Monday, October 28, 2019

Snowden

In the last week or so I have told several people that I was reading the "Snowden book" or that I was going to write a blog post about "Snowden".  Many people's response surprised me.  They asked me "who is Snowden?"  Edward "Ed" Snowden was a big fucking deal for several months about six years ago.  On many days he dominated the news.  There was intense interest in who he was, where he was, what he was up to, what he had done and why.

But in a pattern that has unfortunately become all too common, any legitimately newsworthy thing, and Snowden was definitely legitimately newsworthy, fades to the point where few people remember anything about it in an astoundingly short period of time.  He has written a book called "Permanent Record".  It was published recently and I finished reading it a few days ago.  The title is anodyne enough that it does not telegraph to most people why he was a big deal so let me explain.

Snowden spent several years as a contract employee working for various parts of the US intelligence community, what he short hands to the IC.  He also spent several relatively short stints as a direct employee of the Federal Government.  Most of the time he was directly employed by the Federal Government he worked for the CIA.  In all cases he was a computer guy.

Toward the end of his period of employment he collected a large number of top secret documents.  He did this in a way that did not alert anyone that anything was amiss.  He was also able to smuggle these documents out of the high security facility he worked in without being caught.  He was then able to leave the country after contacting various members of the press, again without alerting anyone that anything was amiss,  Finally, he turned the documentation over to the press who promptly started writing and publishing stories based on the contents of these documents.

He saw himself as a whistleblower who was performing a necessary public service.  Others had a far less flattering opinion of him.  He was promptly charged with espionage and related crimes.  For complicated reasons he ended up stuck in Moscow, although he has steadfastly contended that he has in no way cooperated with the Russians and had no classified information with him when he ended up there.  Needless to say, the fact that he ended up in Moscow, where he still lives, added to the sensationalism.  And that led to even more saturation press coverage of him at the time.

So who is Snowden, what did he do, and why did he do it?  He wrote the book to answer those kinds of questions.  As to the "who", he was born in North Carolina in 1983 to a military family.  Although he was and is very smart, he was a poor student who initially did not want to follow in the family tradition.  But then 9/11 happened.  That caused him to reverse course and join the Army aiming to become part of an elite unit.  An accident during training resulted in a medical discharge that put an end to that plan.

He slightly altered his trajectory.  He still wanted to be of service to the government but figured he was better suited to doing computer things in the IC.  That's not as easy as you might think to do.  But he figured out how to do it and once he got a foot in the door he was very successful almost from the start.

He had demonstrated a high level of computer ability from an early age.  That turns out to be an area of expertise that was and still is highly valued within the IC.  He ended up doing what I call "system administration" work, something he was very good at and a specialty that was in continuous short supply.  (He goes into great detail about subspecialties and draws distinctions that, while they are meaningful to him and to me, add needless complexity so I am going to ignore them.)

Broadly, system administration involves the construction and maintenance of computers, computer systems, and the networks that tie them all together.  The system administrator's job is to tie it all together and to make the result perform effectively as an integrated unit.  It is up to others to figure out how to make what the system administrator creates and keeps running do useful work.

He was not a "programmer".  Programing work is more task specific.  They make the pieces that make this computer or system or network do a specific thing.  But frankly there is a lot of overlap between what programmers do and what system administrators do.

Snowden, for instance, could write programs but didn't consider himself that good at it and it did not interest him.  But there is a programmer-like activity that he was very good at.  He could write "scripts".  These, in turn, allowed him to automate a lot of the routine tasks system administrators needed to perform to keep the computers, computer systems, and networks, running smoothly.  Writing programs and writing scripts are very similar activities.  I know.  I've done both.

The difference between programming and system administration has more to do with outlook than the nuts and bolts of the job.  A programmer's typical concern is with all the details necessary to perform a very specific activity that is typically a small part of a much larger process.  System administration is much more "big picture" in its outlook.  What's the main goal?  It turns out that the skills are nearly identical.  It is only the outlook, and to some extent the tools, that change.

In reading the book I saw a lot of myself in Snowden.  I saw him as a kindred soul.  But there are differences.  I was born in 1947, roughly 35 years before he was.  To state the obvious, it was a different time.  I wrote my first computer program as a freshman in college.  He was six years old when he wrote his.

He grew up surrounded by people who worked for the government.  I didn't.  He felt much more constrained by his environment.  I was comfortable with the environment that I grew up in.  His parents divorced while he was growing up.  Mine didn't.  He felt a need to "hack" the system.  For the most part I just wanted to make the system work better and more efficiently.

Then there is the broader environment we came of age in.  I grew up during the Vietnam era.  This caused me to think carefully about things like right and wrong and what the moral thing to do is.  Just the tenor of the times led me to be far more skeptical of institutions including the government.

He grew up during the "safe" '90s and in a military family.  He got his sense of right and wrong from his family.  And his environment bred a high degree of trust and acceptance of the government, its leaders, and its policies.  Military people don't make policy.  They implement policies made by others, whatever those policies may be.

In that environment being apolitical is appropriate behavior.  That is, until 9/11 happened.  At that point he had no experience or expertise with which to form a judgement independent of that of the government.  The government said "we are the good guys, they are the bad guys, and they have done a bad thing to us for no good reason".  The only appropriate response he could think of was to join the army so he could take the fight to the bad guys.  So he did.  My thinking on the subject was much more nuanced so it led me in a different direction.

One thing we shared, however, was a belief that if you sign up to do a job you should do your best to do it well.  We take our responsibilities seriously and we resent others who have a more cavalier attitude toward theirs.  We also expect our supervisors to also take their responsibilities seriously.  And part of a supervisor's responsibilities should be a concern for when things are and are not being done right.

If a subordinate finds something that looks wrong he or she should report it to his or her supervisor.  That supervisor should take the report seriously and, in normal circumstances, undertake an investigation.  But once sufficient proof has been developed and verified that a problem exists then the supervisor has a duty to move to get the problem fixed or to explain why things should remain the same (the abnormal circumstance).  Doing nothing is NOT an option.

Both of us kept score.  If problems were not handled appropriately, we took note.  And we looked for patterns.  At least initially Snowden was naïve.  He expected supervisors to do their jobs.  He was surprised when people up the chain of command did not respond appropriately.  They were much more "don't rock the boat" than "let's go ahead and fix the problem".  With a cynicism born of Vietnam, I was equally disappointed but less surprised and more careful when management fell down on the job, than he was.

There is another important way we are different.  John Le Carre, the great spy novelist, was a part of the British Intelligence Community before he turned to writing novels for a living.  There he came to the conclusion that con men make the best spies.  Spies need to be expert liars and manipulators of people, for instance.

He addressed the subject at length in fictional form in one of his books, "A Perfect Spy".  He has said that it is the most autobiographical of his spy novels.  In it we find that Pym, the protagonist, is the son of a con man.  And a lot of the skills that made him successful as a spy were things he learned at his father's knee when he was a child.  Both Le Carre and I believe this carries over to the real world of spying.  Con men and spies use the same skills.

I would make a terrible spy.  I can't lie worth shit.  I am terrible at reading other people.  And I make a horrible con man.  Snowden, on the other hand, is proud of the scam he pulled off as a six year old.  He also relates various schemes and scams he employed to get out of school work and otherwise "game the system".  This is a skill he takes pride in.

There is a hacker technique called "social engineering".  It consists of conning people into doing things for you that they shouldn't and with them letting you do things you are not normally allowed to do.  Here's a simple example from a past era.  A hacker would call a telephone operator and behave like a telephone company repair man.  If the ruse worked then the operator would let the hacker perform "systems" functions that, for instance, bypassed the billing system.

Successful spies are good at social engineering.  Snowden was good at social engineering.  I am not.  That's enough of that.  Let's get back to the book.

As reported above, Snowden went to work for the IC.  This is harder to do than you would think but he was a better researcher than I am and he figured out the process.  He then proceeded to game it (in a good way) to both get into the system and also to end up where he wanted to end up.  At this point he still felt bad about not having gotten in the fight as a soldier as a result of his boot came injury.  So he wanted to be at "the pointy end of the spear" when it came to postings.  He wanted to do field work in dangerous places.

But his plan backfired.  The managers he had so successfully impressed chose to put him into a cushy position in Switzerland instead, not exactly a hardship post where they are shooting at you.  But he prospered.  He is a very good systems engineer and he developed and implemented various significant improvements to the computer infrastructure that is now ubiquitous in intelligence and pretty much everywhere else.  His bosses continued to like him and his work (more good social engineering) and he was flagged as a rising star.  Another thing he leaned was that contracting was the way to go.

For various stupid reasons the Federal government has shifted away from work being done by government employees and toward work being done by contractors, people working for firms that are hired by agencies to do the actual work.

A cynic (I plead "guilty") would say that this is so that there are a lot of companies with a lot of executives that can contribute to political campaigns, participate in the "revolving door" between government employment and civilian jobs, can give elected officials bragging rights about how many federal dollars are spent in the district, etc.

The shift from using government employees to using contractors is always sold as being economical and permitting additional flexibility.  But that is 100% BS.  Here's what Snowden has to say on the subject:
The extent of my access [as a contractor] meant that the process itself might be broken, that the government had given up on meaningfully managing and promoting its talent from within.
Anyhow, Snowden "revolving door"ed between government employment and being a civilian contractor a couple of times.  For the most part he found it easier to move to whatever work he wanted to move to by being a civilian contractor.  Being a civilian contractor also paid a lot better.

He rightly questions this system particularly when it comes to system administrators.  System administrators are like janitors in that they see everything.  Janitors see it in the trash.  System administrators see it on the file systems of the computers they administer and across the networks they monitor.  As such, they are the ones who need to be the most trusted people anywhere in the system.  So, from a practical point of view, they have the highest effective security clearance of anyone.  This may or may not be reflected in their "official" clearance level.

So why should a contractor, who owes whatever allegiance he might possess to a company like Dell or Booz Allen (two of the companies Snowden worked for), work diligently to preserve and protect the government and its interests?  Shouldn't you want you want these people above all to have interests that are tightly aligned with those of the government?  Yet it seems that these most critical jobs are the first to be outsourced.

There is (or used to be) a strain of thought in conservativism called "strict construction".  The idea is that if you want to understand what is and is not Constitutional you should look at the plain text of the US Constitution.  Beyond that, it is also appropriate to look at what the founding fathers had to say at the time.  See what their general thinking was on an issue.

Then look closely at what they had to say about various components that were put into or left out of the Constitution.  Words written and thoughts thought at the time should guide you.  The Constitution does not need updating to allow for new and changed conditions that have come into being between then and now, they say.  The sole exception applies to the various amendments to the Constitution that have been approved since.

There are also large "militia" and "gun rights" groups associated with conservatives.  They note that the US was born in revolution so revolution is always an option.  If, of course, there is a "just cause" and the powers that be are not moving appropriately to redress this just cause.

Snowden lays out a case for his actions based on these two concepts.  He first analyzes the plain language of the Constitution,  For instance, the fourth amendment reads "the right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized".

He then argues that much of what the IC routinely sweeps up falls into the category of what the fourth amendment says should be "secure" from government snooping.  He then goes on to argue that warrants are not properly issued that would permit the government to snoop in a Constitutionally appropriate manner.  In short, Constitutionally speaking, the IC is way out of line and something needs to be done about it.

His argument is completely in line with mainstream conservative thought when it comes to strict construction.  It is also completely in line with other constitutional and civil liberties experts from other parts of the political spectrum have to say.  So this, in Snowden's thinking, constitutes a "just cause".

Then there is the matter of the remedy.  If the institution is moving to correct the wrong than no action is warranted on Snowden's part.  But he amply documents in the material he caused to be released, and to which he had legal access as a systems administrator before then, that the leaders of the IC put these policies in place on purpose.  They worked hard to do exactly what they did.

And since then they have taken many steps both to keep these policies in place and to make sure that word of them did not leak out.  So Snowden rightly concluded that any effort to take action while staying within the system was doomed to failure.  And that, according to the logic espoused by the militia/gun people, justifies "revolutionary action".  So here too Snowden's actions fall squarely within the boundaries of conservative thought in this area.  In this case, however, many people located along other parts of the political spectrum would and did beg to differ.

But so far what I have described is Snowden's opinion of the material he had uncovered.  Let's take a look for ourselves at what Snowden found that so concerned him.  And to do that properly we should first take a step back.  You see, for Snowden, history started with 9/11.  He made no effort to find out what had come before.  But I have been interested in this subject for decades.  I am, for instance, currently reading a 750 page tome that covers the history of intelligence activities starting with ancient times and going forward from there.

But we don't need to go so far afield in either time or place.  It turns out that in the period between the first and second World War there was a time when a US intelligence agency received a copy of every single international telegram transiting New York.  Domestically, the FBI operated a "black bag" unit for many years.   It specialized in illegal break-ins.  The FBI also tapped phones, usually legally but often not.  But this sort of thing was so difficult and expensive to do that all government agencies combined could only go after perhaps a few hundred people.  Yet there are hundreds of millions of people in the US.

All this is "security by obscurity".  Almost everyone is safe from being spied upon, not by reason of the fact that it is illegal, or that regulations prohibit it, but by the fact that it is so difficult and expensive that only prominent people get targeted.  Passing laws, writing regulations, putting effective controls in place, can all help (and have helped in the past).  But with the computerization of everything and the internet-ization of everything, the fact that there are a lot of us is getting less and less effective as a protection.

The cost and difficulty involved in snooping has dropped precipitously in recent decades.  In the run up to 9/11 it was relatively hard to snoop on people.  And, as a result of Watergate and a big scandal that erupted a few years later that involved the FBI spying on groups who were peacefully organizing against the Vietnam war, the laws were fairly tight and the IC fairly careful.  Snowden was apparently unaware of these and other pre-9/11 examples of IC overreach and the waxing and waning efforts to control it.  I don't know if his behavior would have been different had he known.

According to Snowden, the IC were blamed for missing 9/11 and accepted the blame.  I think the situation in more complicated but, in the interests of brevity, I am going to skip over that.  In any case, after 9/11 the Bush administration asked the IC "what do you need to do better next time?"  The IC's response was "give us a lot of money then cut us loose from regulation and oversight so we can us do anything we think is appropriate".  The result was the USA/PATRIOT Act, which gave the IC a ton of money and authorization to do pretty much anything they wanted to do.

The resulting buildup had only been under way for a few years when Snowden joined up.  So he had a front row seat on the worst excesses.  One of the things the IC asked for and got was wide authority to access pretty much any kind of data about anyone.  That was bad.  But what made it even worse was that they got authority to make it illegal for the companies on the receiving end of one of these requests to even acknowledge the existence of the request.  The law forced telephone companies, for instance, to lie about the very existence of a subpoena from the NSA asking for "all telephone records of all calls".

For those who don't follow this sort of thing as closely as I do, there are three principle agencies involved in all this.  The NSA is responsible for SIGINT, SIGnals INTelligence, anything they can find out about radio signals, the internet, and such like.  The CIA was responsible for HUMINT, HUMan INTelligence, roughly everything else.  But both agencies were restricted to activities happening overseas.  In other words, prior to 9/11 both the CIA and the NSA were expressly forbidden to spy on US citizens, especially if they were in the US.  The third agency, the FBI, was responsible for both SIGINT and HUMINT within the US and with respect to US citizens.

One of the main causes of 9/11 was "silo-ing", one agency not working closely with the others but instead keeping what they knew "in a silo".  As a result, nobody had the full picture.  The other main cause was a lack of focus.  The Clinton Administration had a cabinet level committee monitoring Al Qaeda.  The Bush administration shelved that.

So modest changes, primarily making all the agencies work together better, would have been enough to prevent another 9/11.  But the IC saw an opportunity and took it.  And things were set up so that there was basically no oversight.  Just the way an out of control bureaucrat likes it.  As a result, the IC was completely out of control at that time.

Here's Snowden's take on how the IC viewed themselves and 9/11:
The general sense of having been manipulated by the Bush Administration and then blamed for its worst excesses gave rise to a culture of victimization and retrenchment.
In that environment the IC is not going to ask itself "are we going too far?"  Instead, they are going to say "we need everything so that we always have enough dirt so we can successful defend outselves the next time something goes wrong".  So they tried to collect everything and to save everything.

When the Obama administration came in they could have tightened things up, cleaned things up, and reigned things in.  But they didn't.  Obama pretty much went along with everything IC related that he inherited from the Bush administration.  Snowden is justifiably harsh in his book for Obama's actions, or rather inactions, in this area.  This is a criticism I second even though I am an Obama fan.

Snowden concludes that "I had been protecting not my country but the state".  And by "state" he means the IC.  Later, he says "it was time to face the fact that the IC believed themselves above the law, and given how broken the promise [of meaningful oversight] was, they were right".  In short, "they'd hacked the Constitution".

This line of thinking led Snowden to believe he had to act.  And he felt that he was uniquely positioned to do so.  As a result of the early successes I mentioned above, Snowden was given an unusual degree of latitude.  In the middle of all this he found out he had Epilepsy.  He used this as an excuse to move to Hawaii and into a less stressful job.  But part of what was going on with him was that he had figured out that he would actually have access to more information from a "lower level" (think janitorial) position there.

This proved to be true.  While there he implemented a system for broadly collecting information from across the intelligence community and summarizing it in one handy spot.  He managed (social engineering) to sell the project as one that would benefit the IC.  But this was the foundation of the data collection that produced the wide range of documents he later provided to the press.  The details are interesting.  If you want to learn more about this, read his book.

His revelations did do a lot of good, in my opinion.  People had not had convincing evidence of how wide spread and invasive the data collection being done by the IC was.  And remember where I said the NSA and CIA were prohibited from domestic activities.  Post 9/11, that was no longer true and the reason we know this is because the Snowden documents told us so.  It turned out there was a lot of spying on ordinary US citizens going on.  The IC was collecting vast amounts of information on the routine activities of all of us.

Snowden's book is more of a memoir than a "this is what the documents reveal" so you will have to go elsewhere for a more complete description of what he revealed and what was changed as a result.  I will touch on just one thing.  There is something called the FISA court.  At the time of the Snowden revelations it was simply a rubber stamp.  Whatever the IC asked for, no matter how outrageous, the FISA court approved it.

That has changed and we know it has because of the Mueller Report.  Substantial detail on certain FISA warrants was provided therein.  As a result, we now know that the IC has to submit substantial documentation to get a FISA warrant and that the court takes its job seriously when it comes to making sure that a sufficient case has been made before issuing a warrant permitting the IC to go forward.

Have the changes been sufficient to make me happy?  Not even close.  But the situation has substantially improved.  And remember "security by obscurity"?  The IC has created a gigantic system for vacuuming up all kinds of information.  But traffic on the internet has grown by leaps and bounds since Snowden's revelations.  And this means that even with the IC's budget, which was more than $77 billion back in 2013, it gets harder and harder to filter the useful information out of the torrent we collectively now produce.  The playing field is slowly tilting back toward "security by obscurity" and that's a good thing.

As I noted above, there are a lot of people who are unhappy, to put it mildly, with Snowden.  But, like so much of modern politics, any kind of serious analysis is completely lacking.  As I noted above, Snowden's thinking is squarely in line with strict constructionist and militia/gun-rights thinking.  So they should be his most ardent supporters, right?  Wrong!  They are his most ardent detractors when, if they actually believed what they say they believe, they should be his most ardent supporters.  Opinions on the left are scattered.  But then there is no consensus position about these issues on the left.

Now, let me cover the story of how he ended up in Russia because it's short and fun.  As I laid out above, he had a plan for every step of the way and his plan worked.  Except he didn't have a plan for the final step, how to get away.  So he made it to Hong Kong, a place he selected as being press friendly (at the time) and lacking a US extradition treaty.  So far so good.  He was able to meet with journalists there, transfer the data to them, and spend some time with them explaining what they now had.  Also, so far so good.

But then they published.  As expected, he was immediately targeted.  To get away he needed to go to a country that would provide shelter and rebuff efforts to extradite him.  Hong Kong was not up to that task.  So he picked Ecuador.  We'll never know if that choice would have worked out because he never made it to there.

The Obama Administration immediately made it hard for him to travel by putting pressure on every country they could to deny him permission to overfly their territory.  So the only feasible route his supporters could figure out was Hong Kong to Moscow to Cuba to Ecuador.  He succeeded in getting on the plane in Hong Kong and the plane took off from there on time.

But while it was in the air the Administration took the additional step of revoking his passport.  So when he landed in Moscow he no longer had a valid passport so he could not leave.  Efforts to secure a new passport, say one issued by another country, failed.  He spent 90 days in the Moscow airport before the Russians decided to grant him limited residency.  So he now lives in an apartment in Moscow with the woman who was his girlfriend and who is now his wife.

Snowden claims the Russians have gotten no intelligence out of him.  Others have other ideas but, so far, there is no credible evidence contradicting Snowden's story.  The US government would like to embarrass Snowden.  The best way to do this would be to demonstrate that the Russians got a significant amount of material out of him.  But they have yet to go down this path.

Finally, we are confronted with the deepest of ironies.  The IC made a power grab in the wake of 9/11.  And for a long time it worked.  They got a big budget and authority to do pretty much whatever they wanted.  It was the dream scenario of every power hungry bureaucrat.

Obama pretty much left them alone in the early part of his administration.  The Snowden revelations caused the IC to be reigned in to an extent.  But they still had the giant budgets and way more maneuvering room than they had had before 9/11.  And if Hillary had been elected the good times would no doubt have continued.

But she wasn't.  And President Trump has nothing but contempt for the IC.  He believes foreign leaders like Putin over what the IC has to say.  The amount of injury this has done to the IC dwarfs whatever harm Snowden might have done to them (and I claim that in the long run he benefited them).

Sure, they still have the bloated budget but that's pretty much it.  As Trump trashes long standing alliances and cooperation agreements other countries, they have become more and more reluctant to work with the US IC.  And that severely constrains the IC's ability to act independently.  Being in the US IC just isn't as much fun as it used to be.  And, if you are working there to do good, it's even worse.

So they completely missed the greatest threat out there to their (and our) way of life.  That failure makes whatever IC shortcoming that 9/11 may possibly have brought to light shrink to insignificance.  And the "unfair" treatment they received at the hands of the Bush Administration was nothing compared to what Trump has dished out and continues to dish out on a nearly daily basis.  Irony of ironies.

No comments:

Post a Comment