Plame, Iran, the CIA, Bloggers, and the "Cyber Storm" war game.

I apologize in advance for the somewhat sporadic content in this, but I'm currently preserving this as a chronology.

Original Post:
Outed CIA officer was working on Iran, intelligence sources say

"The revelation that Iran was the focal point of Plame's work raises new questions as to possible other motivating factors in the White House's decision to reveal the identity of a CIA officer working on tracking a WMD supply network to Iran, particularly when the very topic of Iran's possible WMD capability is of such concern to the Administration."

First Update:
Heads up! About an hour after posting this article, my stumble page got visited by 198.81.129.193 (relay1.ucia.gov).

Did this article strike a nerve? Or just general interest in Iran's alleged WMDs?

Is the CIA stumbling? Or does this relate to the 5 web crawlers that hit my site in that hour-long window?

Second Update: More on the Iran / Plame connection


February 22rd Update:
I've had more than a couple of people ask me how I know the IP address of who visits my stumble page, so I figured an explanation was due.

Sadly, its a trick I learned from spammers and marketing departments. They call them "web bugs".

Spammers use them to confirm which email addresses are read by real human beings. I merely use them to monitor some basic information about who's reading my stumbleupon web page, since I don't have direct access to their logfiles.

As evil as "web bugs" may sound, its something as harmless as an image embedded in HTML content when rendered by most web browsers and email clients. Said image is hosted on a web server that you control, or at the very least, have direct access to the web server's log files.

When someone views the web page, their web browser loads the image directly from the server in which you monitor the logfiles, leaving behind a few key bits of information about the visitor.

The time and date of the visit is recorded, what web browser software the client claims to be using, and most importantly, the IP address. The "whois" service, makes it particularly easy to identify which organization is registered for any given block of IP addresses.

Fear not, this doesn't identify you personally. Most of the time this registration record is in your Internet Service Provider's name. Sometimes this information may reveal what company you work for if you're browsing from work, but usually just your ISP. Though, if push comes to shove, and they really want to know, your ISP can be subpoenaed and be compelled to turn over information on who you are.

If you happen to be using a government supplied connection, the registration records clearly state which particular branch of the government you work for.

This highlights some very important privacy concerns. It shows how easy it is to unknowingly leak information about ourselves and our activities.

Not only have I been visited by the CIA, but also the United States Army Corps of Engineers and the Commonwealth Ombudsman of Australia.

Other interesting hits come from the Australian Sports Commission, Wells Fargo Bank, Amazon.com, the Hebrew University of Jerusalem, and the State Research Center of Russian Federation's Institute for High Energy Physics.

Perhaps the most intriguing visits I've received comes from PLEXSYS Interface Products, Inc.

"PLEXSYS Interface Products, Inc. specializes in the provision of modeling and simulation systems and support services for aircraft and airspace control. Within this general scope, accomplishments include the design and support of war-gaming exercise scenarios, provision of in-the-field simulation support (equipment and personnel), development of courseware, and consulting services for simulation support, interface design, and process controls."

The war game exercises are of particular significance, considering recent publicity of government cyber-warfare exercises that included bloggers in their simulation. Was my blog part of their war game simulation?

A look at the logs shows:

198.81.129.193 - - [13/Feb/2006:10:05:15 -0800] "GET /debt_clock_history.gif HTTP/1.0" 200 4885 "http://smugllama.stumbleupon.com/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705; .NET CLR 1.1.4322)"

198.81.129.193 - - [13/Feb/2006:10:05:15 -0800] "GET /georgedalmas.jpg HTTP/1.0" 200 11391 "http://smugllama.stumbleupon.com/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705; .NET CLR 1.1.4322)"

70.96.111.29 - - [14/Feb/2006:15:00:07 -0800] "GET /georgedalmas.jpg HTTP/1.1" 200 11391 "http://smugllama.stumbleupon.com/" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1"

70.96.111.29 - - [14/Feb/2006:15:00:07 -0800] "GET /debt_clock_history.gif HTTP/1.1" 200 4885 "http://smugllama.stumbleupon.com/" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1"

Interestingly, the CIA visited my stumble page just one day before PLEXSYS did. Hard to tell for certain if the two are related.

Based on some of that logfile information, both claim to use Windows XP. One uses Internet Explorer, one uses Firefox. Maybe these guys just stumble during their lunch breaks?

Maybe. However, lying about what web browser software you're using is quite trivial. For example, you can alter your user-agent in Firefox to anything you want by using any one of many Firefox Extensions. The same forgery can be applied to any web spider that is programmed to crawl the web.

February 23rd Update:
A bit more research on the government exercises shows that these hits came 3 to 4 days after the officially announced conclusion of the exercises.

This begs the question of, "Was this really just an exercise?"

Either the war games ran longer than they said it did, or this wasn't really a game, but an intelligence gathering operation.

The exercises finished Friday. The CIA visited on following Monday. PLEXSYS visited on Tuesday.

What's going on here?

These guys aren't stumbling. They're reviewing the results of intelligence culled from their "exercises".

Greenland's ice sheets are melting at twice the rate they were 5 years ago. This is news that NASA had discovered and the Bush administration tried to keep it from coming out. NASA didn't comply. Buy boats folks, the end is nigh.

Google News Is Evil: Google uses sneaky javascript to track what you click on.

Recently I noticed that when I copied a link on a Google News search, the URL I pasted didn't match the URL that was initally listed. It rewrote the URL to a google redirect page. After studying it a bit longer, I noticed that this only ocurred after right-clicking on an external news link.

When you move your mouse over an external link, the status bar at the bottom of your browser shows you the URL that it is linking to. There's a fair degree of trust that is placed in this text. For example, If it says its linking to http://www.microsoft.com, its pretty safe to assume that when you click that link, you'll be sending that request directly to the microsoft webserver. This is not the case with Google News.

When you click on a Google News link, the URL is silently rewritten using JavaScript, so that you first contact Google's webserver to tell them what page you just clicked on, and then Google redirects you to that page. The practical upshot of this is that Google now knows every news article you clicked on.

Initially, I though this problem only affected Firefox, because it was the only browser I observed behaving this way. Apparently I'm not the only one to make that mistaken assumption -- I found several pages of other people talking about this as a Firefox only problem. But, with a bit quick bit of research with a packet sniffer, I determined that ALL web browsers that support javascript (IE, Firefox, Konqueror) also have this problem -- they just don't show it to you like Firefox does.

Why isn't this considered a security vulnerability? This has a high potential to be abused by scam artists and social engineers. Last time URL spoofing was a public problem, Microsoft issued a security patch to rectify the problem. (Usernames containing NULL characters would truncate the display of the rest of the URL in the status window. Microsoft's lame response was to terminate support for including usernames in a URL. Although this was a lame fix, this DID stop URL spoofing.)

Most users, even advanced users, would never know that their news browsing habits were being bugged unless they knew a lot of javascript and took the time to read the source code or took the time to sniff their own browsing habits.

A friend has also pointed out that they use the same hidden URL rewriting on their "Sponsored Links" on search result pages, though I consider that to be a slightly more legitimate use of this trick. Tracking what News I'm reading isn't helping anybody's marketing department... I can only see one purpose for this information, and it relates to domestic surveilance.

Although, I'm not surprised that Google tracks what news articles you read, in fact -- I'd expect that from Google, but what really irritates me about this is the deceptive nature in which they do so. They go to great lengths to hide this behavior. This is tantamount to SpyWare. Wouldn't it be a whole lot easier to just put the Google redirect URL in the HTML source code? Yes, of course... But then people could easily see that they were being tracked just by looking at the URL in the status bar.

So much for their "Don't be evil" motto. Good thing that mottos don't carry any legal weight.

Update: It has been rightly pointed out that Google's public terms of services clearly permit them to collect this information. I'm not disputing Google's right to collect this information, but rather how they collect it.

Conclusion: Disabling javascript on Google News sends them less information about what you're interested in.

NSA Whistleblower Alleges Illegal Spying: Former Employee Admits to Being a Source for The New York Times (ABC News)
"Russell Tice, a longtime insider at the National Security Agency, is now a whistleblower the agency wouldlike to keep quiet. For 20 years, Tice worked in the shadows as he helped the United States spy on other people's conversations around the world. ... But now, Tice tells ABC News that some of those secret "black world" operations run by the NSA were operated in ways that he believes violated the law. Tice says the technology exists to track and sort through every domestic and international phone call as they are switched through centers, such as one in New York, and to search for key words or phrases that a terrorist might use. President Bush has admitted that he gave orders that allowed the NSA to eavesdrop on a small number of Americans without the usual requisite warrants. But Tice disagrees. He says the number of Americans subject to eavesdropping by the NSA could be in the millions if the full range of secret NSA programs is used. The same day The New York Times broke the story of the NSA eavesdropping without warrants, Tice surfaced as a whistleblower in the agency. He told ABC News that he was a source for the Times' reporters. But Tice maintains that his conscience is clear. The NSA revoked Tice's security clearance in May of last year based on what it called psychological concerns and later dismissed him. Tice calls that bunk and says that's the way the NSA deals with troublemakers and whistleblowers. Today the NSA said it had "no information to provide.""

The Pimping of the Presidency: Jack Abramoff and Grover Norquist Billing Clients for Face Time with George W. Bush



Four months after he took the oath of office in 2001, President George W. Bush was the attraction, and the White House the venue, for a fundraiser organized by the alleged perpetrator of the largest billing fraud in the history of corporate lobbying [Jack Abramoff]. He had just concluded his work on the Bush Transition Team as an advisor to the Department of the Interior. He had sent his personal assistant Susan Ralston to the White House to work as Rove's personal assistant. He was a close friend, advisor, and high-dollar fundraiser for the most powerful man in Congress, Tom DeLay. Abramoff was so closely tied to the Bush Administration that he could, and did, charge two of his clients $25,000 for a White House lunch date and a meeting with the President.

Abramoff was at the meeting, for which he charged the Coushatta Tribe $25,000. The change in Poncho's position is odd in light of the fact that he and his spokespersons have maintained for more than a year that he did not meet with President Bush in May 2001. Norquist has not responded to inquiries about using the White House as a fundraiser. It is, however, a regular ATR practice to invite state legislators and tribal leaders who have supported ATR anti-tax initiatives to the White House for a personal thank-you from the President. A source at ATR said no money is ever accepted from participants in these events. The $25,000 check from the Coushattas suggests that, at least in this instance, Norquist's organization made an exception. The $75,000 collected from the Mississippi Choctaws and two corporate sponsors mentioned in Abramoff's e-mail suggests there were other exceptions. Norquist recently wrote to the tribes who paid to attend White House meetings. His story regarding that event is also evolving. The contributions, he told tribal leaders in letters that went out in May, were in no way related to any White House event. That doesn't square with the paper trail Abramoff and Norquist left behind, which makes it evident that they were selling access to the President.

Inside Pentagon's Fight to Limit Regulation of Military Pollutant
Rocket Fuel Got Into Water; The Issue: At What Level Does It Pose Health Risks?
by Peter Waldman / Wall Street Journal

Four years ago, while U.S. troops were toppling the Taliban in Afghanistan, the Environmental Protection Agency lobbied a different sort of a bomb-shell at the Defense Department. EPA scientists recommended strictly regulating a chemical that is a key component of munitions, but that has seeped into drinking-water supplies.

The EPA said it had determined that the chemical, called perchlorate, endangers babies' brain development when present even at trace levels. As a prelude to possible formal regulation, it proposed declaring that a safe level of the chemical in drinking water would be just one part per billion. That's an amount so minute it wouldn't even have been detectable a few years ago.

Pentagon officials were aghast. Defense suppliers had discharged massive quantities of the chemical into soil and streams during the Cold War, and they still need it for weaponry. Such a strict limit could mean the Pentagon and defense contractors would have to clean up scores of water sources in 35 states and even the mighty Colorado River, with a water flow of 67,000 gallons a second at the Hoover Dam.

Fearing both the costs and possible curbs on arms production, the Pentagon took its case to the White House, which told the EPA to stand down while an outside scientific panel looked at the issues. The panel then issued a middle-ground report that has left some senior EPA scientists deeply unhappy and the Pentagon still pressing for the minimum possible cleanup.

The standoff, involving two high-profile federal agencies, shows how the burgeoning science of low-dose chemical exposure is raising both the stakes and the stratagems in today's pollution fights. There's no question perchlorate interferes with the body's ability to make thyroid hormone, a substance that everyone needs but babies especially so. The question is how much exposure it takes to do harm. The controversy has intensified with science's growing ability to detect and test chemicals at extraordinarily low exposure levels.

The appeal to the White House was just one of the several moves by defense interests in a long struggle with the EPA over whether and how to regulate perchlorate. Among other tactics: Perchlorate users financed a study of the chemical's health effects -- then undermined their own study when results went against them.

Perchlorate, used chiefly in solid rocket fuel, first polluted groundwater decades ago at a munitions plant outside Sacramento, California, triggering years of resistance by the plant's operator to state regulatory efforts. Then in 1997, after technical breakthroughs allowed detection of the chemical at far lower levels than before, it began to be found in water supplies in Southern California.

EPA scientists traced one plume up the Colorado River aqueduct to Las Vegas. There, they found the source in an old plant that once manufactured the missile propellant. The soil beneath was tainted and the chemical was seeping into the river.

In the human body, perchlorate blocks the thyroid gland from absorbing iodide, which the gland needs to make thyroid hormone. The Pentagon and defense industry say such interference isn't dangerous, at least so long as it's only partial, because most adults produce plenty of the hormone.

The EPA, however, focused on fetuses and infants. They need thyroid hormone every day, because it is critical during brain development. And unlike adults, they can't store a supply. Because risk levels weren't well understood, the EPA and the Pentagon agreed in the late 1990s to cooperate to find answers. Several defense contractors, linked in what was called the Perchlorate Study Group, agreed to pay for new research.

The centerpiece was a $3 million experiment involving 3,000 mother, infant and fetal rats. Pregnant rats and pups were fed varying levels of perchlorate for several months. Scientists then dissected the rats' thyroid glands and brains. Researchers started with the rats that got the largest dose of perchlorate, intending to work downward until they found a dose so small that it had now effect.

They never found such a dose. Even at the lowest dose tested -- 0.01 milligrams per kilogram of rat weight per day -- the scientists saw a pattern of altered growth in several regions of the baby rats' brains. They also saw effects on their thyroid cells and hormone output.

Chemicals don't necessarily affect rats and humans the same way. Still, the results would be considered "adverse effects" under EPA policy, the agency's team leader, Ann Jarabek, warned the defense interests. She told them the results would tend to reduce the level of perchlorate exposure the EPA ultimately would deem safe.

Sponsors of the study then did something unusual. Instead of submitting the final results of the study to the EPA, the defense companies that paid for the study commissioned a critique of their own research. They hired a consulting firm, which asked five academic scientists to study the study.

A few months later, in May 2001, the defense contractors delivered to the EPA a 200-page critique of their own study. It found fault with the study's design, with the handling or rat pups, with what the rat pups were fed and with the way the rat-brains were sliced and preserved. Conclusion: They said their multimillion-dollar study they financed was highly flawed.

The agency's chief of neurotoxicology, William Boyes, says he had never seen sponsors of a study attack their own work. "Usually," he says, they either "stand behind their data or they go back and do another study."

Also puzzling: The head of the consulting firm the defense industry hired to critique the original study had been that study's science adviser.

This consultant is Michael Dourson, who leads a nonprofit science consulting firm called Toxicology Excellence for Risk Assessment, or TERA. Dr. Dourson says the critique wasn't an attempt to discredit the rat study, but simply to explain its "biological significance."

The laboratory that had done the rat study says it stood ready to do it over if necessary to correct any flaws identified. But the defense industry didn't ask the lab, Argus Research Laboratories in Horsham, Pa., to do it over. Asked why not, an executive of one major user of perchlorate, the Aerojet missile unit of GenCorp Inc., said it was because EPA guidelines regarded animal studies as inferior to human ones anyway. So, he said, the industry had by this time decided to focus on human research.

One Part Per Billion

In early 2002, the EPA, equipped with the rat study's final results and also the critique of it, issued a draft risk assessment for perchlorate, proposing a safe limit for the chemical in drinking water supplies. This would constitute the first step towards possible regulation, which can occur only after further study, including a cost-benefit analysis. The EPA's proposed safe limit was quite strict: a mere one part per billion.

Pentagon officials felt sandbagged. The defense industry paid for the rat study in the expectation that they would hear privately from the EPA about any problems it presented. Instead, they learned the same time as the public of the strict safe limit the EPA now wanted.

"All of the sudden, up on the screen popped this one parts per billion standard -- where did that come from?" says Raymond DuBois, a former deputy U.S. undersecretary of defense who's now acting under secretary of the army. This limit, he says, "had no consistent scientific confirmation."

EPA officials, asked why they didn't warn the industry the strict proposal was impending, said that while they cooperate with industry on research, the job of setting safe exposure levels is theirs alone.

"Perchlorate is now among the better understood compounds," says Paul Gilman, the EPA's former chief scientist. "At some point, the agency had to step inside itself as a regulatory body and determine the weight of the evidence."

The furor the EPA had stirred was soon evident at a gathering known as a peer-review workshop, where a panel of scientists discussed the proposal. The workshop took place in early 2002 in Sacramento, near the site of decades of groundwater perchlorate pollution from the Aerojet missile factory.

The session was tumultuous, featuring environmentalists, regulators, consultants and lobbyists. Among the speakers was La Donna White, a president of an African-American doctors' group, who said the EPA proposal would divert funds from "real health issues" affecting blacks and "scare the public." She later repeated her points in an op-ed essay in a local newspaper -- and in a news release put out by a lobbying group for perchlorate users, the Council on Water Quality.

Dr. White, a family physician, says she had learned about the issues from a guest at one of her medical-society meetings, Eric Newman. He is a lobbyist for a screening firm that has lobbied on perchlorate matters for defense contractors. Dr. White says she didn't know he was a lobbyist when he asked her to speak to the EPA. She didn't reply to an email asking whether anyone had helped her draft her perchlorate commentaries -- two of which misspelled her first Anne. Mr. Newman didn't return messages left for him.

Pentagon's Position

Perchlorate users and the Pentagon said the chemical was safe in drinking water at 200 times the safe limit the EPA wanted, that is, at up to 200 parts per billion. The pentagon's Mr. DuBois appealed in early 2003 to the White House Office of Management and Budget, which referees inter-agency disputes. Given the strict limit the EPA was pushing for, he said, "I said, 'Time Out!'"

The White House told the EPA to halt further action on the chemical, and arranged for the EPA and three other agencies to sponsor further review by the National Research Council, a federally funded group that vets issues for the government and others. The council, in turn, named a panel of scientists, who did a wide-ranging assessment that included public hearings in 2003 and 2004.

At the hearings, the EPA came in for harsh criticism from perchlorate users and consultants working for them. An Air Force colonel, Daniel Rogers, termed the EPA's work "biased, unrealistic and scientifically imbalanced." Colonel Rogers also said perchlorate is critical to U.S. security because while highly explosive, it is stable during handling and storage. Besides missiles, it is used in various battlefield weapons and flares and munitions for training.

In January 2005, the National Research Council panel announced its conclusions. It called the rat research inconclusive and said perchlorate's key effect of blocking iodide from entering the thyroid gland, and thereby interfering with production of thyroid hormone, was not in itself dangerous. Still, it said, exposure to perchlorate should be restricted because of the high stakes for babies.

The panel recommended a maximum safe exposure level of 0.0008 milligrams per kilogram of body weight per day, based on a small study of human volunteers. For an adult drinking a normal amount of water, that would permit about 24 parts per billion of perchlorate in drinking water -- assuming people ingested no perchlorate from any source except water.

In fact, however, the EPA's working assumption in such cases that drinking water accounts for only 20% of people's exposure to a waterborne contaminant. Recent studies indicate that small amounts of the chemical are in a wide variety of fruits and vegetables, possibly from irrigation water, as well as in some dairy products and breast milk.

Some EPA staffers assumed their agency would reduce the safe level in drinking water well below 24 ppb to adjust for several factors, including exposure through food. Instead, the EPA quickly adopted the panel's assessment as its own, eschewing the internal and external peer reviews that normally precede a formal EPA listing of a safe level for a chemical.

An EPA spokeswoman said no additional reviews were needed before adopting the 24 ppb safe limit because of extensive internal and external scrutiny of the chemical done several years ago. She also said it was natural to use the National Research Council's conclusion as the EPA's own because the EPA was among those who sponsored the review.

Some state agencies criticized both the National Research Council assessment and the EPA for quickly adopting it. Massachusetts complained to the EPA that the research-council panel had based its analysis on a study of just seven adults rather than on babies. Massachusetts reaffirmed its own health advisory that is as strict as the safe limit the EPA envisioned in 2002: one part per billion in water. Meanwhile, two regulators from Connecticut and Maine wrote a science-journal commentary accusing the EPA of superseding its own scientific judgment with flawed review by an outside body.

New Guidance

Today, Pentagon and White house officials are drafting new guidance for toxic-site cleanup officials. Intended to go out under the EPA's name, the guidance under consideration would effectively fix the cleanup standard for federal pollution sites at 24 ppb. The result is that many water bodies with less perchlorate than that would escape cleanup. Several senior EPA staffers believe the agency would be better off with no perchlorate cleanup policy than with this one, emails reviewed by the Wall Street Journal show. "We got a very ugly set of comments from Office Management and Budget last week that eviscerated the guidance" to be given to cleanup officials in the field, one senior EPA staffer emailed a colleague this fall. EPA spokeswoman Eryn Witcher said the policy is still undergoing internal deliberation.

All the skirmishing thus far still doesn't determine whether the federal government ever will actually regulate perchlorate with a mandatory water standard. To help decide that, the EPA plans to test drinking water supplies nationwide over the next several years. It is also monitoring the blood and urine screenings and tests of food, to measure Americans' exposure from sources other than drinking water.

The arms industry thinks even the safe limit of 24 parts per billion is far too strict. It notes that the National Research Council said the effect on the thyroid wasn't itself adverse to health, but merely could possibly lead to ill effects, in a chain of events. Says Dr. Dourson the defense-industry consultant: "The committee chose a precursor to a precursor to a precursor to an adverse effect in the development of its safe dose."

====

In accordance with Title 17 U.S.C. Section 107, the material on this site is distributed without profit to those who have expressed a prior interest in receiving the included information for research and educational purposes. For more information go to: http://www.law.cornell.edu/uscode/17/107.shtml

Bush allowed spying on Americans in US after 9/11 - Presidential order authorized NSA to eavesdrop without court warrants. (By Tom Regan of the Christian Science Monitor)
A few months after 9/11, President Bush authorized the National Security Agency (NSA) to eavesdrop on Americans and others in the US without having to obtain the court warrants normally required in these situations, according to government officials. The New York Times reports that as a result, the NSA has monitored the international phone calls and e-mails of "hundreds, perhaps thousands" of people living in the United States. ... The Times also reported the White House asked it not to publish the article, "arguing that it could jeopardize continuing investigations and alert would-be terrorists that they might be under scrutiny." As a result, the paper delayed publishing the article for a year, and omitted some information that the administration said would be useful for terrorists.