Financial Cryptography

SWIFT breach - embarrassed Europeans, outrageous acting in Congress, the aggreated abuses, camelgate, and the institutionalised defrauding of American values

I was right on the embarrassment call. First the Canadians, now the British, the Irish and even the European Parliament:

The European Parliament demanded Thursday that European governments and European institutions in Brussels disclose how much they knew about a secret U.S. program to tap into international banking data.

In a resolution reflecting concern among Europeans about cooperation in America's "war on terror," the Parliament voted 302 to 219, with 22 abstentions, to demand that the European Commission, the European Central Bank and the EU's 25 member states "explain fully the extent to which they were aware of the secret agreement" between Swift, an international banking consortium, and the U.S. government.

Following the arrest in Italy on Wednesday of two Italian intelligence agents suspected of helping in the alleged CIA kidnapping of a terrorism suspect and his transfer to a third country, a process known as "extraordinary rendition," the Parliament also adopted a resolution stating that it was "implausible" that "certain European governments were not aware of the activities linked to extraordinary rendition taking place on their territory." It voted to extend its investigation into alleged CIA detention centers in Europe by six months.

While the resolutions are not legally binding, they have "political teeth," said Friso Rascam Abbing, spokesman for the EU's justice and security commissioner, Franco Frattini.

The European Parliament are an odd bunch. They have little power to pass laws, but when they jump up and do something, it is a hint that something's gone awray. In this case, the Commission -- where the real power lies -- has realised the writing is on the wall:

Belgian authorities are investigating whether the Brussels-based Society for Worldwide Interbank Financial Telecommunication, or SWIFT, broke the law by passing bank transaction data to the CIA.

Once that inquiry is concluded, European Commission officials will try to determine whether EU privacy laws were also violated.

"There is no question of a cover-up," said Friso Roscam Abbing, a European Commission home affairs spokesman in Brussels.

That other apparently powerless bunch of seat warmers, the US Congress, agrees:

In a sharply worded letter, the Republican chairman of the House intelligence committee has told President Bush that the administration is angering lawmakers, and possibly violating the law, by giving Congress too little information about domestic surveillance programs.

Rep. Peter Hoekstra (Mich.) has been a staunch defender of the administration's anti-terrorism tactics. But seven weeks ago, he wrote to Bush to report that he had heard of "alleged Intelligence Community activities" not outlined to committee members in classified briefings.

"If these allegations are true," he wrote, "they may represent a breach of responsibility by the Administration, a violation of law and . . . a direct affront to me and the Members of this committee."

However, one shouldn't take the noise from Congress as too scary. In a production more befitting of Hollywood than Pennsylvannia Avenue, the bill to legalise and also slip in a few more weapons of mass privacy destruction has already been written, under cover of outrage at the White House:

The White House balked at an early draft that would have mandated the president submit the NSA program to the FISA court for review. Specter agreed to make it voluntary as long as Bush promised to submit the program if Congress passes the bill. Aides privately acknowledged it was a big concession by a president who until now has resisted judicial interference in how he wages war against terrorists.

The White House conceded in part because it believes the NSA program will survive constitutional muster and the Specter bill will make it easier to argue that the program complies with congressional statutes as well. "We've always said it's constitutional," said one administration official who was not authorized to speak on the record.

The language acknowledging the president's constitutional authority to conduct intelligence operations also was important to the White House. "We see it as historic because here's a statute recognizing an authority the president says he has," the administration official said.

Still, that language alone might mean little because it did not define the scope of the authority or explicitly suggest that a president did not need to seek court approval for warrants. But at the same time, Specter agreed to repeal a section of the original FISA law that made it the exclusive statute governing such intelligence programs.

The combination of the statement acknowledging presidential authority and the deletion of the exclusivity clause left open the interpretation that Bush has the power to conduct other surveillance outside FISA's purview, a possibility administration officials noted with approval.

Also, added, a clause sweeping all civil suits before the FISA court. Whoops! In other words, "please tell us what bill you want written to legalise it, and we will pass it, loudly and angrily." Will this Patriot sequal outsell the Pirates of the Caribbean redux? Back to the IHT article:

Revelations about the SWIFT operation have coincided with growing awareness of the CIA's use of clandestine prisons in Europe for terrorism suspects, the abduction of such suspects, and secret flights to transport them, often to countries where they might be tortured.

Note that this is backtracking at rapid speed by the EC and other regulators. Earlier statements were of the ilk of "not our jurisdiction". Note also how this is being linked to the 'extraordinary rendition' issue above and in other press reports (two Italian intelligence agents arrested in recent weeks in connection...). Keeping in mind the phone tracking and the flight data, both cases where data was passed across the Atlantic without coming back the same way, Europe is now waking up to the fact that the much vaunted European privacy model has been breached on a wholesale level. For more evidence of asymmetry accepted by lame-duck politicians, consider the 3 accused Enron scapegoats:

Lawyers for the three former bankers known as the NatWest Three confirmed yesterday that the men will complete on Thursday their fast-track extradition to America to face charges relating to an £11m fraud involving the collapsed US giant Enron.

On the same day, the Home Secretary will dispatch a minister to Washington to try save the British Government from further humiliation by persuading US senators to drop their opposition to a reciprocal US-UK extradition treaty.

In each case in isolation, the government(s) let it happen -- a one way deal. The question we are now looking at is whether the European Union and others such as US Congress, the Canadians, and the rest of the world will view the abuses in aggregate in a different light.

Curiously, the Bush administrations fears may have been justified: Notwithstanding the expected nature of this particular breach, it may become the straw that broke the camel's back. In time honoured American tradition, maybe we should call the SWIFT breach Camelgate.

Finally, we need to keep our eye on the ball here. What is the central problem? It is this: the information that is being collected is not subject to appropriate governance, something that worries as financial cryptographers. The special conditions that once applied to national intelligence activities no longer apply. That data is as we speak being moved out of the box labelled "only for counter-terrorism":

"We can use that information for terrorism, money laundering - all sorts of law enforcement purposes," Stuart Levey, the Treasury Department's undersecretary for terrorism and financial intelligence, told the House Financial Services subcommittee on oversight and investigations. "And we can do all kinds of the things that people traditionally think about when they think about data mining in terms of looking for trend analysis, suspicious activity and the like."

There, he is talking about a *new* program to trace all American/International wires. The only thing that is surprising is the breathtaking speed with which US Treasury are discarding the claims of only a few weeks ago.

Now, the naive might think that the government has the data, and if you've done nothing wrong, then you have nothing to fear. Dead wrong. Because there is no governance worth spit in place, the SWIFT value will be used for nefarious purposes. Intelligence data is already being used so:

A former ISC insider passed the dossier to the intelligence arm of the anti-corruption squad in February. The informant directed handlers to a series of ISC payments, totaling 20,000 pounds, made to a recipient identified as Detective Sergeant Gary Flood.

United Kingdom (oops: not US) Intelligence data is now available to the highest bidder. Some will see this as a good thing -- an opportunity. Some of that data is good stuff:

Among the critical assets in the database are Old MacDonald's Petting Zoo, a Kangaroo Conservation Center, Jay's Sporting Goods, several Wal-Mart stores, Amish Country Popcorn, and the Sweetwater Flea Market.

The DHS Office of Inspector General found the National Asset Database, being compiled to support a variety of infrastructure protection projects, full to overflowing with "poor quality" data, such as 4,055 malls, shopping centers, and retail outlets, 224 racetracks, 539 theme or amusement parks and 163 water parks, 514 religious meeting places and 1,305 casinos.

(spotted by 27BStroke6.)

The USA is moving with breathtaking speed to financial tracking on a comprehensive scale, available to a wide range of interested parties. The institution known as the American Value System has been breached, and is about to be defrauded in a way that makes previous scandals (mutual funds, oil-for-food, KPMG, Enron, ...) look like quaint stories told by old-timers over sherry.

Posted by iang at July 15, 2006 07:07 AM | TrackBack