Slashdot Mirror
UPS Denies Helping the NSA 'Interdict' Packages
An anonymous reader writes "When Glenn Greenwald's book came out recently, one of the most startling revelations was that the NSA has been intercepting shipments of networking gear to add spyware. Cisco was one of the vendors whose gear was altered, and now their shipping provider has spoken up about it: 'UPS, which Cisco has used since 1997 to ship hardware to customers around the world, said on Thursday that it did not voluntarily allow government officials to inspect its packages unless it is required to do so by law. "UPS' long-standing policy is to require a legal court-ordered process, such as a subpoena, before responding to any third-party requests," UPS spokeswoman Kara Ross wrote in an e-mail to TheBlot Magazine. "UPS is not aware of any court orders from the NSA seeking to inspect technology-related shipments." In a follow-up e-mail, Ross said UPS had no knowledge of similar orders from the FBI, CIA or any other federal agency.' That sounds like carefully parsed language to me. 'Did not voluntarily,' 'unless it is required to do so by law.' Perhaps they're bound by a National Security Letter?"
Not voluntarily unless required by law? Why do companies release statements like this? It just makes them seem more guilty. Better not to say anything.
If the device is made (or packaged in the US) and is being shipped overseas, the NSA can grab it at customs, there is nothing the shipper can do about it.
I was once a fool to think I could believe anything the Government, or Corporations told the public. No more.
This is how resentment is nourished, and enemies are made! How can they not know this is bad in the long run?
The UPS statement is full of disclaimers like 'unless required by law' and 'not aware of' type statements. Its pretty clear that they're spinning it hard to avoid scrutiny.
So, what kind of spyware could be installed on an IOS router? Does the NSA write their own bootloader?
Excuse my ignorance, I am not from the U.S., but I thought only the F.B.I. could serve National Security Letters. Can the NSA also serve them?
> unless it is required to do so by law
And there is your problem.
Of course - only the mailroom dude got the letter.
I watched sneakers a couple days ago (it's on netflix) and nearly shit my pants at the end when Robert Redford reveals the magic decryptor box isn't for spying on the russians, it's "for spying on us". (Of course, they meant the NSA was spying on the FBI/CIA but still... future predicted).
Do you even lift?
These aren't the 'roids you're looking for.
When you weaponize U.S. technology products to the extent that the NSA has, don't be surprised when no one wants to buy those products in the future.
What foreign CEO or government official wants U.S. technology in control of their banking industry? Their communications infrastructure? Their manufacuring base? Their electrical power and distribution network?
Can you imagine the U.S. response if the critical infrastructure items such as those listed above were found out to be backdoor and controllable at will by the Russians? Chinese? Indians?
The U.S. has a serious reputation problem right now. We need to stop this nonsense immediately if we expect our tech industry to survive.
It takes a second to destroy a reputation - it takes years, sometimes decades to build it back.
"Perhaps they're bound by a National Security Letter?"
Maybe. It could also be exactly what they say - When presented by an actual warrant to intercept items (EG for goods purchased with stolen credit cards or contraband) they follow it. That WOULD include national security incidents too but, as they say "UPS is not aware of any court orders from the NSA seeking to inspect technology-related shipments" and I'd think a gag order would prevent them from affirming or denying the issue.
Just like Google, Microsoft, Apple, etc, etc. Nobody wants to fess up, but some appear to be "trying" to step up to the NSA now.
I wonder if they (private companies) secretly allowed it(NSA infiltration) to happen under fear of the NSA using whatever power they have to get the companies shut down if they didn't follow suit. Now that the public has been informed, the companies are using all the plausible deniability they can to prevent lawsuits. In the case of the UPS, I don't think there's any plausible deniability to use...It's not a software system that the NSA could exploit per-se.
Or is it the case these companies really are just as corrupt as the NSA?
I really don't see any other alternative, unless you want to argue that Snowdens docs were fake (Highly unlikely).
Don't buy the PR. The ONLY thing identifiable in those pictures was the Cisco logo on a shipping box. What does GG get for product placement as victim?
If an IT something-or-other tell me they are shipping me a configured router or switch or whatever, do I check to see how many layers of tape are sealing the box? No. No one does. We accept because anything else is inconvenient. A UPS driver isn't going to notice if sone of his or her packages has more sealing tape than normal. And, since most of these packages go through some sort of distributionn centers that are cavernously huge, who knows what happens inside that structure. Am I paranoid? Maybe. Is it still true? Maybe...
The only thing in the statement of possible value is that UPS don't break security for just anyone. Well, isn't that expected... law and part of conditions of posting? If not, then there is possibility of interpreting this statement at face value.
However, if secure postage in terms of the law is guarenteed anyway then this statement says _nothing_. And if a statement says nothing then the purpose is clear - they are desperately trying to sub communicate under a gag order. Trying hard to highlight the problem to those who can read between the lines to bring attention to the economic damage gag orders are having to the economy.
I don't know if UPS ensure any security of packages so I don't know which it is - maybe you do.
A blog I run for the wealth
Would the NSA be bold enough to physically interdict trucks? Guys with badges and guns tell you they need something in your truck, tell you you never saw them and by the way, driver Fred, you did a nice job on that new downstairs bathroom, tile job looks real professional, I'll bet your wife and daughter really like how nice it is there.
Or is it even remotely practical to identify specific package/truck combinations?
I'll still not be trusting anything or anyone. Not because I have something to hide, but because of principle of all this sneakiness being bullshit.
Being sneaky is not good security. The fact that your possible "methods" of finding da terrorists being hidden hasn't worked already, outside of maybe finding some retard from 4chan that is going to try mess with football again, says much.
But as a bigger problem, so many people are going to be turned off by this.
I'm sure one group already outright said they are never buying Cisco hardware again because of this. Thanks NSA, you damaged Cisco and your own economy. (forgot who that was again though)
And it is likely only going to get worse.
Funny how there was all this crap going around about spyware in Chinese hardware. I wonder if they were trying to make everyone hate them so they'd eventually get "permission" for global spying (aka the project that already existed long before)
Was there ever even any proof of that? I know it is much harder to both hide and find hardware spying devices than software counterparts.
Seems to me that unless the law prohibits it, tech companies will need to start using tamper evident packaging. Then it won't matter if the NSA, CIA, FBI or other 3 letter agencies intercept the product during shipping. Perhaps glitter embedded in varnish painted over critical screws/fasteners, then photographed from various angles and posted to a web page, or emailed to the customer prior to shipping. Then if the item is intercepted the 3 letter agency will have a rather ... difficult ... time bypassing those seals such that careful examination upon receipt against the photographs received earlier won't reveal any tampering.
NSA hires on people to work at UPS, NSA gets access. Two easy steps. That's exactly what Snowden did in his jobs.
Odd, and careful choice of words there guys.
---- Booth was a patriot ----
Of course they're gagged by a National Security Letter. This whole process is disgusting.
"Stories on rearranged routing yielded great overstatement today. For UPS customers keep invaluable. No government necessitated said law!"
Cisco could make life miserable for the NSA by warehousing its gear in countries that won't cooperate with the US. Non-US orders could be filled from the closest such warehouse.
Non-cooperating countries that spring to mind include Russia (for European orders), China (for Asia), Venezuela (for S. America) and maybe Palestine (for the Middle East and Africa). I don't believe there are any N. American countries that the US can't coerce, so maybe the affected countries should use other network vendors.
The downside is that delivery times for overseas orders might become quite long :-) and/or spendy.
In a follow-up e-mail, Ross said UPS had no knowledge of similar orders from the FBI, CIA or any other federal agency.
This just beggars belief. It's well known that all US couriers have security divisions that work with federal and state government agencies. They routinely help with investigations of suspicious packages containing drugs, counterfeit products, explosive materials, firearms, etc.
Here's what one UPS executive, customs and brokerage manager Norman T. Schenk, had to say in a Congressional hearing in 2000 on how to stop illegal drugs from being delivered by mail:
Our partnership with the Customs Service has dramatically ...
curtailed the flow of contraband. Today, Mr. Chairman, we urge
you to ensure that the Customs Service has the 21st century
tools it needs to maintain the extraordinary growth of commerce
in this new millennium. Last year, the United States received
21 million commercial shipments. By 2004, that number is
projected to climb to 50 million. Customs simply cannot inspect
each shipment by hand.
Mr. Chairman, full funding of the new automation system
known as ACE, the Automated Commercial Environment, is
essential for Customs to keep pace with the growth of commerce.
No technology can enable the Customs Service to inspect 50
million shipments, but ACE can help Customs leverage the power
of information to target its inspections efficiently and
precisely.
Our own experience at UPS shows the difference such a
system will make. Our advanced electronic manifesting procedure
provides Customs with extensive information from the
destination of a parcel to a description of its contents on
every package we transport to the United States before it
arrives at a UPS facility.
In addition to our work with Customs, UPS conducts an
aggressive and thorough drug interdiction program of our own.
We train delivery drivers to spot packages that may contain
illegal drugs. We screen for suspicious parcels. We routinely
work with the other law enforcement agencies like the FBI, DEA,
and State and local authorities, including providing them
information about any offender we identify.
So they not work with 3 letter federal agencies routinely, but they do it without the prompting of a subpoena, or NLS.
This all presupposes that Cisco wasn't sending these routers to Fort Meade to begin with, with the NSA re-shipping the routers to their final destination after modification.
But people can't be inconvenienced. Treat political parties like sports teams. Fuck yes, Elephant Asses! GO TEAM GO.
Can't be arsed to actually pay attention to what's going on. Can't be arsed to take time out of busy schedules of masturbating to the American Dream to actually track down your politicians and confront them, in person, where they can't ignore you. (Words, people, I'm talking about words, just to be clear.)
Can't be arsed to learn anything about a subject before attaching to a pop-soundbyte about it and defending it to the death.
Fuck us. We have better government than we deserve. Because we yet have the power to mold it as we see fit.
But we won't. Because fuck it all, Game of Thrones is on, man. LOL TITTIES.
What ever happened to not tampering with the mail and that includes packages as well? I find the lack of respect for privacy disturbing and this sort of thing will come back to bite the government in the ass someday. The government can't expect privacy and secrets to be kept secrets when they themselves have created tools that can be used by anyone to violate government privacy and secrecy. Karma is a bitch.
OK, so the NSL is basically a secret letter, that nobody wants to talk about. How do they (recipients) even know if/when they're legit. It's not like there's a 1-800-DIAL-NSA number to check it out.
What's to stop "shady group X" from getting some serious looking guys with suits, sunglasses, and some fake ID's+forms to drop by the local datacentre and say "OK, we're NSA and we need records/access from this group of servers here. Oh, and you can't talk about this to anyone. Delay us and very bad things will happen to your and/or your business"
If you're going to use a fancy word like 'interdict', scare quotes and all, you might want to check that it means what you think it means first...
And of course they are blaming the economic damage on getting caught as opposed to, well, what they were doing.
Of *course* they are. They're responsible for the consequences--but they also are right, Snowden's whistleblowing was also a cause. He has (with them) done probably billions of dollars of harm to the US tech industry.
Without him, it wouldn't have happened. Without them, it wouldn't have happened. They both did it for motives that they believed justified the cost.
In almost every way The National Security Organization is a lawless, limitless, overreaching mistake, with no applied checks and balanves. The NSA exemplifies the start of what can go wrong.
https://www.youtube.com/c/BrendaEM
Or... they could have received a National Security Letter.
By law, they have to deny the existence of the letter and its contents.
By law, if they have received a NSL, they have to say that they are "not aware of receiving any court orders or subpoenas from the NSA".
See, perfectly clear denial.
I don't read your sig. Why are you reading mine?
My takeaway is that UPS doesn't care what I ship, as long as it doesn't damage their business model. Unfortunately despite their size, they're not big enough to tell the gubberment to go get stuffed. Well, they could - once.
since the NSA also happens to slap gag orders on everyone too. Pointless.
That's as stupid as blaming the police for the crime rate because if the police didn't write up the reports the crimes wouldn't be counted.
"[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz
If they interdicted your router you'd never get it.
We have no authority to accept or implement NSLs at this company site. Please deliver them as an e-mail attachment to our government compliance department's (publicly readable) server.
Have gnu, will travel.
A solution to this was invented centuries ago. Seal the packages of network hardware with tamper-proof seals (something involving smart cards that the NSA can't duplicate) from the manufacture. Make it impossible for the NSA to open the package without making the customer aware the package was opened in transit. If a package was opened in transit, return to sender and Cisco engineers can figure out how the NSA is implanting bugs.
You, sir, made my day :)
"If you have nothing to hide, you have nothing to fear." - Every fascist, ever
You nailed it. UPS is scott-free. All UPS have secured federal facilities into which all cross-boarder shipment pass and "you don't need to know whats going on in there." Bahhhhh, don't piss on us and call it rain, we know better.
What everyone were to claim that they had received one. Would they have to arrest and jail everyone?
UPS really sucks internationally, they have all sorts of customs/direct shipping agreements with other countries and yet sill charges 'their own brokerage fee' depending where you are.
A package came to my door, someone else signed for it, was then told they must pay the customs/brokerage fee(they did).
I didn't want package, asked about refusing it(never opened) and they said you cannot and there is no refund. They were also good enough to say it was not a government/regulatory fee just one they choose to screw people with to make cash(Was $12.50 in my base, which was about the cost to ship from sender).
By law they can't mention it. NSL's cannot compel you to lie.
For real? I suppose denying knowledge of a government investigation via a NSL isn't lying even though you have knowledge of such an investigation (or request for information). NSLs require lying if a third part inquires about it.
"Those who can make you believe absurdities can make you commit atrocities." - Voltaire