Hacker News Reader

Comment by tanderson92 | Hacker News Reader

Have we learned nothing about the NSA's tactics? The Intercept publishes reporting that they would rather not have been printed, and the very day the DOJ unseals charges where they try to say they learned about the leak from a paper crease from what can be reasonably inferred to be The Intercept. Meanwhile the alleged leaker allegedly used her work computer to contact The Intercept (in contradiction with their recommended best practices).

It has all the appearances of the government trying to smear a news outlet and ensure no one leaks to them again.

Do we still really trust the NSA? It was disappointing yet expected from the WaPo that they took as fact everything the DOJ alleged about how the case proceeded.

View on HN

> It has all the appearances of the government trying to smear a news outlet and ensure no one leaks to them again.

A scheme that would be less effective if not for The Intercept's demonstrably deficient opsec in protecting its source in this affair.

If you trust that what the NSA/DOJ says is true, sure.

There's no evidence that it was The Intercept's actions that caused her to be found. I agree that they should be more careful (they should _always_ be more careful), but there are many ways the source could have been found independent of the newspaper. Regardless, the government has many incentives to claim that it was The Intercept's deficient opsec that caused them to find the leaker.

There really isn't much you can reasonably conclude about this. Is the government lying? Is The Intercept incompetent? The only thing you should remember is that if you are going to leak documents you need to do as much as possible while they are still in your control to hide your involvement. Once you send them off, your fate is in the hands of others.

Plenty of evidence: https://arstechnica.com/security/2017/06/how-a-few-yellow-do...

Massive incompetence and amateurish stuff on part of the leaker and The Intercept. Yellow dots have been known for ages.

That article contains the following "evidence" claiming this is how the leaker was unmasked:

> Armed with this evidence, the NSA was able to quickly determine who had printed the document by checking audit logs.

So no I see exactly _zero_ evidence in that article that this was the method used. If you have any other article that has such evidence, I'm all ears.

Of course you're correct that The Intercept should have taken more care in this matter, but that doesn't mean that this was the reason why the leaker was found. The leaker should also have been a bit less amateur (e.g. not communicating with The Intercept on a _work_ computer).

Do you think the NSA wouldn't have checked access logs and the emails if not for the scan? The difference isn't between getting caught vs. not, it's between getting caught in days vs weeks.

But also caught with irrefutable proof. The printer and job time can be tracked back to her precisely. With that in hand, there is absolutely no doubt that leak came from her (she intentionally shared), or through her (she printed, but someone else shared, with or without her knowledge).

> There's no evidence that it was The Intercept's actions that caused her to be found.

There's plenty of evidence The Intercept's actions caused her to be found. It's documented in the FBI's affidavits for arrest and search warrants. https://www.buzzfeed.com/stevenperlberg/a-federal-government...

To wit: 'The Reporter told the Contractor that the Reporter had received the documents through the mail, and they were postmarked "Augusta, Georgia."'

So the FBI looked up who printed the document and of those six, who lived in Augusta, GA. Open and shut. Thanks, The Intercept!

Yes, but there were only six who printed it to begin with. I'm inclined to agree that the Intercept shouldn't have shared that information with the contractor, but it's not at all clear that the leaker wouldn't have been found anyway.

How does the FBI know it was printed? Because the Intercept told them. It could have been screenshots from a phone. It could have been downloaded from some hack. The number of people that viewed a document is going to be a superset of the number of people that viewed and printed a document. And if they're worried someone could access the report outside of their controls, then the set gets even larger. The Intercept only needed to disclose some content and the intelligence report number to get confirmation. Instead, they gave away how they got the report (printed), narrowing it to a set of six, and then they gave away the postmark, narrowing to a set of one. The Intercept burned their source.

>How does the FBI know it was printed? Because the Intercept told them.

The images have clear fold lines in them.

There's not much evidence that The Intercept tried very hard to protect her identity, either.

In a situation like this, you as the leaker have a lot more to lose than whoever you're leaking to.

In that situation, I'm sorry, but the responsibility for protecting your identity is on you. Anonymize the data. Do not leak something that only you would have access to. etc, etc.

Because unless you're leaking to Infowars, you have to expect that a legitimate journalist will present your data to the organization from which you leaked it to, and request comment.

Snoweden did everything right, and it still wasn't good enough.

I think everyone would agree the leaker should be more cautious, but The Intercept should also know best practices too around printed materials too.

I think everyone would agree with that. The question then becomes: did The Intercept not follow best practices here? Once again, there is no evidence and any "yes" answer relies on trusting the NSA/DOJ.

> The question then becomes: did The Intercept not follow best practices here?

If removing well-known, uniquely identifying printer microdots isn't a best practice, it should be.

> > The question then becomes: did The Intercept not follow best practices here?

> If removing well-known, uniquely identifying printer microdots isn't a best practice, it should be.

Very true; where is the evidence that they did not do so?

https://twitter.com/flashman/status/871896475902631936

Thanks.

They did not. They told a government contractor that the document had been printed and mailed from Augusta, GA, who then reported it to the government. That's what got her, microdots or not.

You can read the search warrant at https://www.buzzfeed.com/stevenperlberg/a-federal-government..., which is more complete than the arrest warrant. Just read paragraphs 12-19, which cover the relevant probable cause. If the FBI don't know how it leaked (printed) and from where (Winner's home town), the case becomes extremely difficult. Instead, they had so much that she just confessed when they showed up.

We don't really know, it might have been good enough.

> Snowden's identity was made public by The Guardian at his request on June 9, 2013.[97] He explained: "I have no intention of hiding who I am because I know I have done nothing wrong."[20] He added that by revealing his identity he hoped to protect his colleagues from being subjected to a hunt to determine who had been responsible for the leaks.

https://en.wikipedia.org/wiki/Edward_Snowden#Motivations

> Snowden did everything right, and it still wasn't good enough.

But Snowden's whole strategy was to be a public figure. He fled the country and had a documentary filmmaker record the handover of the documents. It looks like Winning was hoping to remain private and had no idea what she was doing.

The leaker first contacted them through her work email.

It was game over at that point. Nothing they could do would have fixed that.

Exactaly right. You should assume, especially in an environment like the NSA, that your internet browsing and email correspondence is being monitored and certain hosts and suspicious DNS will trigger something.

I've worked at far less security concerned companies that monitored all network traffic going and out and logged it and continually were looking not only for internal nefarious behavior but for possibly viruses, worms, etc.

No she didn't. Please stop repeating this claim.

She signed up for an email subscription from her personal gmail, on her work computer.

That would certainly have been enough to raise her superiors' hackles when discovered, but the result would have been her getting fired, not indicted.

The bottom line is having a personal subscription to the Intercept was not ever going to be enough to build a case against her. You repeating that claim is victim blaming, and more importantly, wrong.

>> You repeating that claim is victim blaming, and more importantly, wrong.

I think that really depends on whether you perceive the leaker as a perpetrator or a victim. Valid arguments can be made for either side.

I don't think The Intercept has much responsibility here at all. In my opinion, in their role as receivers of leaked information, they should verify the information provided to them and decide if it should be released to the public. Sure, they shouldn't reveal their source and The Intercept met that requirement by insuring that they themselves did not know the leaker's identity.

Anyone who is thinking about leaking anything classified only needs to spend thirty seconds typing "Snowden" into Google to find out what happens when the federal government identifies the leaker. They then decide if it's worth the risk and how much time they will spend on covering their tracks. In this case (if true) it sounds like Reality Winner decided that they simply couldn't cover up their leaking and threw in the towel.

Much has been made of the watermarks on laser printers, we've known about those for a long time. Not everyone is aware but it's the sort of thing you can find out about if you put in time to do the research. After doing my own research, it doesn't seem like these watermarks really came into play; the NSA simply looked up everyone who had accessed the document and inspected their workstations for clues.

I'm not doubting that the NSA would have figured out the source eventually, yellow dots or not, but I think it's a fair criticism to say the Intercept did not have to publish a picture of the document in full, instead of transcribing the contents.

It could still make a major difference when it comes to the question of what they can prove in court.

I disagree, if the Intercept values leaking things the public deserves to know (their whole raison d'être), they need to do better.

Bear in mind, The Intercept is likely more aware of anti-leaker strategies than most of the people they are hoping will leak them data. If they're going to encourage the act, they should do everything possible to help their sources protect themselves, and do diligence on anonymizing everything they get even further.

No, Journalists need to ensure the confidentiality of their source by all means. Simply releasing the info would consitute negligence. They have a duty to protect those who risk their life or freedom for the public good

> I don't think The Intercept has much responsibility here at all.

They do if they want to keep their jobs. It's not a moral point, it's a Darwinian one. No one talks to journalists who burn their sources.

The Intercept's literal genesis was as a clearing house for leaked data. This is... really bad if they want to be known as a safe place to send leaks.

> the NSA simply looked up everyone who had accessed the document and inspected their workstations for clues.

The FBI doesn't mention the watermark in their affidavits, but they do mention that The Intercept gave away that the document had been printed and mailed from Augusta, GA. That allowed them to quickly zero in on Winner. The only "clue" on her workstation was that she had e-mailed The Intercept asking for a podcast transcript months before. In other words, she knew The Intercept existed. The Intercept burned her.

To be clear, she contacted The Intercept from her work computer for something entirely unrelated. (Which is still not smart, but not as bad as people are implying)

That's an important distinction that gets lost in the vaguery of the sensational journalistic rhetoric. To me, the evidence trail presented sounds like one of those post-facto explanations the FBI concocts in order to preserve their true secret methodologies.

I'm not sure I understand. There's a woman actually in jail awaiting charges over this. You're saying the NSA has a sacrificial agent to take the fall? That they're faking the whole judicial process? That they somehow induced a contractor to steal a real document and leak it to the paper they wanted it leaked to?

I'm all for a good conspiracy theory, but you're going to have to spell this one out better.

Not that I have any idea what actually happened but hiring someone at a low level, who seems kind of unreliable, allowing them access to something who's leakage you might not care about, letting everything play out the way it did, seems like something a spy agency would be reasonably adept it.

The women was a contractor, not an agent, so they aren't sacrificing someone they've invested in. etc

Again, what actually happened, who knows?

> Again, what actually happened, who knows?

So given the choice between "News Site Messed Up Protecting a Source" and "The Whole Thing Was Orchestrated By The Spymasters", you're refusing to make a call because... "who knows?"

I mean, if that's the level of detachment and rationality you're going to apply here... why stop at a mere egg-on-face moment for The Intercept? Surely the NSA could be applying those powers for something more juicy.

I think tanderson92 is claiming that the source was actually identified via other methods, so the material provided by the Intercept played no role in identifying the source. Hence the Intercept did not accidentally reveal their source but is being portrayed as such in order to discourage people from leaking to them.

Personally, while that scenario doesn't sound impossible I think the likelihood is being overstated due to motivated cognition: if you like the Intercept you would like to believe they did nothing wrong, but in reality people do make mistakes.

I don't make any particular claim about how the government identified the source. They also have access logs and apparently only 6 people accessed the document.

I do think that The Intercept bungled this in not stripping the watermarks; I don't shield them from criticism even though I value their reporting. But I do not necessarily accept the government's version of events. Parallel construction is not unheard-of.

> I don't make any particular claim about how the government identified the source. They also have access logs and apparently only 6 people accessed the document.

Thanks for pointing that out. I've edited it to simply say "via other methods", especially since other comments say the source did not directly send the info via her work email.

> I do think that The Intercept bungled this in not stripping the watermarks; I don't shield them from criticism even though I value their reporting. But I do not necessarily accept the government's version of events. Parallel construction is not unheard-of.

If the Intercept did make the mistakes they apparently made (if not they're free to deny it), does it matter whether or not the parallel construction theory is true?

And so the top comment on this HN thread is more or less a content-free distilled expression of rooting interest. NSA bad, Intercept good, what more do you need to know?

Excuse me? Your characterization is far off the mark, and your snark unappreciated. I was simply remembering that the government can and does lie, and that there we should remember the interests of the parties involved. It's not content free to observe this fact and to stress what we do and do not know.

If I had to change anything it would be the fact that they only signed up for an intercept mailing list using work email, not direct contact. I regret the error, I was going off what I read yesterday.

There's nothing snarky about my comment; I meant exactly what I said.

One can be snarky while very serious. I didn't even realize until looking it up that "snark" is a portmanteau of "snide" and "remark". One can be seriously snide.

Anyway I'll take the lack of substantive criticism of my point and critique of form as a point of pride.

We're talking about the FBI, not the NSA, and court documents.

> Meanwhile the alleged leaker allegedly used her work computer to contact The Intercept.

This really should be ignored. The FBI included it as probable cause for their search and arrest warrants, but she had e-mailed them asking for a podcast transcript months earlier. As far as leaking, she mailed the document to them and had no electronic communication at all. The Intercept blabbed that it was postmarked Augusta, GA and was printed, which is what gave her away. They screwed up and if they want anyone to feel safe leaking to them again, they need to own up to it and describe how they are going to fix their procedures to protect their sources in the future.

> We're talking about the FBI, not the NSA, and court documents.

It's called parallel construction; it has happened before and it will happen again.

http://www.reuters.com/article/us-dea-sod-idUSBRE97409R20130...

Why do they need parallel construction when The Intercept narrowed it to a single person (printed and lives in Augusta, GA)? I'm going to restrict my conversation on this topic to the reporting and sworn testimony.

I'm not shielding The Intercept from criticism. But the reporting is based on what the DOJ wanted released and I do not share your trust in what they say.

You are shielding The Intercept from criticism. The Intercept has not countered the DOJ testimony or any of the other reporting on this. The FBI has sworn that these things happened. So let us think through the counterfactual that you're proposing: The Intercept didn't burn their source and the FBI lied to a federal judge on a warrant application. In that reality, the Intercept would immediately publish a story about how the FBI lies to federal judges. Not only would it be a huge blockbuster, but that search warrant would be fucked and the search (during which she confessed) would be inadmissible. Not only do they have a huge story, they got their source off!

Instead, they released this chickenshit statement that tries to cast doubt on the testimony without actually disputing any of it: https://theintercept.com/2017/06/06/statement-on-justice-dep... So, it looks like we live in the reality where the FBI didn't lie on a warrant application and The Intercept burned a source.

I have not proposed a counterfactual, contrary to what you allege. I simply do not automatically trust what the DOJ believes simply because the FBI swore to it in an affidavit. The government lies.

Seriously seems like this was a whistleblower with a legitimate concern for the American people. Maybe she was careless on purpose. If you know you are going to get caught, might as well make your trail obvious so that you can claim that you are a whistleblower.

...and use a pseudonym?

How is that she was a whistleblower? The US government wasn't breaking any laws and, for all we know, the evidence she had may be part of the ongoing investigation into Russian interference in the election.

Also, article is on the Washington Post, possibly the most propagandist of mainstream media outlets.

People shouldn't necessarily trust the Washington Post either, who is beholden to their sources in the NSA.

The Washington Post covered Snowden's leaks of unconstitutional actions by the NSA, won a Pulitzer Prize for the coverage, only to then stab him in the back and call for his prosecution.

https://www.washingtonpost.com/opinions/edward-snowden-doesn...

You can use the leaks and still be critical of the way it was done.

WaPo is the WSJ of D.C. They know which side their bread is buttered on.

> The Washington Post covered Snowden's leaks of unconstitutional actions by the NSA, won a Pulitzer Prize for the coverage, only to then stab him in the back and call for his prosecution.

I've heard speculation that the change in attitude was tied to regime change at the Post in the wake of the Bezos acquisition.

I don't trust any organization that has a thorough understanding of trust.

WaPo is a CIA mouthpiece. So it's to be expected if they portray "The Intercept" as an unsafe place to leak to. https://www.youtube.com/watch?v=ofB1b3RMdhA&list=PLTpcK80ird...

https://www.commondreams.org/views/2013/12/18/under-amazons-...

This sort of conspiracy mongering is below the HN standard of discourse.

Amazon doesn't own WaPo, Jeff Bezos does. A $600 million 10 year contract for a private cloud is a tiny fraction of AWS revenue (some $15 billion per year), let alone overall Amazon revenue. It is in no way a sweetheart deal that would require Bezos bend over backwards, let alone undermine the integrity of the news organization for which he paid $250 million out of his own pocket.

Oh really? Am I being singled out? Or are you ready to call conspiracy mongers to everybody in this thread who "cast doubt" over WaPo allegiances?

Reply on news.ycombinator.com