly because it offers an unusual level of insight into Muench's — and ultimately Gamma's — thinking.

The exchange began when I sent Muench a query regarding a prospective story I was working on — a follow-up to a Netzpolitik article detailing documents showing German federal police's plans to use Gamma's "Finfisher" (a.k.a "FinSpy") computer surveillance software. I also wanted to ask Muench about a "code of conduct" his company is apparently looking to implement in response to concerns about complicity in human rights violations.

However, the exchange, all on the record, eventually became a broader discussion about selling surveillance technologies, with Muench telling me that "we don’t necessarily agree with each other as far as the definition of what is ethical" and adding that he thought journalists had kicked up a "fuss" about Finfisher because they themselves were "guilty of the most appalling breaches."

It makes for quite a thought-provoking read, I think, especially toward the end. The content of the correspondence has not been edited, though I have removed email signatures and greetings ("Hi Ryan," "best regards," etc.) to cut out unnecessary repetition.

*****

From: Ryan Gallagher
To: Martin J. Muench
22 January 2013 12:52

I was reading this report on netzpolitik.org about the German Bundeskriminalamt acquiring Finspy: https://netzpolitik.org/2013/secret-government-document-reveals-german-federal-police-plans-to-use-gamma-finfisher-spyware/

I wanted to confirm with you:

1. is this an accurate report? Have the Bundeskriminalamt purchased Finspy or are they just testing it?

2. I note that the Netzpolitik report says you are in talks with NGOs with regards introducing a code of conduct for companies like yours. Which organizations are involved in the discussions? Can you share any information about what the code of conduct might include? And are any other companies involved?

*****

From: Martin J. Muench
To: Ryan Gallagher
22 January 2013 13:15

1. is this an accurate report? Have the Bundeskriminalamt purchased Finspy or are they just testing it?

As you can imagine this article and others relating to it have stimulated a great deal of interest...

However, I am afraid I have to tell you that Gamma simply does not discuss its client base, its exports, or any of the operations which its clients may or may not be undertaking. This is because there is usually a contractual term of confidentiality, and because naming a client can prejudice criminal or counter terror investigations and compromise the security of the members of the police or security services involved. Neither will Gamma name any countries which have not purchased its products thereby enabling customer countries to be identified by a process of elimination.

2. I note that the Netzpolitik report says you are in talks with NGOs with regards introducing a code of conduct for companies like yours. Which organizations are involved in the discussions? Can you share any information about what the code of conduct might include? And are any other companies involved?

We are currently having discussions with several groups. I don’t wish to elaborate further at the moment as some of these groups are our most vociferous public critics but who are quite prepared to discuss our ideas with us in private. In fact we have drafted a proposed Code of Conduct for the industry which goes far beyond the current ECAs.

*****

From: Ryan Gallagher
To: Martin J. Muench
22 January 2013 14:04

Regarding the code of conduct: is there any way you can send me a copy of the draft so I can get an idea of what it includes? Will it be made available publicly?

I note that Privacy International were previously reported to have turned down an invitation to discuss the code of conduct: http://www.guardian.co.uk/technology/2012/dec/26/british-company-gamma-international

Why did Privacy International refuse to engage? Do you think the code will have credibility if groups like Privacy International say they won't meet you to discuss it?

*****

From: Martin J. Muench
To: Ryan Gallagher
22 January 2013 14:16

I would honestly appreciate not putting too much focus on it at this point as I firstly would like to finish it and most of all also implement everything that has been and will be defined in there before promoting it publicly. Once it's done and we began the implementation we will definately make it public.

PI was offered numerous times a visit to our offices, a full product demonstration and open discussions about various topics. They mentioned that they're discussing internally a few month ago but did not respond to any follow-up emails. No reasons were given on why the offer was ignored.

I can only guess or better wonder why Eric King of PI does not want a personal meeting and also see the other side of the stories especially as he is spending so much time and energy on them without having the full picture; but I don't think that one organisation like PI not being interested in also giving constructive criticism will affect the credibility of such a code on a global level.

*****

From: Ryan Gallagher
To: Martin J. Muench
22 January 2013 15:05

If you have not yet implemented the code of conduct, doesn't that mean you are acknowledging that thus far you have not been adhering to appropriate ethical standards? What exactly is it that you need to implement? It would be great if you could show me a draft of the code, even on a background basis, to help me understand the context of the thing.

*****

From: Martin J. Muench
To: Ryan Gallagher
22 January 2013 21:56

Firstly, let me correct you. I am not acknowledging that Gamma has not adhered to ethical standards at all. One problem with ethical standards is that we all have them and we don’t necessarily agree with each other as far as the definition of what is ethical. Who decides? You have your views, I have mine and others have theirs’. That’s not to say we all disagree on everything. It simply means that we don’t all have the same views and for very different reasons.

Our position is this; we believe in the right to privacy but we don’t believe it takes precedence over or supersedes the right to life. We believe that nation states have the right to defend themselves against terrorists and we believe in the right to fight organised crime. We sell FinFisher to governments and law enforcement agencies to do this. We don’t sell a mass-monitoring tool. We sell a highly sophisticated piece of target specific software capable of providing evidential quality reports.

Another problem, of course, is that today’s ‘good guy’ may be tomorrow’s ‘bad guy’ and vice versa. If we imposed a moral code based on our intuition as to who might become a bad guy in the future we could end up spending a lot of time thinking about it and doing very little else. So, until we can get a code of conduct up and running that will actually work, rather than pay lip service to ‘ethics’, we have decided to let the export controls authorities act as our ‘moral compass’, for want of a better expression. After all, they are best placed to know who the ‘bad guys’ are and who the likely future ‘bad guys’ will be. We follow their lead and comply with the law.

Of course one of the reasons that some of the media have picked up on FinFisher products and make such a fuss is that some of them have become the subject of law enforcement inquiries themselves by electronic means and have been shown in the past to be by their own admission guilty of the most appalling breaches. The Leveson Inquiry shows a good example of this.

*****

From: Ryan Gallagher
To: Martin J. Muench
23 January 2013 03:30

Your last email raises many questions for me.

One problem with ethical standards is that we all have them and we don’t necessarily agree with each other as far as the definition of what is ethical.

Ethical standards can sometimes be highly subjective but they are often also relative to basic standards of right and wrong. Would it be ethical for me to sell a gun to a man I knew had a history of violence and might subsequently use it to murder an innocent person? I think the answer to that question is obvious. And I think the same kind of hypotheticals can be used in the realm of surveillance technologies. Would it be ethical for me to sell a sophisticated spy technology to a notoriously brutal state security agency operating in a country ruled by a despot with a well documented record of cracking down on, beating and jailing people engaging in legitimate democratic activities?

So, until we can get a code of conduct up and running that will actually work, rather than pay lip service to ‘ethics’, we have decided to let the export controls authorities act as our ‘moral compass’, for want of a better expression.

By this I assume you mean European export controls? Or are you also including United Nations and United States sanctions?

I should point out that just because a company is not on an export control list doesn't mean it is a place where human rights violations are not rife. For instance, countries such as Turkmenistan, Kazakhstan, Uzbekistan, Morocco and Thailand are ruled by authoritarian regimes with little (if any) limitations on the use of sophisticated spy technologies to monitor innocent individuals participating in legitimate democratic activities (journalism, activism, etc.). It is a given that these countries also have serious criminals whom they wish to monitor. But they may also have a disposition towards abusing surveillance technology to stifle dissent, track dissidents, target journalists, etc.

Have you never considered conducting an analysis of each country's respective social and polititical conditions before you do business with it? This is in line with the "know your customer" program recommended by the United States and the UN Guiding Principles on Business and Human Rights, which outlines how companies should "act with due diligence to avoid infringing on human rights and address adverse impacts."

It doesn't strike me as due diligence for you to say that you will sell to any country so long as they are not on a sanctions list.

Of course one of the reasons that some of the media have picked up on FinFisher products and make such a fuss is that some of them have become the subject of law enforcement inquiries themselves by electronic means have been shown in the past to be by their own admission guilty of the most appalling breaches. The Leveson Inquiry shows a good example of this.

I find this to be a bit of an inaccurate comparison. The "phone hacking" scandal involved (unethical) tabloid journalists listening to the voicemails of individuals by entering a default PIN code into their mailbox to gain access. I don't think that it is comparable to providing authoritarian regimes with a sophisticated spy trojan that can be used to secretly take over targeted computers, intercept communications and steal data from hard disks. The scale is different, the technology is different, and, perhaps most crucially, the potential harms are different.

*****

From: Martin J. Muench
To: Ryan Gallagher
23 January 2013 08:51

Thanks for your email. It’s a fascinating debate and one in which we could engage for some time. I see you have strong views and clearly have made your own judgments but I am afraid that I am going to have to end it here.

Would it be ethical for me to sell a sophisticated spy technology to a notoriously brutal state security agency operating in a country ruled by a despot with a well documented record of cracking down on, beating and jailing people engaging in legitimate democratic activities?

This may well be a view held by some of; the UK (Northern Ireland), the USA (Guantanamo Bay) or Germany – and we are a little sensitive of our past. However, many people in the West might not view those counties that way…..

Debate aside and let’s be clear, we co-operate with the export controls agencies of Germany, the UK and the USA. Gamma simply does not discuss its client base, its exports, or any of the operations which its clients may or may not be undertaking. This is because there is usually a contractual term of confidentiality, and because naming a client can prejudice criminal or counter terror investigations and compromise the security of the members of the police or security services involved. Neither will Gamma name any countries which have not purchased its products thereby enabling customer countries to be identified by a process of elimination.

Lastly, may I suggest you have a closer look at the Leveson Inquiry — you may find it illuminating — at least in the definition of a tabloid (David Leigh of The Guardian admits to hacking an arms dealer?)

*****

From: Ryan Gallagher
To: Martin J. Muench
23 January 2013 13:33

Yes, it's an interesting discussion. I was particularly keen to hear your response to my question about due diligence and the UN Guiding Principles on Business and Human Rights, which I note that you did not answer directly.

we are a little sensitive of our past. However, many people in the West might not view those counties that way…..

What do you mean?

may I suggest you have a closer look at the Leveson Inquiry – you may find it illuminating — at least in the definition of a tabloid (David Leigh of The Guardian admits to hacking an arms dealer?)

Yes, that's right. There were a few cases included in the Leveson inquiry that focused on journalists outside the tabloids, though it was certainly a tabloid-orientated inquiry. The Leigh case is interesting because it reveals the extent to which investigative journalists will sometimes break the law in order to expose corruption — which can be deemed permissible under UK law if there is a substantial "public interest" defence. In 2006, well before Leveson, Leigh admitted to listening to voicemails of an arms dealer in order to help reveal corrupt payments. If you followed the case you would know that the UK's Crown Prosecution Service looked into Leigh's activities and advised that he not be prosecuted because on balance it was decided his actions were in the public interest: http://www.guardian.co.uk/media/2012/jun/14/police-guardian-journalist-phone-hacking

I understand why you raise the example. But ultimately it is unrelated to what we are discussing — that is, export controls and surveillance technologies. It's false equivalence for you to bring up Leveson in the context of selling spy trojans to authoritarian regimes. As I wrote in my previous message, the scale is different, the technology is different, and, perhaps most crucially, the potential harms are different.

*****

From: Martin J. Muench
To: Ryan Gallagher
23 January 2013 14:37

Thank you for your email. I do not wish to add anything at this point. You have my answers.

India's BlackBerry Snooping

The Indian government, as I reported at Slate today, is keen to obtain data on millions of BlackBerry users across the world to help its spy agencies intercept and track messages sent in and out of the country.

I was able to obtain some revealing Indian government documents, signed and dated as recently as last month, which offer an unusual level of insight into how the authorities have been negotiating with BlackBerry to enable surveillance of communications. You can find a bunch of previously unpublished extracts from these documents below.

Why they are of particular interest is because they disclose the level of cooperation between BlackBerry and spy agencies. It is highly likely that BlackBerry has worked with other countries — not only India — to help them monitor communications sent via BlackBerry's unique "BBM" messaging service, which allows BlackBerry users to communicate for free with each other.

Authorities in the United Kingdom, for instance, struggled to intercept BlackBerry messages during the riots in 2011 due to the encryption the technology uses. However, BlackBerry later admitted that it had "engaged with the authorities to assist," presumably by providing the type of interception function that is currently being used in India. The Indian government document I obtained show the authorities there have been working with RIM to:

• Enable interception of emails and email attachments sent using BlackBerry devices.
• Enable monitoring of web browsing by people using BlackBerry handsets.
• Enable eavesdropping on messages sent via BlackBerry messenger.
• Enable the interception of "delivery reports" showing when a sent message has been received.
• Obtain access to a trove of the unique PIN codes of all BlackBerry phones shipped to India. (These codes can be used to trace and intercept BlackBerry messenger communications. Indian authorities are seeking access to all PIN codes belonging to every BlackBerry handset across the world. They say this will enable them to track and monitor BlackBerry messages going from India to countries overseas.)

It also caught my eye that the US-based company Verint, which I recently reported is offering governments a mass surveillance system to help intercept "billions" of communications, was present while India's BlackBerry monitoring system was being tested.

You can read the specific details in the extracts indented below, taken from an Indian government department of telecommunication report, produced by its "security wing." There is quite a lot of telecom jargon in there, unfortunately, but if you can cut through the acronyms you will see that the content is significant. I've included a little glossary/acronym debunker at the bottom of this post which may help translate. I've also bolded some bits that stand out to me as particularly noteworthy.

Research in Motion (RIM), Canada, is providing the Blackberry services in India through the licensed Telecom Service Providers.

Since Blackberry services are not getting intercepted in a readable format while lawful interception and monitoring by Security agencies, RIM was asked to provide the solution for lawful interception and monitoring in a readable format.

Accordingly, RIM offered the Interception solution for testing on 19.07.2012. During the testing, some observations were made by the testing team which were forwarded to RIM for compliance vide this office even letter dated 27.07.2012.

We may ask all the TSPs [telecom service providers] to comply with the Blackberry Interception requirements by 31.12.2012.

...the initial testing of various Blackberry services offered in India by Research In Motion (RIM), Canada, was carried out on 19 July, 2012 at Mumbai. During the testing on 19 July, 2012, some observations were made and conveyed to RIM as well as Vodafone to comply, which are as follows:

• (i) PIN resolution is required to identify the actual user behind Blackberry PIN.
• (ii) Web-browsing services which are being offered under BIS [are] also required to be decrypted.
• (iii) CRI [call related information] is required in the standard format as applicable for Non-Blackberry cases.
• (iv) Correlation between attachment intercepted communication and its initial email communication is required.
• (v) The correct direction has to be provided in the CRI as per actual case scenario.
• (vi) In case of BES services, Enterprise server and its Public IP address should be made available.
• (vii) The delivery & read acknowledgment communications/signaling messages are not getting intercepted.

For the compliance of the above observations, RIM offered the testing in the network of Vodafone for the verification of compliances against the observations made on 19 July 2012. Accordingly, the testing was conducted on 10 Dec 2012 at Vodafone Data Center, Sahas, Mumbai. Besides the representatives of RIM Canada, Verint & Vodafone...officers were present during the testing...

*****

The IMEI was populated in all the scenarios of BBM (incoming / outgoing) and PIN-to-PIN messages (incoming and outgoing) correctly along with the PIN details (and IMEI) details of both the target and the other communicated party. However, if the target/communicated party is international then correlation between Blackberry PIN and IMEI does not appear.

During interaction, it was clarified by RIM that database provided in the CRS [carrier routing system] is based on the information of the PINs which have been officially shipped to India and data pertaining to other countries have not been provided due to privacy and other legal provisions of those countries. However, if data for entire world is loaded in the CRS, it can correlate each & every PIN.

In OS5 — the Web browsing service is based on RIM proprietary protocol (IPPP). Presently, it cannot be intercepted in a readable format through the proposed solution. As per RIM, the solution for OS5 is still under development and will be deployed and tested by end of April 2013.

Correlation between attachment intercepted communication and its initial email communication is required. Email Attachments — In BIS Email service, attachments are not downloaded automatically for incoming mails. Attachment gets transmitted after email is delivered when the user initiates an event to download it. Thus, the attachment arrives in a later stage (after the Email product has already been marked and stored), the system shall mark an independent File Transfer product (like Email).

With respect to PIN to IMEI resolution, the tested solution is apparently satisfactory for all the handsets officially shipped to India. With regard to handsets shipped to other countries, RIM intimated that PIN to IMEI correlation in such cases can be obtained through Blackberry Public safety office (PSO). However, we may negotiate with RIM to provide the entire IMEI-PIN correlation data including other countries.

it is proposed that:

(i) We may initiate a process to take over the possession of RIM infrastructure created at Mumbai for which a suitable agreement may be entered between DOT [department of telecommunication] and RIM.

(ii) We may negotiate with RIM to provide the Blackberry PIN-IMEI Correlation data for all the Blackberry handsets.

(iii) RIM and Vodafone may be asked to demonstrate the final solution in respect in respect of [interception of delivery reports] by end of January 2013 and [email attachment monitoring and web browsing tracking/decryption] by end of April 2013.

Acronym debunker: PIN = Personal Identification Number (a unique code every BlackBerry is allocated, can be used to track and monitor communications and identify the sender); BBM = BlackBerry Messenger; IMEI = International Mobile Station Equipment Identity (another unique code used to identify a phone); OS5 = a BlackBerry operating system; BIS = BlackBerry Internet Service; CRI = Call Related Information (the who, where and when of a communication — like the time a call was made and the number of the caller and recipient); CRS = Carrier Routing System (network infrastructure through which communications travel).

Give Light

After writing a short note here yesterday about weak and deferential journalism in the United States, I was reading today about a fearless American newsman from a different age.

In the 1920s, Carl C. Magee kicked up a shitstorm when his Albuquerque newspaper published revelations about what was called the Teapot Dome scandal. This was, according to the History News Network:

...the most famous of several scandals that ruined the reputation of President Warren G. Harding, who served from March 1921 to August 1923 and is often described as the worst president our country has ever had. At its bare bones, Teapot Dome is a simple case of bribery. Secretary of the Interior Albert Fall, a former senator from New Mexico and a friend of Harding's, was convicted of taking bribes from oil executives.

Magee's newspaper, the Albuquerque Morning Journal, had apparently infuriated President Harding by revealing details about this corruption. He was later called to testify in Washington and his testimony helped convict Fall, who was sentenced to one year in prison and fined $100,000.

There was a backlash against Magee during these years. He received death threats, was physically assaulted, and one district judge at the time was implicated (pdf) in efforts to discredit, or possibly imprison him. Eventually he was forced to sell off the Journal after being driven close to bankruptcy by financial institutions which, under political pressure, refused to renew his loans.

But Magee couldn't be stopped for long — emerging just two months later with another newspaper, named Magee's Independent. On the front page, printed beneath the sketch of a rising sun, there was a motto: Give Light And The People Will Find Their Own Way.

The firebrand continued to call out corrupt officials and reveal wrongdoing in a regular column titled "Turning on the Light." He was unfazed by the threats and intimidation.

"They did as they pleased without criticism," Magee was quoted as saying. "State institutions were run negligently. Public money was deposited in the banks, and state officials took the interest and put it in their own pockets."

Magee died in 1946 aged 73. A brilliant character whose tenacious muckraking embodied the pure spirit of good journalism.

Saudi Drone Base Blackout

Yesterday it was widely reported that the United States has been operating "secret" drone base in Saudi Arabia since 2011. Not only that, but some American news organisations had known about the base for more than a year and chose not to disclose its existence because of a blackout agreement made with the government.

Here's a snippet from the Washington Post's report:

The Washington Post had refrained from disclosing the location at the request of the administration, which cited concern that exposing the facility would undermine operations against an al-Qaeda affiliate regarded as the network’s most potent threat to the United States, as well as potentially damage counterterrorism collaboration with Saudi Arabia.

The Post learned Tuesday night that another news organization was planning to reveal the location of the base, effectively ending an informal arrangement among several news organizations that had been aware of the location for more than a year.

But the logic here doesn't stack up. Why? Because on 26 July 2011 a story was published by the London Times titled "Secret drone bases mark latest shift in US attacks on al-Qaeda." This report revealed the existance of a CIA drone base in Saudi Arabia, and even went as far as to speculatively pinpoint its exact location:

The CIA has set up a network of secret drone bases in Arab states in a major escalation of its campaign against al-Qaeda militants in Yemen.

Sources in the Gulf say the agency is now massed along Yemen’s borders, launching daily missions with unmanned Predator aircraft from bases in Saudi Arabia, Oman, Djibouti and the United Arab Emirates. [...]

“Oman, Saudi and the UAE are being used as bases for drones. The operation against al-Qaeda has been stepped up in Yemen and in Somalia,” said a Gulf defence source. [...]

A senior Gulf intelligence source believes the most likely base in Saudi Arabia is at Khamis Mushayt in the southwest. The site has been used by Saudi forces for airstrikes against Houthi rebels in northern Yemen. A possible alternative is Sharurah in the kingdom’s Empty Quarter, close to the Yemeni border but considered less secure.

What this means is that the information the United States government was pressuring American reporters to keep secret was already in the public domain — it had already been "outed," as it were, and it hadn't damaged counter-terrorism operations or the relationship with Saudi Arabia. Anyone with an Internet connection — and yes, that includes members of al-Qaeda — could find out that the CIA had a "secret" drone base in Saudi Arabia simply by doing a quick Google search. (Even though the Times story is behind a paywall, the first few paragraphs, which include the Saudi detail, can still be viewed for free.)

Defending the decision not to publish this information after some criticism, Washington Post reporter Greg Miller posted a tweet today saying: "For the record, WaPo has reported CIA drone base on Arabian peninsula since 2011, w/out disclosing it was in Saudi." I asked him why not disclose the specific country when it had already been published elsewhere, and he responded: "Short answer: US govt concerned more about US press than British, and saying on Arabian peninsula puts readers pretty close."

I think this shows poor judgement. It seems flawed to make a distinction between the British and American press here, especially in the age of the Internet. All news stories published online are distributed instantly to an international audience. By disclosing the existence of an "Arabian peninsula" base while suppressing the exact country in question — even though it is already in the public domain — not only are you serving no substantive purpose but you are doing your readers a disservice.

In national security journalism, difficult decisions often have to be made under incredible pressures. Sometimes, there can be a legitimate need to keep a certain military operation undisclosed if, for example, lives are at stake. But in this case I think the American press got it wrong. Unfortunately, it comes off looking like another example of deference to power that will ultimately taint the reputations of the newspapers involved.

Guantanamo's Anonymous Censor

When a suspected terrorist mastermind goes on trial at the Guantanamo Bay military commission, strange things can happen.

Last week, midway through the pretrial hearings for five accused 9/11 plotters, an anonymous outside censor unilaterally blacked out an audiovisual feed that provides public access to journalists reporting on the proceedings. The incident frustrated the military judge, who is supposed to have total control over the courtroom, and in the process illustrated the acute tension between open justice and obsessive-compulsive national security secrecy.

Here's how it went down, according to Jason Leopold, a reporter for Truthout who was in attendance:

...the audio feed to the proceedings was interrupted Monday when defence attorney David Nevin, who represents [accused 9/11 planner Khalid Shaikh] Mohammed, discussed the title of an exhibit pertaining to the CIA's secret black site prisons, where the self-professed 9/11 mastermind and his alleged co-conspirators had been held prior to their transfer to Guantanamo.

When Nevin uttered the word "secret," a warning light, which is silent, positioned on the judge's dais, started to flash and the sound of white noise was fed through the audio feed. Moments later, the monitors inside the gallery went black. The outage lasted three minutes. (The courtroom is visible to members of the gallery but is separated by soundproof glass; the audio feed is delayed by 40 seconds).

The judge, Col. James Pohl, was not happy about the act of censorship because he had not approved it. "If some external body is turning the commission on or off based on their own views of what things ought to be, with no reasonable explanation ... then we’re going to have a little meeting about who turns that light on and off," he said, reported the Huffington Post.

The fascinating debacle raised a number of questions, most importantly: who was this mysterious outside censor, watching proceedings from outside the courtroom and able to hit a "white noise" button on a whim? Leopold's report offers the closest thing to an answer:

It was later revealed by the government that the third party monitoring the hearings who was responsible for the interruption ... was the "original classification authority," or OCA, likely a reference to the CIA since that is the agency that operated the black site prisons.

But the government refused to provide information about whether the censor had been monitoring proceedings from a room at Guantanamo or was in fact located somewhere in the United States (like, say, the CIA's headquarters at Langley, Virginia).

"Who is the invisible hand?" asked one of the defence attorneys, not content with the lack of clarity. "Who is the master of puppets?"

It's a question that's difficult to answer with 100 percent certainty, given the secrecy. But whoever was responsible, he or she is not likely to be hitting the blackout button again any time soon. On Thursday judge Pohl ordered the government to unplug any outside censors. “This is the last time that will happen,” he said. “No third party can unilaterally cut off the broadcast.”

A rare triumph for transparency, it seems.

[You can a detailed report about the case, United States v. Mohammed, et al., here, courtesy of the Public Record.]