FBI pursuit of Stuxnet leaks reignites whistleblower debate

The FBI is ramping up its efforts to find out who leaked information about the Stuxnet worm used to attack Iranian nuclear facilities in 2010, and that has reignited debate over whether the Obama administration's aggressive pursuit of those who leak classified information is trampling privacy rights.

U.S. Attorney General Eric Holder announced a criminal probe last June, shortly after a lengthy article by The New York Times' chief Washington correspondent, David Sanger, reported that anonymous, high-level sources in the Obama administration had told him that the U.S. and Israeli governments had used the Stuxnet worm to attack centrifuges at Iran's Natanz nuclear plant.

But the intensity of that probe has increased in recent weeks, the Washington Post reported. Jody Westby, CEO of Global Cyber Risk and a consultant on privacy, said that is a good thing.

"The Times' report on Stuxnet was shocking because of the quotes being attributed to officials from what had to be high levels of government," she said. "It was clear the article was revealing information that was surely classified. The people who provided this information have put us at risk. The DoJ (Department of Justice) inquiry is appropriate."

But Glenn Greenwald, writing in The Guardian this past Sunday, argued that one of the last remaining ways for citizens to hold the government accountable for misconduct is through unauthorized leaks. "That is why the Obama administration is waging an unprecedented war against it -- a war that continually escalates -- and it is why it is so threatening," he wrote.

"Virtually every significant revelation of the bad acts of the U.S. government over the last decade [came from leaks,]" he said, including the Bush administration's use of waterboarding and the National Security Agency's (NSA) eavesdropping on Americans without the warrants required by the criminal law.

"Silencing government sources is the key to disabling investigative journalism and a free press," Greenwald wrote.

He and a number of others contend it is those who expose misconduct who are punished, instead of those guilty of the misconduct itself. Their most recent example is former CIA officer John Kiriakou, who was recently sentenced to 30 months in prison, in connection with CIA policies on waterboarding because he spoke publicly about it, while none of those who actually did it were sanctioned or punished.

Another major element of the debate is over the government's surveillance powers. Finn, writing in the Post, said the FBI and prosecutors have "interviewed several current and former senior government officials in connection with the disclosures, sometimes confronting them with evidence of contact with journalists, according to people familiar with the probe."

"Investigators, they said, have conducted extensive analysis of the email accounts and phone records of current and former government officials in a search for links to journalists," he wrote.

The government does not need a warrant to look at government emails and phone records on government-issued devices. But, once it has any evidence of contact between a suspect and a journalist, it can then obtain a warrant to examine private email, phone and text records.

[Podcast: Stuxnet and SCADA systems -- the 'wow' factor]

Gen. David H. Petraeus knows all about that. He resigned as CIA director after the FBI discovered emails in what he thought was an anonymous account, which implicated him in an extramarital affair.

Critics of the administration's tactics also contend that its investigation and prosecution of leaks is highly selective. They say the administration is a world-class leaker when it serves its interests.

"[The Obama administration] is a prolific exploiter of exactly those kinds of leaks -- when they can be used to propagandize the citizenry to glorify the president's image as a tough guy, advance his political goals or produce a multi-million-dollar Hollywood film about his greatest conquest ("Zero Dark Thirty," about the killing of Osama bin Laden)," The Guardian's Greenwald wrote.

While Westby supports the investigation into the Stuxnet leak, she says that today's technology means there are risks to individual privacy, partially because the Electronic Communications Privacy Act (ECPA) "is very convoluted."

"If people want to ensure their constitutional rights are upheld against unlawful search and seizure and freedom of the press, they need to download all email into their laptop or servers and be sure it is deleted from all ISP servers," she said. Then it becomes a matter of search and seizure and probable cause and requires a court order."

"This is why reporters should never use Gmail or other email services that may, through their lengthy and also convoluted terms of service, say they can keep a copy for whatever purpose they want," she said.

Read more about malware/cybercrime in CSOonline's Malware/Cybercrime section.

Join the CSO newsletter!

Error: Please check your email address.

Tags The New York TimesapplicationsData Protection | MalwarelegalStuxnetsoftwarefbidata protectioncybercrimenew york times

More about BushDepartment of JusticeFBINational Security AgencyNSA

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Taylor Armerding

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place