Whistleblower says Feds have highspeed backdoor into major US wireless carrier's network
Snip from post by Kevin Poulsen, at Wired Threat Level blog.
A U.S. government office in Quantico, Virginia, has direct, high-speed access to a major wireless carrier's systems, exposing customers' voice calls, data packets and physical movements to uncontrolled surveillance, according to a computer security consultant who says he worked for the carrier in late 2003.Wired contacted Verizon, and a company spokesperson declined to comment:"What I thought was alarming is how this carrier ended up essentially allowing a third party outside their organization to have unfettered access to their environment," Babak Pasdar, CTO of New Jersey-based IGXglobal told Threat Level. "I wanted to put some access controls around it; they vehemently denied it. And when I wanted to put some logging around it, they denied that."
Pasdar won't name the wireless carrier in question, but his claims are nearly identical to unsourced allegations made in a federal lawsuit filed in 2006 against four phone companies and the U.S. government for alleged privacy violations. That suit names Verizon Wireless as the culprit.
"What you're talking about sounds as if it would be classified and involving national security, so I wouldn't be able to find out the facts."Link to full post, with related documents.
Update: A BB commenter points to a related Slashdot thread. Snip:
It's very likely this is to meet the realtime reporting/relay requirements of the CALEA statue which governs lawful intercept of voice and data communications.Link
the latest
latest episodes
Whatever it takes to keep us free!
bng bng, y r cmplt mrns fr dvctng tht w shld hndr ntnl scrty ffrts bcs r 'prvcy' s t stk hr.
what is "national" security? Is it bigger than personal security? Does it smell nicer?
Wow, Sam, you're as articulate as you are gracious.
oh wait, you're the one that thought Hiroshima was just swell. How is Himmler these days?
Wireless phone signals aren't very secure in the first place. Yes, it's foolish to let a third party walk in the door and have full access to the records, but, no, it's not as though the third party couldn't have tapped into the signal anyway.
@takuan,antinous: He's a troll. Ignore him.
There's a good slashdot thread indicating that this story is probably blown out of proportion:
http://it.slashdot.org/comments.pl?sid=477114&cid=22657770
mmmm...trollmeat......
Looking at Slashdot; if EVERY carrier has this, it makes it a bigger deal - not a smaller one.
DO NOT LOSE SIGHT OF WHAT THIS IS ABOUT.
Anyone planning terror IS NOT GOING TO BE CAUGHT BY THESE MEASURES.
You, however, are now living in a fishbowl. Rely on your obscurity to protect you. It will - until someone more powerful than you decides you are a "problem", or a resource.
In a time of great economic chaos, an easy way to increase your own property is to acquire that of the denounced. Don't expect others to speak up for you, they will have their own problems.
'm trll? Jst bcs dsgr wth pnts bng md n ths st cndmns m. 'm srry bt dn't fll n ln lk th rst f y knckl-hds nd jst gr t wht sm psts sy. Wt, sn't ths st tht s brngng p s clld, 'dssdnt' thght? Yr llwd t mk yr pnt s qlly s m mn.
nd wht ws wrng wth my sttmnts bt hrshm. t ws jst thn s t s nw. t svd lvs nd ndd wr. Hw bt stppng t f th shs f n nnyms blggr n th 21st cntry nd nt th bts f sldr n WW r vn Trmn hmslf. Lk t t frm thr prspctv nd hw, ys, t md sns t thm t d t. vryn's lwys th sm wth n ct bng tkn ntlly s gd nd thn w sftn p nd cndmn th ct bcs w wrn't thr, nly nw w hv bcm 'mrlly nlghtnd' t knw th tr trcts f hmn rghts. Rdcls.
I wish I could respond to Sam's comments, but I don't understand them. Anyone know what he is trying to say?
Sam, Sam, Sam, you impetuous lad...
You need to read a tad bit more on the war, me thinks. By July 1945, the Allies were in a position to begin pressuring Japan into capitulation. Regular bombimgs by American B-29s, loaded to the gills with high explosive and incenriary devices (which had also done an impressive number on a little German town known as Dresden, though Superforts weren't involved in that operation), had shown that they could strike the Japanese islands with relative impunity. The Japanese had been pushed back pretty much to their homeland and were now hurting. If Operation Downfall (the invasion of the Japanese homeland) had proceeded, I suspect that the number of American casualties might not have been as high as the 80,000 who died as a result of the bombings; General Groves was just aching to use his toy, and this was his opportunity.
((There are many folks out there who like to imagine what would have happened if the Japanese had allowed some of their little black projects to proceed; how might this have changed the war? Problem is, you need resources, and by summer 1945, the Japanese were sorely in need of them))
And Takuan is dead-on right. If terrorists are planning attacks on our soil, you can bet your sweet tuckus that the last thing they'll do is use our telecommunication backbone because they greatly increase the chances that they will be caught. I for one am utterly appalled at my own government's behavior.
We should be very concerned about this. All of us. Even you, Sam.
I've said it here before and I'll say it again:
The extent to which I disagree with someone's post seems to be a reliable predictor of their ability to spell.
Sammy me boy, go watch the Fog of War. Look into McNamara's eyes. He was there.
@13
wot u meen? u stoopid!!!
The extent to which I disagree with someone's post seems to be a reliable predictor of their ability to spell.
Armbruster's Law? Is it taken already?
#12:
In august '45, secret negotiations with the Japanese were already under way. While the a-bombs on Hiroshima and Nagasaki rendered these negotiations pointless, most historians agree that the Japanese would soon have surrendered anyway, and the bombs were merely a jolly little show for Stalin & Co.
Of course, they won't teach this in history lesseons in the U.S. as it would be tantamount to admitting to a war crime.
yeah, this is for CALEA. I worked for Sprint, and we had to set this up all over. It is always running, it splits off all the call records (non-real time) so they can have access to them, plus, then can flip on anytime real time voice/data tracking and listen in. Its like a split network direct to the government.
Hello,
I'm quite new to boingboing so forgive me if I'm stating the obvious, but something struck me as rather odd. I read this lovely little bit of information about some confirmation that our civil liberties are being used like soft toilet paper (with all fingers pointing at Verizon) and continued to scroll down the page to read the other lovely little bits of information. Imagine my surprise when I accidentally clicked on that stupid "Klaus Pierre" video and all of a sudden, I see that boingboing is sponsored by Verizon.
Am I missing something here? Or is this just an example of irony in it's full magestic glory?
Thanks for reading
no irony. Irony would apply if this article weren't
here. Now, eat your tasty information and be grateful you found BB.
Am I missing something here?
No, but we are. Where's your monthly dues to keep the site running?
So, the way this works is that they'll have computers connected to the streams which are analyzing the conversations and waiting to key in on a list of words that some jackwad has decided are relevant to terrorism. The majority of callers will be ignored although you can be sure that there is a long list of individuals who have committed heinous crimes against America and their calls will always be monitored. People like Philip Zimmerman, Richard A. Clarke, Sibel Edmonds, and William Clinton; subversive anti-american adulterers.
So, the computer searches for keywords and then a human has to intervene! Someone must listen to the context of the conversation to try to understand if what was said was actually a reference to a terrorist act or simply a word that had a similar sound.
I think we should all start talking about the NSA, bombs, airplanes, 9/11 and anything else you can think of that might interest an NSA investigator.
Let's start abusing their manpower allotment. Let's make their job a living, (ricin, firearms, bomb, aircraft) hell.
In the end it probably won't change a damn thing, but it'll be fun to twist their panties.
yeah, that goes back to Echelon. I'm sure they have filters but no matter how good the software, they are still schmucks manning the phones. You can't get smart people to betray their countrymen, not the brightest anyway.
After 9/11, the NSA + CIA became heavily involved in searching for terrorists via any means necessary. They were granted access originally under the pretense of monitoring international phone calls, but this monitoring also gave them full access to major ISP/backbone networks.
This is explained in a very logical and believable way in the book "The One Percent Doctrine" -- an interesting read.
This is kind of old news. AT&T has allowed this for years, using Narus hardware.
After 9/11, the NSA + CIA became heavily involved in searching for terrorists via any means necessary. They were granted access originally under the pretense of monitoring international phone calls, but this monitoring also gave them full access to major ISP/backbone networks.
This is explained in a very logical and believable way in the book "The One Percent Doctrine" -- an interesting read.
I consider myself to be a conservative with pro-privacy leanings; however, in the interest of looking at things from a different POV, I'm going to argue FOR the administration's case of having a backdoor to all the major wireless carriers.
tl;dr: not a troll.
First of all, I would argue on the principle of harm/benefit ratio. That is to say, is the harmful aspect of this greater than the benefits? I say no; the Administration has not, to date, misused the data accumulated. On the other hand, the benefit of being able to eavesdrop on possible terrorist communication is quite real. Therefore, I would say that having these backdoors passes the harm/benefit test.
Secondly, I would say that there are no visible impact on the overwhelming majority of customers. There is no drop of quality attributable to these backdoors, nor are the customers unduly charged by it.
And finally, I would say that in these days and age, giving up some degree of privacy is unavoidable. The Constitution is not a suicide pact; in 1931, the then-US Sec. of State Henry Stimson famously remarked, "gentlemen do not read each other's mail". A decade later, Pearl Harbor happened.
SHAWK!!!
Naw.... do something about it.... pussies....
@StrawMan
They may not have used this inappropriately yet, but I find it hard to believe they won't.
The Republican Party got caught voter caging Democrats, because some people that were not supposed to receive an email about it did. I'm sure the Democratic party does things like that as well, but they're a bit more tech-savvy and are not as likely to CC un-needed addresses in their unencrypted emails about illegal activities.
My main point I'm trying to get to is the current Powers in our nation are to old to grasp what they can do with these new toys. Once the older generation retires, that will no longer be the case. They will know full well that they can access systems like this for their own evil little schemes, know that they have a good chance of erasing all evidence of wrongdoing once they're done, and will be tech savvy enough to do it themselves. I would doubt 100% of the politicians would hold out against the little voice in their head saying, "there's an easier way, there's an easier way" over and over again.
PS: Did you know we had plans to bomb Europe at the same time as Japan?
http://www.thememoryhole.org/war/nuke-europe.htm
Also, I love what one of the scientists from the Manhattan Project had to say about our actions.
"Let me say only this much to the moral issue involved: Suppose Germany had developed two bombs before we had any bombs. And suppose Germany had dropped one bomb, say, on Rochester and the other on Buffalo, and then having run out of bombs she would have lost the war. Can anyone doubt that we would then have defined the dropping of atomic bombs on cities as a war crime, and that we would have sentenced the Germans who were guilty of this crime to death at Nuremberg and hanged them?"
#24 strawMan
> I would argue on the principle of harm/benefit ratio. That is to say, is the harmful aspect of this greater than the benefits? I say no; the Administration has not, to date, misused the data accumulated. On the other hand, the benefit of being able to eavesdrop on possible terrorist communication is quite real. Therefore, I would say that having these backdoors passes the harm/benefit test.
I will argue that the benefit of being able to eavesdrop on possible terrorists is a delusional wishful falacy. After all, how many real terrorists have they caught this way? They know you would be listening (or at least it's possible that you might be listening) and take the necessary precautions to avoid getting caught this way.
On the other hand, the harm of giving up all your much vaunted civil liberties, one after another, in the believe that the state will use this to increase "security", is very real. Without the terrorists having to do anything, you're surrendering, turning your country into a police state.
When this process is complete, how will your country be better than any other? In fact, it will be worse. You'll find yourselves living in a new East Germany. The only reason there has not been another 9/11 is not because the state has been very successful in protecting you. It's because the terrorists find there is no need. There is no need to carry out a risky, expensive attack that will like kill some of their own. Not when you are doing exactly what they want. Robbers do not beat their victims when the victims are in the act of handing over all their possessions.
Ten years ago, many people look up to America. The land of liberty and freedom. They wanted to move there, or turn their own countries into little copies of America. Today, the only people wishing to go to America are economic migrants. Those who wanted to emulate it now hang their head in shame, wishing their friends will forget what they said in the past.
While I agree Sam's first comment is dumb, I'm not convinced the subsequent arguments about Hiroshima are well reasoned.
It's true Japan was on the ropes and that surrender discussions were underway but all statements from Japan suggested they were unwilling to surrender unconditionally and their was international support for persuing unconditional surrender. You can't understand that bit of craziness without understanding the mindset of the time. WWII was fought in the shadows of the debacle that was WWI's conditional peace. Everyone was dog tired of war and pissed we had to do it all over again because things weren't settled properly the first time (not saying the attitude is right, but it was there).
Prior to Hiroshima, we killed just as many people at Dresden in Feb '45 and even more in the incendiary bombing in Tokyo in March '45 but strangely those events don't get the same attention because they used traditional weapons.
Even after Hiroshima and Nagasaki, the Japanese military refused to accept surrender - Hirohito did it himself.
I think the use of atomic weapons is in general immoral but suggesting that historians all agree it was wrong or that it is a clear black and white issue assigns much more certainty to the situation than really exists.
Sam has been disemvowelled but not banned. This gives him the opportunity to post comments that demonstrate he can do something other than rant and troll.
Strawman, it would be an act of faith to assume that such unrestrained access hasn't been misused. This administration has not merited that faith. Quite the opposite.
It would be foolhardy to assume that that unrestrained access will not be misused in the future.
If some loss of privacy is unavoidable (which is only an assertion; you don't back it up), then there's all the more reason to not give it away unnecessarily.
THAT'S why me and many of my friends always speak in "code" for at least part of our conversations. "The grooms are ready for their weddings" "Is the wedding cake primed and hidden?" "We will begin the festivities at 11pm, in the martyr's lounge, praise be to Allah" etc.
Just think of all snoops pulling their hair out trying to figure out what the nonsensical code really means. Then when we speak in regular conversation about "going camping" or "picking up the bass-player before going to the practice space" they probably think it's still code and only exacerbate their "code-breaking" attempts.
From an update to the linked Thread Level blog:
Postscript: In response to some of the comments here and elsewhere: No, it's not CALEA. CALEA requires phone companies to give the FBI real time access to call content and call detail information on specific targets when presented with a warrant. It does not oblige them to give the FBI or anyone else direct unmonitored access to switches, billing systems or databases.
actually CALEA connections are monitored and require that someone set up the tap on phone system hardware usually dedicated for that purpose.
CALEA taps work as follows (usually):
the agency has a tap need and gets a subpoena
the subpoena is given to the carrier
if the carrier does not already have a conection (VPN usually) to the agency one is created
phone switches are set up to forward call data to the agency over the vpn
The carrier i worked for manually set up all taps only when a subpoena was received and agencies only saw traffic from the switches dedicated to forwarding CALEA data. Agencies had no other access to the network and saw no routes other than those required to receive the CALEA data.
That being said, I'm pretty sure most carriers (land or wireless) have dedicated circuits to the DEA and/or FBI. Though, a single circuit should be enough to carry the traffic for all federal CALEA data.
They turned LOLcats into a programing language, why have they not come up with a espionage/spy programing language?
this quack doesn't work for igxglobal any more...
Maybe this isn't related at all, but I can't help but remember the recent Comcast "terms of service" agreement I just got a few weeks ago... One of the subjects jumped at me:
Eavesdropping. Our facilities are used by numerous persons or entities including, without limitation, other subscribers to HSI. As a result, there is a risk that you could be subject to "eavesdropping." This means that other persons or entities may be able to access and/or monitor your use of HSI. This risk of eavesdropping exists not only with our facilities, but also on the Internet and other services to which access is provided as a part of HSI. If you post, store, transmit, or disseminate any sensitive or confidential information, you do so at your sole risk.
source: http://www6.comcast.net/terms/subscriber/
I can't help but think this clause was meant to be a legal backdoor.
Maybe they are just being honest, perhaps they are simply admitting their networks are insecure against their own government's shadow warriors or employees who work for both the Feds and Comcast without Comcast knowing, and anyway this "contractual" stuff also helps to rid Americans of their "expectation of privacy" such that all electro-comm activity becomes "open" as far as the Gov't (especially the courts) is concerned... for in the US there's no built-in "right" to privacy otherwise all abortion laws would be unconstitutional...you have to reasonably expect privacy for the courts to notice violations of it...USians are "openly" subject to secret government surveillance since 9/11 right? And it truly is "open season" for the rest of the world's comms as far as the US Gov cares......anyway unwarranted wiretaps cannot be used as evidence in court but otherwise are useful. And since when does the US send "terrorists" to a court? That too is history, along with any "reasonable expectation of privacy", apparently for the duration of the War.
And as to FISA the nameless people who currently have the right to sue for unwarranted surveillance are being expropriated, as the right to sue for injury is most certainly a vested right akin to a property right. Is this "taking" even Constitutional? Can Congress strip citizens of their accrued and existing rights without any compensation? Particularly where such rights have arisen due to Government malfeasance? They have been wronged in the past , but Congress now takes away their right to ask for compensation in the future?
How is this different from the state seizing property without compensation? As to claims which may arise in the future, ok but the injuries occurred in the past in this case.
I can't help but feel grants of retroactive immunity are flat-out unconstitutional, but the US courts have been stacked for over twenty years now, and it is their opinions that count....
To #34:
That's just a basic acknowledgement of how a packet network works. If you're on the same subnet, you see ALL packets. Your ethernet interface is normally programmed to ignore ones not addressed to it.
If the interface is set to "promiscuous mode", it returns all packets to the rest of the computer. There are well known tools that are freely available that allow this to happen.
Note that this is only over the same subnet. Routers and switches are set to transfer packets to a neighbouring subnet that takes them a step closer to the specified destination address, etc.
The packets hop from subnet to subnet until they reach their destination. If a given subnet is compromised as described above, they also can see your data in the packet.
Comcast is just stating the technically obvious - the internet was NOT designed for security, that's just how it works.
If you are concerned about security, you negotiate that between your end and the other end and agree on how to set that up. Those measures typically mean encryption of the data in the packets so that packet interception doesn't tell an eavesdropper near as much.
The most common encryption techniques are SSL and VPN. The former is used by browsers in talking to websites when transferring sensitive data like passwords or credit card info. You should see "https" instead of "http" as the beginning of the web page address as well as a padlock in the locked position on some browsers.
A VPN is commonly used when connecting between your work and a computer at home or between business offices. The VPN software on the home end already has an agreed upon encryption method, a data file that uniquely identifies the computer doing the connection and something called a key (or key pair) that is used to encrypt the data.
The office has a copy of the uniquely identifying data as well as a copy of that key (or one of the key pair). This is more secure as a VPN doesn't have to send negotiation information in readable form at all. That's all already been decided on.
Both of these approaches have been in common use since the internet became viable for home shopping and talking to work computers from home. Comcast is neither worse nor better than any other internet service provider as far as that goes.
I'm with stinkyhorsebutt - stop taking the Verizon ad dollars if you're going to post about how the telecoms are selling out the people to the government.
why? How can they pay for criticizing the government? Should they withhold their taxes? Ask you for money? Doesn't if make sense to use their money?
Sunny Baby:
“A wise general makes a point of foraging of the enemy.”
To #35: Yeah I guess thats the case security and privacy are diy, as those who truly need them know. So the TOS are simply stating the tech facts. Good.
Verizon is the culprit it says. I'm glad I got to sit through a Verizon commercial on BBtv a few minutes ago. Very odd since they seem to be part of the corporate lap dogs that Boing Boing and the EFF are constantly complaining about and fighting. How about a commercial (or no commercial!) from a company that isn't helping big bro come in our "back door."
Or you could just mail BB a check.
Alright so, I've left comments on this website a grand total of 4 times and I'm branded a 'troll'. What exactly was the problem with my first comment? I can't say that when Mr. Tibbets had 'no regret's' I think that's a good thing? Call me wrong on it or what not, but taking out all the vowels in my above 3 comments is a bit..extreme.
I have to say, this site has extraordinarily low tolerances for anyone commenting here.
To Antinous: I have no problem supporting anything I think is valid and good with my money. Do you? Do you have a problem with giving your money to causes, ideas, websites, etc that you wish to see succeed? I mean, after all, you give your money blindly to corporations that act in ways you find abhorent (no matter what your own moral playbook dictates). Why do you assume I (or anyone else) wouldn't want to mail BB a check?
Look, there are many ways to get people listening; however with so much emphasis on "profit", one of the most effective is what we do with the money we have at our disposal. What's the point of vilifying these companies with words if all we're going to do is turn around and give them the money to enable them to keep doing that we don't want them doing? As far as accepting advertising dollars from these vilified entities, I would think our principled stance would have to extend to that in order to make our point a little clearer and keep our integrity intact.
Antinous,
STINKYHORSEBUTT beat me to it in post #43. It's not a matter of ads, its a matter of consistency. I doubt that Jet magazine runs ads for the KKK. Think that example is extreme? The Klan is a tiny organization with little to no power other than a bad rep. Ver!zon is a huge company, taking your money, and giving away your privacy. The government may force them eventually, but we know there have been several corporations that have resisted heavily.
Besides, I don't think BoingBoing is in danger of shutting down. They are way up on the list for blog traffic, while running ads. Maybe they aren't making millions off the site, but none of the BB crew seem to be struggling much and I don't think that any of them would claim that BB hasn't helped their careers.
The matter is- don't post about a company that seems to be at odds with BB and the EFF ideals, and then run an ad.
I love BoingBoing, but let's "keep it real."
While all (or almost all) the comments in this thread are interesting and bring up many valid points in this ctitical argument that I believe must take place in the public arena and with full visibility I cannot but recall what started this albeit valuable dialoge in the first place and that is a innacurate story about what is essentially a non issue. Closer scrutiny into the story shows that;
1)Babak Pasdar is no longer with igxglobal - he is the CEO of Batblue - a company of 4 people that work out of their homes and so far his most notable accomplishment has been to spam Security Focus.
2)A single DS3 circuit carries insufficient bandwidth to accomplish any significant snooping especially when you consider the vast amount of data a backbone carrier is transporting at any given moment. A single DS3 circuit terminating on a carrier firewall with unrestricted access to the same subnet as the billing and record systems would be more appropriate for a governmental organization with strict chain of evidence guidelines to transfer hundreds(with warrant I pray) of billing and call records as they almost certainly do. I do not pretend to know if this access is being abused or not but the method is sound and valid even when used in a strictly legal and responsible way. There are several very good reasons why a law enforcement agency would prefer a P2P connection rather than a VPN for this purpose. Think about it for a moment - how else would an agency obtain phone records legally and with a warrant? A self addressed stamped envelope?
No, there is no indication of any wrongdoing or conspiracies here and this particular article regarding what Pasdar saw is all smoke and mirrors perpetuated by small minds and large egos craving attention. A mediocre technical resource without a security clearance would never be allowed to log into a device being used for clandestine data mining. I do not claim that this type of activity is not taking place - only that Pasdar has never witnessed it.
As I keep saying, the Boingers would have to remember who their advertisers are in order to stand a chance of being influenced by them.
How's this: I promise that if the Boingers ever do start remembering who's advertising on their site, I'll let you know about it so you can start worrying. Until then, you can take it easy.
Serious memory problems. That shouldn't be ignored.
I do feel better though...