monitoring Trump and relevant contemporary events

Veteran Intelligence Professionals for Sanity (VIPS) is a group of former officers of the United States Intelligence Community. It was formed in January 2003 when the group issued a statement accusing the Bush Administration of misrepresenting U.S. national intelligence information in order to push the US and its allies toward that year's US-led invasion of Iraq. The group issued a letter stating that intelligence analysts were not being heeded by policy makers. The group initially numbered 25, mostly retired analysts.

VIPS followed up with ten further memos throughout 2003 and early 2004, "assessing what the Bush Administration knew about Iraq before, during, and after the war, and how that intelligence has been used–and misused." After the CIA chief weapons inspector David Kay in 2004 announced no stockpiles of weapons of mass destruction could be found in Iraq, Michael W. Robbins opined in the magazine Mother Jones that VIPS "produced some of the most credible, and critical, analyses of the Bush Administration's handling of intelligence data in the run-up to the March 2003 invasion of Iraq."

You left out some of the wiki article you cited, eh, Walt?

Well, thank you so much for bringing another conspiracy theory. ...

layman wrote:

Quote:

As I have posted before, a group comprised of a good number of former government cyber and security experts has concluded that the DNC emails could not possibly have been stolen over the internet. That had to have been downloaded by an insider.

They were not "hacked," they were "leaked."

That post was for you, Rev.

This is a disturbing, quite unpopular fact among most people here.

“The author of the report didn’t consider a number of scenarios and breezed right past others. It completely ignores all the evidence that contradicts its claims.”

TOP-SECRET SNOWDEN DOCUMENT REVEALS WHAT THE NSA KNEW ABOUT PREVIOUS RUSSIAN HACKING

TO DATE, THE only public evidence that the Russian government was responsible for hacks of the DNC and key Democratic figures has been circumstantial and far short of conclusive, courtesy of private research firms with a financial stake in such claims. Multiple federal agencies now claim certainty about the Kremlin connection, but they have yet to make public the basis for their beliefs.

Now, a never-before-published top-secret document provided by whistleblower Edward Snowden suggests the NSA has a way of collecting evidence of Russian hacks, because the agency tracked a similar hack before in the case of a prominent Russian journalist, who was also a U.S. citizen.

What’s particularly interesting here is the provenance of NSA’s claims: The section is classified TS/SI, meaning Top Secret Signals Intelligence, the interception of signals (broadly construed) as they pass from one point to another, including anything from tapped phone calls to monitored internet traffic. Thanks to the Snowden revelations, we know there are many powerful, overlapping government spy programs that could allow the NSA to observe communications as they unfold.

NSA whistleblowers have so far given the best idea of what the NSA’s signals intelligence on Russia, today or in 2005, could look like. Earlier this year, Snowden tweeted that if the Russian government was indeed behind the hacking of the Democrats, the NSA most likely has the goods, noting that XKEYSCORE, a sort of global SIGINT search engine, “makes following exfiltrated data easy. I did this personally against Chinese ops.” Snowden went so far as to say that nailing down this sort of SIGINT hacker attribution “is the only case in which mass surveillance has actually proven effective.”

Unfortunately, in the case of this wiki there’s no indication of exactly what sort of SIGINT was collected with regard to Politkovskaya, or how it incriminated Russian intelligence — all we have is the allusion to the evidence, not the evidence. The NSA declined to comment.

Too much of what’s been passed off to the public as proof of Kremlin involvement is based on vague clues and educated guesses of what took place. Signals intelligence could bridge the empirical gap.

The ex-U.S. intelligence personnel who comprise the group Veteran Intelligence Professionals for Sanity, including fellow high-profile NSA whistleblower William Binney, echoed Snowden’s assessment earlier this month:

"The bottom line is that the NSA would know where and how any “hacked” emails from the DNC, HRC or any other servers were routed through the network. This process can sometimes require a closer look into the routing to sort out intermediate clients, but in the end sender and recipient can be traced across the network."

We know intelligence is being gathered on a fine enough level to pin the breach of a single inbox on the Russian government. If the NSA could use signals intelligence to track a specific hack of an American email account in 2005, it’s not too much to assume that, 10 years later, the agency possesses the same or better capability. And signals intelligence is the type of evidence that the American people are owed from the federal government today, as we contemplate a possible confrontation with Russia for interfering in our most important of democratic processes.

1. It wasn't that the rate is over a certain speed that's the important thing here, it's that the speed matched with what USB2.0 transfer rates were, when tested, using the exact same files (from Guccifer 2.0's archive). Uchill fails to mention this at all.

2. This excludes the FAT filesystem anomalies observed that are a part of the basis for the conclusion.

3. This excludes the timezone information that is also part of the basis for the conclusion.

But, said Barger and other experts, that overlooks the possibility the files were copied multiple times before being released, something that may be more probable than not in a bureaucracy like Russian intelligence.
Forensicator refers to multiple copying operations and doesn't rule out the possibility of files being transferred prior to the earliest dates observed. The assumption made here is not made in Forensicator's work. This response from Rich Barger (director of security research at Splunk) also includes a needless and highly speculative statement trying to link things back to Russian intelligence without any basis.

"A hacker might have downloaded it to one computer, then shared it by USB to an air gapped [off the internet] network for translation, then copied by a different person for analysis, then brought a new USB to an entirely different air gapped computer to determine a strategy all before it was packaged for Guccifer 2.0 to leak," said Barger.

Wow, so, lots of stuff we've no indication of and a convoluted sequence of events is this security expert's rebuttal? This is the sort of thing we see on social media frequently so I think I should make something clear:

Forensicator analyzed, made observations and gave the most probable explanations based on those observations. It is NOT incumbent on him to disprove convoluted and unsubstantiated theories people can imagine in order to demonstrate that his findings are the most probable.

If Barger sees anything that indicates an alternate theory is more probable, he's welcome to contribute his evidence/observations and a counter-argument to help improve everyone's understanding here.

Hultquist said the date that Forensicator believes that the files were downloaded, based on the metadata, is almost definitely not the date the files were removed from the DNC.

That's not the point, the point is that the files were still being moved around, apparently by USB device in the Eastern timezone as late as September 2016. This basically tells us Guccifer 2.0 was highly unlikely to be someone in Russia pretending to be a Romanian (as is what we have been told repeatedly over the last year).

Even if there were no other scenarios that would create the same metadata, experts note that metadata is among the easiest pieces of forensic evidence to falsify.

That's funny because many 'experts' were easily duped by fabricated Russian fingerprints that I personally had a hand in helping to expose and explained to others how they could check and verify this for themselves.

Shouldn't it be us lecturing your 'experts' about metadata integrity here?

In Forensicator's case, we are talking about relative time differences between file modification timestamps, this is something that would rarely be noticed even by cybersecurity experts and so it is an unlikely candidate for forging metadata. Altering timezones, etc. would also have made no impact on the outcome of the transfer speed analysis.

The work presented on both Forensicator's and my site, demonstrate far greater consideration given to the integrity of metadata than I've seen in any of the work that preceded our efforts.

It would be far more difficult to fabricate other evidence pointing to Russia, including the malware only known to be used by the suspected Russian hackers, and internet and email addresses seen in previous attacks by that group.

This is where the debunking of Guccifer 2.0 takes a back seat so that they can argue that the research fails to entirely disprove that the DNC was hacked, pointing to the malware discovered and other things that are unrelated to Guccifer 2.0.

It's also interesting to see a claim that the malware discovered was "only known to be used by the suspected Russian hackers" when it's been shown that at least some of the malware attributed to Russian hackers actually has Ukrainian origins, was dated and has been used by other malicious entities online.

Forensicator's claim that 20 to 25 megabyte per second downloads would be impossible over the internet also raised eyebrows.

I'm not surprised, that wasn't his actual claim and is a misrepresentation of it, which makes subsequent statements from John Bambenek (of Fidelis) become irrelevant.

In the end, Fidelis, FireEye, SecureWorks, Threat Connect and other CrowdStrike competitors all confirmed Crowdstike's results.

I don't see them concluding that the Trump Opposition Research was 'targeted' and if any have concluded Guccifer 2.0 was a GRU/FSB associate, they're demonstrably wrong as verifiable evidence shows a framing effort that GRU/FSB and associates would never engage in.

The intelligence community, including the CIA, FBI and NSA, also claims to have evidence the attacks were coordinated by Moscow, though they have not released their evidence to the public.

So we're seeing both logical fallacies in quick succession, the "appeal-to-authority" and just before it, the "band-wagon" - both used against readers when the actual research Forensicator and I have done and the things we have discovered all came AFTER those assessments were made.

"I find it interesting that people are so eager to believe that Dmitri Alperovitch is biased, but willing to accept the forensics of an anonymous blogger, with no reputation, that no one knows anything about," said Hultquist.

I find it interesting that Hultquist is defending Dmitri considering Dmitri's public track record of blaming things on Russian hacking, often providing little more than speculation to support his assertions.

"When this many brands agree on something, come together to provide several different aspects of the attack, sometimes it's true."

And sometimes, they're wrong and their collective wrongness becomes the basis of the bandwagon logical fallacy.

The man is in custody. Time to shut up and wait for the facts.

How about you shut up when it happens to you.

@mavolvo,

http://g-2.space/distortions/

Quote:

Forensicator analyzed, made observations and gave the most probable explanations based on those observations. If Barger sees anything that indicates an alternate theory is more probable, he's welcome to contribute his evidence/observations and a counter-argument to help improve everyone's understanding here. It is NOT incumbent on him to disprove convoluted and unsubstantiated theories people can imagine in order to demonstrate that his findings are the most probable.

coldjoint wrote:

The man is in custody. Time to shut up and wait for the facts.

Quote:

How about you shut up when it happens to you.

I said the man is in custody. If you want to describe what happens after a crime, go for it. It has nothing to do with the crime. It has to do with procedure.