US justice department absolves itself of wrongdoing

US justice department absolves itself of wrongdoing

Computer Fraud & Security Bulletin concern is the perceived threat to individual privacy and corporate security. Public confidence in the chipsets ha...

431KB Sizes 9 Downloads 162 Views

Computer Fraud & Security Bulletin

concern is the perceived threat to individual privacy and corporate security. Public confidence in the chipsets has been difficult to achieve because the underlying technology remains classified. The NSA’s refusal to declassify the Skipjack algorithm has fostered doubts about the strength of the algorithm, rumours of the existence of hidden trapdoors, and fears that the chips could be reverse-engineered in time. Questions have been raised about the impact of this technology on business. Of immediate concern is the public’s forced reliance upon a single, Government-approved supplier for the certified Mykotronx Inc, a chips. NSA-communications security vendor, currently maintains exclusive rights to manufacture and market chipsets. Because the Clipper Chip and Capstone algorithms do not comply with existing international standards, there are concerns that the added investment in hardware and personnel could make the technology unduly expensive to implement. There are worries that foreign companies may not be able to get the chips, and that foreign reaction to the US Government holding the decryption keys may be unfavourable. These worries are compounded by other security fears: the keys could be compromised during manufacturing, while being transported to the Government-approved agencies, or while stored in escrow. Despite these concerns, NIST has been authorized to develop standards for the procurement and use of the key escrow chips. Summary The Federal Government, through the NSA, has guided the design and use of non-military cryptographictechnologyfrom its inception. From the DES to the DSS and the newly proposed Capstone and Clipper Chips, advances in technology have blended with increased Government regulation. The result - a gradual shading of the rights to individual privacy and corporate security should be a matter of international concern.

September

1993

THE INSLAW AFFAIR US Justice Department itself of wrongdoing

absolves

Wayne Madsen The Department of Justice (DOJ) has released the long-awaited report of its internal investigation of the lnslaw Affair. In November 1992, then-Attorney General, William Barr, appointed

retired federal judge, Nicholas J. Bua,

as a DOJ Special Counsel to investigate whether officials of the Justice Department had conspired to wrongfully appropriate copies of the case-tracking Prosecutors’ Management Information System (PROMIS) from lnslaw Inc, a contractor. Many journalists and other parties that have followed the lnslaw Affair since it surfaced in 1985 condemned the Justice report as a “whitewash”. Some congressional officials pointed to the need for an independent counsel to investigate the lnslaw Affair, however, the Independent Counsel Law lapsed in December 1992. Consequently, there are no current statutory provisions for an independent counsel to investigate either the lnslaw matter or any other matters requiring such impartial investigations. Mr. Bua was assisted in his investigation six Assistant

US Attorneys.

them had connections

by

It is possible some of

with the lnslaw affair while

serving as members of the DOJ bureaucracy. A significant amount of critical information in the Justice report was omitted pursuant

to Federal

Rules for Criminal Procedures because, the report stated, “Several third party witnesses (were required) to appear before a grand jury in the Northern District of Illinois”. There was no explanation

of why the grand jury was conducted

in Judge Bua’s former federal judicial seat in Chicago. This was an unusual choice considering that Inslaw’s

complaints

were originally

district courts in Washington, criminal

activity

conducted

filed in

DC and the alleged

on the part of the DOJ was

mainly

in Washington.

The alleged

initial theft of PROMIS occurred at the main DOJ

-12

01993

Elsevier Science Publishers

Ltd

September

Computer Fraud & Security Bulletin

1993

headquarters

in Washington

Additionally,

Inslaw’s

beginning

lawsuit

in 1983.

resulting

in its

The report states that the death of Casolaro was outside the normal jurisdiction

award of $6.8 million was held in the District of

Government

Columbia’s

involved in the investigation

bankruptcy

Government

appeals

court

and subsequent

of this decision

heard before Washington

were also

and therefore, the DOJ could not get of Casolaro’s

The report fails to mention repeated

courts.

of the Federal

conversations

death.

that Casolaro

with FBI special

had

agent,

Thomas Gates, who, according to a 1992 House The DOJ report contains which seem intended of Inslaw’s

witnesses.

lnslaw

John Otto, a former Acting was told by an unnamed Department Information

official’ form

investigators

passages

the veracity

had claimed

Director

that

of the FBI,

‘senior career Justice

that the FBI’s Field Office

Management

a pirated

several

to undermine

System (FOIMS) was

of PROMIS.

Otto

told

DOJ

be able to discuss such a subject. The report also states that Terry D. Miller, the Governmental Sales Consultants have complete information

President of Inc, did not

when he wrote a letter

to then-FBI Director, William Sessions in January 1991, stating that he had, “reason to believe that the software that your agency uses throughout FOIMS -

is stolen.” lnslaw contended

that this meant that the FBI was using a disguised version of PROMIS as FOIMS. The Justice investigators requested Professor Dorothy Denning source

of Georgetown code

Professor

of both

Denning

University PROMIS

concluded

to study the and

FOIMS.

that

the two

programs were totally different as PROMIS was written in COBOL and FOIMS was written in a NATURAVADABASE

environment.

Further, the DOJ report concentrated

on the

late Danny Casolaro, a journalist who was writing an expose of the lnslaw Affair, and who died in August 1991 while planning to meet a confidential informant in Martinsburg,

West Virginia. The DOJ

contends

committed

that Casolaro

lists several motives including

suicide,

and

several months of

unemployment, an inability to pay for a ballooning mortgage and difficulties with his publisher. Furthermore, no problems suicide.

Committee

investigating

report,

the activities

had

been

of one of Casolaro’s

sources, a Robert Booth Nichols, for alleged ties to organized

crime in the entertainment

Gates was concerned

yet the DOJ felt it unnecessary death of a journalist

industry.

about Casolaro’s

safety

to investigate

contact with an agent of the FBI.

the DOJ contends that there were with the police investigation of the

The

DOJ

contends

that

the

forensic

investigation of the suicide was satisfactory. There is controversy concerning information which may not support this conclusion. Casolaro was found dead in his hotel bathtub, both wrists deeply slashed several times with a razor blade. The report states that there was no sign of a forced entry to the hotel room, but the existence of a master or duplicate key is not mentioned. The DOJ unequivocally declares that a struggle did not occur, although enough controversy existed to warrant a second autopsy, during which the pathologists and Casolaro’s own brother, a medical doctor, noted that three fingernails on Casolaro’s right hand were missing and there was a bruise on Casolaro’s head that indicated some bleeding had occurred. The DOJ is adamant that the autopsy (it does not state which one the first or the second) revealed no contusions or trauma of the kind that one might expect if Casolaro were involved in a struggle. The report contends that although extensive pools of blood and stains were found in the hotel bathroom where Casolaro’s body was discovered, there was no evidence such as footprints indicating that other persons were present. The Sheraton Hotel quickly contracted a professional cleaning crew to clean the hotel room after the police concluded their investigation, thus annihilating any option for further investigation. The DOJ has no doubts over the validity

01993

the

who had been in periodic

that he never made this statement

and was so ‘computer illiterate’ he would not even

the US -

Judiciary

Elsevier Science Publishers

Ltd

of

13

Computer Fraud & Security Bulletin

September

1993

Chronology of the lnslaw Affair 1981

lnslaw (Institute for Law and Social Research) becomes a for-profit corporation, develops PROMIS

1982

lnslaw awarded $10 million, three-year version of PROMIS DOJ decides to terminate

April 1982 December

1982

contract to implement

public domain

contract with lnslaw for convenience

Earl Brian and Robert McFarlane Unit of the Israeli Defence Force

allegedly

of the Government

pass PROMIS to the Signals Intelligence

1983

DOJ recognizes Inslaw’s proprietary a 32 bit VAX system

rights to enhanced

PROMIS, designed to run on

1983

Enhanced PROMIS allegedly passed by DOJ to Hadron Inc, a firm owned by Reagan associate Earl Brian, Hadron allegedly sells regular PROMIS to Jordanian military intelligence

1983184

Enhanced PROMIS allegedly modified at the Cabazon Indian Reservations, by Wackenhut/Cabazon joint venture company, Cabazon Security Corp

1983184

Earl Brian allegedly sells enhanced PROMIS to Royal Canadian and the Canadian Security and Intelligence Service (CSIS)

February 1985

DOJ withholds $1.6 million in payments to Inslaw, lnslaw files for bankruptcy Chapter 11 of Bankruptcy Code

1985

DOJ plans to petition bankruptcy court to force lnslaw into Chapter 7, forced bankruptcy with liquidation of all assets including PROMIS

1986

DOJ attorneys advise Deputy Attorney General, Arnold Burns, that Inslaw’s proprietary rights to enhanced PROMIS are legitimate

Indio, California

Mounted Police (RCMP) under

June 1986

lnslaw files adversary

1986

Systems and Computer Technology

1987

Israel allegedly

1987

Federal bankruptcy judge, George Bason, rules that DOJ converted enhanced PROMIS by, “trickery, fraud and deceit”. Hadron allegedly sells a version of PROMIS to the Iraq Intelligence Service

December

1987

complaint against DOJ (SCT) attempts a hostile takeover

of lnslaw

sells PROMIS to USSR

Judge Bason is not reappointed

to his bench

January 1988

Judge Bason awards damages and attorney fees of $6.8 million and $1.2 million respectively to lnslaw a week before his departure from the bench

May 1988

Former DEA agent claims that DEA proprietary firm was selling PROMIS to drug control agencies in Cyprus, Pakistan, Syria, Kuwait and Turkey

1988

Attorney General, Thornburgh, install PROMIS

March 1989

DOJ Office of Professional Responsibility DOJ malfeasance were erroneous

November

US District Judge, William Bryant, upholds Bankruptcy Court rulings for lnslaw stating that, “The Government acted wilfully and fraudulently to obtain property that it was not entitled to under the contract”. Upholds attorney fees, but reduces damages to $655 200

1989

orders Drug Enforcement

Administration

(DEA) to

(OPR) rules that Judge Bason’s findings on

March 1990

British journalist, Jonathan Moyle, investigating hanging in his hotel wardrobe in Santiago

May 1990

US Court of Appeal reverses Bankruptcy Inslaw’s complaint against DOJ

July 1991

Lawrence Ng, a Financial Times reporter investigating BCCI and its intelligence in Guatemala, is found shot to death in his hotel bathtub in Guatemala City

August 1991

Investigative journalist, hotel bathtub

November

Attorney General, William Barr, appoints retired federal judge, Nicholas J. Bua as an internal DOJ special counsel to investigate lnslaw Affair

September June 1993

14

1991 1992

an lnslaw Affair figure in Chile is found

and District court decisions and dismisses

Danny Casolaro found dead in his Martinsburg,

House Judiciary Committee issues its investigative appointment of an independent Special Counsel

links

West Virginia

report on Inslaw. Recommends

Judge Bua issues DOJ report, DOJ absolved of any wrongdoing

01993

Elsevier

Science Publishers Ltc

September

Computer

1993

Casolaro’s suicide note, stating that it was found to be in Casolaro’s handwriting. The DOJ report states, “Fingerprint analysis of the bathroom and the pad of paper in which the suicide note was found revealed the prints of Casolaro and no others except for a sing/e print on the bottom of an ash tray’. The existence of Casolaro’s prints, and the absence of others’, supports the conclusion that Casolaro was alone and tend to negate the possibility that someone ‘wiped-down’ the premises.” The presence of another print on an object (ashtray), so close to the hotel memo pad from which the suicide note was supposedly written, is possibly an indication that further investigation should have been carried out. The report also states that, “Subsequent police interviews of those with knowledge of Casolaro’s activities during the two days preceding his death failed to develop any substantial evidence that any other person had the means or opportunity to murder Casolaro”. However, FBI Special Agent Gates knew that Casolaro was in contact with at least one shady underworld figure who also had some kind of connection with the CIA. Casolaro himself had related death threats he had received to his brother just days before his death. The DOJ report also states that, “There were no indications that the personal effects found in the hotel room had been disturbed”. But there remains the mystery of the whereabouts of Casolaro’s briefcase, containing many of his notes, which was missing from the room. The DOJ report is scathing about Judge George Bason, the bankruptcy judge who ruled in Inslaw’s favour and who was fired from his position shortly thereafter. It also questions the ethical motives of lnslaw in suing the DOJ. The report pays scant attention to one of the most serious charges levelled by Inslaw, that the DOJ gave PROMIS to US intelligence agencies and quasi-intelligence companies like Wackenhut, Inc who made an enhanced version of the program (complete with trap door access) available to the national intelligence agencies of other countries. The report concentrates on the somewhat irregular testimony of Michael ’ Author’s

Fraud & Security Bulletin

Riconosciuto, who claims to have had knowledge of illegal PROMIS transfers to Israel while he was doing some contract computer programming work for Wackenhut and the CIA. The DOJ report does not mention how PROMIS allegedly fell into the hands of the intelligence services of some 80 other countries including Syria, Iraq, Iran, China, Chile, Singapore, South Korea and Cyprus. The Bua team deliberately chose not to “conduct an international search of foreign governments and intelligence operatives” based on the testimony of a former Israeli intelligence officer. It is quite possible that PROMIS fell into the hands of other nations’ espionage agencies in much the same way that US arms were sent to Iran by the Reagan administration: a byzantine network of pass-throughs, proprietary firms and intelligence assets that would expose American intelligence links not only with its allies, but unsavoury governments around the world. This was the subject of Casolaro’s planned book which, appropriately, was to be titled, ‘The Octopus File’. Based on the results of the DOJ’s lnslaw investigations, one must wonder how far the ‘Octopus’ tentacles reach into the DOJ and the Federal judiciary.

EVENTS VIRUS BULLETIN CONFERENCE September 9-10, 1993. Location: Amsterdam, The Netherlands. Contact: Petra Diffield, Virus Bulletin, 21 The Quadrant, Abingdon, Oxfordshire, OX1 4 3YS, UK: tel: +44 (0)235 531889; fax: +44 (0)235 559935. 16TH NATIONAL COMPUTER SECURITY CONFERENCE September 20-23, 1993. Location: Baltimore, MD, USA. Contact: Tammie Grice, NCSC Conference Registrar, NIST/PAD, Gaithersburg, MD 20899, USA; tel: +I 301 975 2775; fax: +l 301 948 2067. XVTH INTERNATIONAL CONFERENCE OF DATA PROTECTION AND PRIVACY COMMISSIONERS September 28-30, 1993. Location: Manchester, UK. Contact: John Woulds, Wycliffe House, Water Lane, Wilmslow, SK9 5AF; tel +44 (0)625 535711; fax: +44 (0)625 524510.

italics.

al 993 Elsevier

Science Publishers

Ltd

15