Tag Archives: Government Surveillance

Military Kills Recruiting Contracts for Hundreds of Immigrant Recruits

Standard

Thirty-seven service members from 22 different countries take the Oath of Allegiance during a naturalization ceremony held at Bagram Air Field, Afghanistan on July 4, 2013. (Army/Sgt. Anita VanderMolen)  

“WASHINGTON POST”

“Many of these enlistees have waited years to join a troubled recruitment program designed to attract highly skilled immigrants into the service in exchange for fast-track citizenship.

U.S. Army recruiters have abruptly canceled enlistment contracts for hundreds of foreign-born military recruits since last week, upending their lives and potentially exposing many to deportation, according to several affected recruits and former military officials familiar with their situation.

Now recruits and experts say that recruiters are shedding their contracts to free themselves from an onerous enlistment process, which includes extensive background investigations, to focus on individuals who can more quickly enlist and thus satisfy strict recruitment targets.

Margaret Stock, a retired Army officer who led creation of the immigration recruitment program, told The Washington Post that she has received dozens of frantic messages from recruits this week, with many more reporting similar action in Facebook groups. She said hundreds could be affected.

“It’s a dumpster fire ruining people’s lives. The magnitude of incompetence is beyond belief,” she said. “We have a war going on. We need these people.”

The nationwide disruption comes at a time when President Trump navigates a political minefield, working with Democrats on the fate of “dreamers” — undocumented immigrants brought to the country as children — while continuing to stoke his anti-immigrant base. It was not immediately clear whether Pentagon officials have taken hard-line immigration stances from the White House as a signal to ramp down support for its foreign-born recruitment program.

Stock said a recruiter told her there was pressure from the recruiting command to release foreign-born recruits, with one directive suggesting they had until Sept. 14 to cut them loose without counting against their recruiting targets, an accounting quirk known as “loss forgiveness.”

The recruiter told Stock that the Army Reserve is struggling to meet its numbers before the fiscal year closes Sept. 30 and that canceling on resource-intensive recruits is attractive to some recruiters, she said.

On Friday, the Pentagon denied ordering a mass cancellation of immigrant recruit contracts and said there were no incentives to do so. Officials said that recent directives to recruiters were meant to reiterate that immigrant recruits must be separated within two years of enlistment unless they “opt in” for an additional year.

But some recruits among half a dozen interviewed for this article said they were not approaching that two-year limit when their contracts were canceled, sowing confusion about the reason they were cut loose. The Pentagon declined to address whether messages to recruiters contained language that could have been misinterpreted.

Lola Mamadzhanova, who immigrated to the United States from Kyrgyzstan in 2009, said she heard that Army recruiters in Evanston, Ill., texted immigrant recruits last week asking whether they still wanted to enlist, with an unusual condition: They had 10 minutes to respond. She never received the text message.

“The recruiters did some dirty trick just to get me out so I won’t be trouble anymore,” Mamadzhanova, 27, told The Post on Thursday. Her active-duty contract was canceled Sept. 7, according to a separation document obtained by The Post that said she “declined to enlist.” She later learned the recruiters used a wrong number to text her.

The senior recruiter at Mamadzhanova’s station contacted by The Post declined to comment and called Mamadzhanova seven minutes afterward to reverse previous guidance, saying her unlawful immigration status was the reason she was released. She enlisted in December 2015, which puts her three months outside the two-year limit.

Mamadzhanova was assured by other recruiters that her status would not be an issue and that she would ship for training soon after her immigration status slipped, around her enlistment date. Mamadzhanova, who is fluent in Russian, said the shifting and unclear rules have blindsided her.

“Joining the Army was a dream of mine since America has treated me so well,” she said. She applied for asylum in April, joining other recruits who have sought asylum or fled.

Some anti-immigration sentiment has swirled in the Pentagon for years, former staffers have said, with personnel and security officials from the Obama administration larding the immigrant recruiting process with additional security checks for visa holders already vetted by the Departments of State and Homeland Security.

“Immigrant recruits are already screened far more than any other recruits we have,” Naomi Verdugo, a former senior recruiting official for the Army at the Pentagon, told The Post.

“It seems like overkill, but there seems to be a sense that no matter what background check you do, it’s never enough,” she said. Verdugo, along with Stock, helped implement the recruitment program.

One Indian immigrant, a Harvard graduate and early recruit who is now a Special Forces soldier, was called back to undertake the updated security checks, she said.

“Even though you’re in the Army, even though you’re naturalized, these policies say ‘we’re not going to treat you like any other soldier,’” Verdugo said of the concerns over immigrants held by some at the Pentagon.

Internal Pentagon documents obtained by The Post have said the immigrant recruitment program, formally known as the Military Accessions Vital to National Interest (MAVNI) program, was suspended last fall after the clearance process was paralyzed and officials voiced concern over foreign infiltrators, though it remains unclear whether any threats have ever materialized.

Experts say the relatively small number of recruits in the MAVNI program possess skills with outsize value, such as foreign languages highly sought by Special Operations Command. The program has rotated 10,400 troops into the military, mostly the Army, since its inception in 2009.

Although the military says it benefits from these recruits, they can generate a disproportionate amount of work for recruiters who must navigate regulations and shifting policies. The layered security checks can add months or years to the enlistment process, frustrating recruiters who must meet strictly enforced goals by quickly processing recruits.

In a summer memo, the Pentagon listed 2,400 foreign recruits with signed contracts who are drilling in reserve units but have not been naturalized and have not gone to basic training. About 1,600 others are waiting to clear background checks before active duty service, the Pentagon said.

The document acknowledges 1,000 of those troops waited so long that they are no longer in legal status and could be exposed to deportation. That number probably has climbed since the memo was drafted in May or June. Lawmakers have asked Trump and Defense Secretary Jim Mattis to intervene on behalf of those recruits.

Sens. Kamala D. Harris (D-Calif.) and Richard J. Durbin (D-Ill.) filed an amendment in the defense authorization bill Tuesday to retain MAVNI recruits until their lengthy background investigations are finished.

“These brave men & women enlisted & the Administration turns its back on them,” Harris tweeted Friday. “We must pass Sen. Durbin’s & my bill to protect these recruits.”

During July 19 testimony in a lawsuit filed by recruits who said the federal government unlawfully delayed their naturalizations, Justice Department attorney Colin Kisor assured a district court in Washington that recruits would see their contracts canceled only if “derogatory” information was found in extensive background investigations.

Mamadzhanova and others said their screenings, which take months to complete, have begun recently and could not have returned results.

Meanwhile, confusion reigned for recruits in multiple states.

At one office in Illinois, a senior recruiter restored a contract less than two hours after The Post inquired about a case. In Texas, a recruiter did the same 12 minutes after a call seeking to confirm whether a recruit’s contract was canceled.

An immigrant recruit who came to the United States in 2006 and enlisted in Virginia said her contract was canceled Tuesday after she had waited for two years, just as her legal immigration status expired. She asked to opt-in for another year, but her contract was dissolved days later, she said.

Recruiters had assured her, saying her contract was a shield from federal immigration authorities, she said. She spoke on the condition of anonymity for fear of retribution.

She now fears deportation to her native Indonesia, which strips native-born people of citizenship if they enlist in a foreign military or pledge loyalty to another country, as she has done.

“I feel devastated,” she said. “The Army was my only hope.”

Advertisements

Letting Government Contractors Pick Their Own Auditors is a Bad Idea

Standard
Hand in Jar istockphoto by Getty

Image: istock photo by Getty

“THE PROJECT ON GOVERNMENT OVERSIGHT”

“The law in question is the 2017 National Defense Authorization Act (NDAA) passed late last year.

When it comes to contract auditing, giving audit responsibilities to a company working directly for a contractor hampers the government’s ability to negotiate good deals for taxpayers.

Section 820 of the law states that “contractors with the Department of Defense may present, and the Defense Contract Audit Agency shall accept without performing additional audits, a summary of audit findings prepared by a commercial auditor” of contractors’ indirect costs (with some exceptions). This section is scheduled to go into effect on October 1, 2018.

Last year, in annual legislation setting defense policy, Congress gave military contractors the authority to hire their own auditors to review the bills those contractors send to the government. For decades, the Pentagon’s own Defense Contract Audit Agency (DCAA) has helped government contracting officials negotiate better deals by examining a contractor’s charges. But last year’s legislation, which goes into effect next year, diminishes the DCAA’s oversight authority to the detriment of taxpayers.

The topic was broached in an important, but under-the-radar Congressional oversight hearing in April.

Most of the hearing centered on the cost of government versus private auditors, with two conflicting tales being told. But a bigger issue went largely unaddressed: whether allowing contractors to pick their own auditors creates inherent conflicts of interest since the auditors would be in the position of serving contractors—their client—rather than taxpayers. There is a reasonable fear that these private sector auditors, in an effort to keep their client happy and win repeat business, would be reluctant to disclose to the government that the contractor is overcharging taxpayers.

New legislation pending before Congress would rescind Section 820, but it would also allow “contractors to engage commercial auditors to perform incurred cost audits,” according to a Department of Defense (DoD) analysis. The analysis also states that the new provision creates “several unintended consequences that will negatively impact the Department and industry.” The DoD opposes both Section 820 and the new Congressional language. The DoD’s proposed alternative keeps the power to conduct these audits in DCAA’s hands with an option allowing the government (rather than the contractors) to hire private sector auditors on a case-by-case basis. After analyzing the issue, POGO supports the Department’s proposed alternative.

DCAA’s Role

DCAA is responsible for auditing the financial side of certain defense contracts to “ensure that warfighters get what they need at fair and reasonable prices,” according to  its website. DCAA looks for whether contractor costs are “allowable, allocable, and reasonable,” and it performs other audits to ensure contractors have adequate business and accounting systems and adhere to federal cost and accounting principles. DCAA’s report for fiscal year 2016 notes that it audited $287 billion in contract costs that year. These audits are not usually intended to uncover fraud, although DCAA sometimes finds indicators of criminal activity and participates in law enforcement investigations.

What Are “Indirect Costs” and Why Do They Matter?

Contractors charge the government for two types of costs: direct costs that specifically relate to the contract, such as labor and materials, and indirect costs that exist apart from specific work on the contract, such as the rent a contractor pays for its office or fringe benefits for employees.

But there’s nothing fringe about these costs. Within incurred cost audits, indirect costs make up the majority of all questioned costs, according to DCAA Director Anita Bales. Because they are less clear-cut than direct audits, audits of indirect costs can be contentious—especially when auditors want more access to contractor information than the contractor is willing to provide—and quite technical. For instance, contractors are allowed to charge the government for indirect costs associated with litigation under some circumstances, but not in other situations. Contractors can easily pad their profits at taxpayers’ expense if these costs are not carefully examined.

An example of indirect cost overbilling made the news in February 2016 when the Justice Department announced that Centerra Services International (formerly known as Wackenhut Services LLC) agreed to pay $7.4 million to resolve a whistleblower lawsuit alleging the company had defrauded taxpayers. According to the Justice Department, Centerra double billed its labor costs while providing firefighting services on a military base in Iraq. The government alleged Centerra “inflated its labor costs by billing the salaries of certain managers as direct costs under the subcontract, when those salaries had already been charged as indirect costs.”

The Centerra case isn’t a one-off. In 2015, a DCAA audit questioned $14.6 million in costs that a contractor charged the government, according to a DoD Inspector General report to Congress. The vast majority—$14 million—involved wrongly billed indirect costs.

Lessons from the Recent Past

We don’t have to look very far back in history to see that allowing profit-motivated companies to hire their own profit-motivated auditors can lead to problems.

The Enron scandal showed that accountants and auditors aren’t immune from conflicts of interest. “Obviously the history of Enron and the financial crisis suggest we have to be very careful in this situation,” Representative Seth Moulton (D-MA), Ranking Member of the House Armed Services Oversight and Investigations Subcommittee said during his opening statement at the April hearing. Arthur Andersen, Enron’s auditor, had conflicts of interest. It was simultaneously employed as internal and external auditor, meaning that the supposedly independent external auditor could cover up the inaccuracies of the internal audit team.

More recently, during the fallout of the Great Recession, the government required banks to conduct mortgage foreclosure reviews. Banks were allowed to hire for those reviews their own “independent consultants” who proved to be not so independent. The New York Department of Financial Services (NYDFS) punished several of these consultants, including Promontory Financial Group, Deloitte, and PricewaterhouseCoopers, for “misconduct, violations of law, and lack of autonomy.” Settlements generally included multi-million dollar fines and temporary bans from consulting.

“A consultant’s allegiance too often goes to the client that pays the bills,” former NYDFS General Counsel Daniel Alter wrote in a 2015 piece for American Banker. Laws like Sarbanes-Oxley, which create criminal liability for misrepresenting financial statements, have helped to prevent future Enrons by balancing that pressure. However, criminal liability doesn’t apply to other types of financial reporting, such as the consulting work done in the aftermath of the housing crisis and the proposed contract audits.

Counting the Costs  

At the April Congressional hearing, DCAA Director Anita Bales testified that third-party auditors would cost an estimated 30 percent more than DCAA auditors. David Berteau, President and CEO of the Professional Services Council, a contractor lobbying group, countered in his testimony that when civilian agencies have used private auditors, they have in some cases paid significantly less than they used to pay DCAA.

Bales’ claim that DCAA auditors were 30 percent cheaper was based on a comparison of hourly billing rates, according to emails provided to POGO through the Freedom Of Information Act (FOIA). Berteau and other employees of the Professional Services Council did not respond to emails requesting evidence supporting their claims.

Other members of the federal auditing community have told POGO that the comparison of auditing costs is not clear cut. DCAA has more specialized experience and might charge lower costs per auditor hour, but they may also take longer to conduct audits (which may be a good thing in the long run, as more thorough audits may save even more money). Pricing for private auditors can also vary widely from company to company and even year to year, making a comprehensive analysis difficult.

And although cost was the most-discussed factor at the hearing, it isn’t the only factor that needs to be examined. A federal source, not authorized to speak on the record, who is familiar with both DCAA and private contract audits for civilian agencies said the work of private auditors still has to be closely checked, even when they are hired directly by the government. Both last year’s NDAA and a recent proposal for this year’s NDAA prohibit DCAA from examining the work of private auditors before accepting the results.

There is also concern over how the records generated by private auditors would be handled: Will they be subject to FOIA? How would the discovery of potential fraud be handled? Would private sector audits be incorporated into the DCAA’s “Management Information System” that tracks audit data so that auditors can spot trends and look at the bigger picture?

What About Incurred Costs?

New Congressional language would rescind Section 820 but would allow contractors to hire auditors to audit incurred costs. The argument for this is DCAA’s lower rate of return when it audits incurred costs. However, DCAA’s other auditing work with the same contractor and on the same contracts benefits from its incurred cost audits, and vice-versa. For instance, DCAA conducts audits of contractors’ billing, accounts, and internal control systems. The insights DCAA gains from those audits assists DCAA when it audits a contractor’s incurred costs. According to a DoD analysis of the impacts of the recently proposed legislation, keeping incurred cost audits in the hands of DCAA:

…allows for the continuation of many initiatives that DCAA has put in place to more efficiently and effectively perform audits (e.g., the use of the low risk sampling process, the coordination of subcontract assist audits, and the process for obtaining and determining adequacy of incurred cost proposals). Without one group coordinating the need for commercial auditors, the Department will lose many of these efficiencies and will lose adequate oversight over the complete incurred cost audit process. [emphasis added]

One of the primary motivations for the new Congressional language on incurred cost audits is DCAA’s incurred cost audit backlog, which was relatively large until a few years ago and has recently become more manageable according to DCAA’s most recent annual report. The agency said it was on track to eliminate the backlog by next year, although with the hiring freeze it may have to re-evaluate that goal. Regardless of whether the backlog is eliminated one or three or even five years from now, Congress is proposing a rather drastic solution to a problem that is no longer drastic itself.

This is not a backyard experiment with few consequences for failure. Billions of taxpayer dollars are on the line every year. While DCAA has room for improvement, privatizing the agency’s work would most likely make it harder to crack down on contractor overbilling.

Given the large risks and the unclear benefits or privatizing contract audits, Section 820 should be repealed. If DCAA needs a temporary boost, it should be given authority to hire more staff on a temporary basis, or perhaps even hire private sector auditors on a short-term basis. The Defense Department proposes the latter, calling it “much more effective” while ensuring “that a function that is inherently governmental in nature continues to be performed by Government auditors when feasible, but allows for the use of commercial auditors when necessary to address incurred cost backlog.”

POGO does not often agree with the Defense Department, but its proposal makes sense. Let’s learn from our past mistakes rather than repeat them.”

http://www.pogo.org/blog/2017/06/letting-contractors-pick-own-auditors-bad-idea.html

The US Military’s Iran Connection?

Standard
Military and IRAN

(Photo: KGL Logistics logo, Iran rials by Serova / Flickr)

“THE PROJECT ON GOVERNMENT OVERSIGHT”

“The chairman of a key US military contractor in the Middle East was recently charged with multiple felonies in a major fraud, money laundering, and public corruption scheme.

Fraud and money laundering charges are only the latest in a string of KGL controversies in recent years.

There have been accusations of business ties to Iran in violation of US sanctions, and of systematic leaking of sealed and privileged federal court documents and other sensitive material to KGL’s Washington lawyers by the Defense Logistics Agency (DLA), the DoD component that oversees KGL’s US military contracts.

According to court papers in Kuwait, where the charges were filed, misappropriated investor money so far totals more than $160 million, a figure that could go higher, the Project On Government Oversight (POGO) has learned. The contractor, Kuwait and Gulf Link Transport, better known as KGL, is a publicly traded conglomerate with hundreds of millions of dollars in US military contracts. The criminal charges, together with other court documents and unreported revelations made by former executives of a KGL affiliate in a US lawsuit, involve KGL’s possible violation of US sanctions against Iran, and accusations of potentially illicit flows of cash from Russia, Iran, and Syria. Taken together, the allegations raise troubling questions about the American military’s heavy reliance on the firm.

The 2017 criminal indictment by Kuwaiti prosecutors points specifically to a KGL affiliate, called KGL Investments (KGLI), as the alleged nexus of fraud and money laundering inside company headquarters from 2007 to 2015.

Two former KGLI executives have also made related allegations in little-noticed 2013 sworn statements filed in a US lawsuit. One executive said he was told by his KGLI boss that Iran’s state-owned shipping company, sanctioned by the United States in 2008 as a nuclear proliferator, was “KGL’s vehicle to Iran and she further told me that…[it] made a lot of money for KGL.”

The executive also said, “Specifically, it appeared to me that KGLI was engaged in money laundering, and presenting false financial information to investors.”

A spokesperson for KGL told POGO that, “Notwithstanding the name, KGL Investments is neither owned nor controlled by any of the KGL group of companies. No KGL entity is a party to the legal proceedings in Kuwait. The Kuwait courts will address and resolve the disputed allegations.” KGL has long denied it has ever violated US sanctions in any way.

However, KGL Investments, KGL, and many of its subsidiaries are co-located in the same office building and directed, in part, by KGL’s just-indicted chairman, who is also a director of KGLI, according to court papers. The indictment says that a portion of the embezzled funds was channeled to KGL component companies.

Also targeted in the criminal complaint against KGL’s chairman is the Vice-Chairman of KGLI. Convictions could result in jail sentences. Court documents list victims of the alleged fraud as key government departments: Kuwait’s Public Institution for Social Security and its Ports Authority. The Ports Authority serves as a staging area for America’s ongoing military involvement in Iraq, and was indispensable to US Central Command (CENTCOM) in both the first and second Gulf Wars and occupation of Iraq.

According to an official in Kuwait, senior US military personnel at the American embassy and at Camp Arifjan, a large American base in Kuwait, were officially informed of the criminal indictment, and received written copies of the details. This was done, the official said, because the indictment targets executives related to a major US military contractor, allegedly involved in stealing from important Kuwaiti institutions. In a separate dispute, the Ports Authority recently banned KGL from operating in the port. It remained unclear what action, if any, the US military might take in response. Spokespersons at CENTCOM, the Department of Defense, and the US Army’s Contracting Command all declined to comment.

What Happens Next?

Further revelations about KGL or its subsidiaries, or a conviction of one or both of the indicted executives, could call into question the conglomerate’s grip on sizable US military contracts, and its eligibility to receive future awards. Beyond the large contracts it already has, KGL is currently in line for a sizable share of the new so-called Heavy Lift VIII (HL8), a $200 million transportation-services deal that the US military could assign by August. But there is the possibility the award could run afoul of federal contracting rules, which require ethical conduct and the avoidance of serious crimes.

According to contracting rules, officially known as the Federal Acquisition Regulation (FAR): “Purchases shall be made from, and contracts shall be awarded to, responsible prospective contractors only.” The FAR goes on to specify that, “… To be determined responsible, a prospective contractor must … have a satisfactory record of integrity and business ethics.” The regulation notes that contractors may be subject to debarment, suspension, or ineligibility if they are convicted or face a civil judgment for fraud, embezzlement, or “any other offense indicating a lack of business integrity or business honesty that seriously and directly affects the present responsibility of a Government contractor or subcontractor.”

In December, the Iran Sanctions Act was extended by 10 years on a 99-0 vote in the Senate, and a 419-1 vote in the House of Representations. The law states that the federal government “shall terminate a contract with such person or debar or suspend such person from eligibility for Federal contracts for a period of not less than 2 years” if they are found to have falsely certified to be in compliance with US sanctions against Iran.

KGL has repeatedly said it complied with provisions of the FAR.

A Hearing in Court

The criminal charges against KGL executives are the result of a four-year probe by Kuwait’s national security police. A court hearing on the matter in Kuwait was held on May 21, and another is scheduled for June 11. Among other records, POGO obtained a 21-page copy of a charge sheet dated May 9, 2017 (in Arabic).

The document names three defendants. Saed Dashti, 61, is chairman of KGL. Maria [Marsha] Lazareva, 44, is Vice-Chairman and Managing Director of KGLI, where Saed Dashti also serves as a director. A third defendant, Mohamed Al-Asfour, 71, is a senior public official: the executive vice-chairman of Kuwait’s Ports Authority.

Documents describe Lazareva as a Russian national. She was educated at the Wharton business school and public records associate her with real estate ownership in the Philadelphia area. According to news accounts, she showed up in court for the May 21 hearing, protesting her innocence.

The indictment says Dashti and Lazareva transferred large sums of investors’ money to their own private accounts and to a variety of KGL subsidiaries or related companies between 2007 and 2015. They did this, court documents say, partly using a network of financial institutions including the Hong Kong and Shanghai Banking Corporation (HSBC) and one of its branches in the Cayman Islands. The bank also has branches in the United States, Kuwait, Asia, and other parts of the world. It’s unclear whether any of the allegedly embezzled funds passed at some point through the American financial system, which could trigger a US investigation.

A civil lawsuit involving KGL in Pennsylvania has brought to light accusations that could bear directly on the alleged fraud and money laundering scheme in Kuwait. The lawsuit, brought by KGL, charges the firm’s principal competitor, Agility Public Warehousing Co., with defaming KGL’s reputation by falsely claiming it had ties to Iran.

Saed Dashti and Marsha Lazareva

Saed Dashti and Marsha Lazareva (Source: Instagram)

 

Testimony in the Pennsylvania case—which is ongoing—includes declarations sworn in 2013 by a pair of former executives of KGL Investments, as part of Agility’s defense. Both said Dashti and Lazareva misinformed investors about KGLI’s financial condition, and one of the executives reported they had made repeated trips to Russia, Iran, and Syria in an apparent attempt to shore up KGLI’s faltering finances.

The two former KGLI executives testified that Dashti and Lazareva occupied offices on the same floors and hallways at KGL’s headquarters in Kuwait along with other subsidiaries.

One of the executives who testified, Ahmed Mabrouk, is an American citizen currently employed in the US financial industry. Court records identify him as former KGLI Vice-President Investments, a job where he testified he spent 18 months in 2008 and 2009 (a period covered by the 2017 criminal indictment) helping to analyze KGLI’s so-called “Port Fund,” an entity that invested in marine facilities around the Middle East and elsewhere. Under oath, Mabrouk said:

“Ms. Lazareva described to me the Islamic Republic of Iran Shipping Lines (IRISL) as KGL’s vehicle to Iran and she further told me that IRISL made a lot of money for KGL. When I was employed at KGLI, I observed Ms. Lazareva in her office reviewing documents related to IRISL, which bore the logo of IRISL, as well as the Iranian emblem.”

The declaration of Mabrouk, who could not be reached for comment, did not include documentary or other evidence to support his statement.

The United States, European Union (EU), and United Nations (UN) have all imposed sanctions on IRISL, Iran’s state-owned shipping company and a former joint-venture partner with KGL. Referring to US sanctions, applied in 2008, then-Treasury Under Secretary for Terrorism and Financial Intelligence Stuart Levey explained:

“Not only does IRISL facilitate the transport of cargo for U.N. designated proliferators, it also falsifies documents and uses deceptive schemes to shroud its involvement in illicit commerce. IRISL’s actions are part of a broader pattern of deception and fabrication that Iran uses to advance its nuclear and missile programs.”

In his declaration, Mabrouk said, “I reviewed KGLI’s internal financial statements and observed that KGLI consistently had a negative cash flow.” Mabrouk also testified that he looked at “…financial statements that had been provided to investors. The financial statements provided to investors consistently, and in bad faith, misrepresented financial data regarding KGLI and its portfolio companies’ actual financial condition.”

Concern about KGLI’s financial condition, according to Mabrouk, caused KGLI’s banks to stop lending it money, creating a cash squeeze. And that led to “fundraising” trips by Dashti and Lazareva, he said:

“I understood that Ms. Lazareva and Saeeed (sic) Dashti took a number of trips on private planes to, among other places, Iran, Syria and Russia. Following each trip, I observed in KGLI’s internal financial statements an influx of funds into KGLI’s accounts. Ms. Lazareva told me and others at KGLI that these trips were for ‘fundraising;’ however, to my knowledge, such fundraising was not tied to any formalized investment process.”

Mabrouk did not say what, if anything, KGL Investments did in exchange for the money it allegedly received, or that he knew specifically that inflows had come from Iran, Syria, and Russia, even though he said the pair had travelled there.

Mabrouk did specify that Lazareva at one point asked him to travel to Syria to “review a potential investment in a port,” but he refused because that country was under US sanctions. Because Mabrouk also holds an Egyptian passport, he said Lazareva told him to use that travel document instead of an American passport. When he refused a second time, it set off a chain of events which, he said, led to his departure from the company.

Another KGLI executive also offered testimony in the same Pennsylvania court case. Wael Salam, an American citizen who worked for KGLI both in Kuwait and in Atlanta, said he was the firm’s Chief Investment Officer. He said both Dashti and Lazareva were directly and deeply involved in decision-making at the firm. He also reported that KGL funded KGLI with money from its subsidiaries as well as seeking contributions from outside investors.

Salam said that, from his perspective as an insider at the company, making profits did not appear to be KGLI’s principal goal, at least given its decision to sink its money and assets from its “Port Fund” into a variety of failing or near-bankrupt facilities in Egypt, Pakistan, and other countries.

Four years before the criminal indictments in Kuwait, Salam testified that he wanted to leave KGLI “…because I believed it was engaging in illicit activities … Specifically, it appeared to me that KGLI was engaged in money laundering, and presenting false financial information to investors.” His statements also show that Salam was trying to raise money to start his own investment fund after he left KGLI, which the company cited as one of the grounds for his dismissal. He could not be reached for comment.

Salam said Lazareva asked him on multiple occasions to visit Iran, sometimes without explanation and at other times to evaluate a port investment. When he refused because Iran was under US sanctions, she suggested that he, too, use his Egyptian passport. He again refused to go and, following a series of disputes and alleged high-pressure tactics by the company, was fired.

A KGL representative declined to comment to POGO on the testimony of Mabrouk or Salam.

More Ties to Iran

The Pennsylvania court case recently provided additional information about KGL’s relationship with Iran, a controversy that stretches back into the Obama Administration. As evidence emerged indicating possible sanctions violations by KGL in its joint ownership of ships with IRISL, Ashton Carter, then Under Secretary of Defense for Acquisition, Technology and Logistics and later Secretary of Defense, wrote to US lawmakers who had inquired about the situation.

In letters to Senators Claire McCaskill, Robert Menendez, Mark Kirk, Robert Bennett, and others in 2011, Carter wrote that DoD could find “no substantial information” that KGL had continuing ties to Iran that would prevent it from holding US military contracts. By that time, the company had publicly announced its decision to end all business dealings with Iran in compliance with US law.

Since then, however, as part of legal discovery in the Pennsylvania court case, KGL has divulged emails and documents, and offered testimony from one of its former executives that appear to show it did have business with IRISL—at a time when Under Secretary Carter was telling Congress just the opposite. At least that is the argument set forth in an extensively documented summary of KGL’s own internal records filed by KGL’s adversary in the Pennsylvania case. Among other things, the summary cites those KGL records showing that its joint venture with IRISL made “at least 63 financial transactions” with the Iranian shipper after US sanctions had been imposed. In another example from the summary, a former KGL executive, Allan Rosenberg, gave the court a statement describing how he set up a “ghost structure” email system that resulted in the concealment of KGL’s continuing business with the Iranian-owned company.

A KGL spokesperson declined to comment on the summary or on Rosenberg’s statement.

Airplane Parts for Iran?

In May last year, Fuad Dashti, a brother of the recently indicted Saed Dashti—both members of the wealthy Kuwaiti family that controls KGL—was arrested at San Francisco International Airport. He was charged with involvement in illegally selling aircraft parts to Iran, according to a senior US official, and brought to Washington, DC, apparently for questioning by the FBI. One official at the time described him as, “singing like a bird” while in US custody. Fuad Dashti has since been allowed to leave the United States and was photographed some months ago in Doha, Qatar. At the time of his arrest, a KGL spokesman told POGO that “the alleged conduct [of Fuad Dashti] does not involve KGL or any of its affiliates and that Mr. Fuad Dashti was not acting as a KGL employee or representative.”

However, Fuad Dashti maintains ongoing financial ties to KGL, and has been listed as a top executive and part owner of National Cleaning Company, which is partly owned by KGL. According to the recent indictment in Kuwait, Saed Dashti also owns a share of National Cleaning, though it is unclear whether misappropriated funds were diverted to the company. There was no reply to POGO’s repeated attempts to reach Fuad Dashti, including a message left at a California house where he is listed as owner.

Key Questions Remain

The criminal indictment of KGL’s chairman adds to a growing roster of unresolved issues swirling around the company and its role as a contractor with hundreds of millions of dollars in business with the US military. Questions surrounding the company’s possible financial ties to Iran, and even Syria and Russia, raise national security concerns at a time when those countries are actively engaged in confronting American interests.

America’s federal acquisition regulations require ethical conduct from companies and their leaders. The large body of evidence in Kuwait’s extensively documented fraud and money laundering case raises doubts whether that requirement is being met.

So, too, does the arrest of Fuad Dashti, long a key figure in KGL’s controlling dynasty, on charges of commercial dealings with Iran. Yet the US government has made virtually no public statements about the matter. The fact that KGL, as long ago as 2011 and perhaps earlier, has been the focus of a probe led by the FBI into its ties with Iran only adds to the doubts. Again, no result of that investigation has ever been made public. And the same is true of the US official response to a well-documented pattern of leaks to KGL’s Washington lawyers by the Defense Logistics Agency. Senior US officials have told POGO that the DoD’s Office of General Counsel and its Defense Criminal Investigative Service have looked at or been made aware of the matter. Yet neither has made a public statement about the issues.

Indeed, years of requests for information about KGL from agencies ranging from DoD to the Treasury’s Office of Foreign Assets Control have been met with incomplete answers and, on occasion, with apparently inaccurate information. Given that result, Congress needs to clear up what is going on with KGL and its huge government contracts, because federal agencies appear unable or unwilling to shed light on the issue, or credibly resolve it.

Given the new criminal charges lodged against KGL’s chairman, the American public needs to know whether the company is a responsible and deserving recipient of US taxpayer funds. To find out, Congress should look into what the FBI and other agencies have learned after years of investigating the company’s conduct, and inform the public of what it learns.

Of course KGL is not the only logistics contractor the US military could rely on. Its principal competitor, and one of the largest single US contractors in the Iraq war, is Agility Public Warehousing Company. Yet Agility, too, has faced its share legal problems: the Department of Justice recently settled criminal, civil, and administrative charges against it. In the criminal case, which began in 2009, DOJ sought hundreds of millions of dollars in compensation for alleged overcharging.  In the end, Agility was only required to “pay a maximum of $551…in restitution.” In the civil case, the company agreed to pay $95 million, ending its suspension and allowing it to bid once again on US government contracts.

Taken together, Agility’s recently resolved legal problems and the new criminal charges against KGL’s chairman highlight the need for Congress and the Defense Department to reevaluate a contracting framework that has made America’s military the captive of two giant companies in one of the most strategic parts of the globe, an area where US forces cannot operate without extensive logistical support. As an alternative to this dysfunctional system, Congress and the Defense Department should examine how to foster more competition by explicitly encouraging the Pentagon to make deals with a wider variety of market participants.”

http://www.pogo.org/our-work/articles/2017/us-top-militarys-iran-contracting.html

 

First-ever Audit At The Department of Defense

Standard

First Ever Audit at the Pentagon

“DEFENSE ONE”

“The Department of Defense is preparing for its first-ever audit.

The nation’s most sprawling and expensive bureaucracy and the world’s largest employer—has yet to undergo a formal, legally mandated review of its finances.

[It] has become a preoccupation for members of Congress intent on demonstrating their fiscal prudence even as they appropriate more than $600 billion annually to the Pentagon.

“Like Waiting for Godot,” one Democratic senator, Jack Reed of Rhode Island, quipped about the absent audit at a recent hearing. The lack of formal accountability has left unanswered basic questions about how the military spends taxpayer money, like the precise number of employees and contractors its various branches have hired. Cost overruns have become legendary, none more so than the F-35 fighter-jet program that has drawn the ire of President Trump. And partial reports suggest that the department has misspent or not accounted for anywhere from hundreds of billions to several trillion dollars.

After years of missed deadlines, the mounting political pressure and a renewed commitment from the Trump administration might finally result in an audit. For the first time last year, both major political parties called for auditing the Pentagon in their campaign platforms. That unites everyone from Hillary Clinton and Elizabeth Warren to Ted Cruz and the House Freedom Caucus. And last week, Trump’s nominee to serve as comptroller for the Pentagon, David Norquist, testified at his Senate confirmation hearing that he would insist on one whether the department could pass it or not. “It is time to audit the Pentagon,” Norquist told members of the Senate Armed Services Committee in his opening statement.

As comptroller for the Homeland Security Department a decade ago, Norquist, the brother of the anti-tax advocate Grover Norquist, undertook the first successful audits of that much younger federal agency. The Defense Department is unlikely to meet a statutory deadline to be “audit-ready” by the end of September. But Norquist said he would begin the process even if the Pentagon’s financial statements were not fully in order, and he committed to having the report completed by March 2019.

What has prevented the Pentagon from being examined this way before? The answer lies somewhere “between lethargy and complexity,” said Gordon Adams, a distinguished fellow at the Stimson Center who was the top budget official for national security in the Clinton White House. “It hasn’t been done ever,” he told me, “partly because it’s incredibly complicated to do and also because there’s not a great, powerful will in the building to do it.”

The complexity of the project dates back to the Civil War, Adams said, when the Army and the Navy set up their own separate accounting systems. The Air Force also went its own way after its creation following World War II, and the military build-ups of the last four decades scrambled the department’s financial records many times over. The explosion of military contractors since 9/11 has made scrubbing the books harder still. Adams estimated that an audit would have to account for 15 million to 20 million contracting transactions each year. The Pentagon has spent several billion dollars over the last seven years just trying to consolidate its accounting systems in preparation for a potential audit.

Despite the ramp-up costs, the project has never risen to be a top priority; the Pentagon has simply been too busy fighting wars. “The military has repeatedly argued that they need to focus on the war effort and accountability can come later,” said Kori Schake, a fellow at the Hoover Institution who previously served in a variety of national-security positions in the government. That excuse carried more weight with lawmakers in the years when the United States had hundreds of thousands of troops fighting in Iraq and Afghanistan.

Now, top Republicans like Senator John McCain of Arizona, chairman of the Armed Services Committee, are pressing for an audit with more urgency. “This has been a very public continuing failure for the Department of Defense, in large part due to the failure of senior management to make this a priority for the department and invest the necessary time and will to get it done,” McCain said at the outset of Norquist’s hearing. “This must end with you,” he told the president’s nominee.

Yet those fiscal hawks hoping that the long-awaited report will spur substantial reforms to defense spending are just as likely to be disappointed. An audit by itself won’t dismantle the “military industrial complex” that former President Dwight Eisenhower famously warned about, nor will it lead members of Congress to stop fighting to protect the bases and weapons systems that are manufactured in their districts—and the jobs that come with them. Several times in recent years, it has been congressional lobbying that has kept up production of weapons and equipment that the military no longer considers necessary.

“An audit does not raise the big issues,” Adams said. “It doesn’t tell you that we’re not getting the right bang for the buck. It doesn’t tell you anything about whether we’re getting the right forces for the threat. It doesn’t tell you how well the forces perform. It doesn’t tell you where we are wasting capability that we don’t need.”

“What it allows a member of Congress to do,” he continued, “is to look tough on defense and spend a lot on defense at the same time.”

Spending a lot on defense is what the Trump administration wants to do, even as it pledges its support for a Pentagon audit. The White House has asked Congress for a $54 billion increase in the military budget over the next year and secured about $15 billion of that in the recent spending deal. “It’s harder when there’s a big inflow of cash to focus on something like the audit,” said William Hartung, director of the arms and security project at the Center for International Policy. “There’s still that incentive to just push the money out the door.”

There’s some hope among audit advocates that the administration’s demand for more money will give congressional spending hawks leverage to insist on progress toward the accounting milestone in exchange for a budget increase. But they also don’t believe leverage should be necessary to demand that a department with a workforce pegged at more than 3 million people commit, at long last, to some basic bookkeeping. “We would never accept the argument that the Department of Education is too big and too complicated to be accountable,” Schake argued. “Why do we accept that for Defense?”

http://www.defenseone.com/politics/2017/05/white-house-vows-audit-pentagon-which-would-be-first/137928/?oref=d-channeltop

 

Navigating Defense Department Cyber Rules

Standard

Cyber Rules

“NATIONAL DEFENSE MAGAZINE”

“Defense contractors by Dec. 31 are expected to provide “adequate security” to protect “covered defense information” using cyber safeguards.

Thousands of companies who sell directly to the Defense Department, and thousands more who sell to its suppliers, are or will be, subject to the rule.

This obligation arises from a Defense Acquisition Regulation System Supplement clause, “Network Penetration Reporting and Contracting For Cloud Services,” that was finalized last October and described in the National Institute of Standards and Technology (NIST) Special Publication 800-171.

The Pentagon is well-justified to seek improved cyber protection of sensitive but unclassified technical information. Hackers have exploited network vulnerabilities in the defense supply chain for the unauthorized exfiltration of valuable and sensitive defense information. Senior defense officials have expressed alarm at this persistent and pervasive economic espionage. 

Since 2013, the Defense Department has used acquisition regulations to protect controlled technical information significant to military or space. Other forms of information may not have direct military or space significance, but loss of confidentiality through a cyber breach can produce serious, even grave national injury. 

The Defense Department is the leader among federal agencies in using its contractual power to cause its vendors to improve their cybersecurity. The principal instruments are two contract clauses, DFARS 252.204-7008, “Compliance with Safeguarding Covered Defense Information Controls,” and DFARS 252.204-7012, “Safeguarding Covered Defense Information and Cyber Incident Reporting.” Both were the subject of final rulemaking released Oct. 21.

Where the -7008 “compliance” clause is included in a solicitation, the offeror commits to implement the SP 800-171 safeguards by the end of this year. Defense Department contracts will include the -7012 “safeguards” clause, which defines the types of information that must be protected, informs contractors of their obligation to deliver “adequate security” using SP 800-171 controls, and obligates reporting to the department of cyber incidents.  

Every responsible defense supplier supports the objectives of these cyber DFARS rules. But the requirements are complex and are not currently well-understood. Outside of a few of the largest, dedicated military suppliers, many companies in the defense supply chain view these rules with a mix of doubt, concern and alarm. This recipe serves neither the interests of the Defense Department nor its industrial base.

A technology trade association, the IT Alliance for Public Sector, released a white paper that examines the Defense Acquisition Regulation System Supplement and other federal initiatives to protect controlled unclassified information. The goal was to assist both government and industry to find effective, practical and affordable means to implement the new cyber requirements. The paper examines these five areas: designation, scope, methods, adoption and compliance.

As for designation, the department should accept that it is responsible to identify and designate the covered defense information that contractors are obliged to protect. It should confirm that contractors only have to protect information that it has designated as covered, and that such obligations are only prospective — newly received information — and not retrospective.

In regards to “scope,” the Defense Department should revise the rule to clarify that contractors must protect information that it has identified as covered and provided to the contractor in the course of performance of a contract that is subject to the rule. The definition of “covered defense information” should be revised to remove confusing language that can be interpreted to require protection of “background” business information and other data that has only a remote nexus to a Defense Department contract.

The October 2016 revision now allows defense contractors to use external cloud service providers, where covered information is involved, only if those vendors meet the security requirements of FedRAMP Moderate “or equivalent.” The Federal Risk and Authorization Management Program, or FedRAMP, is a government-wide program that provides a standardized approach to security assessment, authorization and continuous monitoring for cloud products and services.

The regulation fails to explain what is meant by “or equivalent” and who decides. The Defense Department needs to explain what it expects from cloud services to satisfy SP 800-171 and the DFARS rules. A security overlay should be prepared by NIST to add cloud-specific controls. But it is unnecessary to impose the whole of the FedRAMP process and federal-specific controls on commercial cloud providers.

The Defense Department continues to depend on small business for many needs, and seeks their innovative ideas. The supplements are an obstacle and burden on smaller businesses, and yet security is just as important at the lower levels of the supply chain as at the top. The department can improve the ability of small business to implement the required security controls. Several specific recommendations are made as to how it can reach and assist the small business community. One recommendation is to make increased use of the NIST voluntary cybersecurity framework.

As far as compliance, contractors are required to represent that they will deliver “adequate security” and fully implement the SP 800-171 controls by the year-end deadline. The Defense Department needs to better inform its contractors how they can be confident their security measures will satisfy the requirements should they come under scrutiny following a cyber incident. The white paper explores different ways to create a safe harbor for compliance. A key component is contractor documentation of a system security plan, which was added as a 110th requirement to SP 800-171.        

The White Paper is available here. The Defense Department is hosting an industry day on the cyber DFARS, June 23 at the Mark Center in Alexandria, Virginia. Information and registration details available here. ”     

http://www.nationaldefensemagazine.org/articles/2017/4/21/navigating-defense-department-cyber-rules

Intelligence Watchdog Finds Contractor Abuses

Standard

contractor-waste-fraud-and-abuse

“POGO”

“Dozens of instances when contractor employees fudged their timesheets, billing the government for time they were not at work or when they engaged in activities either personal in nature or outside the scope of the contract.

38 substantiated cases  – loss to the government of more than $2.5 million.

Last week brought news that another Booz Allen Hamilton employee was accused of improperly removing sensitive material from the National Security Agency (NSA). Harold Thomas Martin III was charged with theft of government property and unauthorized removal and retention of classified materials. The government alleges Martin took documents and digital files containing information that, if disclosed, “reasonably could be expected to cause exceptionally grave damage to the national security of the United States.”

It was another black eye for Booz Allen, which was NSA surveillance program whistleblower Edward Snowden’s employer. It was equally embarrassing for the U.S. intelligence community, which pays contractors like Booz Allen billions of dollars each year to help run its global operations and keep a tight lid on our country’s more sensitive secrets.

Just days after the Harold Martin story broke, U.S. intelligence contractors were again in the spotlight. On Sunday, VICE News reporter Jason Leopold posted hundreds of pages of Intelligence Community Inspector General (ICIG) investigative reports. The documents contain the juicy—and occasionally disturbing—details of misconduct investigations conducted by the ICIG, the watchdog office that oversees the federal intelligence agencies. Most of the cases involved employees of Booz Allen and other prominent contractors.

Specifically, the documents contain dozens of instances when contractor employees fudged their timesheets, billing the government for time they were not at work or when they engaged in activities either personal in nature or outside the scope of the contract.

The ICIG also found that some contractor employees, while working on extremely sensitive intelligence programs and operations, risked exposing classified information by using non-secure networks and computers. They did so while working for some of the government’s most trusted private sector partners: Booz Allen and SAIC are among only a handful of private firms that collectively employ nearly all of the intelligence community’s contractor workforce.

The implications of the VICE News revelations are enormous. Not only did the contractor employees rip off taxpayers, they also compromised national security. The ICIG reports bolster POGO’s concern that contractor timesheet fraud is especially rampant among intelligence programs due to a lack of transparency and insufficient contract oversight. However, they also give us a reason to be optimistic: they show that the intelligence watchdog takes its role seriously and doggedly pursues allegations of wrongdoing.”

http://www.pogo.org/blog/2016/10/intelligence-watchdog-finds-contractor-abuses.html

 

 

The Realities of Federal Drone Domestic Surveillance

Standard

Drones

“The Atlantic”

“Americans don’t particularly want to be spied on from above.

There are too many federal, state, and local agencies with too many surveillance aircraft to pretend any longer that aerial spying is rare.

A little more than a decade ago the border patrol started using surveillance drones. The technology and the mission were a perfect match, and few did any worrying—almost no one objects to closely monitoring America’s southern border.

The belief that the federal government was using drones to conduct domestic surveillance inside the United States, though, could get a person labeled a paranoid lunatic as recently as 2012. Yet by then, the border patrol had lent its drones to other agencies 700 times. And the Department of Homeland Security was actively developing a domestic drone fleet, egged on by at least 60 members of Congress. “This bipartisan caucus, together with its allies in the drone industry, has been promoting UAV use at home and abroad through drone fairs on Capitol Hill, new legislation and drone-favored budgets,” the Center for International Policy reported.

In 2013, Senator Dianne Feinstein, a staunch defender of NSA surveillance,declared that drones are “the biggest threat to privacy in society today.” Under her questioning, the FBI admitted to using surveillance drones in “a very minimal way.”

What did Feinstein know that the FBI wasn’t telling us? Perhaps that the federal government gave local police departments $1.2 million to spend on drones that year.

In 2015, NBC News reported that the Bureau of Alcohol, Tobacco, and Firearms spent $600,000 on six drones, “then never flew them because of technical problems with flight time, maneuverability and more.” Has ATF figured them out yet?

AP reported that the DEA was using drones domestically, too.

That brings us to 2016.

On Wednesday, USA Today reported that the Pentagon “has deployed drones to spy over U.S. territory for non-military missions over the past decade,” citing a report by a Pentagon inspector general who declared that the flights are “rare and lawful.”

That’s the narrative that officials speaking on behalf of the federal government keep conveying––that the instances of aerial surveillance over U.S. soil are safe, legal, and rare.

But it isn’t so.

There is too little oversight to presume all these government entities are acting legally. As for safety, Americans know neither what sort of aerial-surveillance data has been archived nor how secure it is. And security researcher Nils Rodday learned that he could successfully hack into professional drones and take over their operations on a $40 budget.

The ACLU and Electronic Frontier Foundation are trying to draw attention to these issues; the Department of Justice has issued its own guidelines on domestic drone use. But there’s still not much public discussion, debate, or oversight of domestic drone surveillance.

By keeping various aerial-surveillance programs hidden or very quiet, the government will continue to achieve a rapid fait accompli unless it is stopped”

http://www.defenseone.com/technology/2016/03/lets-talk-about-rapid-rise-federal-drones-over-us-soil/126579/?oref=d_brief_nl

What the Future of Government Surveillance Looks Like

Standard

defense-large“DEFENSE ONE”

“A future awaits where countries share intelligence one minute, then hack and cyberattack each other the next.

These partnerships make no sense when the primary goal of intelligence is government vs. government espionage, but are obvious and appropriate when the primary goal is global surveillance of the population.

So while the German government expresses outrage at the NSA’s surveillance of the country’s leaders, its BND continues to partner with the NSA to surveil everyone else.

The endgame of this isn’t pretty: It’s a global surveillance network where all countries collude to surveil everyone on the entire planet. It’ll probably not happen for a while—there will be holdout countries like Russia that will insist on doing it themselves, and rigid ideological differences will never let countries like Iran cooperate fully with either Russia or the United States—but most smaller countries will be motivated to join. From a very narrow perspective, it’s the rational thing to do.

Before the Internet, when surveillance consisted largely of government-on-government espionage, agencies like the NSA would target specific communications circuits: that Soviet undersea cable between Petropavlovsk and Vladivostok, a military communications satellite, a microwave network. This was for the most part passive, requiring large antenna farms in nearby countries.

Modern targeted surveillance is likely to involve actively breaking into an adversary’s computer network and installing malicious software designed to take over that network and “exfiltrate” data—that’s NSA talk for stealing it. To put it more plainly, the easiest way for someone to eavesdrop on your communications isn’t to intercept them in transit anymore; it’s to hack your computer.

And there’s a lot of government hacking going on.

In 2011, an Iranian hacker broke into the Dutch certificate authority DigiNotar. This enabled him to impersonate organizations like Google, the CIA, MI6, Mossad, Microsoft, Yahoo, Skype, Facebook, Twitter, and Microsoft’s Windows Update service. That, in turn, allowed him to spy on users of these services. He passed this ability on to others—almost certainly in the Iranian government—who in turn used it for mass surveillance on Iranians and probably foreigners as well. Fox-IT estimated that 300,000 Iranian Gmail accounts were accessed.

In 2009, Canadian security researchers discovered a piece of malware called GhostNet on the Dalai Lama’s computers. It was a sophisticated surveillance network, controlled by a computer in China. Further research found it installed on computers of political, economic, and media organizations in 103 countries—basically a who’s who of Chinese espionage targets. Flame is a surveillance tool that researchers detected on Iranian networks in 2012; these experts believe the United States and Israel put it there and elsewhere. Red October, which hacked and spied on computers worldwide for five years before it was discovered in 2013, is believed to be a Russian surveillance system. So is Turla, which targeted Western government computers and was ferreted out in 2014. The Mask, also discovered in 2014, is believed to be Spanish. Iranian hackers have specifically targeted U.S. officials. There are many more known surveillance tools like these, and presumably others still undiscovered.

(Related: NSA Spying Continues With Another Rubber Stamp)

To be fair, we don’t have proof that these countries were behind these surveillance networks, nor that they were government-sponsored. Governments almost never admit to hacking each other’s computers. Researchers generally infer the country of origin from the target list. For example, The Mask target list included almost all Spanish-speaking countries, and a bunch of computers in Morocco and Gibraltar. That sounds like Spain.

In the United States, the group charged with hacking computers is the Tailored Access Operations group (TAO) inside the NSA. We know that TAO infiltrates computers remotely, using programs with cool code names like QUANTUMINSERT and FOXACID. We know that TAO has developed specialized software to hack into everything from computers to routers to smartphones, and that its staff installs hardware “implants” into computer and networking equipment by intercepting and infecting it in transit. One estimate is that the group has successfully hacked into, and is exfiltrating information from, 80,000 computers worldwide.

Of course, most of what we know about TAO and America’s hacking efforts comes from top-secret NSA documents provided by Edward Snowden. There haven’t been similar leaks from other countries, so we know much less about their capabilities.

We do know a lot about China. China has been reliably identified as the origin of many high-profile attacks—against Google, against the Canadian government, against The New York Times, against the security company RSA and other U.S. corporations, and against the U.S. military and its contractors. In 2013, researchers found presumed Chinese government malware targeting Tibetan activists’ Android phones. In 2014, Chinese hackers breached a database of the U.S. Office of Personnel Management that stored detailed data on up to 5 million U.S. government employees and contractors with security clearances.

A lot of this is political and military espionage, but some of it is commercial espionage. Many countries have a long history of spying on foreign corporations for their own military and commercial advantage. The U.S. claims that it does not engage in commercial espionage, meaning that it does not hack foreign corporate networks and pass that information on to U.S. competitors for commercial advantage. But it does engage in economic espionage, by hacking into foreign corporate networks and using that information in government trade negotiations that directly benefit U.S. corporate interests. Recent examples are the Brazilian oil company Petrobras and the European SWIFT international bank-payment system. In fact, according to a 1996 government report, the NSA claimed that the economic benefits of one of its programs to U.S. industry “totaled tens of billions of dollars over the last several years.” You may or may not see a substantive difference between the two types of espionage. China, without so clean a separation between its government and its industries, does not.

Many countries buy software from private companies to facilitate their hacking. Consider an Italian cyberweapons manufacturer called Hacking Team that sells hacking systems to governments worldwide for use against computer and smartphone operating systems. The mobile malware installs itself remotely and collects e-mails, text messages, call history, address books, search-history data, and keystrokes. It can take screenshots, record audio to monitor either calls or ambient noise, snap photos, and monitor the phone’s GPS coordinates. It then surreptitiously sends all of that back to its handlers. Ethiopia used this software to sneak onto the computers of European and American journalists.

When American officials first started getting reports of the Chinese breaking into U.S. computer networks for espionage purposes, they described it in very strong language. They labeled the Chinese actions “cyberattacks,” sometimes invoking the word “cyberwar.” After Snowden revealed that the NSA had been doing exactly the same thing as the Chinese to computer networks around the world, the U.S. used much more moderate language to describe its own actions—terms like “espionage,” or “intelligence-gathering,” or “spying”—and stressed that these were peacetime activities.

When the Chinese company Huawei tried to sell networking equipment to the United States, many feared that the Chinese government had installed backdoors into the switches that would allow Beijing to eavesdrop, and considered the move a “national-security threat.” But, as Snowden’s disclosures eventually revealed, the NSA has been doing exactly the same thing, both to Huawei’s equipment and to American-made equipment sold in China.

(Related: DARPA’s New Search Engine Puts Google in the Dust)

The problem is that—as they occur and from the point of view of the victim—international espionage and attack look pretty much alike. Modern cyberespionage is a form of cyberattack, and both involve breaking into the network of another country. The only difference between them is whether they deliberately disrupt network operations or not. That’s a huge difference, of course, but the time lag between breaking into a network and disrupting operations might be months or even years. Because breaking into a foreign network affects the territory of another country, it is almost certainly illegal under that country’s laws. Even so, countries are doing it constantly to one another.

In 2012, for example, the NSA repeatedly penetrated Syria’s Internet infrastructure. Its intent was to remotely install eavesdropping code in one of the country’s core routers, but it accidentally caused a nationwide Internet blackout. Exfiltrating data and taking out a country’s Internet involve exactly the same operations.

Governments, meanwhile, are getting into cyberwar big time. About 30 countries have cyberwar divisions in their military: the United States, Russia, China, the major European countries, Israel, India, Brazil, Australia, New Zealand, and a handful of African countries. In the United States, this effort is led by U.S. Cyber Command inside the Department of Defense. Admiral Michael S. Rogers is in charge of both this organization and the NSA. That’s how close the missions are.

Few examples have surfaced of cyberattacks that cause actual damage, either to people or to property. In 2007, Estonia was the victim of a broad series of cyberattacks—an incident that is often called the first cyberwar because it coincided with increased tensions with neighboring Russia. The ex-Soviet republic of Georgia was also the victim of cyberattacks, ones that preceded a land invasion by Russian troops a year later. In 2009, South Korea was the victim of a cyberattack. All of these were denial-of-service attacks, during which selected Internet sites are flooded with traffic and stop working temporarily. They’re disruptive, but not very damaging in the long run.

In all of these cases, we don’t know for sure who the perpetrator was, or even whether it was a government. In 2009, a pro-Kremlin youth group took credit for the 2007 Estonian attacks, although the only person convicted of them was a 22-year-old Russian living in Tallinn. That sort of identifiability is rare. Like the espionage attacks discussed earlier, cyberattacks are hard to trace. We’re left to infer the attacker by the list of victims. Ethnic tensions with Russia—of course Russia is to blame. South Korea gets attacked—who else but North Korea would be motivated?

Stuxnet is the first military-grade cyberweapon known to be deployed by one country against another. It was launched in 2009 by the United States and Israel against the Natanz nuclear facility in Iran, and succeeded in causing significant physical damage. A 2012 attack against Saudi Aramco that damaged some 30,000 of the national oil company’s computers is believed to have been retaliation by Iran.

* * *There’s an interesting monopolistic effect that occurs with surveillance. Espionage basically follows geopolitical lines; a country gets together with its allies to jointly spy on its adversaries. That’s how we did it during the Cold War. It’s politics.

Mass surveillance is different. If you’re truly worried about attacks coming from anyone anywhere, you need to spy on everyone everywhere. And since no one country can do that alone, it makes sense to share data with other countries.

But whom do you share information with? You could share with your traditional military allies, but they might not be spying on the countries you’re most worried about. Or they might not be spying on enough of the planet to make sharing worthwhile. It makes the best sense to join the most extensive spying network around. And that’s the United States.

This is what’s happening right now. U.S. intelligence agencies partner with many countries as part of an extremely close relationship of wealthy, English-speaking nations called the Five Eyes: the U.S., U.K., Canada, Australia, and New Zealand. Other partnerships include the Nine Eyes, which adds Denmark, France, the Netherlands, and Norway; and the Fourteen Eyes, which adds Germany, Belgium, Italy, Spain, and Sweden. And the United States partners with countries that have traditionally been much more standoffish, like India, and even with brutally repressive regimes like Saudi Arabia’s.

All of this gives the NSA access to almost everything. In testimony to the European Parliament in 2014, Snowden said, “The result is a European bazaar, where an EU member state like Denmark may give the NSA access to a tapping center on the (unenforceable) condition that NSA doesn’t search it for Danes, and Germany may give the NSA access to another on the condition that it doesn’t search for Germans. Yet the two tapping sites may be two points on the same cable, so the NSA simply captures the communications of the German citizens as they transit Denmark, and the Danish citizens as they transit Germany, all the while considering it entirely in accordance with their agreements.”

In 2014, we learned that the NSA spies on the Turkish government, and at the same time partners with the Turkish government to spy on the Kurdish separatists within Turkey. We also learned that the NSA spies on the government of one of its much closer surveillance partners: Germany. Presumably the United States spies on all of its partners, with the possible exception of the other Five Eyes countries. Even when the NSA touts its counterterrorism successes, most of them are foreign threats against foreign countries and have nothing to do with the United States.

It should come as no surprise that the U.S. shares intelligence data with Israel. Normally, identities of Americans are removed before this data is shared with another country to protect our privacy, but Israel seems to be an exception. The NSA gives Israel’s secretive Unit 8200 “raw SIGINT”—that’s signals intelligence.

(Related: Obama Pushes for Greater Intel Sharing in New Strategy)

Even historical enemies are sharing intelligence with the United States., if only on a limited basis. After 9/11, Russia rebranded the Chechen separatists as terrorists, and persuaded the United States to help by sharing information. In 2011, Russia warned the United States about Boston Marathon bomber Tamerlan Tsarnaev. The United States returned the favor, watching out for threats at the Sochi Olympics.

These partnerships make no sense when the primary goal of intelligence is government vs. government espionage, but are obvious and appropriate when the primary goal is global surveillance of the population. So while the German government expresses outrage at the NSA’s surveillance of the country’s leaders, its BND continues to partner with the NSA to surveil everyone else.

The endgame of this isn’t pretty: It’s a global surveillance network where all countries collude to surveil everyone on the entire planet. It’ll probably not happen for a while—there will be holdout countries like Russia that will insist on doing it themselves, and rigid ideological differences will never let countries like Iran cooperate fully with either Russia or the United States—but most smaller countries will be motivated to join. From a very narrow perspective, it’s the rational thing to do.”

http://www.defenseone.com/technology/2015/03/what-future-government-surveillance-looks/106425/?oref=defenseone_today_nl


“This post has been adapted from Bruce Schneier’s new book Data and Goliath: The Hidden Battles to Collect Your Data and Control Your World.