New Snowden Profile in Wired Reveals New NSA Secrets Like 'MonsterMind'
James Bamford, the national security journalist and author who himself had once been threatened with prosecution over his writings about the National Security Agency's (NSA) activities decades ago, has gone to Russia to sit down with Edward Snowden. From the meeting, he put together a profile of the NSA whistleblower for a massive piece in Wired magazine.
In addition to the typical biographical background and the description of how Snowden's life is playing out in Russia (pretty tame—Snowden doesn't appear to get around much), Bamford came back with two new scoops.
First, back in 2012 Syria had a major Internet outage amidst its civil war. Naturally, people assumed this was done somehow by President Bashar al-Assad or loyalists in order to censor opposition. It was not. It was caused by the United States, and it was an accident:
One day an intelligence officer told [Snowden] that TAO—a division of NSA hackers—had attempted in 2012 to remotely install an exploit in one of the core routers at a major Internet service provider in Syria, which was in the midst of a prolonged civil war. This would have given the NSA access to email and other Internet traffic from much of the country. But something went wrong, and the router was bricked instead—rendered totally inoperable. The failure of this router caused Syria to suddenly lose all connection to the Internet—although the public didn't know that the US government was responsible. (This is the first time the claim has been revealed.)
Inside the TAO operations center, the panicked government hackers had what Snowden calls an "oh shit" moment. They raced to remotely repair the router, desperate to cover their tracks and prevent the Syrians from discovering the sophisticated infiltration software used to access the network. But because the router was bricked, they were powerless to fix the problem.
Fortunately for the NSA, the Syrians were apparently more focused on restoring the nation's Internet than on tracking down the cause of the outage. Back at TAO's operations center, the tension was broken with a joke that contained more than a little truth: "If we get caught, we can always point the finger at Israel."
So if the outage did actually hamper efforts to dislodge Assad—and remember U.S. leaders were publicly calling for him to step down at this time—they have us to thank.
The bigger revelation is the existence of MonsterMind, which is not the name of Lady Gaga's next album. It is the reason why the NSA really, really needs to be connected to everybody online, all the time:
The massive surveillance effort was bad enough, but Snowden was even more disturbed to discover a new, Strangelovian cyberwarfare program in the works, codenamed MonsterMind. The program, disclosed here for the first time, would automate the process of hunting for the beginnings of a foreign cyberattack. Software would constantly be on the lookout for traffic patterns indicating known or suspected attacks. When it detected an attack, MonsterMind would automatically block it from entering the country—a "kill" in cyber terminology.
Programs like this had existed for decades, but MonsterMind software would add a unique new capability: Instead of simply detecting and killing the malware at the point of entry, MonsterMind would automatically fire back, with no human involvement. That's a problem, Snowden says, because the initial attacks are often routed through computers in innocent third countries. "These attacks can be spoofed," he says. "You could have someone sitting in China, for example, making it appear that one of these attacks is originating in Russia. And then we end up shooting back at a Russian hospital. What happens next?"
In addition to the possibility of accidentally starting a war, Snowden views MonsterMind as the ultimate threat to privacy because, in order for the system to work, the NSA first would have to secretly get access to virtually all private communications coming in from overseas to people in the US. "The argument is that the only way we can identify these malicious traffic flows and respond to them is if we're analyzing all traffic flows," he says. "And if we're analyzing all traffic flows, that means we have to be intercepting all traffic flows. That means violating the Fourth Amendment, seizing private communications without a warrant, without probable cause or even a suspicion of wrongdoing. For everyone, all the time."
Read the whole story here, including explanations why Snowden ended up dropping out of high school as a teen and what happened next (if you're thinking detractors have left out important details, you're right), Snowden's explanation that he left clues so NSA could determine how many documents he actually took with him (they still don't know), and more potential confirmation that there is at least one other NSA leaker out there.
