Cyberwar (2016) s01e08 Episode Script

1 BEN: Leaked documents revealed the scope of the NSA's mass surveillance program.
We cannot prevent terrorist attacks or cyber threats without some capability to penetrate digital communications.
Others unmasked a unit called Tailored Access Operations.
I don't need mass surveillance.
I need you to break into that guy's computer.
Their mission is to get the ungettable.
If you want to hack into systems lawfully, the only game in town is the government.
But their targets are secret.
They are very important at actually tracking down people who are then subsequently killed.
And there's almost nothing they can't hack.
The National Security Agency is one of the world's largest intelligence agencies.
Headquartered in Fort Meade, Maryland, the NSA's mandate is to collect foreign intelligence.
After 9/11, George W.
Bush authorized the NSA to collect even more, including American communications to and from foreign targets.
(Cameras snapping) Good morning.
This is a highly classified program that is crucial to our national security.
This program shocked an NSA senior executive named Thomas Drake.
Drake is a decorated veteran who blew the whistle on NSA's activities to the press.
He barely escaped 35 years in jail after being charged under the Espionage Act, a law first written in 1917.
- Mr.
Drake? - Hi.
- I'm Ben.
- Nice to meet you.
The National Security Agency is focused on foreign intelligence.
It was formed in 1952.
People don't realize it was not formed by an act of Congress.
It was literally signed into existence by the stroke of a secret presidential pen.
In fact, the joke was it was "No Such Agency" or "Never Say Anything".
You never even referenced the actual name.
People who used to work there, "Oh, I work at DOD.
" Now, accelerate forward.
Internet explodes.
You have this rapid transition from analog to digital, and the explosion of data became exponential.
What do you think is the easiest way to deal with it? Just suck it all.
But what happened after 9/11? Was it the NSA should do better? Here's where you have culture in secret meeting itself; realizing it had failed but can't admit it failed.
It had not prevented the next Pearl Harbor.
And now, NSA is literally unleashed.
It's unleashed on an extraordinary scale, a scale we have never seen in US history or the world.
All means necessary to confront the threat.
Who cares about the Constitution? Who cares about law? Who cares about the rights of US persons? Hey, if you've done nothing wrong - I even heard this - then it shouldn't matter.
And the mantra was: just get the data.
Collect it all so we can know it all.
Collect it all so we can know it all.
Drake inspired another NSA worker to sound the alarm.
RADIO: This afternoon, The Guardian newspapers revealed the name of their source.
BEN: In 2013, Edward Snowden leaked tens of thousands of classified NSA documents.
The first to get published was a secret court order forcing Verizon to fork over the call data of millions of US customers.
The next big leak was a PowerPoint presentation about a program called Prism.
The NSA boasted that Prism gave them direct access to emails, video chats and more from some of America's biggest tech companies.
The media was obsessed with Snowden and the leaks, but few people noticed information hidden in the documents about a top secret NSA unit called TAO, or Tailored Access Operations, until the German magazine Der Spiegel revealed more about it than ever before.
Jorg Schindler is the magazine's award-winning national security reporter.
You can call them the highly skilled plumbers of the NSA who are able to get into every sort of pipe.
What they are doing is getting the ungettable.
They're like the special forces of the NSA essentially.
Yeah, a special hacker force.
I mean, the whole NSA is a special force, but those are the highly skilled handymen who create certain kinds of tools to infiltrate, manipulate and sabotage every kind of digital device you might think of.
What's the relationship between Tailored Access Operations by the NSA and their mass surveillance? I mean, to explain it easily, I would say that mass surveillance is like going into the ocean with a huge fishing net and to draw everything out, whatever you find.
And what the Tailored Access Operation units are doing is like using the harpoon to find the special targets and the fishes they really need.
So that might be the difference.
So it's like going hand in hand.
And TAO's pretty good at it.
They're extremely good at it, yes.
(Laughing) The Snowden leaks revealed details about Tailored Access Operations, but a lot is still unknown.
I wanted to talk to someone who knows the NSA from the inside: an Air Force veteran and former NSA exec named John Harbaugh.
- I'm John Harbaugh.
- Nice to meet you, John.
Please, come in.
Let's see this place.
- "root9B".
- Yeah.
(Laughing) Why that name, by the way? So "root" is system level access.
"9B" is hexadecimal for 9/11.
Ah.
So it's a nod to the fact that the next 9/11 event is most likely gonna be cyber-related.
root9B, which has defense contracts, aims to hunt and pursue adversaries inside a client's network.
This is where we do all of our Hunt Operations, what we call it for our clients.
So what this is showing you is what the operator sees while they're doing their op, right? So there'll be windows of time where they're actually active inside the client's network pursuing the adversary.
And this was really driven by our experiences in the government space.
Does it look like this in Fort Meade? This is better.
(Laughing) In your bio, it says something like you were the director of a super elite cyber operation unit.
So basically what that's about is what we've tried to recreate here.
So my time inside the organization, I had the pleasure and the fortune to be asked to run a team of about 8 individuals, and that team was focused on the most challenging problems in cyber.
Was that Tailored Access Operations? So you know, there is elements of that space, right? 'Cause if you're in cyber and you do all of cyber, then you're doing all of those types of things.
And so the bosses could come in and say, "We have a significant national event.
I need you guys to be able to do this in the next 12 hours.
" I could walk into that space and say, "Hey guys, I need 5 minutes.
" I would give them what we would call the op order.
"This is what we need to achieve, we need to achieve it in the next 12, 24, 48 hours," and I could walk away.
And I knew when I came back, no matter what time of day, how long they were working on it, they would get it done.
And it was that kind of Again, it was that kind of Teamwork? teamwork that really drew people.
And it's a very similar thing to the Special Ops community.
It does sound like a military chain of command.
Yeah, I mean, NSA is a very military organization.
To build a team like TAO, the NSA has to hire highly skilled hackers.
So how does it head hunt them? To find out, I ask Chris Soghoian.
He's a privacy activist with the American Civil Liberties Union.
Who are they, and where's the NSA recruiting them from? The government wants people who can get us security clearance, more so than ever.
Particularly after Snowden and after Chelsea Manning, they want people who they know are gonna play by the rules.
They want people who cannot be easily blackmailed.
So I think NSA tries to recruit the best and brightest from computer science programs around the country, and in particular computer security programs.
like Carnegie Mellon, that have probably the most sophisticated offensive cybersecurity programs in academia in the United States, and their students are heavily recruited both by NSA, but also by Silicon Valley.
They're competing for the same people? So they're competing for the same people, and the problem that NSA has is they can't pay the same kind of money, right? They're not gonna be able to offer the smoothies and massages and sort of perks of life that Google and Facebook can.
But they have something that those companies don't.
What they have is a monopoly on violence, right? In the same way that if you wanna like repel out of helicopters and shoot people in the head, you go join the Special Forces.
If you wanna hack into systems lawfully, the only game in town is the government.
In many other walks of life, you would be you would be a criminal, you would be a stalker, you'd be a bad person.
But when you go to NSA, suddenly you get to wrap yourself in the flag and do it for king and country.
If TAO can legally do things no one else can, who are they hacking, and why? BEN: Not much is known about who Tailored Access Operations hacks, but the Snowden Leaks revealed one major target: Osama bin Laden.
TAO hacked into the mobile phones of Al Qaeda operatives in the hunt for bin Laden, as reported by The Washington Post.
The unit's work also led to the capture of 40 insurgents in Afghanistan.
Ryan Gallagher is an investigative reporter at The Intercept, where he has covered the role of surveillance in the ongoing war on terror.
How did TAO and how does TAO fit into the War on Terror? Well, they're very important.
I mean, people don't necessarily think of surveillance even as a thing being integral to what the military is doing on the ground, but it is.
It's absolutely vital.
What the Tailored Access guys are doing for instance is, because they're so skilled at actually breaking into systems and going after what they would refer to as hard targets, people who are elusive or skilled at dodging surveillance, they are very important at actually tracking down people who are then subsequently killed or captured, in past years probably rendered in through the Black Sites program that was going on through the Bush Administration.
So they're very entwined with these physical, kind of kinetic, they call it, operations on the ground.
So are they basically the commandos of the NSA? You could put it like that, yeah.
I mean, it's maybe sort of glorifying them a little bit.
But I mean, essentially these guys are just like geeky nerds, but they do kind of do that sort of commando-type role.
They're facilitating military operations on the ground by hacking into targets.
They are actually directly able to track people who are then killed in say a drone strike.
So what they do, yeah, it is kind of commando work, but they are also providing assistance on the ground to real commando types who are out there trying to kill people.
In the hunt for bin Laden, TAO reportedly used what the unit calls "implants", spy devices installed in mobile phones or other hardware.
Implants are just some of the tools that appear in a leaked document called the ANT Catalog, which lists other spy gear at TAO's disposal.
Security researchers Michael Ossmann, Joe FitzPatrick and Dean Pierce decided to build some of these spy tools themselves.
The media kinda saw it and reported on bits and pieces of it and said, "Oh, look at this thing! This is magic!" And I think all of us looked at it and said, "Oh, yeah, I know how to do that.
Yeah, I know how to do that.
" Joe recreated a graphics card that can see what's running on a computer's active memory, and Dean rigged a phone so it picks up the mobile traffic in the area.
Mike reproduced Ragemaster, a tiny chip implanted in a computer video cable to reflect information via radar.
When this is installed, I can point one antenna at it, and that's transmitting a signal.
And then my other antenna's also pointed at it, and it's receiving a reflection.
By measuring that reflection, I can, on my laptop, recover information that's going over the cable.
And what I get is a video image, a screen image from the target computer system.
And this is an example of something where an implant is required.
Getting an implant into a piece of hardware, like a video cable, requires physical access.
But planting bugs into terrorists' cell phones isn't the only thing TAO does.
Some of their activity has jeopardized internet security at large.
One Snowden leak shows how TAO found a vulnerability a software bug - in Mozilla Firefox.
TAO used the bug to try to identify some users also running an anonymizing software called Tor.
Not only did TAO need to be able to monitor and hijack internet traffic to pull of its attack, but hundreds of millions of Firefox users were left vulnerable to the software bug, which has since been patched.
- Claudio.
- Hey, man.
Hacker Claudio Guarnieri has helped expose TAO's activities.
I met him in an old Stasi surveillance tower that still stands in what used to be Soviet-controlled East Berlin.
A lot of the mass surveillance and bulk collection capability of the NSA is empowered by some of the break-ins that TAO is able to do.
For example, they would ask TAO to break into some core parts of the internet infrastructure, of the whole global backbone.
You know, from an internet structure perspective, when you connect from Germany to Google, you move through a number of hubs, 10, 15 nodes that relay your message from Berlin to, you know, Hamburg and Frankfurt, and then to who knows, Netherlands, wherever the cables are.
If the NSA is able to break into any one of these points, then they're able to see you communicating with Google.
When they're able to observe that, they're also able to hijack it.
So pretend like you're getting a response from Google, while instead you're getting a response from the NSA.
None of this comes cheap.
Claudio and I went inside to look through a Snowden leak known as the Black Budget.
The NSA spends more than $600 million a year for just the kind of offensive hacks TAO conducts.
Yeah, this is what it's being called the Black Budget.
And the trend that we see is that again, the balance between how much is invested in breaking things and how much is invested in protecting things is uneven.
You know, part of the mandate of intelligence services is to keep the country secure.
At the same time, from a technological perspective, they're undermining the security of the country.
And like you said, we all use the exact same internet.
Once it's broken for one, it's broken for all.
So the question is: is it worth it to break something and keep it broken for catching one or two terrorists that you probably could catch otherwise? Breaking into the internet or hacking into phones might make us all less secure.
So is TAO's hacking really all that targeted? BEN: To find out more about who TAO targets, I met up with Robert M.
Lee.
He'd been out of the military for only a week.
He was an Air Force cyber officer and also worked for an intelligence agency; he confirm or deny that's the NSA.
- Prost.
- Cheers.
(Chattering) How did you get into being a hacker? So, the Air Force has a wonderful program where it volunteers you to do shit.
And I joined the Air Force, said, "Here I am, Lord.
What would you like me to do?" And they said, "Go be a cyber guy.
" So if you were to take Snowden's slides completely seriously, you'd think that it's all mass surveillance.
I actually for the first time ended up seeing slides that I had actually seen before in real life.
I was like holy shit, like I've seen these ones! But once you bring something into the intelligence community, you don't delete files, like everything is stored.
And so there were some files that like get translated out, like their truth, and they were just remnants of product pitches or something like that.
And so I think that you can't take all the slides seriously.
We also know that there is something called TAO in the NSA.
What is that team? Like what are they doing? Yeah, so I think when you look at TAO, that's actually the thing that I think most of the community should be cool with, right? So I'm actually a huge privacy advocate.
And ironically enough, I hate the idea of any sort of mass surveillance.
From a perspective of TAO or whoever would be breaking into those networks, that's targeted, retained intelligence.
And so privacy activists should actually enjoy that.
They should say, "Hey, mass surveillance sucks.
We need more targeted surveillance, we need more" If you're gonna do intelligence, do the kind that you put resources into and have to think about, and have to prioritize your own efforts so it's not gonna be some dissident or accidentally picking up somebody else's communications.
So who are TAO's targets? I don't know exactly their targets, right? And I wouldn't be able to speak on it anyway, but I would say that it would be asinine to assume that anything in our national policy of interest isn't one of their targets, right? So if we say if the president says global terrorism is something we're concerned with, well, then TAO's not doing their job, like the government's not doing their job if they don't go after it.
Anything that the president wakes up in the morning and says, "Hey, this is important to me," anybody in the government who's not supporting his needs is not doing their job.
So I would, just off virtue of that, say that TAO has to be doing that stuff, or they're incompetent and they're wasting taxpayer money.
So you can't have it both ways.
Rob made a pretty convincing case for the so-called targeted surveillance TAO conducts, but investigative reporter Ryan Gallagher disagrees.
He says the problem is that unit's methods aren't as targeted as they seem.
TAO is doing some of the most aggressive work that NSA does.
The traditional eavesdropping where they're listening in on a phone call just by like wiretapping a cable, which they call kind of passive surveillance, that's actually becoming almost secondary now to the active surveillance they call it, which is attacking and hacking systems.
And part of the reason for that is because, increasingly, networks and technologies adopting encryption, and so they can't listen to it by just tapping the queue because then you can't read it or listen to it.
It's just, you know, jargon.
Going forward, especially with this sort of boom in encryption, you're gonna see more and more of these hacking attacks to the point that there may come a stage in the future where it's described as a mass surveillance kind of technique.
TAO's hacking skills may be in higher demand than ever before.
And while the group goes after terrorists, that's not all they do.
BEN: How does TAO decide who to target? And are they really legitimate threats? The elite unit has gone after al-Qaeda and Taliban fighters, but the Snowden leaks also revealed the group hacked into the president of Mexico's emails.
And workers at a Belgian telecommunications company were spied on by the British, possibly with help from TAO.
Generally there is a consensus that mass surveillance is a bad thing, while targeted surveillance is tolerable because they go after very specific individuals or very specific groups.
However, there is multiple things that you need to consider.
One is: what makes a legitimate target? You know, ultimately the NSA only has to respond to somehow to the US government.
But they have no respect whatsoever towards foreigners.
And so we have cases where they spied on UNICEF, they spied on foreign ministries, they spied on private companies, energy companies, you know.
So what, at that point, makes it legitimate to hack directly and target a certain organization? We don't know.
One of the Snowden documents that came out about the Tailored Access group is one of the guys from within the unit is saying, "Look, we don't just do terrorism, we do everything.
We do all operations, we're here to support any operations.
" I think it's one of the common misconceptions that the government has managed to build up around a lot of these revelations.
So it's like, "Don't worry about it, we're only going after these extreme terrorists, people who are, you know We're just trying to protect you," and all that.
But that's kind of disingenuous because that's not at all just what they're doing.
They're doing a lot more than that.
Ultimately, it seems TAO may be just one more tool in the NSA's mass surveillance arsenal.
What happens in a mass surveillance regime, you sweep up essentially everybody.
Everybody by definition becomes a target, which means there's no target.
The problem is that when you do this in secret and you protect your secret powers, this usually doesn't end well in terms of history.
It just doesn't.
You know, in 1984, the extraordinary George Orwell novel, the only place Winston the only place he could go to, out of sight, was in the corner, because that's where the surveillance cameras couldn't reach.
Which meant what? They knew where he was.
And remember, people forget even in 1984, he didn't prevail.
He basically cried uncle.
If you can't fight them, you can't beat them, join them.
So you're a whistleblower, you cried uncle to some extent, or you cried out.
Do you think it was worth it? Yeah.
History was at stake.
We know the NSA's elite hacking unit has helped capture terrorists, but they've also targeted friendly nation states.
So who else have they gone after? For now, much of TAO's work remains shrouded in secrecy.
But privacy activists, whistleblowers and others aren't giving up on the fight to know more, and to live surveillance free.