Mark Klein's AT&T statement in the EFF case

Monday, 22 May 2006 by jaduncan ,

This is the statement given by former AT&T technician Mark Klein as the key witness in the Electronic Frontier Foundation's class-action lawsuit against the telecommunications company, which alleges that AT&T cooperated in an illegal National Security Agency domestic surveillance program. Wired news has posted the PDF of this, but has messed up their links on the site, as well as being in danger of having it ordered down. For this reason, I have mirrored it here, with an HTML transcript.

AT&T’s Implementation of NSA Spying on American Citizens 31 December 2005

I wrote the following document in 2004 when it became clear to me that AT&T, at the behest of the National Security Agency, had illegally installed secret computer gear designed to spy on internet traffic. At the time I thought this was an outgrowth of the notorious “Total Information Awareness” program which was attacked by defenders of civil liberties. But now it’s been revealed by the New York Times that the spying program is vastly bigger and was directly authorized by president Bush, as he himself has now admitted, in flagrant violation of specific statutes and Constitutional protections for civil liberties. I am presenting this information to facilitate the dismantling of this dangerous Orwellian project.

AT&T Deploys Government Spy Gear on WorldNet Network --16 January, 2004

In 2003 AT&T built “secret rooms” hidden deep in the bowels of its central offices in various cities, housing computer gear for a government spy operation which taps into the company's popular WorldNet service and the entire Internet. These installations enable the government to look at every individual message on the Internet and analyze exactly what people are doing. Documents showing the hardwire installation in San Francisco suggest that there are similar locations being installed in numerous other cities.

The physical arrangement, the timing of its construction, the government-imposed secrecy surrounding it, and other factors all strongly suggest that its origins are rooted in the Defense Department's “Total Information Awareness” (TIA) program which brought forth vigorous protests from defenders of constitutionally-protected civil liberties last year:
“As the director of the effort, Vice Adm. John M. Poindexter, has described the system in Pentagon documents and in speeches, it will provide intelligence analysts and law enforcement officials with instant access to information from Internet mail and calling records to credit card and banking transactions and travel documents, without a search warrant.” - - The New York Times, 9 November 2002
To mollify critics, the Defense Advanced Research Projects Agency (DARPA) spokesmen have repeatedly asserted that they are only conducting “research” using “artificial synthetic data” or information from “normal DoD intelligence channels” and hence there are “no U.S. citizen privacy implications” (Department of Defense, Office of the Inspector General report on TIA, December 12, 2003). They also changed the name of the program to “Terrorism Information Awareness” to make it more politically palatable. But feeling the heat, Congress made a big show of allegedly cutting off funding for TIA in late 2003, and the political fallout resulted in Admiral Poindexter's abrupt resignation last August. However, the fine print reveals that Congress eliminated funding only for “the majority of the TIA components,” allowing several “components” to continue (DoD, ibid). The essential hardware elements of a TIA-type spy program are being surreptitiously slipped into “real world” telecommunications offices.

In San Francisco the “secret room” is Room 641A at 611 Folsom Street, the site of a large SBC phone building, three floors of which are occupied by AT&T. High speed fiber optic circuits come in on the 8th floor and run down to the 7t h floor where they connect to routers for AT&T's WorldNet service, part of the latter's vital “Common Backbone.” In order to snoop on these circuits, a special cabinet was installed and cabled to the “secret room” on the 6th floor to monitor the information going through the circuits. (The location code of the cabinet is 070177.04, which denotes the 7th floor, aisle 177 and bay 04.) The “secret room” itself is roughly 24-by-48 feet, containing perhaps a dozen cabinets including such equipment as Sun servers and two Juniper routers, plus an industrial-size air conditioner.

The normal workforce of unionized technicians in the office are forbidden to enter the “secret room,” which has a special combination lock on the main door. The telltale sign of an illicit government spy operation is the fact that only people with security clearance from the National Security Agency can enter this room. In practice this has meant that only one management-level technician works in there. Ironically, the one who set up the room was laid off in late 2003 in one of the company's endless “downsizings,” but he was quickly replaced by another.

Plans for the “secret room” were fully drawn up by December 2002, curiously only four months after DARPA started awarding contracts for TIA. One 60-page document, identified as coming from “AT&T Labs Connectivity & Net Services” and authored by the labs' consultant Mathew F. Casamassima, is titled “Study Group 3, LGX/Splitter Wiring, San Francisco and dated 12/10/02. (See sample pdf 1-4.) This document addresses the special problem of trying to spy on fiber optic circuits. Unlike copper wire circuits which emit electromagnetic fields that can be tapped into without disturbing the circuits, fiber optic circuits do not “leak” their light signals. In order to monitor such communications, one has to physically cut into the fiber somehow and divert a portion of the light signal to see the information.

This problem is solved with “splitters” which literally split off a percentage of the light signal so it can be examined. This is the purpose of the special cabinet referred to above: circuits are connected into it, the light signal is split into two signals, one of which is diverted to the “secret room.” The cabinet is totally unnecessary for the circuit to perform--in fact it introduces problems since the signal level is reduced by the splitter—its only purpose is to enable a third party to examine the data flowing between sender and recipient on the Internet.

The above-referenced document includes a diagram (pdf 3) showing the splitting of the light signal, a portion of which is diverted to “SG3 Secure Room,” i.e., the so-called “Study Group” spy room. Another page headlined “Cabinet Naming” (pdf 2) lists not only the “splitter” cabinet but also the equipment installed in the “SG3” room, including various Sun devices, and Juniper M40e and M160 “backbone” routers. Pdf file 4 shows shows one of many tables detailing the connections between the “splitter” cabinet on the 7th floor (location 070177.04) and a cabinet in the “secret room” on the 6th floor (location 060903.01). Since the San Francisco “secret room” is numbered 3, the implication is that there are at least several more in other cities (Seattle, San Jose, Los Angeles and San Diego are some of the rumored locations), which likely are spread across the U.S.

One of the devices in the “Cabinet Naming” list is particularly revealing as to the purpose of the “secret room”: a Narus STA 6400. Narus is a 7-year-old company which, because of its particular niche, appeals not only to businessmen (it is backed by AT&T, JP Morgan and Intel, among others) but also to police, military and intelligence officials. Last November 13-14, for instance, Narus was the “Lead Sponsor” for a technical conference held in McLean, Virginia, titled “Intelligence Support Systems for Lawful Interception and Internet Surveillance.”* Police officials, FBI and DEA agents, and major telecommunications companies eager to cash in on the “war on terror” had gathered in the hometown of the CIA to discuss their special problems. Among the attendees were AT&T, BellSouth, MCI, Sprint and Verizon. Narus founder, Dr. Ori Cohen, gave a keynote speech. So what does the Narus STA 6400 do?
“The [Narus] STA Platform consists of standalone traffic analyzers that collect network and customer usage information in real time directly from the message...These analyzers sit on the message pipe into the ISP [Internet Service Provider] cloud rather than tap into each router or ISP device” (Telecommunications magazine, April, 2000),** A Narus press release (1 Dec.,1999) also boasts that its Semantic Traffic Analysis (STA) technology “captures comprehensive customer usage data...and transforms it into actionable information...[it] is the only technology that provides complete visibility for all Internet applications.”***
To implement this scheme, WorldNet's highspeed data circuits already in service had to be re-routed to go through the special “splitter” cabinet. This was addressed in another document of 44 pages from AT&T Labs, titled “SIMS, Splitter Cut-In and Test Procedure,” dated 01/13/03 (pdf 5-6). “SIMS” is an unexplained reference to the secret room. Part of this reads as follows:
“A WMS [work] Ticket will be issued by the AT&T Bridgeton Network Operation Center (NOC) to charge time for performing the work described in this procedure document.... “This procedure covers the steps required to insert optical splitters into select live Common Backbone (CBB) OC3, OC12 and OC48 optical circuits.”
The NOC referred to is in Bridgeton, Missouri, and controls WorldNet operations. (As a sign that government spying goes hand-in-hand with union-busting, the entire CWA Local 6377 which had jurisdiction over the Bridgeton NOC was wiped out in early 2002 when AT&T fired the union workforce and later re-hired them as non-union “management” employees.) The cut-in work was performed in 2003, and since then new circuits are connected through the “splitter” cabinet.

Another “Cut-In and Test Procedure” document dated January 24, 2003, provides diagrams of how AT&T Core Network circuits were to be run through the “splitter” cabinet (pdf 7). One page lists the circuit IDs of key Peering Links which were “cut-in” in February 2003 (pdf 8), including ConXion, Verio, XO, Genuity, Qwest, PAIX, Allegiance, Abovenet, Global Crossing, C&W, UUNET, Level 3, Sprint, Telia, PSINet, and Mae West. By the way, Mae West is one of two key Internet nodal points in the United States (the other, Mae East, is in Vienna, Virginia). It's not just WorldNet customers who are being spied on—it's the entire Internet.

The next logical question is, what central command is collecting the data sent by the various “secret rooms”? One can only make educated guesses, but perhaps the answer was inadvertently given in the DoD Inspector General's report (cited above):
“For testing TIA capabilities, DARPA and the U.S. Army Intelligence and Security Command (INSCOM) created an operational research and development environment that uses real time feedback. The main node of TIA is located at INSCOM [in Fort Belvoir, Virginia]...”
Among the agencies participating or planning to participate in the INSCOM “testing” are the “National Security Agency, the Defense Intelligence Agency, the Central Intelligence Agency, the DoD Counterintelligence Field Activity, the U.S. Strategic Command, the Special Operations Command, the Joint Forces Command and the Joint Warfare Analysis Center.” There are also “discussions” going on to bring in “non-DoD Federal agencies” such as the FBI.

This is the infrastructure for an Orwellian police state. It must be shut down!

* TeleStrategies postings, see:
http://www.serviceprovidersclub.com/main/event-detail.cfm?eventId=36&v=agenda
http://telestrategies.com/issworld/sponsors.htm http://telestrategies.com/iss_2004/index.htm

** see http://www.findarticles.com/cf_dls/m0TLC/4_34/62350496/p1/article.jhtml

*** see http://www.lucent.com/press/1299/991201.nsa.html

0 comments

 

Why Korea is not Iraq

Friday, 5 May 2006 by jaduncan ,

Following today’s missile test, I have had conversations with people comparing the current situation with the Cuban Missile Crisis, and even stating that the US will enter Iraq-style open war with the DPRK. There are issues I have with comparing DPRK/ROK to those conflicts, as there are fundamental differences that make an both an accidental or chosen war far less likely on the Korean peninsula. So, the reasons no shooting war is likely…

The North Koreans: I will not attempt to analyse the possible motives of the DPRK, other than to avoid the internal collapse of the regime, and therefore of the Juche system. Since every government has survival of that government as a primary concern, this seems reasonable.

The first main reason an accidental war starting is unlikely is the massive amount of landmines on the DMZ, meaning that no units are going to encroach on each other’s territory via land. This route to war is therefore closed off. To do an invasion/incursion, you have to carpet bomb the border to clear a path. This is known by both sides, and so the only situation in which this is likely to be done is all out war. So not the first step then. Assuming they did start doing this, and that any conflict for the DPRK is magically guaranteed conventional, let’s see how this turns out for the DPRK forces.

They have:
20 MiG, and about 8-900 other 70s-80s mainly Soviet planes. It should be noted that the country has a massive oil crisis leading to a likely lack of fuel, and many are likely unmaintained, or have been cannibalised for parts.
1.08 million troops. This is a formidable number, but it should be noted that these men do not possess modern equipment in the main, or more crucially, modern C&C networks. There are shades of the Iraqi Army in Gulf War I here, and they got pasted.
55,000 special ops. These are well trained, well equipped (for task) troops, who do not face massive problems with C&C as they are designed to operate behind enemy lines in a semi-partisan role. These are likely to be a very effective constant irritation, but people doing asymmetrical warfare without support from the local population can only be an irritation, as they cannot shrink into that population to hide.

They would immediately face around half a million ROK troops armed with modern US supplied kit, the 17 thousand US troops that are already in the ROK, the ROK navy, and probable nuclear subs in the area. They would very soon face US troops from the Japanese bases also, and nigh-limitless air cover. While the DPRK has such a massively fortified country (photos on request) that it would be very easy for them to make an invasion costly beyond any reasonable cost for ROK/US, it is by no means certain that they would have the ability to hold the South Korean ground. One of the most crucial things here is the comparative industrial ability to provide ammunition that even *all* of a war-ruined Korea could provide compared to US forces. So, conventional war results in a massive loss, and probably a complete collapse of an already-on-the-deathbed internal economy.

A nuclear conflict also has no gain for them in power terms. Bear in mind that their nukes are the only thing in their locker: the conventional stuff is all somewhat outdated, representing the materiel that the USSR and PRC felt comfortable giving them, and was much the same carefully obsolete stuff the US give to second string allies. We can take it as read that a limited DPRK first nuclear strike of any kind would result in a massive retaliation on all sites where nukes were still suspected (suspected? Maybe just idly considered possible) to be stored, leaving the DPRK with no real assets to prevent further military response. This means they are faced again with a rather binary option of launching all they have, or having most of their nukes blown up within the DPRK. This is much the same dilemma that resulted in Soviet nuclear planning revolving around a full scale nuclear attack or nothing.

The major reason that this is so unpalatable to the DPRK when compared to Soviet military planners is that the Soviets had a chance of knocking out a significant percentage of the US nuclear arsenal. The DPRK has (unbelievably generously) 15 nuclear warheads. With this it can reliably level the ROK, and *might* be able to get a nuke on Japan. At this point it is faced with the US as main adversary, nuclear subs that each carry more warheads then the DPRK’s entire arsenal, and no possibility of strike on that adversary. This means that a real nuclear war results in them being obliterated.

Why the US/ROK won’t start it: We are well aware that the DPRK know that their only real big card is the nuclear issue. This is what they see as their ticket to both continuing aid, and to avoiding invasion. For this reason, there is next to no chance of us attempting to strike at the only targets that we care about, the nuclear sites. The risk of a preventative missile strike being detected and causing the DPRK to launch the threatened missiles is far too high for the payoff. In addition, we would then face the scenario of having started a conflict where the DPRK had another warhead storage point we were unaware of. Also consider that this is highly likely given that DPRK political planners know that they face a massive disadvantage in an air war, and have no practical way to stop an air strike from a B2, for example. Given the massive concentration of troops on the border, we also would face the likely loss of ROK lives numbered in the hundreds of thousands in even a short conventional war. Any US or ROK president has to be aware that this is not likely to be massively loved by the people at home, and neither party wants to be involved in the massive, massive problem that would be administrating the DPRK as an entity even if all military forces on the Northern side were destroyed.

People have said that Cuba was dangerous as there was no easy bright line planners could avoid crossing to prevent conflict, but neglect to note that in Korea, there is. Consider that the only open military conflict since the DMZ was created was the killing of Southern-based soldiers who had entered the DMZ to cut a tree down. This is a highly formalised conflict, with both sides knowing that any major incursion over the DMZ would mean a full scale conflict, and neither having anything to gain. Terrifyingly well-armed as it may be, there is a reason that the DMZ is the most stable wartime border line in history.

0 comments

 

Meta