Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Did the Intercept bungle the NSA leak?

washingtonpost.com

Post reply on HN
Print view View original

31–40 of 245 posts

Re: Did the Intercept bungle the NSA leak?

#31

Post by castis »

hdolt wrote: post #8

It's getting complicated managing 25 year olds at work these days. Lot of mistrust and entitlement issues I have never seen before. If you are a manager any suggestions about how to handle this stuff?

Not having your crew do things they would perceive as morally reprehensible is a fantastic start. Aside from that, providing an environment where they can disclose and/or discuss their issues with you would also work well.

Any other measures of "putting a stop to it" will only make it worse.

Re: Did the Intercept bungle the NSA leak?

#33

Post by CogitoCogito »

[deleted] wrote: post #25
CogitoCogito wrote: post #18

Earlier quoted context omitted.

There's no evidence that it was The Intercept's actions that caused her to be found. I agree that they should be more careful (they should _always_ be more careful), but there are many ways the source could have been found independent of the newspaper. Regardless, the government has many incentives to claim that it was The Intercept's deficient opsec that caused them to find the leaker. There really isn't much you ca…

[deleted]

Yes it certainly is. The Intercept should have taken such precautions, but it's not very smart to assume that they always will take those precautions. If you want to be safe as the leaker, you'll have to either do that sort of thing yourself or communicate with The Intercept to make sure they will. Point is that you cannot really control how much caution third parties will take with your documents.

But like I said, the government has every incentive to make us question The Intercept's competence in these matters even though there are many ways the government could have found the leakers. Leakers _should_ be worried about these sorts of things, but we as the general populace should realize that this is perfect opportunity to make The Intercept look bad and to deter future leaks.

Re: Did the Intercept bungle the NSA leak?

#34

Post by nemo44x »

revelation wrote: post #29
user982 wrote: post #12

Earlier quoted context omitted.

> It has all the appearances of the government trying to smear a news outlet and ensure no one leaks to them again. A scheme that would be less effective if not for The Intercept's demonstrably deficient opsec in protecting its source in this affair.

The leaker first contacted them through her work email . It was game over at that point. Nothing they could do would have fixed that.

Exactaly right. You should assume, especially in an environment like the NSA, that your internet browsing and email correspondence is being monitored and certain hosts and suspicious DNS will trigger something.

I've worked at far less security concerned companies that monitored all network traffic going and out and logged it and continually were looking not only for internal nefarious behavior but for possibly viruses, worms, etc.

Re: Did the Intercept bungle the NSA leak?

#35

Post by Natsu »

apeace wrote: post #10

The yellow dots thing was certainly a mistake on their part. But there's a much bigger issue I haven't seen anyone point out yet. One thing that the Intercept--and Glenn Greenwald in particular--have been very critical of is news organizations that blindly publish leaks as verified facts. Here[0] is just one example where Greenwald writes: > THE WASHINGTON POST late Friday night published an explosive story that, in…

Going by what we've seen so far (Crowdstrike report), the malware looks like an old copy of some freeware called P.A.S. and the IPs were mostly Tor exit nodes.

Re: Did the Intercept bungle the NSA leak?

#36

Post by tanderson92 »

lotso wrote: post #30
deanCommie wrote: post #19

Earlier quoted context omitted.

In a situation like this, you as the leaker have a lot more to lose than whoever you're leaking to. In that situation, I'm sorry, but the responsibility for protecting your identity is on you. Anonymize the data. Do not leak something that only you would have access to. etc, etc. Because unless you're leaking to Infowars, you have to expect that a legitimate journalist will present your data to the organization from…

I think everyone would agree the leaker should be more cautious, but The Intercept should also know best practices too around printed materials too.

I think everyone would agree with that. The question then becomes: did The Intercept not follow best practices here? Once again, there is no evidence and any "yes" answer relies on trusting the NSA/DOJ.

Re: Did the Intercept bungle the NSA leak?

#38

Post by mmjaa »

fixermark wrote: post #28
mmjaa wrote: post #21

Earlier quoted context omitted.

I dunno how we can quantify "Americans being benefited" in light of what these leaks are revealing in the global context, but I sure don't like it, living as I do, under either a velvet glove, or an iron one, depending on which side of the wall I happen to decide to visit. But, I do think that these leaks are good for everyone, not just Americans, and that is why they need to happen.

But practically, what would you do given the information divulged. Hackers gonna hack, that's known. Does knowing Russian agents attempted a hack cast them in worse light? No; we already know Russia isn't a close political ally of the US. What details of the hack do is tip off the Russians to burn their channels and methods and complicate the NSA's work in protecting American digital assets from further attack (as we…

This story has the danger of cyber-fatigue'ing the general public, but it has the potential to forward a number of positive aspects in the war against warfare-criminality-because-secrecy, on either side of the argument: Pro "Pease with Russia, At All Costs", or Con "Send Russkie Hacker UP The Bomb(s)".

These leaks have value, because they continue to forward the narrative in the general public, and the centres of true power, though weakening: mainstream/middle-class/entitled-/privileged- consumers who can Do Stuff™ to change the power structures behind this big military-industrial mess.

If we hold one thing in place: Pease with Russia, we must assume that there are parties who want this, and parties who don't. Oh, sorry, I mean "War With Russia", which is what this is all really about.

Re: Did the Intercept bungle the NSA leak?

#39

Post by LeifCarrotson »

thefalcon wrote: post #4
ahoy wrote: post #2

As with every headline that poses a yes/no question, the answer is usually "no". EDIT: I'm also unsure what the point of shifting the focus onto The Intercept's alleged "mishandling" of the leaker's identity is. It seems like a smear job meant to discredit a publication that the natsec community and mainstream media like WaPo dislike. It also removes the focus from the substance of the leaks and puts it on the "chara…

Except it sure seems like in this case, yeah, they bungled it. At the very least a total lack of awareness or care towards infosec to help protect sources (regardless of the fact that the lack of awareness extends to the source - I'd want a journalist to be better at this than I am if I were leaking information). [ The article doesn't mention this, but I wouldn't be surprised if these microdots, rather than "a crease…

The search warrant says that the internal audit and (logged-in?) gmail account were the smoking gun. Page 11, paragraphs 14-16:

https://d3vv6lp55qjaqc.cloudfront.net/items/1k2I053M3J2z0f47...

> 14. The U.S. Government Agency [NSA] examined the document shared by the News Outlet [The Intercept] and determined the pages of the intelligence reporting appeared to be folded and/or creased, suggesting they had been printed and hand-carried out of a secured space.

> 15. The U.S. Government Agency conducted an internal audit to determine who accessed the intelligence reporting since its publication. The U.S. Government Agency determined that six individuals printed this reporting. These six individuals included WINNER. A further audit of the six individuals' desk computers revealed that WINNER had e-mail contact with the News Outlet. The audit did not reveal that any of the other individuals had e-mail contact with the News Outlet.

> 16. The U.S. Government Agency determined that WINNER had e-mail communication with the News Outlet on or about March 30, 2017, and March 31, 2017. The first e-mail was from WINNER, using e-mail address [redacted].fitness@gmail.com, to the News Outlet. In it, WINNER appeared to request transcripts of a podcast. The second e-mail was from the News Outlet to [redacted].fitness@gmail.com and confirmed WINNER'S subscription to the service. The [redacted].fitness@gmail.com account is a personal e-mail account not sponsored by or affiliated with the U.S. Government Agency.

Whether the 'crease' noticed by the NSA in paragraph 14 was actually creases or an internal code for microdots, if The Intercept was going to use this report there's nothing they could have done to protect this reckless source.

Re: Did the Intercept bungle the NSA leak?

#40

Post by ceejayoz »

tanderson92 wrote: post #36
lotso wrote: post #30

Earlier quoted context omitted.

I think everyone would agree the leaker should be more cautious, but The Intercept should also know best practices too around printed materials too.

I think everyone would agree with that. The question then becomes: did The Intercept not follow best practices here? Once again, there is no evidence and any "yes" answer relies on trusting the NSA/DOJ.

> The question then becomes: did The Intercept not follow best practices here?

If removing well-known, uniquely identifying printer microdots isn't a best practice, it should be.

Post reply on HN