Arms and influence

Security? Just say no.

The US attorney imbroglio wouldn't normally be a topic for a blog about national security. However, at least one revelation in the last few days does have a serious national security dimension.

To avoid discovery, in the legal sense of the term, White House officials, including Karl Rove, have been using outside e-mail accounts, on mail servers maintained by the Republican National Committee. While that statement sinks in, here's a quote from a White House employee:

"We just got a bit lazy," said one aide. "We knew E-mails could be subpoenaed. We saw that with the Clintons but I don't think anybody saw that we were doing anything wrong."

Actually, I think they had the Iran-Contra scandal in mind, more than the Clintons. Remember when Oliver North et al. thought they had deleted messages from the internal mail system, only to discover that archived copies of them still existed?

Legal matters aside
There may be good legal reasons why people in the White House should never, never use outside e-mail to conduct government business. Some observers have cited the 1978 Presidential Records Act, which in a post-Watergate world, clearly intended to preserve even the most embarrassing content. If content is maintained outside US government systems, the risk of losing this information to posterity runs pretty high.

Unfortunately, there's a bit of wiggle room in the Act, which has exemptions for "personal records," which include "materials relating to private political associations, and having no relation to or direct effect upon the carrying out of constitutional, statutory, or other official or ceremonial duties of the President" and "materials relating exclusively to the President's own election to the office of the Presidency; and materials directly relating to the election of a particular individual or individuals to Federal, State, or local office, which have no relation to or direct effect upon the carrying out of constitutional, statutory, or other official or ceremonial duties of the President." It seems doubtful that these exemptions were intended to cover 95% of the communications from the President's Political Advisor, however, which fairly describes how often Karl Rove used these RNC e-mail accounts.

While there are other laws that the Administration may have broken here, the legal issues aren't necessarily the biggest problem with outside e-mail use. National security could be easily and severely compromised.

Communications insecurity
You don't have to be someone like me, working on the software business, to know the potential security risks with e-mail. Instead of getting into technical details, I'll tell you how information technology (IT) departments treat situations like this one. I've worked with hundreds of IT professionals who are very concerned that people in their organizations are using outside e-mail like Yahoo! and Gmail, outside file storage on services like XDrive, outside chat systems like AOL Instant Messaging, and outside web conferencing services like WebEx. (Here's a decent summary of the e-mail security problems, if you're interested.)

Without saying how secure these services are, they are definitely not designed for a high-security environment. There's also the problem of security "along the wire." An outside e-mail service might be very secure, but the connection between your PC or Blackberry might not be. (That statement definitely applies to text messages, which White House staffers were also using to communicate.)

Companies worry that trade secrets might be exposed, or they might be violating regulations about the confidentiality of financial information (see the SEC restrictions on what companies can communicate during quiet periods). HR departments, insurance companies, and health care providers can face serious legal penalties if they accidentally expose private medical information.

Need I go on? Let's just say, outside communication and collaboration services are a big source of anxiety in IT departments. Sure, there are companies in the security business who overstate the threats. However, the threats are quite real. If DoD employees can't install software on their own computers, why should White House staffers be using their Blackberries to read e-mail on the RNC's e-mail servers, with God only knows how good security on the server or on the wireless connection to it?

Multiple levels of information security
No one should have to make the argument that the White House needs to be at least as secure in its communications as an electronics retailer or a hospital chain. In fact, it needs to be more secure, in part because of the accidental ways people might divulge important secrets without realizing it. While most people focus on the first-order secrets, the direct documentation of decision-makers' statements or policies, the threat of indirect, second-order disclosure is just as dangerous.

Take, for example, the Japanese surprise attack on Pearl Harbor. A number of indirect clues that the Japanese were going to take some kind of aggressive action existed. The negotiations between Japan and the United States had stopped. The bulk of the Japanese navy, most critically its carriers, were not in port. Japanese diplomats were destroying documents. As shown in the Russo-Japanese war and other conflicts, the Japanese pattern was to mobilize, strike, and then declare war. Scholars continue to debate whether the US government should have been better prepared for the attack because the warning signs were certainly there.

Flash forward to the present day, when White House staffers have their daily work perturbed by counterterrorism, the war in Iraq, and any number of other high-security questions. Even if someone eavesdropping on RNC e-mail accounts couldn't find a "smoking gun" document about (speaking hypothetically here) a secret understanding between the US and North Korean governments, someone could infer the existence of such a deal through these kinds of second-order clues. Which top officials were out of the office on particular days? Were White House officials sending lots of messages to anyone used as back channel conduit for discussions with the DPRK? Was anyone asking for a briefing on particular legal or diplomatic issues that might point towards a secret US-DPRK deal?

Of course, it's the height of absurdity and hypocrisy for the Justice Department to be using outside channels of communication. On the one hand, the DOJ is involved in highly secret counterterrorism investigations and prosecutions. On the other hand, some key DOJ officials may have been using text messaging and outside e-mail servers to communicate.

An obvious conclusion
We can spend the next several years tied up in knots over the legal issues involved. It can take less than five minutes of reflection to determine that someone in the White House needs to be fired for jeopardizing national security in this fashion.

No Arabic speakers need apply

IN THE NEWS
From Poliblogger comes this jaw-dropping Washington Post story. Apparently, the FBI still hasn't recruited more Arabic speakers:

Five years after Arab terrorists attacked the United States, only 33 FBI agents have even a limited proficiency in Arabic, and none of them work in the sections of the bureau that coordinate investigations of international terrorism, according to new FBI statistics.

As Poliblogger notes, what makes this story doubly infuriating is how it came to light. An Egyptian-born agent--one of the few who can speak Arabic, apparently--sued the FBI because he was cut out of terrorism-related cases. If he hadn't sued, it's not clear when someone might have noticed that the FBI is as about as proficient at monitoring or interviewing Arabic-speaking suspects as, oh, they were before the 9/11 attacks. Accountability, anyone?

Deliberately vague

IN THE NEWS
Dahlia Lithwick at Slate makes an obvious point: perhaps it's not a good idea to have too specific a definition of torture.

Or perhaps we shouldn't be having this discussion at all. When Americans are chewing over the proper definitions of torture, we're in a bad, bad place.

And no, the 9/11 terrorists did not put us there. We did it to ourselves. There are no ticking bombs that can be found and dismantled. There are people who mean us harm, and there are people in indefinite American custody. Most of the people in the latter category do not belong to the former. The minority of prisoners who may be involved with Al Qaeda or its allies don't have knowledge of imminent attacks.

Al Qaeda is like any terrorist organization: it hopes for an overreaction. Al Qaeda's leaders want Americans are more afraid than they should be. They want the US government to take reckless, violent measures that are as offensive as they are unjustified.  They're probably very happy to see Americans having a debate that should never have happened in the first place.

ADDENDUM: The fellows at Lawyers, Guns, and Money make an excellent point: the Constitution is written deliberately to be far less than specific on most points, as are many laws that extend from these constitutional axioms. There are plenty of reasons to be unspecific, when you're trying to deter the worst forms of behavior.

Trust us

IN THE NEWS
Trust us is about all President Bush can say to defend warrantless wiretaps, waterboarding, indefinite detentions, and other post-9/11 measures. Matt Lauer's questions are surprisingly pointed, and he politely but firmly continues his line of questioning. Well worth watching: the suspense around whether Bush is going to stab Lauer through the chest with his finger is nearly unbearable.

Distrust of government

IN THE NEWS
The theft of personal data about 26.5 million US veterans makes the point more eloquently than I did the other day: it's better not have to trust the federal government with private information by keeping it out of the hands of government officials.

Government's wicked ways

IN THE NEWS
I noticed, after commenting on Armchair General's escapade with his car insurance, that he had updated his original post. The General feels better that the USAA representative assured him that the extra information the company requested was purely for their own records, and that they wouldn't possibly share private information with the federal government.

Uh, right. Much like the gigantic database of phone calls won't be used to retaliate against reporters and their sources. To quote Peter Cushing's character (the consummate bad bureaucrat, Grand Moff Tarkin) in Star Wars, "You're far too trusting."

I know the General was trying to make the best of a bad situation, but this anecdote illustrates how far Americans have come from their political roots. Clearly, the Bush Administration's MO is, Trust us as much as humanly possible. However, this country was founded on the principle that government is inherently untrustworthy. Even the most well-intentioned policies are subject to abuse.

Rather than use an example you might expect (say, something to do with the NSA's warrantless wiretaps), I'll cite welfare as a good example. Back in the day when conservatives were people who were skeptical about big government, many conservative thinkers, such as William F. Buckley, said that welfare programs were corrosive to the spirit. They had a point: being on welfare meant opening everything about your life—what you owned, who lived with you, what you did with practically every moment of your time—to the scrutiny of a government employee. Where did you get that radio? How did you pay for it? Who is this man living with you? Is he contributing to the rent? How much time did you spend looking for work? Can you verify that you made these job applications? Etc. Naturally, this approach made many welfare recipients resentful of this intrusion, and resistant to the, er, helpful suggestions they received from agents of the federal government. Clearly, these officials were trained and rewarded to be distrustful of their subjects, putting the representatives of the US government immediately at odds with a certain class of American citizens.

If you believe in this sort of critique of welfare, it's hard to see where widespread surveillance is much different. You might say that the professional busybodies who poked and prodded into the lives of welfare recipients were just protecting the taxpayer's investment in social welfare. How different is that from protecting the taxpayer?

James Madison used terms like "wickedness" to describe the realities of human nature that the Constitution needed to take into account. The Framers were well aware of the potential abuses of government, particularly when these abuses could be framed as necessities for public order and national security. The original Articles built a system of shared powers and overlapping responsibilities to make the tyranny of the majority or the dictatorship of a single man impossible. Since they felt they weren't clear enough on a few key points, the Framers added the Bill of Rights, in which the federal government is barred from indefinitely imprisoning criminal suspects, forcibly quartering troops in citizens' homes, and declaring monopoly control of the weapons needed to maintain a "well-regulated militia."

The government might claim exigent reasons for all these abuses. For example, during the Whiskey Rebellion, the government might have thrown suspected rebels into prison until prosecutors could find evidence against them. Government troops might have demanded they be quartered immediately in the homes of local residents, while the wagons containing their tents caught up with them. Officers might have ordered the immediate seizure of all weapons in the area of the rebellion. National leaders might have claimed all these steps were necessary, since the "first new nation" was so new that an uprising might fracture it. To their credit, the first generation of American leaders were confident that they could handle challenges like the Whiskey Rebellion without reverting to British methods, the policies that inspired the American War of Independence in the first place.

If empowering government busybodies in the name of national security is a bad idea, enrolling corporate busybodies in the same campaign is worse. Civil servants are at least accountable to some measure, and their activities can be swiftly regulated or de-funded if things get out of hand. It's inherently harder to monitor people outside of the government, and it's more difficult to police their actions. Just as mercenaries are no substitute for US soldiers, insurance agents and customer service representatives at companies like USAA are no substitute for the FBI.

Even the most self-consciously villainous people will cite good reasons for their villainy. The Framers, whose jaundiced view of human nature recognized this fact of life, built a system of government to keep power out of the hands of accidental or deliberate villains.

The meaning of the PATRIOT Act

IN THE NEWS
What does the PATRIOT Act mean to you? If you try to refinance your house, in most cases, the amount of paperwork has gone up at least 50%. Apparently, we're more security if Al Qaeda can't purchase condominiums in Sarasota, Florida.

That's the sort of trivial, brainless response to 9/11 that's all to commonplace, but might be relatively innocuous. However, this anecdote from Armchair Generalist is anything but harmless. What does it mean if you can't perform any standard transaction, such as paying off your automobile loan, without having to endure intrusive scrutiny? How many other private organizations than your bank and your phone company are willing to act as de facto arms of the US government's surveillance apparatus?

We've quickly entered a world in which the federal government claims sweeping powers to monitor US citizens, then hands off much of the actual monitoring to private corporations. If you throw in the government's claim that the Justice Department lacks the clearances needed to investigate how this surveillance is being conducted, you have a program with no effective control or accountability. Once you lose people like John Robb, who is about as dedicated to the defeat of terrorists as you can get, you've pretty much lost the core of informed observers who might have suspended disbelief about the effectiveness of these programs.

Wrong and ineffective

IN THE NEWS
Poliblogger's post on the vast NSA database of everyone's phone calls is really good...But it's not enough. The argument has to be made that these policies are not just morally and Constitutionally indefensible. To land the rhetorical punch, you have to also make the argument that they are not effective.

I wish Americans had enough faith in their own institutions that the burden of proof didn't include explaining why the Framers created the system of government we have. I also wish that 9/11 had prompted enough people to review the history of counterterrorism, in the United States and elsewhere, to the point where the general public already knew that a big pile of information doesn't make you safer. But, we're here now, where it's not enough to say that the NSA wiretaps and archive of phone records are just illegal and unconstitutional. It's also important for the reading public to know, they're also practically useless--at least for catching terrorists. What other purposes they might serve is a separate question.

Flame wars and terrorist e-mails

IN THE NEWS
Just to continue listing reasons to be skeptical about the US government's data mining efforts, here are a few more salient points:

• To date, the executive branch has followed up on only a handful of leads from these surveillance efforts.
• The recently-revealed Library Tower plot doesn't really help the Administration's case. The fact that someone was thinking about crashing an airliner in Los Angeles isn't proof that a serious possibility of such an attack existed. It's also not clear from the information provided that surveillance helped stop the plot--only that the alleged terrorists never followed through.
• According to this recent article in Wired, humans have serious cognitive obstacles to understanding the tone and intent of e-mails sent to them. Since terrorists can and do talk in code, this psychological barrier to understanding e-mail traffic only confounds further attempts to catch terrorist communications through a vast electronic dragnet.

No surprise, then, that Congress is increasingly skeptical of this program's value.

Give it up already

IN THE NEWS
Sometimes, bad ideas die a natural death. Other times, they cling to life like the mold in your shower. The executive branch's various experiments in data mining fall into the latter category. Just when you thought the Total Information Awareness (TIA) program has died, up pops the warrantless NSA wiretaps, which are just the proverbial tip of the iceberg. The US government is still pushing for a massive sweep of all e-mail, web sites, telephone calls, and other sniglets of electronic information it can get.

What's the value of this information? They say, We're focusing on suspected terrorists, don't worry. We say, Your algorithms mistakenly identify people like Senator Ted Kennedy and a four year old boy as terrorists, and there's a suspiciously high number of your political opponents on the no-fly list.

They say, Every program has its kinks to work out. We have our top people on this project. We say, So why do you keep giving important posts in the departments of Homeland Security and Defense to people who got their computer science degrees from diploma mills?

They say, We're fixing problems like these as we go. We say, Data mining projects are just plain hard. If Amazon.com needs a large team of programmers to analyze the buying habits of the captive audience of people browsing their web site, how exactly are you going to find terrorists in all the e-mails, instant messaging, phone calls, and other electronic communications out there?

They say, Catching terrorists is our top priority. We'll figure out how to do this. We say, Even if there were the Manhattan Project of data mining, we're finding it hard to believe you.

They say, Trust us. We say, You keep saying that, but you never back up your claims with results. And don't tell us it's too secret to say a word about how we catch terrorists, because European governments, with a lot more counterterrorism experience under their belts, frequently do tell their citizens about their counterterrorism efforts .

They say, No, really, trust us. We say, You're not listening to anything we've said.

Of course we need to monitor suspected terrorists. It's the way the Administration has described its efforts that fails to convince, particularly in light of the problems already identified.