Team Themis

Team Themis (not to be confused with Koch big data effort (to ctr Obama GOTV?)
1) PALATIR THIEL 2) HBGARY  3) BERICO

ex gov't ppl  on what basis sep from service?
  this machine kills secrets
<a href="https://www.amazon.com/This-Machine-Kills-Secrets-Whistleblowers/dp/0142180491">https://www.amazon.com/This-Machine-Kills-Secrets-Whistleblowers/dp/0142180491</a>
<a href="https://en.wikipedia.org/wiki/This_Machine_Kills_Secrets">https://en.wikipedia.org/wiki/This_Machine_Kills_Secrets</a>

This Machine Kills Secrets is a 2012 book by <a href="https://en.wikipedia.org/wiki/Andy_Greenberg" title="Andy Greenberg" style="text-decoration-line: none; color: rgb(11, 0, 128); background: none rgb(255, 255, 255); font-size: 14px;">Andy Greenberg</a> (<a href="https://en.wikipedia.org/wiki/Forbes" title="Forbes" style="text-decoration-line: none; color: rgb(11, 0, 128); background-image: none; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial; font-size: 14px; background-color: rgb(255, 255, 102);">Forbes</a> Journalist).<sup id="cite_ref-FOOTNOTEAllnutt2012_1-0" class="reference" style="line-height: 1; unicode-bidi: isolate; white-space: nowrap; font-size: 11.2px; color: rgb(32, 33, 34); background-color: rgb(255, 255, 255);"><a href="https://en.wikipedia.org/wiki/This_Machine_Kills_Secrets#cite_note-FOOTNOTEAllnutt2012-1" style="text-decoration-line: none; color: rgb(11, 0, 128); background: none;">[1]</a> The subject of the book is "politically motivated information leaks ... the lives and work of numerous cryptographers, hackers and <a href="https://en.wikipedia.org/wiki/Whistleblower" title="Whistleblower" style="text-decoration-line: none; color: rgb(11, 0, 128); background: none rgb(255, 255, 255); font-size: 14px;">whistleblowers</a>",<sup id="cite_ref-FOOTNOTENader2016_2-0" class="reference" style="line-height: 1; unicode-bidi: isolate; white-space: nowrap; font-size: 11.2px; color: rgb(32, 33, 34); background-color: rgb(255, 255, 255);"><a href="https://en.wikipedia.org/wiki/This_Machine_Kills_Secrets#cite_note-FOOTNOTENader2016-2" style="text-decoration-line: none; color: rgb(11, 0, 128); background: none;">[2]</a> including <a href="https://en.wikipedia.org/wiki/WikiLeaks" title="WikiLeaks" style="text-decoration-line: none; color: rgb(11, 0, 128); background: none rgb(255, 255, 255); font-size: 14px;">WikiLeaks</a>.<sup id="cite_ref-FOOTNOTEMorozov2012_3-0" class="reference" style="line-height: 1; unicode-bidi: isolate; white-space: nowrap; font-size: 11.2px; color: rgb(32, 33, 34); background-color: rgb(255, 255, 255);"><a href="https://en.wikipedia.org/wiki/This_Machine_Kills_Secrets#cite_note-FOOTNOTEMorozov2012-3" style="text-decoration-line: none; color: rgb(11, 0, 128); background: none;">[3]</a>ch 1 <span style="color: rgb(0, 0, 0); font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap; background-color: transparent;">dan ellsberg RANDmore than a yr to xerox, 8 foot pile; 10c/page fulbright aide offered to reimburse but balked at 345 incl postage; fullb also 180 on pledge for hearings p 13
enlisted marines for korea
VN 1/1/67 VC repeated ambushes, well-coordinated.
Mcnamara comiss study before he bailed to world bank = pent papers 7k pages: one war for 25 yrs and US backed; supported french, then b/c of cold war we could not let VN go; state dept reports that ho chi minh had pop suport; never a civil war; DE went to war resister mtg, broken by courage 26
McGov 180 also b/c of campaign
WH accused NYT ~ Espionage Act 36
RMN said destroy DE at all costs 40 followed psych, then broke office (he kept no notes on DE there) 41
<span style="color: rgb(0, 0, 0); font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap; background-color: transparent;">liddy team lsd soup before speech in DC; 12 cubans to beat up, but crowds too thick; illegal wiretaps; judge offered dir of fbi if cooperate 41
// manning---
ch 5 the plumbers:darpa: self drive car --> gGl; mec bats that suck power lines; cyborg roaches; robots switch liq to solid and forage 173
WikiLeaks 250K state dept cables; corrupt leaders, corp mal-doing, sex, nepotism, tex co pimps boys to cops; US diplomats spy on UN
Amazon pulled WL servers; paypal, visa, mastercard Bofa cut off $; hundreds of clone sites in solidarity/mirror 177
JA consensual but unprotected sex sweden
1/11 JA lawyers says same cell 1/11 as Wilde 177
maj bank leak will lead to investigations and reform JA predicts 178
never happened b/c mat'l a letdown, or defector took it 178
ja theory not the leaks but fear of them that matters 
<span style="color: rgb(0, 0, 0); font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap; background-color: transparent;">Bofa internal team of 12 plus tried to find a mole; hired Chief Info Security officer  and Booz
started preemptively buying up websites; DOJ rec H&W, richard wyatt in partic (deals w/ sensitive matters, made his bones on) 179 subcontr HBG
12/2 urgent-opport to barr (mtg with TASC/Northrop)
A Barr under pressure b/c hired to solve attribution problem [?], and bring in govt deals; 
barr ppt on ~ WL; track down and expose funders, no $ 182
sep deal CoC ~ union (w/ Palantir and Berico) 2m$ mo --> $200K
WL and Anon had common for Ch of Sci 185 so when WL attacked, Anon ctr-attacked JPB EFF
paypal. visa etc taken offline by Low Orbit Ion Cannon sw
barr found vuln in penn nuke plant and army intel INSCOM
data leak prot hot but failed; so new approach is forensics, fingerprints to ID intruder
JA fear strat fail b/c govt wd rather let data leak than have 911 fail to connect dots
barr trynor debate: gut feeling
barr wrong in ID leaders anon
wood refers to booz, barr encouraged does FTimes art'l, fbi, dni
zatkos gpa spent z's dad inheritance on apple 2 (confisticated be got back for prodigy;
 idolized zappa met hero abbie hoffman 197 darpa?
 LOpht hackerspace (hw v sw) but ethical // levy  comb abbie and nader (expose data vuln?)
mudge invited richard clarke to loft; got visit to nsa crypto museum (accidentally drives into secure area) got to play w/ enigma
testify before john glenn; started co sold to symantec
anon ? used sql injection to hack HBG; a barr? used kibafo33 for all
anon posted all AB mail, his bad report on anon and added a search tool [so ppl could go thru it? // BB?]
penny levay g hoagland wife mail not released, negot not, but fail? 213
4 hrs talk, Greg h email too
Benjamin Spock de Vries permaculture 
[http://www.itworld.com/article/2747872/networking-hardware/who-is-anonymous--commander-x--not-this-guy.html
The reason Barr thought De Vries was the elusive X? Because de Vries is the founder and admin of a Facebook Group called Global Strike 2011, which appears to be popular with the Anons. ]
<span style="color: rgb(0, 0, 0); font-weight: 400; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap; background-color: rgb(255, 255, 102);">hbg had malware root deep in PC
Colbert mock barr [penis wasp]
sabu caught b/c entered chat room w/o disguise IP addy 215; pled guilty aug 2011, faced 124 years
fbi kept indictment sealed 1 yr (they ran him as agent for 8 mos? he suggested targets he got from FBI?]
barr fought walmart in colo town to protect small biz 2004
barr sw paranoia meter: watch keystrokes and even face twitches; at 1st for mil (intel) then comm'l
th drake, thinthread too intrusive till 911; better than Trailblazer sw 1.2b$ boondoggle
corruption/rev door normalized; NYT published, b2 admin PO'd, looked for leaks; big leak ignored bc dangerous to pros, so drake who was minor leak? indicted when he was upfront w/ fbi 2238K$ legal bills, 2nd mortgage, fired from 2 jobs; divorceother whistleblower eg
==wiki:On the weekend of February 5–6, 2011, <a href="http://en.wikipedia.org/wiki/Aaron_Barr" title="Aaron Barr" class="mw-redirect" style="background-color: rgb(255, 255, 255); text-decoration: none; color: rgb(11, 0, 128); background-image: none;">Aaron Barr</a>, the chief executive of the security firm <a href="http://en.wikipedia.org/wiki/HBGary_Federal" title="HBGary Federal" class="mw-redirect" style="text-decoration: none; color: rgb(11, 0, 128); background-image: none;">HBGary Federal</a>, announced that his firm had successfully infiltrated the Anonymous group, and although he would not hand over details to the police, he would reveal his findings at a later conference in San Francisco. In retaliation for Aaron Barr's claims, members of the group Anonymous hacked the website of HBGary Federal and replaced the welcome page with a message stating that Anonymous should not be messed with, and that the hacking of the website was necessary to defend itself. Using a variety of techniques, including <a href="http://en.wikipedia.org/wiki/Social_engineering_(security)" title="Social engineering (security)" style="text-decoration: none; color: rgb(11, 0, 128); background-image: none;">social engineering</a> and <a href="http://en.wikipedia.org/wiki/SQL_injection" title="SQL injection" style="text-decoration: none; color: rgb(11, 0, 128); background-image: none;">SQL injection</a>,<a href="http://en.wikipedia.org/wiki/Timeline_of_events_associated_with_Anonymous#cite_note-109" style="text-decoration: none; color: rgb(11, 0, 128); background-image: none; white-space: nowrap; background-position: initial initial; background-repeat: initial initial;">[109]</a>Anonymous also went on to take control of the company's e-mail, dumping 68,000 e-mails from the system, erasing files, and taking down their phone system.<a href="http://en.wikipedia.org/wiki/Timeline_of_events_associated_with_Anonymous#cite_note-110" style="text-decoration: none; color: rgb(11, 0, 128); background-image: none; white-space: nowrap; background-position: initial initial; background-repeat: initial initial;">[110]</a> 
The leaked emails revealed the reports and company presentations of other companies in computer security such as <a href="http://en.wikipedia.org/wiki/Endgame_systems" title="Endgame systems" class="mw-redirect" style="text-decoration: none; color: rgb(11, 0, 128); background-image: none;">Endgame systems</a> who promise high quality offensive software, advertising "subscriptions of $2,500,000 per year for access to <a href="http://en.wikipedia.org/wiki/Zero-day_exploit" title="Zero-day exploit" class="mw-redirect" style="text-decoration: none; color: rgb(11, 0, 128); background-image: none;">0day exploits</a>".<a href="http://en.wikipedia.org/wiki/Timeline_of_events_associated_with_Anonymous#cite_note-111" style="text-decoration: none; color: rgb(11, 0, 128); background-image: none; white-space: nowrap; background-position: initial initial; background-repeat: initial initial;">[111]</a>Among the documents exposed was a <a href="http://en.wikipedia.org/wiki/PowerPoint" title="PowerPoint" class="mw-redirect" style="text-decoration: none; color: rgb(11, 0, 128); background-image: none; background-position: initial initial; background-repeat: initial initial;">PowerPoint</a> presentation entitled "The Wikileaks Threat", put together by HBGary Federal along with two other data intelligence firms [team themis, palantir] for Bank of America in December.<a href="http://en.wikipedia.org/wiki/Timeline_of_events_associated_with_Anonymous#cite_note-CB1-112" style="text-decoration: none; color: rgb(11, 0, 128); background-image: none; white-space: nowrap; background-position: initial initial; background-repeat: initial initial;">[112]</a> Within the report, these firms created a list of important contributors to WikiLeaks; they further developed a strategic plan of attack against the site. As TechHerald explains, "the plan included pressing a journalist in order to disrupt his support of the organization, cyber attacks, disinformation, and other potential proactive tactics." The report specifically claims that <a href="http://en.wikipedia.org/wiki/Glenn_Greenwald" title="Glenn Greenwald" style="text-decoration: none; background-image: none; color: rgb(11, 0, 128);">Glenn Greenwald</a>'s support was key to WikiLeaks' ongoing survival.<a href="http://en.wikipedia.org/wiki/Timeline_of_events_associated_with_Anonymous#cite_note-113" style="text-decoration: none; color: rgb(11, 0, 128); background-image: none; white-space: nowrap; background-position: initial initial; background-repeat: initial initial;">[113]</a><a href="http://en.wikipedia.org/wiki/Timeline_of_events_associated_with_Anonymous#cite_note-114" style="text-decoration: none; color: rgb(11, 0, 128); background-image: none; white-space: nowrap; background-position: initial initial; background-repeat: initial initial;">[114]</a><a href="http://en.wikipedia.org/wiki/Timeline_of_events_associated_with_Anonymous#cite_note-115" style="text-decoration: none; color: rgb(11, 0, 128); background-image: none; white-space: nowrap; background-position: initial initial; background-repeat: initial initial;">[115]</a>Anonymous also personally attacked Aaron Barr by taking control of his Twitter account, posting Mr Barr's supposed home address and social security number.<a href="http://en.wikipedia.org/wiki/Timeline_of_events_associated_with_Anonymous#cite_note-independent.co.uk-116" style="text-decoration: none; color: rgb(11, 0, 128); background-image: none; white-space: nowrap; background-position: initial initial; background-repeat: initial initial;">[116]</a>In response to the attacks, founder of HBGary Federal, Greg Hoglund, responded to journalist Brian Krebs, "They didn't just pick on any company, we try to protect the US Government from hackers. They couldn't have chosen a worse company to pick on."<a href="http://en.wikipedia.org/wiki/Timeline_of_events_associated_with_Anonymous#cite_note-independent.co.uk-116" style="text-decoration: none; color: rgb(11, 0, 128); background-image: none; white-space: nowrap; background-position: initial initial; background-repeat: initial initial;">[116]</a> After the attacks, Anonymous continued to clog up HBGary Federal fax machines, and made threatening phone calls.<a href="http://en.wikipedia.org/wiki/Timeline_of_events_associated_with_Anonymous#cite_note-117" style="text-decoration: none; color: rgb(11, 0, 128); white-space: nowrap; background-image: none;">[117]</a>---<a href="http://www.fixtheuschamber.org/issues/chamber-gate-2011-what-chamber-knew">http://www.fixtheuschamber.org/issues/chamber-gate-2011-what-chamber-knew</a>
 details of negot---<a href="http://www.democracynow.org/2013/7/11/jailed_journalist_barrett_brown_faces_105">http://www.democracynow.org/2013/7/11/jailed_journalist_barrett_brown_faces_105</a><a href="http://www.democracynow.org/appearances/peter_ludlow" data-clicky-href="#story/guest_link" data-clicky-title="Story: Guest Link" style="color: rgb(51, 102, 153); text-decoration: none; outline-width: 0px;">Peter Ludlow</a>, professor of philosophy at Northwestern University. He has written extensively on hacktivist actions against private intelligence firms and the surveillance state. His recent article for The Nation is called "The Strange Case of Barrett Brown."<div id="content-navigation" style="margin: 0px 0px 15px; padding: 10px 15px; direction: ltr; white-space: nowrap; overflow: hidden; -webkit-box-shadow: rgb(204, 204, 204) 0px 1px 1px; box-shadow: rgb(204, 204, 204) 0px 1px 1px; background-color: rgb(238, 231, 221);">THURSDAY, JULY 11, 2013</div><div id="top-video-content" style="margin: 0px 0px 20px; padding: 0px; direction: ltr; zoom: 1; background-color: rgb(255, 255, 255);"><div id="top-video-left" style="margin: 0px; padding: 0px 15px; direction: ltr; width: 675px; float: left;"><div id="story_wrapper" style="margin: 0px; padding: 0px; direction: ltr;"><h1 class="pageTitle" itemprop="name" style="margin: 0px 0px 15px 20px; padding: 0px; direction: ltr; width: 820px; color: rgb(62, 31, 33);">Jailed Journalist Barrett Brown Faces 105 Years For Reporting on Hacked Private Intelligence Firms</h1></div></div></div><div id="content-and-right-panel" style="margin: 0px; padding: 0px; direction: ltr; clear: both;"><div id="content" style="margin: 0px; padding: 0px 0px 10px; direction: ltr; overflow: hidden; width: 705px; float: left;"><div id="left-panel-and-body" style="margin: 0px; padding: 0px; direction: ltr;"><div id="content-body" style="margin: 0px; padding: 0px 15px; direction: ltr;"><div id="story" style="margin: 0px 20px 20px; padding: 0px; direction: ltr;"><div id="story-summary" itemprop="description" style="margin: 0px; padding: 0px; direction: ltr; line-height: 1.5em;">Journalist Barrett Brown spent his 300th day behind bars this week on a range of charges filed after he used information obtained by the hacker group Anonymous to report on the operations of private intelligence firms. Brown faces 17 charges ranging from threatening an FBI agent to credit card fraud for posting a link online to a document that contained stolen credit card data. But according to his supporters, Brown is being unfairly targeted for daring to investigate the highly secretive world of private intelligence and military contractors. Using information Anonymous took from the firm HBGary Federal, Brown helped discover a secret plan to tarnish the reputations of WikiLeaks and journalist Glenn Greenwald of The Guardian. Brown similarly analyzed and wrote about the millions of internal company emails from Stratfor Global Intelligence that were leaked in 2011. We speak to Peter Ludlow, professor of philosophy at Northwestern University, whose article "The Strange Case of Barrett Brown" recently appeared in The Nation. "Considering that the person who carried out the actual Stratfor hack had several priors and is facing a maximum of 10 years, the inescapable conclusion is that the problem is not with the hack itself but with Brown’s journalism," Ludlow argues. He adds that the case against Brown could suggest criminality "to even link to something or share a link with someone."</div><div id="story-body" style="margin: 0px; padding: 0px; direction: ltr; line-height: 1.5em;"><div id="story-transcript" class="" style="margin: 15px 0px 0px; padding: 0px; direction: ltr; line-height: 1.5em; clear: right;"><h2 class="section-header" style="margin: 0px 0px 10px; padding: 5px 10px 5px 0px; direction: ltr; line-height: normal; overflow: auto; text-transform: uppercase; background-color: rgb(255, 255, 255);">TRANSCRIPT</h2><div id="story-rush-transcript" style="margin: 0px; padding: 0px; direction: ltr; background-color: rgb(255, 255, 255);">This is a rush transcript. Copy may not be in its final form.]</div>JUAN GONZÁLEZ: As NSA leaker Edward Snowden remains at a Moscow airport, Army whistleblower Bradley Manning is on trial, and WikiLeaks founder Julian Assange is holed up in the Ecuadorean embassy in London, today we look at the strange story of another man tied to the world of cyber-activism who faces over a hundred years in prison. His name is Barrett Brown. He’s an investigative reporter with ties to the hacking collective Anonymous. He has spent the past 300 days in jail and has been denied bail. He faces 17 charges, ranging from threatening an FBI agent to credit card fraud for posting a link online to a document that contained stolen credit card data. But according to his supporters, Brown is being unfairly targeted for daring to investigate the highly secretive world of private intelligence and military contractors.AMY GOODMAN: Before Brown’s path crossed with the FBI, he frequently contributed to Vanity Fair, The Huffington Post, The Guardian and other news outlets. In 2009, Brown created Project PM, which was, quote, "dedicated to investigating private government contractors working in the secretive fields of cybersecurity, intelligence and surveillance." He was particularly interested in the documents leaked by WikiLeaks and Anonymous. In the documentary We Are Legion, Barrett Brown explains the importance of information obtained by hackers.<blockquote style="margin: 1em 0px; padding: 0px 3em; direction: ltr; overflow: auto;">BARRETT BROWN: Some of the most important things that have been—have had the most far-reaching influence and have been the most important in terms of what’s been discovered, not just by Anonymous, but by the media in the aftermath, is the result of hacking. That information can’t be obtained by institutional journalistic process, or it can’t be obtained or won’t be obtained by a congressional committee or a federal oversight committee. For the most part, that information has to be, you know, obtained by hackers.</blockquote>AMY GOODMAN: In 2011, the group Anonymous hacked into the computer system of the private security firm HBGary Federal and disclosed thousands of internal emails. Barrett Brown has not been accused of being involved in the hack, but he did read and analyze the documents, eventually crowd-sourcing the effort through Project PM. One of the first things he discovered was a plan to tarnish the reputations of WikiLeaks and sympathetic journalist Glenn Greenwald of The Guardian. Brown similarly analyzed and wrote about the millions of internal company emails for Stratfor Global Intelligence that were leaked on Christmas Eve 2011. Shortly thereafter, the FBI acquired a warrant for Brown’s laptop and authority to seize any information from his communications—or, in journalism parlance, his sources. In September 2012, a troupe of armed agents surged into Brown’s apartment in Dallas, Texas, and handcuffed him face down on the floor. He has been in prison ever since.JUAN GONZÁLEZ: Well, for more, we’re joined by Peter Ludlow, professor of philosophy at Northwestern University. He has written extensively on hacktivist actions against people—against private intelligence firms and the surveillance state. His recent <a href="http://www.thenation.com/article/174851/strange-case-barrett-brown" style="color: rgb(51, 102, 153); text-decoration: none; outline-width: 0px;">article</a> for The Nation is called "The Strange Case of Barrett Brown."Peter Ludlow, welcome to Democracy Now!PETER LUDLOW: Hi. Thank you very much.JUAN GONZÁLEZ: Talk to us about Barrett Brown, the importance of his case, given all the others that we’ve been dealing with on this show now for many years.PETER LUDLOW: Well, yeah, it’s important for two reasons. First of all, it’s showing that, to some extent, all of us could be targets, because the principal reasons that they’re going after him with this sort of claim that he was involved in credit card fraud or something like that, I mean, that’s completely fallacious. I mean, in effect, what he did was take a link from a chat room and copied that link and pasted it into the chat room for Project PM. That is, he took a link that was broadcast widely on the Internet, and it was a link to the Stratfor hack information, and he just brought it to the attention of the editorial board of Project PM. And because there were, for whatever reason, unencrypted credit card numbers and validation codes among those five million other emails, the government is claiming that he was engaged in credit card fraud. They’re claiming that Project PM was a criminal enterprise. And so, basically, for our interest, why this is interesting to us is basically it makes this dangerous to even link to something or to share a link with someone.JUAN GONZÁLEZ: And—PETER LUDLOW: Go ahead, yeah, please.JUAN GONZÁLEZ: Well, one of the things that you raise is, in some of your writings on this, is the incestuous relationship between the Justice Department, the government and these private firms that are being now targeted by cyber-activists. And could you talk about that, as well?PETER LUDLOW: Well, sure. A lot of these private intelligence companies are started by ex-CIA, NSA people. Some people come from those agencies and rotate back into the government. I mean, you even see, with the case of Snowden, he was actually a contractor for a private intelligence company, Booz Allen. And, I mean, people think about the NSA, FBI, CIA, and they think of—those are the people that are doing the surveillance of you and doing this intelligence work, but really, if you look at how much the United States spends on intelligence, 70 percent of that is actually going to these private intelligence contractors. So, you know, if you add up CIA, NSA,FBI, that’s just a tip of the iceberg. So there’s all this sort of spook stuff going on in the private realm. And, yeah, right, a lot of it is very incestuous. There’s a revolving door. And no one is investigating it or even talking about it, as far as I can tell.AMY GOODMAN: Let’s go to Barrett Brown in his own words. In March 2012,Democracy Now! spoke with Barrett soon after his house was raided.<blockquote class="collapsed-hide" style="margin: 1em 0px; padding: 0px 3em; direction: ltr; overflow: auto; background-color: rgb(255, 255, 255);">BARRETT BROWN: On March 5th, I received a tip that I was about to be raided by the FBI. I left my apartment here in Dallas, went to my mom’s residence here in the same city. Next morning, three FBI agents arrived at my mom’s place. I went out and talked to them. They said my apartment had just been raided. The door was damaged. They would take care of that. And that they also asked me if I had any laptops with me that I wanted to give them. I said no.</blockquote><blockquote class="collapsed-hide" style="margin: 1em 0px; padding: 0px 3em; direction: ltr; overflow: auto; background-color: rgb(255, 255, 255);">A few hours later, the FBI returned to my mom’s house with another warrant, this time for her house, and detained the both of us for three hours while they searched the residence. They found several laptops I had stashed somewhere in the house and left the search warrants and left another one in my apartment, which I got when I came back here a little after, the next day or so.</blockquote><blockquote class="collapsed-hide" style="margin: 1em 0px; padding: 0px 3em; direction: ltr; overflow: auto;">The warrants themselves refer to the information that they’re seeking as regarding Anonymous, of course, a few other things of that nature, and also two companies: HBGary and Endgame Systems. Both of these are intelligence contracting companies that Anonymous had a run-in with in February of 2011, during which a number of emails were taken from HBGary, in particular, which themselves revealed a number of conspiracies being perpetuated by those companies in conjunction with Justice Department and several other institutions, including Bank of America, against WikiLeaks and against several journalists.</blockquote><blockquote class="collapsed-hide" style="margin: 1em 0px; padding: 0px 3em; direction: ltr; overflow: auto; background-color: rgb(255, 255, 255);">The time since, I’ve spent a lot of time going over those emails, researching them, conducting other research, otherwise trying to expose a number of things that have been discovered by virtue of those emails from HBGary having been taken. I sincerely believe that my activities on that front contributed to me being raided the other day and will no doubt contribute to any further action that the FBI decides to take. I would just also note the Justice Department itself is very much intertwined with this issue, and has been for a while, and in no way can conduct a fair investigation against me, based on what I’ve revealed, what I’ve helped to sort of emphasize about them.</blockquote>AMY GOODMAN: That was Barrett Brown in his own words just after the raid.PETER LUDLOW: Yeah.AMY GOODMAN: Peter Ludlow, talk about what he had released. Talk about what he got from HBGary and how this links to Glenn Greenwald.PETER LUDLOW: Sure. Well, what they uncovered was—I mean, it’s actually a little bit subtle, right? Because it begins with the Bank of America being concerned that WikiLeaks had information on it. Bank of America goes to the United States Department of Justice. The Department of Justice leads them to Hunton & Williams, the big law fix-it firm in the D.C. area, who in turn hooks them up with a group of private intelligence contractors that went under the umbrella Team Themis. And Team Themis had a number of proposals and projects that were exposed in all of this. They included running kind of a psyops operation against the Chamber Watch, which is a group that sort of monitors the Chamber of Commerce, and it was an attempt to undermine it and Glenn Greenwald and other individuals. And, I mean, there were many, many plans that they had, many, many things, but some of the documents released showed that they were saying they were going to create fake documents, leak them to Greenwald, and then, when Greenwald eventually released them, they would expose it as a fraud and attempt to undermine him in that way. And they had a similar plan for Chamber Watch, as well.JUAN GONZÁLEZ: And their concern with Greenwald was that he was giving—that his defense of WikiLeaks was giving legitimacy to WikiLeaks—PETER LUDLOW: That was—yeah. That was the concern.JUAN GONZÁLEZ: —it didn’t deserve.PETER LUDLOW: That was the concern, yeah. And they actually said in there, "Well, he’s just a professional journalist, and he’ll fold under pressure immediately. I mean, apparently they were wrong about that. So, yeah.JUAN GONZÁLEZ: There were also emails found where these private security firms were assessing the damage that Jeremy Scahill’s books had done to Blackwater?PETER LUDLOW: Well, actually, those—I ran across that in the Stratfor leaks, and that was kind of interesting, because they were monitoring—they were monitoring this because they were concerned that Blackwater was going to get into the private intelligence business themselves. And they were commenting on Scahill. They go, "Well, yeah, Scahill, you know, I don’t care much for his politics, but he’s really got these guys figured out, yeah?" So that was a little compliment for Scahill, I think.JUAN GONZÁLEZ: But the amazing thing in all of this is the degree to which these private security firms are engaging in attempts to influence what’s going on in the public debate on—PETER LUDLOW: Oh, yeah.JUAN GONZÁLEZ: —on intelligence.PETER LUDLOW: Oh, yeah, yeah. I mean, one of the most crazy things in the whole thing was when Coca-Cola approached Stratfor, and they were concerned about PETA, you know, People for the Ethical Treatment of Animals. And why, I’m not entirely sure, but one of the people in Stratfor said, "Well, the FBI has a classified file on PETA. I’ll see if I can get it for you." Now, that little story sums up a lot of stuff that’s wrong about this. First of all, why are private—why is Coca-Cola going to a private intelligence company for this? Why is—why did the private intelligence company feel that they had immediate access to a classified file by the FBI? And why did the FBI have a classified file, to begin with? I mean—but, to me, the creepiest part of that very creepy little story is the fact that the guy at Stratfor felt that he had access to this classified file by the FBI. And the Barrett Brown case revealed something like this, as well. It’s almost like the FBI has become just another private security firm, that it’s become like a private cop for these companies, as it were. And, I mean, that’s part because of the revolving door. It’s part because they get pressed into service for companies that want inside information on activist organizations like PETA.AMY GOODMAN: —and then come back to this conversation. We’re talking to Peter Ludlow, professor of philosophy at Northwestern University, has written extensively on hacktivist actions against private intelligence firms. The <a href="http://www.thenation.com/article/174851/strange-case-barrett-brown" style="color: rgb(51, 102, 153); text-decoration: none; outline-width: 0px;">piece</a> he most recently wrote is for The Nation, and it’s called "The Strange Case of Barrett Brown." When we come back, I want to ask you how it’s possible he faces a hundred years in prison.AMY GOODMAN: It makes us think about Aaron Swartz.AMY GOODMAN: He didn’t face anything like that, but he faced decades in prison.PETER LUDLOW: Yeah.AMY GOODMAN: He ultimately committed suicide before prosecution. Stay with us. [end rush trans]
BB:arrested, 105 yrs, no bail, in 300 days no, for a while contrib to legal fund //wikileaks; bb spokesperson for WL westboro, hbg, took over gov't website (in ME? arab spring?] and told ppl in other countries to revolt; i have lawyers to protect me and they don't want dirty laundry publicized; hacked SES? search warrant hbg and Endgame  (zero day exploits) subscription 2.5m$/yr see Bizweek article slides on airport computers Atlanta? video of hq; ibm and ------; hastings; chls swift JAG gitmo, ahmed kapur, free bb</div></div></div></div></div></div>

<a href="http://www.mediafreedominternational.org/2013/01/29/palantir-software/?utm_source=From+Paypal&utm_campaign=3d7c096353-&utm_medium=email">http://www.mediafreedominternational.org/2013/01/29/palantir-software/?utm_source=From+Paypal&utm_campaign=3d7c096353-&utm_medium=email</a>

<h1 style="background-color: rgb(255, 255, 255);">Schneier on Security</h1>

A blog covering security and security technology.

<a href="http://www.schneier.com/blog/archives/2011/02/good_article_ab.html">« Good Article About the Terrorist Non-Threat</a> | <a href="http://www.schneier.com/blog/">Main</a> | <a href="http://www.schneier.com/blog/archives/2011/02/interview_with_19.html">Interview with Me »</a>

<h2 style="background-color: rgb(255, 255, 255);">February 25, 2011</h2>

<h3 style="background-color: rgb(255, 255, 255);">HBGary and the Future of the IT Security Industry</h3>

<a href="http://threatpost.com/en_us/blogs/rsa-2011-winning-war-losing-our-soul-022211">This</a> is a really good piece by Paul Roberts on Anonymous vs. HBGary: not the tactics or the politics, but what HBGary demonstrates about the IT security industry.

<blockquote>But I think the real lesson of the hack - and of the revelations that followed it - is that the IT security industry, having finally gotten the attention of law makers, Pentagon generals and public policy establishment wonks in the Beltway, is now in mortal danger of losing its soul. We've convinced the world that the threat is real - omnipresent and omnipotent. But in our desire to combat it, we are becoming indistinguishable from the folks with the black hats.

[...]

...While "scare 'em and snare 'em" may be business as usual in the IT security industry, other HBGary Federal skunk works projects clearly crossed a line: a proposal for a major U.S. bank, allegedly Bank of America, to launch offensive cyber attacks on the servers that host the whistle blower site Wikileaks. HBGary was part of a triumvirate of firms that also included Palantir Inc and Berico Technologies, that was working with the law firm of the U.S. Chamber of Commerce to develop plans to target progressive groups, labor unions and other left-leaning non profits who the Chamber opposed with a campaign of false information and entrapment. Other leaked e-mail messages reveal work with General Dynamics and a host of other firms to develop custom, stealth malware and collaborations with other firms selling offensive cyber capabilities including knowledge of previously undiscovered ("zero day") vulnerabilities.

[...]

What's more disturbing is the way that the folks at HBGary - mostly Aaron Barr, but others as well - came to view the infowar tactics they were pitching to the military and its contractors as applicable in the civilian context, as well. How effortlessly and seamlessly the focus on "advanced persistent threats" shifted from government backed hackers in China and Russia to encompass political foes like ThinkProgress or the columnist Glenn Greenwald. Anonymous may have committed crimes that demand punishment - but its up to the FBI to handle that, not "a large U.S. bank" or its attorneys.

</blockquote>

Read the whole thing.

<a href="http://www.schneier.com/blog/archives/2011/02/hbgary_and_the.html">Posted on February 25, 2011 at 6:14 AM</a> • <a href="http://www.schneier.com/blog/archives/2011/02/hbgary_and_the.html#comments">73 Comments</a>

To receive these entries once a month by e-mail, <a href="http://www.schneier.com/crypto-gram-sub.html" style="">sign up</a> for the <a href="http://www.schneier.com/crypto-gram.html" style="">Crypto-Gram Newsletter</a>.

--

<a href="http://thinkprogress.org/politics/2011/08/18/298081/hbgary-federal-us-chamber-persona/"> http://thinkprogress.org/politics/2011/08/18/298081/hbgary-federal-us-chamber-persona/</a>

...I<a href="http://thinkprogress.org/politics/2011/08/18/298081/hbgary-federal-us-chamber-persona/">n presentations obtained by ThinkProgress from the e-mail dump detailing the </a><a href="http://images2.americanprogress.org/ThinkProgress/themisproposal1.pdf">tactics</a> potentially used against progressives, HBGary Federal <a href="http://images2.americanprogress.org/ThinkProgress/ProposalForTheChamber.pdf">floated</a> the idea of using “<a href="http://thinkprogress.org/economy/2011/02/10/143419/lobbyists-chamberleaks/">fake insider personas</a>” to infiltrate left-leaning groups critical of the U.S. Chamber of Commerce’s policies. As HBGary Federal executive Aaron Barr described in several emails, his firm could work with partner companies Palantir and Berico Technologies to <a href="http://arstechnica.com/tech-policy/news/2011/02/black-ops-how-hbgary-wrote-backdoors-and-rootkits-for-the-government.ars/4">manipulate fake</a> online identities, using networks like Facebook, to gain access to private information from his targets. Other presentations are more specific and describe efforts to use social media <a href="http://thinkprogress.org/economy/2011/02/17/144678/chamberleaks-malware-hacking/">to hack</a> computers and find vulnerabilities among even the <a href="http://thinkprogress.org/economy/2011/02/10/143428/chamberleaks-target-families/">families</a> of people who work at organizations critical of the Chamber.

In one email from the dump, Barr <a href="http://hbgary.anonleaks.ch/ted_hbgary_com/10535.html">discusses</a> a fake persona he created called “<a href="http://www.facebook.com/people/Holly-Weber/100001555180221">Holly Weber</a>.” She would be born in Portland in 1984, attend Reynolds High School, and work for Lockheed Martin after a stint in the Air Force. Earlier this week, Twitter <a href="https://twitter.com/#%21/AnonyOps/status/103584959733837826">users</a> actually identified the phony account. Before it was taken down, ThinkProgress snagged screen shots of the fake persona’s <a href="http://thinkprogress.org/wp-content/uploads/2011/08/hbgaryfakepersona1.png">Facebook</a> and <a href="http://thinkprogress.org/wp-content/uploads/2011/08/fakehbgarypersona.png">LinkedIn</a> accounts. (Barr also described his strategy for <a href="http://hbgary.anonleaks.ch/ted_hbgary_com/343.html">pretending</a> to be teenagers online). View a screenshot of the fake account below:...Hunton and Williams, the law firm <a href="http://thinkprogress.org/economy/2011/02/14/143885/chamberleaks-briefed/">representing</a> the U.S. Chamber of Commerce, had been <a href="http://thinkprogress.org/chamberleaks-timeline/">immersed</a> in talks with HBGary Federal, Palantir, and Berico to deliver on a $2 million deal to move forward with the hacking plot against the Chamber’s critics. However, after Anonymous leaked HBGary’s emails and a few reporters picked up on the story, the Chamber distanced itself from the deal. The emails show that HBGary Federal had also <a href="http://arstechnica.com/tech-policy/news/2011/02/black-ops-how-hbgary-wrote-backdoors-and-rootkits-for-the-government.ars/4">worked</a> to sell “persona management” solutions to the U.S. government for cyber intelligence work.

---

February 16, 2011 by Brad Johnson, ThinkProgress

Original reporting by ThinkProgress <a href="http://thinkprogress.org/2011/02/10/lobbyists-chamberleaks/">revealed</a> that Hunton & Williams, a corporate law firm representing the U.S. Chamber of Commerce, conspired with set of private security companies and lobbying firms to undermine the political opponents of the Chamber with a surreptitious sabotage campaign.

Their plot was revealed when emails from one of the companies involved, HBGary Federal, were leaked by hackers who were angered by boasts by HBGary Federal CEO Aaron Barr that he could use social media sites such as Facebook and false identities to uncover their identities.

Below is a detailed timeline of the conspiracy to launch a dirty-tricks campaign against labor unions, progressive organizations, and journalists who have challenged the U.S. Chamber of Commerce’s right-wing agenda.

Dramatis Personae:

Hunton and Williams: Partners John Woods, Bob Quackenboss, David Lashway, and Litigation Group head Richard Wyatt

Palantir Technologies: Matthew Steckman, Eli Bingham, Ryan Castle, Sean Stenstrom, Shyam Sankar; General Counsel Matt Long, CEO Alex Karp*

Berico Technologies: Patrick Ryan, Sam Kremin, Amanda McDonald, Danielle Berti, Jeremy Glesner, Katie Crotty, Bill Lantzy, CEO Nicholas Hallam, COO Guy Filippelli*

HBGary Federal: CEO Aaron Barr, Mark Trynor, COO Ted Vera, HBGary President Penny Leavy-Hoglund

Booz Allen: Senior Vice President Bill Wansley, Renee Way, Lloyd Howell, Chris O’Ferrell

</blockquote>

*Signed contracts included in leaked e-mail record but were not involved in sending or receiving the e-mails.

Mentioned by name in leaked emails but were not involved in sending or receiving them.

<h2 style="background-color: rgb(255, 255, 255);">SEPTEMBER</h2>

On September 10, <a href="http://www.fixtheuschamber.org/about-chamber-watch-0" style="">U.S. Chamber Watch</a> files charges with the IRS that the U.S. Chamber of Commerce “violated tax codes by <a href="http://www.nytimes.com/2010/09/11/us/politics/11chamber.html" style="">laundering millions of dollars</a> meant for charitable work from a group with ties to the insurance giant AIG.”

<h2 style="background-color: rgb(255, 255, 255);">OCTOBER</h2>

On October 5, ThinkProgress <a href="http://thinkprogress.org/2010/10/05/foreign-chamber-commerce/">exposes the U.S. Chamber of Commerce</a> for directing foreign funds into the general account it uses for political expenditures to defeat progressive candidates.

On October 7, MoveOn, Public Citizen, and other progressive organizations <a href="http://www.campusprogress.org/articles/progressive_groups_protest_chamber_of_commerce_spending_on_elections/">protest the Chamber’s plan to spend $75 million</a> against progressive candidates, and their lack of transparency over foreign money, in front of Chamber headquarters in Washington D.C.

On October 19, Matthew Steckman (Palantir) emails Aaron Barr (HBGary) and Patrick Ryan (Berico) about “about offering a complete intelligence solution to a law firm that approached us” using “<a href="http://thinkprogress.org/wp-content/uploads/2011/02/steckman_social_media_exploitation.png" style="">social media exploitation</a>.” “Looking forward to discussing this opportunity,” Barr replies. Ryan says it “sounds like a great opportunity.”

On October 25, Steckman introduces John Woods to Patrick Ryan and Aaron Barr. They plan to meet on Nov 4 (gets moved to Nov 3) because Woods says “I have to make our formal pitch to the client early the following week.”

On October 28, Ryan outlines H&W’s problem: “A client of theirs is targeted by another entity, specifically a labor union, that is trying to extract some kind of concession or favorable outcome.” They have not yet learned the name of the client.

On October 30, Barr emails the group with a document for the proposal that is a triumph of biztalk verbiage.

<h2 style="background-color: rgb(255, 255, 255);">NOVEMBER</h2>

On November 1, Barr emails the group with the info he’d collected on H&W, including John Woods’ family, by scraping LinkedIn and Facebook. He “grabbed all the partners friends lists that have facebook accounts,” 21 in all. “One of the steps we will do once we start on contract is do [sic] automate some of the scraping an artifact collection into single files and then develop a helper app that can parse all this information into the right fields. Should be easy.”

[pre election?] On November 2, U.S. Chamber of Commerce president Tom Donohue praises the Republican gains in Congress, governorships, and state legislatures: “Today Americans sent a powerful message to Washington: Focus on job creation and economic growth. Voters have <a href="http://www.uschamber.com/press/releases/2010/november/americans-voted-jobs-and-economic-growth-says-donohue">resoundingly rejected</a> more government spending, higher taxes, and more burdensome regulations that have caused crippling uncertainty for businesses.” Meanwhile, the group of private security contractors comes up with the name “Team Themis.”

On November 3, John Woods meets with Patrick Ryan, Aaron Barr, etc. to discuss the project. In their “Corporate Information Reconnaissance Cell” slide show: “Purpose: Develop a corporate information reconnaissance service to aid legal investigations through the open source collection of information on <a href="http://thinkprogress.org/wp-content/uploads/2011/02/themis_presentation_s.png">target groups and individuals</a> that appear organized to extort specific concessions through online slander campaigns.” It appears that at the meeting it was revealed that the client is the U.S. Chamber of Commerce. [note crime lang? get what action from whom?]

On November 4, Themis has a conference call to discuss their pricing proposal. Steckman notes “Their client is loaded!” Ryan forwards the group a Chamber of Commerce booklet on corporate campaigns that Sam Kremin had found.

On November 5, Ryan asks Woods what data H&W has, wondering if it includes “Financial Records, Union Rosters, IP addresses” and “access to the union in question’s membership lists”. Ryan attaches a $200,000 cost proposal.

On November 7, Woods tells Ryan he will be meeting on November 9 “with the team at HW who has gathered the underlying data” and asks about how pricing will work.

On November 8 Woods and Ryan talk on the phone.

On November 9, Woods asks Barr to “impress” Richard Wyatt by investigating Stop The Chamber. [vs fix?] Woods says Wyatt “might freak out” if he saw all the personal info Barr had collected by scraping social media sites. Barr is already collecting data on a number of anti-Chamber sites, including ThinkProgress. He tells Woods about what he found about Michael Gehrke. Aaron Barr also tells John Woods and Patrick Ryan the info he had found about VelvetRevolution.us, Brad Friedman, Emily Levy, ThinkProgress, and Debbie Fine. He also emails John Woods to tell him “Lets say we can publicly tie Joe Trippi (http://www.facebook.com/trippi) and his company to the development of videos for organization X. We can take videos released by organization Y and analyze the internals to see if there are forensic markers that are a match.”
[[[Mike Gehrke is a Vice President in our Washington D.C. office where he consults international and domestic political and public affairs clients. After building a reputation as one of the Democratic Party's top campaign staffers and political operatives over the past 20 years, Mike joined BSG in the fall of 2010. His prior work includes serving as the White House Director of Research for President Bill Clinton, the Research Director for the Presidential campaign of Sen. John Kerry, and leading the opposition communications and research operation at the Democratic National Committee during the 2007-2008 presidential primary and general election. Mike has served as a consultant, advisor or on-the-ground staff for political and issue campaigns in 17 states throughout the South and West. He has also worked for the Democratic Senatorial Campaign Committee, was the Executive Director of the Senate Majority Project - an independent 527 political committee in the 2006 election cycle - and is a veteran of the AFL-CIO Political Department and the Change to Win Federation. Internationally, his work includes polling for the Presidential campaign of Dominican Republic President Danilo Medina and work in Colombia, Nigeria, Jamaica and the European Union.]][Mike Gehrke is a Vice President in our Washington D.C. office where he consults international and domestic political and public affairs clients. After building a reputation as one of the Democratic Party's top campaign staffers and political operatives over the past 20 years, Mike joined BSG in the fall of 2010. His prior work includes serving as the White House Director of Research for President Bill Clinton, the Research Director for the Presidential campaign of Sen. John Kerry, and leading the opposition communications and research operation at the Democratic National Committee during the 2007-2008 presidential primary and general election. Mike has served as a consultant, advisor or on-the-ground staff for political and issue campaigns in 17 states throughout the South and West. He has also worked for the Democratic Senatorial Campaign Committee, was the Executive Director of the Senate Majority Project - an independent 527 political committee in the 2006 election cycle - and is a veteran of the AFL-CIO Political Department and the Change to Win Federation. Internationally, his work includes polling for the Presidential campaign of Dominican Republic President Danilo Medina and work in Colombia, Nigeria, Jamaica and the European Union.]

On November 10, Woods talked with Ryan and “set up a meeting” for November 12 at the Palantir offices intended to get Richard Wyatt “to sign off on the project.”

On November 11, Barr sends Berico’s Kremin and Ryan a document with his research of “Chamber Opposition,” downloads of the Facebook supporters of Change To Win, Code Pink, Stop The Chamber, US Chamber Watch, Velvet Revolution, and a list of the Facebook friends of the Velvet Revolution’s Brett Kimberlin.

On November 12, representatives from Palantir, Berico, and HBGary meet with John Woods and Richard Wyatt. The expectation is set for a presentation to the Chamber of Commerce on November 23.

On November 16, Berico <a href="http://thinkprogress.org/wp-content/uploads/2011/02/berico-hbgary_contract.png">formally sub-contracts</a> HBGary Federal “to submit a proposal to Hunton & Williams (herein referred to as ‘Customer’) in response to their request for assistance within the realm of legal discovery to provide certain software platforms and maintenance, and systems integrators and analysts in order to better conduct cyber investigations and Corporate Campaign Analysis (herein referred to as the ‘Program.’)” The contract is signed by Nicholas Hallam, Berico COO and Aaron Barr, HBGary CEO. In a separate email, Barr expresses amazement that Palantir wants $1 million a month for six months.

On November 17, Eli Bingham sets up the Themis instance on the Palantir system. He shares a “printable version of the current ontology,” which includes labor organizations, strikes, and demonstrations. The ontology is also designed to hold the social media profiles of people.

On November 18, Ryan Castle (Palantir) tells the team that the “<a href="http://thinkprogress.org/wp-content/uploads/2011/02/palantir_facebook_import_email.png" style="background-color: rgb(255, 255, 255);">facebook information</a> that you sent to me has been imported” and “mugshots [ezra quit resisting] are included.” Barr raises issues about the pricing for this six-month project, pointing out that HBGary and Berico will be doing all the work, and asks for a 40/30/30 split. Ryan agrees on behalf of Berico. Steckman says “we got <a href="http://thinkprogress.org/wp-content/uploads/2011/02/approval_from_karp_email.png" style="">approval from Dr. Karp</a> [PALANTIR?] and the Board to go ahead with the modified 40/30/30 breakdown proposed” for pricing the project. He notes “it will seem like money falling from the sky for those of us used to working in the govt sector.”

On November 19, Sean Stenstrom (Palantir) sends a license agreement to Berico for the use of Palantir’s services.

On November 22, Palantir general counsel Matt Long signs a “teaming agreement” contract between Palantir and Berico, signed by Hallam the next day.

On November 23, Kremin emails Woods with the contracts between Palantir & Berico and Berico & HBGary. He also attaches a costing proposal, for $200,000 for 11/23 – 12/23, then $2 million total for 12/24 to 6/24/11. The proposal includes creating “in-depth target dossiers for key entities and groups; will include key biographic data, relationships, intentions, etc.” Woods and Kremin discuss setting up a conference call with Bob Quackenboss, “our key client contact operationally.”

On November 24, H&W and Themis have a conference call. After the call, Steckman says: “We need to blow these guys away with descriptions of our capabilities, IP, and talent. Make them think that we are Bond, Q, and money penny all packaged up with a bow.” As they discuss how to bill the client, Steckman reiterates that H&W and the Chamber need to know why they should spend so much: “Most of all that we are the best money can buy! Dam it feels good to be a gangsta.” By the end of the day Katie Crotty had sent a more detailed breakdown of the abilities of the team’s staff to H&W in a “labor category spreadsheet.”

On November 29, Berico completes sample “reports” for H&W and collects resumes of the team members, per H&W’s request. H&W tells Berico the NDA language “needs to be reworked.”

On November 30, Steckman meets with John Woods and briefly meets Bob Quackenboss. Although the $2 million price tag was high, Woods says that Richard Wyatt is “looking to push that number to the Chamber.” Woods tells Steckman the Themis group “has potential for huge gains in this market especially since ‘the results of the election made some people angry.’”

<h2 style="background-color: rgb(255, 255, 255);">DECEMBER</h2>

On December 1, John Woods and Bob Quackenboss receive sample “reports” from Themis that involve scraping Facebook to create dossiers of the Chamber’s political opponents (including people at MoveOn).

On December 2, Woods (h&w] asks Themis for “five to six slides on Wikileaks” for “a large US Bank.” The group eagerly begins work on the presentation.

On December 3, Barr tells the Themis group “I think we need to highlight people like Glenn Greenwald” for the WikiLeaks presentation. By 11:18 am, they have sent a Powerpoint presentation to John Woods.

On December 10, Sam Kremin complains to Aaron Barr that H&W wasn’t responding to them. He also explains to Barr how to upload personal information “scraped” from Facebook onto Palantir’s systems.

On December 13, Berico & HBGary emails John Woods to basically ask what was going on.

On December 21, Guy Filippelli, Berico CEO, <a href="http://thinkprogress.org/wp-content/uploads/2011/02/guy_bob_meeting_email.png">meets with Bob Quackenboss</a> who complained about the price.

On December 23, Palantir has a meeting with John Woods and “we are all in for this first opp (obviously lot’s of understood caveats/implications/long term thoughts/etc here).”

On December 28 they email Quackenboss again, who replied that he would try to get back to them the next day. He doesn’t.

On December 30-31 Aaron Barr and Mark Trynor discuss the Facebook scraper app that Trynor developed.

<h2 style="background-color: rgb(255, 255, 255);">JANUARY</h2>

On January 13, H&W gives Themis a “very basic” document “that shows the connections between groups and people involved.” That document is not forwarded over email but sent on CD by courier. The Themis team assumes this act represents official initiation of the $200,000 Phase 1. Aaron Barr and Ted Vera at HBGary talk about finally landing $50K.

Meanwhile, Barr spends two hours giving a presentation on social media exploitation at the United States Army Intelligence and Security Command in Springfield, VA.

On January 14, Ted Vera tells HBGary president Penny Leavy-Hoglund that HBGary will get the contract. Kremkin tells the team that “phase 1 has started” and believes that Bob Quackenboss “will hopefully be able to meet with us to give us his vision and guidance for the project.”

On January 18, Barr goes to the Berico offices to discuss the project.

On January 19, Amanda McDonald (Palantir) creates the Berico Themis instance. Barr tells Leavy-Hoglund: “The law firm deal has been agreed upon but the lawfirm has still not written us a contract. Berico says they have verbally areed [sic] to the pricing and want us to get started but we don’t have the contract yet.”

On January 20, in a conversation with Mark Trynor about Wikileaks, Barr says, “I really dislike corporations. They suck the lifeblood out of humanity,” although: “Governments and corporations should have a right to protect secrets, sensitive information that could be damage to their operations.”

On January 25, Barr asks Ryan for news. “Still waiting for Bob [Quackenboss] to return my calls,” Ryan replies, “also had our lawyer/contracts person reach out to their contracts person to push from that direction. Im pretty much calling bob daily at this point.”

On January 26, Barr tells Woods about the research he’s been doing on Anonymous. Woods puts him in contact with Bill Wansley at Booz Allen. Wansley and Barr set up a meeting for the 28th.

<h2 style="background-color: rgb(255, 255, 255);">FEBRUARY</h2>

On February 3, Berico’s Pat Ryan discusses a “long-overdue” meeting he had with Bob Quackenboss, who told him that “H&W is unable/unwilling to pay any fees/costs to us for the “Phase I” demo build-out” and “they won’t commit any funds to this project until we’ve helped them earn buy-in from their Client (the Chamber).” Quackenboss “apologized for the confusion/misunderstanding and said he thinks there is a high likelihood of selling the Chamber on this, but asked that we be willing to share the risk with H&W up-front.” Berico is willing to work on a demo to present to the Chamber on February 14.

On February 4, the Financial Times publishes the story about Aaron Barr and Anonymous, and Anonymous soon goes after HBGary. Email record ends February 6.  http://thinkprogress.org/chamberleaks-timeline/

==

update; vouched for by Just Dept?

hbg ceo quits

HB Gary Federal, Palantir, and Berico Technologies (collectively called Team Themis)

<a href="http://projects.washingtonpost.com/top-secret-america/companies/berico-technologies/">http://projects.washingtonpost.com/top-secret-america/companies/berico-technologies/</a>

est 2006  pvt co 6m$ rev, 75 employees

<h6 style="background-color: rgb(255, 255, 255);">Number of Locations 9</h6>

<h6>Number of Government Clients 3</h6>

</div>

<h6>Types of Work (4)  </h6>

</div>

<li><a href="http://projects.washingtonpost.com/top-secret-america/functions/cyber-ops/">Cyber operations</a></li>

<li><a href="http://projects.washingtonpost.com/top-secret-america/functions/ground-ops/">Ground force operations</a></li>

<li><a href="http://projects.washingtonpost.com/top-secret-america/functions/special-ops/">Specialized military operations</a></li>

<li><a href="http://projects.washingtonpost.com/top-secret-america/functions/technical-intelligence/">Technical intelligence</a></li>

</ul>

ctr attack <a href="http://www.examiner.com/libertarian-in-san-jose/anonymous-announces-us-chamber-of-commerce-target">http://www.examiner.com/libertarian-in-san-jose/anonymous-announces-us-chamber-of-commerce-target</a>

==

Greenwald reactions:

...

My initial reaction to all of this was to scoff at its absurdity.  Not being familiar with the private-sector world of internet security, I hadn’t heard of these firms before and, based on the quality of the proposal, assumed they were just some self-promoting, fly-by-night entities of little significance.  Moreover, for the reasons I detailed in <a href="http://www.thetechherald.com/article.php/201106/6798/Data-intelligence-firms-proposed-a-systematic-attack-against-WikiLeaks">my interview with The Tech Herald</a> — and for reasons <a href="http://digbysblog.blogspot.com/2011/02/tit-for-tat-and-hack-for-hack.html">Digby elaborated on here</a> — the very notion that I could be forced to choose “professional preservation over cause” is ludicrous on multiple levels.  Obviously, I wouldn’t have spent the last year vehemently supporting WikiLeaks — to say nothing of aggressively criticizing virtually every large media outlet and many of their leading stars, as well as the most beloved political leaders of both parties — if I were willing to choose ”career preservation over cause.”

But after learning a lot more over the last couple of days, I now take this more seriously — not in terms of my involvement but the broader implications this story highlights.  For one thing, it turns out that the firms involved here are large, legitimate and serious, and do <a href="http://emptywheel.firedoglake.com/2011/02/10/palantir-tries-to-preserve-their-government-contracts/">substantial amounts of work</a> for both the U.S. Government and the nation’s largest private corporations (as but one example, see <a href="http://utdocuments.blogspot.com/2011/02/email-from-stanford-student-re-palantir.html">this email from a Stanford computer science student</a> about Palantir).  Moreover, these kinds of smear campaigns are far from unusual; in other leaked HB Gary emails, <a href="http://thinkprogress.org/2011/02/10/lobbyists-chamberleaks/">ThinkProgress discovered</a> that similar proposals were prepared for the Chamber of Commerce to attack progressive groups and other activists (including ThinkProgress).  And perhaps most disturbing of all, Hunton & Williams was recommended to Bank of America’s General Counsel by the Justice Department — meaning the U.S. Government is aiding Bank of America in its defense against/attacks on WikiLeaks....

<a href="http://www.salon.com/2011/02/11/campaigns_4/">http:/www.salon.com/2011/02/11/campaigns_4/</a>

----

subst work:

Somehow, Dr. Karp forgot to apologize to Brad Friedman, another journalist WBGary–in projects bid in partnership with Palantir–<a href="http://thinkprogress.org/2011/02/10/chamberleaks-target-families/" style="background-color: rgb(255, 255, 255);">has targeted</a>.

As a reminder, Palantir Technologies is one of the two other security firms that HBGary partnered with to try to get spying business with <a href="http://emptywheel.firedoglake.com/2011/02/09/security-firms-pitching-bank-of-america-proposed-targeting-glenn-greenwald/">Bank of America</a> and the <a href="http://emptywheel.firedoglake.com/2011/02/10/will-the-chamber-continue-wits-hbgary-work-now-that-theyve-been-hacked/">Chamber of Commerce</a>.

But perhaps more relevant is Palantir’s primary focus: working with the national security apparatus. They’ve done at least <a href="http://www.usaspending.gov/search?query=&searchtype=&formFields=eyJSZWNpcGllbnROYW1lTGNhc2UiOlsiUGFsYW50aXIgVGVjaG5vbG9naWVzIEluYy4iXX0=">$6,378,332 in business</a> with entities like SOCOM and FBI in the last several years. And while they say they have no plans to adopt “offensive cyber capabilities,” that’s not to say they’re not helping the government analyze data on our presumed enemies.[The United States Special Operations Command (USSOCOM or SOCOM) is the <a href="http://en.wikipedia.org/wiki/Unified_Combatant_Command" title="Unified Combatant Command" style="background-color: rgb(255, 255, 255); text-decoration: none; color: rgb(11, 0, 128); line-height: 19.2px; background-image: none;">Unified Combatant Command</a> charged with overseeing the various <a href="http://en.wikipedia.org/wiki/Special_forces" title="Special forces" style="background-color: rgb(255, 255, 255); text-decoration: none; color: rgb(11, 0, 128); line-height: 19.2px; background-image: none;">Special Operations</a> Component Commands of the <a href="http://en.wikipedia.org/wiki/USASOC" title="USASOC" class="mw-redirect" style="background-color: rgb(255, 255, 255); text-decoration: none; color: rgb(11, 0, 128); line-height: 19.2px; background-image: none;">Army</a>, <a href="http://en.wikipedia.org/wiki/AFSOC" title="AFSOC" class="mw-redirect" style="background-color: rgb(255, 255, 255); text-decoration: none; color: rgb(11, 0, 128); line-height: 19.2px; background-image: none;">Air Force</a>, <a href="http://en.wikipedia.org/wiki/NAVSPECWARCOM" title="NAVSPECWARCOM" class="mw-redirect" style="background-color: rgb(255, 255, 255); text-decoration: none; color: rgb(11, 0, 128); line-height: 19.2px; background-image: none;">Navy</a> and <a href="http://en.wikipedia.org/wiki/MARSOC" title="MARSOC" class="mw-redirect" style="background-color: rgb(255, 255, 255); text-decoration: none; color: rgb(11, 0, 128); line-height: 19.2px; background-image: none;">Marine Corps</a> of the <a href="http://en.wikipedia.org/wiki/United_States_Armed_Forces" title="United States Armed Forces" style="background-color: rgb(255, 255, 255); text-decoration: none; color: rgb(11, 0, 128); line-height: 19.2px; background-image: none;">United States Armed Forces</a>. The command is part of the <a href="http://en.wikipedia.org/wiki/United_States_Department_of_Defense" title="United States Department of Defense" style="background-color: rgb(255, 255, 255); text-decoration: none; color: rgb(11, 0, 128); line-height: 19.2px; background-image: none;">Department of Defense</a> and is the only Unified Combatant Command legislated into being by the U.S. Congress. USSOCOM is headquartered at <a href="http://en.wikipedia.org/wiki/MacDill_Air_Force_Base" title="MacDill Air Force Base" style="background-color: rgb(255, 255, 255); text-decoration: none; color: rgb(11, 0, 128); line-height: 19.2px; background-image: none;">MacDill Air Force Base</a> in <a href="http://en.wikipedia.org/wiki/Tampa,_Florida" title="Tampa, Florida" style="background-color: rgb(255, 255, 255); text-decoration: none; color: rgb(11, 0, 128); line-height: 19.2px; background-image: none;">Tampa</a>, Florida.]

I would imagine Palantir has pretty good reason to know that the government will not do business with a contractor using the same technologies to target Glenn Greenwald (and maybe Brad Friedman).

At least not publicly. Remember–DOJ recommended Hunton & Williams (which put Palantir and HBGary together for the bid) to Bank of America.

<h2 style="background-color: rgb(255, 255, 255);">New SAP® Solution Extension for Public Sector by SAP Partner Palantir to Help Public Safety and Security Agencies Run Better, So That Communities Run Safer</h2>

May 25, 2011 (PR Newswire) --

<div class="xn-content" style="background-color: rgb(255, 255, 255);">KARLSRUHE, Germany, May 25, 2011 /PRNewswire/ -- In pursuit of its stated vision to help the world run better, SAP AG (NYSE: SAP) is teaming up with Palantir <a tabindex="0" class="itxtrst itxtrsta itxthook" href="http://www.istockanalyst.com/business/news/5179877/palantir-and-sap-boost-public-safety-with-intelligence-analysis#" id="itxthook0" rel="nofollow" style="text-decoration: underline; border-bottom-width: 0.075em; border-bottom-style: solid; border-bottom-color: rgb(0, 100, 0); padding-bottom: 1px; color: rgb(0, 100, 0); background-color: transparent;">Technologies</a>, a leading provider of intelligence analysis tools, to help government agencies improve public safety and security. The companies have signed a global reseller agreement through which SAP will resell Palantir's market-leading intelligence analysis platform as the SAP® Intelligence Analysis for Public Sector application by Palantir. </div><div class="xn-content" style="">
</div><div class="xn-content" style="">The solution will allow public safety agencies,[police]  in particular, to upgrade their intelligence management capabilities to better anticipate security threats. It provides officials' improved access to information so that they can make better decisions and act faster. The announcement was made at the SAP Public Services Ecosystem Summit, being held May 25-26, 2011.</div>

----

Palantir

Dr. Alex Karp, the Co-Founder and CEO of Palantir Technologies

Dr. Alex Karp is co-founder and Chief Executive Officer of Palantir Technologies. Prior to Palantir, Dr. Karp founded the Caedmon Group. He earned his law degree from Stanford University and his Ph.D. from the University of Frankfurt, Germany. A U.S. citizen, Dr. Karp is bilingual in English and German, and also speaks French.

Peter Andreas Thiel (born 1967) is an <a href="http://en.wikipedia.org/wiki/United_States" title="United States">American</a> <a href="http://en.wikipedia.org/wiki/Entrepreneur" title="Entrepreneur">entrepreneur</a>, <a href="http://en.wikipedia.org/wiki/Hedge_fund" title="Hedge fund">hedge fund</a> manager, <a href="http://en.wikipedia.org/wiki/Libertarian" title="Libertarian">libertarian</a> and <a href="http://en.wikipedia.org/wiki/Venture_capitalist" title="Venture capitalist" class="mw-redirect">venture capitalist</a> of German descent. With <a href="http://en.wikipedia.org/wiki/Elon_Musk" title="Elon Musk">Elon Musk</a> and <a href="http://en.wikipedia.org/wiki/Max_Levchin" title="Max Levchin">Max Levchin</a>, Thiel co-founded <a href="http://en.wikipedia.org/wiki/PayPal" title="PayPal">PayPal</a> and was its <a href="http://en.wikipedia.org/wiki/CEO" title="CEO" class="mw-redirect">CEO</a>. He currently serves as president of <a href="http://en.wikipedia.org/wiki/Clarium_Capital" title="Clarium Capital">Clarium Capital</a>, a <a href="http://en.wikipedia.org/wiki/Global_macro" title="Global macro">global macro</a> hedge fund with under $700M in <a href="http://en.wikipedia.org/wiki/Assets_under_management" title="Assets under management">assets under management</a>, and a managing partner in <a href="http://en.wikipedia.org/wiki/The_Founders_Fund" title="The Founders Fund">The Founders Fund</a>, a $275 million venture capital fund that he launched with <a href="http://en.wikipedia.org/wiki/Ken_Howery" title="Ken Howery">Ken Howery</a> and <a href="http://en.wikipedia.org/wiki/Luke_Nosek" title="Luke Nosek">Luke Nosek</a> in 2005. He was an early investor in <a href="http://en.wikipedia.org/wiki/Facebook" title="Facebook">Facebook</a>, the popular social-networking site, and sits on the company’s board of directors. Thiel was ranked #365 on the <a href="http://en.wikipedia.org/wiki/Forbes_400" title="Forbes 400">Forbes 400</a> in 2010, with a net worth of <a href="http://en.wikipedia.org/wiki/US$" title="US$" class="mw-redirect">US$</a>1.5 billion.<a href="http://en.wikipedia.org/wiki/Peter_Thiel#cite_note-forbes-0">[1]</a> However, this number now underestimates his wealth as his Facebook share alone, at a 2010 valuation, is worth <a href="http://en.wikipedia.org/wiki/US$" title="US$" class="mw-redirect">US$</a>1.7 billion.<a href="http://en.wikipedia.org/wiki/Peter_Thiel#cite_note-G01-1">[2]</a> Peter Thiel lives in <a href="http://en.wikipedia.org/wiki/San_Francisco,_California" title="San Francisco, California" class="mw-redirect">San Francisco, California</a>.<a href="http://en.wikipedia.org/wiki/Peter_Thiel#cite_note-2">[3]</a> also stanford

<a href="http://www.dailykos.com/story/2011/02/15/944614/-HBGary,-Themis,-bloggers,-and-traditional-media:-What-a-tangled-Web">http://www.dailykos.com/story/2011/02/15/944614/-HBGary,-Themis,-bloggers,-and-traditional-media:-What-a-tangled-Web</a>

US CoC

<a href="http://thinkprogress.org/2011/02/10/lobbyists-chamberleaks/">http://thinkprogress.org/2011/02/10/lobbyists-chamberleaks/</a>

EXCLUSIVE: US Chamber’s Lobbyists Solicited Hackers To Sabotage Unions, Smear Chamber’s Political Opponents

ThinkProgress has learned that a law firm representing the U.S. Chamber of Commerce, the big business trade association representing ExxonMobil, AIG, and other major international corporations, is working with set of “private security” companies and lobbying firms to undermine their political opponents, including ThinkProgress, with a surreptitious sabotage campaign.

According to e-mails obtained by ThinkProgress, the Chamber hired the lobbying firm Hunton and Williams. Hunton And Williams’ attorney Richard Wyatt, who once represented Food Lion in its infamous lawsuit against ABC News, was hired by the Chamber in October of last year. To assist the Chamber, Wyatt and his associates, John Woods and Bob Quackenboss, solicited a set of private security firms — HBGary Federal, Palantir, and Berico Technologies (collectively called Team Themis) — to develop tactics for damaging progressive groups and labor unions, in particular ThinkProgress, the labor coalition called Change to Win, the SEIU, US Chamber Watch, and StopTheChamber.com.

--

http://arstechnica.com/tech-policy/news/2011/02/the-ridiculous-plan-to-attack-wikileaks.ars/

cyberwar, keystroke recording?

sockpuppers in SL:

<h3 style="background-color: rgb(255, 255, 255);">Psyops</h3>

In mid-2010, HBGary Federal put together a PSYOP (psychological operations) proposal for SOCOM, which had issued a general call for new tools and techniques. In the document, the new HBGary Federal team talked up their past experience as creators of "multiple products briefed to POTUS [President of the United States], the NSC [National Security Council], and Congressional Intelligence committees, as well as senior intelligence and military leaders."

The document focused on cartoons and the Second Life virtual world. "HBGary personnel have experience creating political cartoons that leverage current events to seize the target audience's attention and propagate the desired messages and themes," said the document, noting that security-cleared cartoonists and 3D modelers had already been lined up to do the work if the government wanted some help.

Cartoon example of Ahmadinejad with a puppet ayatollah

</div>

The cartooning process "starts with gathering customer requirements such as the target audience, high level messages and themes, intended publication mediums… Through brainstorming sessions, we develop concept ideas. Approved concepts are rough sketched in pencil. Approved sketches are developed into a detailed, color end product that is suitable for publishing in a variety of mediums."

A sample cartoon, of Iranian President Ahmadinejad manipulating a puppet Ayatollah, was helpfully included.

The document then went on to explain how the US government could use a virtual world such as Second Life to propagate specific messages. HBGary could localize the Second Life client, translating its menu options and keyboard shortcuts into local dialects, and this localized client could report "valuable usage metrics, enabling detailed measures of effects." If you want to know whether your message is getting out, just look at the statistics of how many people play the game and for how long.

As for the messages themselves, those would appear within the Second Life world. "HBGary can develop an in-world advertising company, securing small plots of virtual land in attractive locations, which can be used to promote themes using billboards, autonomous virtual robots, audio, video, and 3D presentations," said the document.

They could even make a little money while they're at it, by creating "original marketable products to generate self-sustaining revenue within the virtual space as well as promote targeted messaging."

We found no evidence that SOCOM adopted the proposal.

But HBGary Federal's real interest had become social media like Facebook and Twitter—and how they could be used to explore and then penetrate secretive networks. And that was exactly what the Air Force wanted to do.

<h3 style="background-color: rgb(255, 255, 255);">Fake Facebook friends</h3>

In June 2010, the government was expressing real interest in social networks. The Air Force issued a <a href="https://www.fbo.gov/index?s=opportunity&mode=form&id=d88e9d660336be91552fe8c1a51bacb2&tab=core&_cview=1">public request</a> for "persona management software," which might sound boring until you realize that the government essentially wanted the ability to have one agent run multiple social media accounts at once.

It wanted 50 software licenses, each of which could support 10 personas, "replete with background, history, supporting details, and cyber presences that are technically, culturally and geographically consistent."

The software would allow these 50 cyberwarriors to peer at their monitors all day and manipulate these 10 accounts easily, all "without fear of being discovered by sophisticated adversaries." The personas would appear to come from all over the world, the better to infiltrate jihadist websites and social networks, or perhaps to show up on Facebook groups and influence public opinion in pro-US directions.

As the cyberwarriors worked away controlling their 10 personas, their computers would helpfully provide "real-time local information" so that they could play their roles convincingly.

In addition the Air Force wanted a secure virtual private network that could mask the IP addresses behind all of this persona traffic. Every day, each user would get a random IP address to help hide "the existence of the operation." The network would further mask this persona work by "traffic mixing, blending the user's traffic with traffic from multitudes of users from outside the organization. This traffic blending provides excellent cover and powerful deniability."

This sort of work most interested HBGary Federal's Aaron Barr, who was carving out a niche for himself as a social media expert. Throughout late 2010 and early 2011, he spent large chunks of his time attempting to use Facebook, Twitter, and Internet chat to map the network of Exelon nuclear plant workers in the US and to research the members of Anonymous. As money for his company dried up and government contracts proved hard to come by, Barr turned his social media ideas on pro-union forces, getting involved in a now-controversial project with two other security firms.

But e-mails make clear that he mostly wanted to sell this sort of capability to the government. "We have other customers, mostly on offense, that are interested in Social Media for other things," he wrote in August 2010. "The social media stuff seems like low hanging fruit."

How does one use social media and fake "personas" to do anything of value? An e-mail from Barr on August 22 makes his thinking clear. Barr ponders "the best way to go about establishing a persona to reach an objective (in this case <a href="http://www.belvoir.army.mil/">ft. belvoir</a>/INSCOM/1st IO)."

The Army's Fort Belvoir, like any secretive institution, might be more easily penetrated by pretending to be an old friend of a current employee. "Make your profile swim in a large sea," Barr wrote. "Pick a big city, big high school, big company. Work your way up and in. Recreate your history. Start by friending high school people. In my case I am in the army so after you have amassed enough friends from high school, then start friending military folks outside of your location, something that matches the area your in, bootcamp, etc. Lastly start to friend people from the base, but start low and work your way up. So far so good."

Once the persona had this network of friends, "I will start doing things tricky. Try to manipulate conversations, insert communication streams, etc," said Barr. This sort of social media targeting could also be used to send your new "friend" documents or files (such as the Al-Qaeda poison document discussed above) [that] come complete with malware, or by directing them to specially-crafted websites designed to elicit some specific piece of information: directed attacks known as "spear phishing."

But concerns arose about obtaining and using social media data, in part because sites like Facebook restricted the "scraping" of its user data. An employee from the link analysis firm <a href="http://www.palantirtech.com/" style="">Palantir</a> wrote Barr at the end of August, asking, "Is the idea that we'd want to ingest all of Facebook's data, or just a targeted subset for a few users of interest?"

The more data that was grabbed from Facebook, the more chance a problem could arise. The Palantir employee noted that a researcher had used similar tools to violate Facebook's acceptable use policy on data scraping, "resulting in a lawsuit when he crawled most of Facebook's social graph to build some statistics. I'd be worried about doing the same. (I'd ask him for his Facebook data—he's a fan of Palantir—but he's already deleted it.)"

Still, the potential usefulness of sites like Facebook was just too powerful to ignore, acceptable use policy or not.

<h3 style="background-color: rgb(255, 255, 255);">Feeling twitchy</h3>

While Barr fell increasingly in love with his social media sleuthing, Hoglund still liked researching his rootkits. In September, the two teamed up for a proposal to <a href="http://www.darpa.mil/">DARPA</a>, the Defense Advanced Research Projects Agency that had been instrumental in creating the Internet back in the 1960s.

DARPA didn't want incrementalism. It wanted breakthroughs (one of its most recent projects is the "100-Year Starship Study"), and Barr and Hoglund teamed up for a proposal to help the agency on its Cyber Insider Threat (CINDER) program. CINDER was an expensive effort to find new ways to watch employees with access to sensitive information and root out double agents or disgruntled workers who might leak classified information.

So Barr and Hoglund drafted a plan to create something like a lie detector, except that it would look for signs of "paranoia" instead.....

<h1 id="archive-head" class="subheading thick-divide-bottom" style="background-color: rgb(255, 255, 255);"><a href="http://arstechnica.com/tech-policy">Law & Disorder / Civilization & Discontents</a></h1>

<h1 class="heading" style="background-color: rgb(255, 255, 255);">Black ops: how HBGary wrote backdoors for the government</h1>

<h2 class="standalone-deck" style="background-color: rgb(255, 255, 255);">The attacks last week by Anonymous on security firm HBGary have yanked back …</h2>

by <a href="http://arstechnica.com/author/nate-anderson/" rel="author">Nate Anderson</a> - Feb 21 2011, 6:30am PST

<li><a href="http://arstechnica.com/discipline/black-hat-2">Black Hat</a></li>

<li><a href="http://arstechnica.com/discipline/government-2">Government</a></li>

</ul>

</div>

<h2 class="subheading notched" style="background-color: rgb(255, 255, 255);">The HBGary saga</h2>

<li><a href="http://arstechnica.com/staff/2011/02/our-anonymous-hbgary-coverage-on-colbert-report/">Colbert Report features Ars Anonymous/HBGary coverage</a></li>

<li><a href="http://arstechnica.com/tech-policy/2011/02/anonymous-vs-hbgary-the-aftermath/">Anonymous vs. HBGary: the aftermath</a></li>

<li><a href="http://arstechnica.com/tech-policy/2011/02/anonymous-speaks-the-inside-story-of-the-hbgary-hack/">Anonymous speaks: the inside story of the HBGary hack</a></li>

<li><a href="http://arstechnica.com/tech-policy/2011/02/the-ridiculous-plan-to-attack-wikileaks/">Spy games: Inside the convoluted plot to bring down WikiLeaks</a></li>

<li><a href="http://arstechnica.com/tech-policy/2011/02/virtually-face-to-face-when-aaron-barr-met-anonymous/">(Virtually) face to face: how Aaron Barr revealed himself to Anonymous</a></li>

</ul>

<h3 style="background-color: rgb(255, 255, 255);">Back to basics</h3>

In January 2011, Barr had moved on to his research into Anonymous—research that would eventually do his company in. Over at HBGary, Hoglund continued his pursuit of next-gen rootkits. He had hit on a new approach that he called "Magenta."

This would be a "new breed of Windows-based rootkit," said a Magenta planning document, one that HBGary called a "multi-context rootkit." The Magenta software would be written in low-level assembly language, one step up from the ones and zeroes of the binary code with which computers do their calculating. It would inject itself into the Windows kernel, and then inject itself further into an active process; only from there would the main body of the rootkit execute.

Magenta would also inject itself routinely into different processes, jumping around inside the computer's memory to avoid detection. Its command-and-control instructions, telling the rootkit exactly what to do and where to send the information, wouldn't come from some remote Internet server but from the host computer's own memory—where the control instructions had been separately injected.

"This is ideal because it’s trivial to remotely seed C&C messages into any networked Windows host," noted Hoglund, "even if the host in question has full Windows firewalling enabled."

Nothing like Magenta existed (not publicly, at least), and Hoglund was sure that he could squeeze the rootkit code into less than 4KB of memory and make it "almost impossible to remove from a live running system." Once running, all of the Magenta files on disk could be deleted. Even the best anti-rootkit tools, those that monitored physical memory for signs of such activity, "would only be of limited use since by the time the responder tried to verify his results Magenta will have already moved to a new location & context."

Hoglund wanted to build Magenta in two parts: first, a prototype for Windows XP with Service Pack 3—an old operating system but still widely installed. Second, if the prototype generated interest, HBGary could port the rootkit "to all current flavors of Microsoft Windows."

Shortly thereafter, Anonymous broke into HBGary Federal's website, cracked Barr's hashed password using rainbow tables, and found themselves in a curious position; Barr was also the administrator for the entire e-mail system, so they were able to grab e-mail from multiple accounts, including Hoglund's.

<h3 style="background-color: rgb(255, 255, 255);">A world awash in rootkits</h3>

The leaked e-mails provide a tantalizing glimpse of life behind the security curtain. HBGary and HBGary Federal were small players in this space; indeed, HBGary appears to have made much of its cash with more traditional projects, like selling anti-malware defense tools to corporations and scanning their networks for signs of infection.

If rootkits, paranoia monitors, cartoons, and fake Facebook personas were being proposed and developed here, one can only imagine the sorts of classified projects underway throughout the entire defense and security industry.

Whether these programs are good or bad depends upon how they are used. Just as Hoglund's rootkit expertise meant that he could both detect them and author them, 0-day exploits and rootkits in government hands can be turned to many uses. The FBI has had malware like <a href="http://www.wired.com/threatlevel/2007/07/fbi-spyware-how/">CIPAV</a> (the Computer and Internet Protocol Address Verifier) for several years, and it's clear from the HBGary e-mail leak that the military is in wide possession of rootkits and other malware of its own. The Stuxnet virus widely believed to have at <a href="http://arstechnica.com/tech-policy/news/2010/12/report-strengthens-suspicions-that-stuxnet-harmed-irans-nuke-plant.ars">least damaged</a> Iranian nuclear centrifuge operations is thought to have originated in the <a href="http://arstechnica.com/tech-policy/news/2011/01/did-a-us-government-lab-help-israel-develop-stuxnet.ars">US or Israeli governments</a>, for instance.

But the e-mails also remind us how much of this work is carried out privately and beyond the control of government agencies. We found no evidence that HBGary sold malware to nongovernment entities intent on hacking, though the company did have plans to repurpose its DARPA rootkit idea for corporate surveillance work. ("HBGary plans to transition technology into commercial products," it told DARPA.)

And another document, listing HBGary's work over the last few years, included this entry: "HBGary had multiple contracts with a consumer software company to add stealth capability to their host agent."

The actions of HBGary Federal's Aaron Barr also serve as a good reminder that, when they're searching for work, private security companies are more than happy to switch from military to corporate clients—and they bring some of the same tools to bear.

When asked to investigate pro-union websites and WikiLeaks, Barr turned immediately to his social media toolkit and was ready to deploy personas, Facebook scraping, link analysis, and fake websites; he also suggested computer attacks on WikiLeaks infrastructure and pressure be brought upon journalists like Glenn Greenwald.

His compatriots at Palantir and <a href="http://www.bericotechnologies.com/">Berico</a> showed, in their many e-mails, few if any qualms about turning their national security techniques upon private dissenting voices. Barr's ideas showed up in Palantir-branded PowerPoints and Berico-branded "scope of work" documents. "Reconnaissance cells" were proposed, network attacks were acceptable, "target dossiers" on "adversaries" would be compiled, and "complex information campaigns" involving fake personas were on the table.

Critics like Glenn Greenwald contend that this nexus of private and public security power is a dangerous mix. "The real issue highlighted by this episode is just how lawless and unrestrained is the unified axis of government and corporate power," he <a href="http://www.salon.com/news/opinion/glenn_greenwald/2011/02/11/campaigns/index.html">wrote last week</a>.

Especially (though by no means only) in the worlds of the Surveillance and National Security State, the powers of the state have become largely privatized. There is very little separation between government power and corporate power. Those who wield the latter intrinsically wield the former.

The revolving door between the highest levels of government and corporate offices rotates so fast and continuously that it has basically flown off its track and no longer provides even the minimal barrier it once did. It's not merely that corporate power is unrestrained; it's worse than that: corporations actively exploit the power of the state to further entrench and enhance their power.

</blockquote>

Even if you don't share this view, the e-mails provide a fascinating glimpse into the origins of government-controlled malware. Given the number of rootkits apparently being developed for government use, one wonders just how many machines around the globe could respond to orders from the US military. Or the Chinese military. Or the Russian military.

While hackers get most of the attention for their rootkits and botnets and malware, state actors use the same tools to play a different game—the Great Game—and it could be coming soon to a computer near you

<a href="http://arstechnica.com/tech-policy/2011/02/black-ops-how-hbgary-wrote-backdoors-and-rootkits-for-the-government/3/">http://arstechnica.com/tech-policy/2011/02/black-ops-how-hbgary-wrote-backdoors-and-rootkits-for-the-government/3/</a>

...

Faking documents seemed like a good idea, too, documents which could later be "called out" so as to make WikiLeaks look unreliable.

And Barr wanted to go further, pushing on people like civil liberties Salon.com columnist Glenn Greenwald—apparently hoping to threaten their livelihoods. "These are established professionals that have a liberal bent, but ultimately most of them if pushed will choose professional preservation over cause, such is the mentality of most business professionals," he wrote. "Without the support of people like Glenn WikiLeaks would fold."

When the US Chamber of Commerce wanted to look into some of its opponents, Barr teamed with two other security companies and went nuts, proposing that the Chamber create an absurdly expensive "fusion cell" of the kind "developed and utilized by Joint Special Operations Command (JSOC)"—and costing $2 million a month. And if the fusion cell couldn't turn up enough opposition research, the security firms would be happy to create honeypot websites to lure the Chamber's union-loving opponents in order to grab more data from them.

The security companies even began grabbing tweets from liberal activists and mapping the connections between people using advanced link analysis software most often used by the intelligence community. (Some of the Chamber material was unearthed by <a href="http://thinkprogress.org/2011/02/10/lobbyists-chamberleaks/" style="background-color: rgb(255, 255, 255);">ThinkProgress</a> and <a href="http://emptywheel.firedoglake.com/2011/02/10/will-the-chamber-continue-wits-hbgary-work-now-that-theyve-been-hacked/" style="background-color: rgb(255, 255, 255);">other liberal bloggers</a>, while <a href="http://www.thetechherald.com/article.php/201106/6798/Data-intelligence-firms-proposed-a-systematic-attack-against-WikiLeaks" style="background-color: rgb(255, 255, 255);">The Tech Herald</a> and <a href="http://crowdleaks.org/" style="background-color: rgb(255, 255, 255);">Crowdleaks.org</a> first wrote about the proposed WikiLeaks attacks.)

While waiting to see if his proposals would result in work for HBGary Federal, Barr turned in January to <a href="http://www.ft.com/cms/s/0/87dc140e-3099-11e0-9de3-00144feabdc0.html">unmask the leadership of the hacker collective Anonymous</a>. This part of the story is well known by now (read our <a href="http://arstechnica.com/tech-policy/news/2011/02/how-one-security-firm-tracked-anonymousand-paid-a-heavy-price.ars">investigative feature</a>): when Barr went public with his findings, Anonymous took down his website, stole his e-mails, deleted the company's backup data, trashed Barr's Twitter account, and remotely wiped his iPad.

In the days since the attack and the publication of Barr's e-mails, his partners at other security firms threw him under the bus. "I have directed the company to sever any and all contacts with HB Gary," said the CEO of Palantir.

Berico Technologies, another private security firm, said that it "does not condone or support any effort that proactively targets American firms, organizations or individuals. We find such actions reprehensible and are deeply committed to partnering with the best companies in our industry that share our core values. Therefore, we have discontinued all ties with HBGary Federal."

Glenn Greenwald <a href="http://www.salon.com/news/opinion/glenn_greenwald/2011/02/11/campaigns/index.html">unleashed both barrels</a> of his own, claiming that "what is set forth in these proposal... quite possibly constitutes serious crimes. Manufacturing and submitting fake documents with the intent they be published likely constitutes forgery and fraud. Threatening the careers of journalists and activists in order to force them to be silent is possibly extortion and, depending on the specific means to be used, constitutes other crimes as well. Attacking WikiLeaks' computer infrastructure in an attempt to compromise their sources undoubtedly violates numerous cyber laws."

How did Barr, a man with long experience in security and intelligence, come to spend his days as a CEO e-stalking clients and their wives on Facebook? Why did he start performing "reconnaissance" on the largest nuclear power company in the US? Why did he suggest pressuring corporate critics to shut up, even as he privately insisted that corporations "suck the lifeblood out of humanity"? And why did he launch his ill-fated investigation into Anonymous, one which may well have destroyed his company and damaged his career?

Thanks to his leaked e-mails, the downward spiral is easy enough to retrace. Barr was under tremendous pressure to bring in cash, pressure which began on November 23, 2009.

players attract players

That's when Barr started the CEO job at HBGary Federal. Its parent company, the security firm HBGary, wanted a separate firm to handle government work and the clearances that went with it, and Barr was brought in from Northrup Grumman to launch the operation.

In an e-mail announcing Barr's move, HBGary CEO Greg Hoglund told his company that "these two are A+ players in the DoD contracting space and are able to 'walk the halls' in customer spaces. Some very big players made offers to Ted and Aaron last week, and instead they chose HBGary. This reflects extremely well on our company. 'A' players attract 'A' players."...On October 19, a note arrived. HBGary Federal might be able to provide part of "a complete intelligence solution to a law firm that approached us." That law firm was DC-based powerhouse Hunton & Williams, which boasted 1,000 attorneys and terrific contacts. They had a client who wanted to do a little corporate investigative work, and three small security firms thought they might band together to win the deal...

Once that was done, Team Themis staffers could start churning out intelligence reports for the Chamber. The team wrote up a set of "sample reports" filled with action ideas like:

<li>Create a false document, perhaps highlighting periodical financial information, and monitor to see if US Chamber Watch acquires it. Afterward, present explicit evidence proving that such transactions never occurred. Also, create a fake insider persona and generate communications with [union-backed Change to Win]. Afterward, release the actual documents at a specified time and explain the activity as a CtW contrived operation.</li>

<li>

</li>

<li>If needed, create two fake insider personas, using one as leverage to discredit the other while confirming the legitimacy of the second. Such work is complicated, but a well-thought out approach will give way to a variety of strategies that can sufficiently aid the formation of vetting questions US Chamber Watch will likely ask.</li>

</ul>

In October 2010, HBGary CEO Greg Hoglund had tossed out a random idea for Barr, one that did not apparently seem unusual: "I suggest we create a large set of unlicensed windows-7 themes for video games and movies appropriate for middle east & asia. These theme packs would contain back doors."

Barr's ideas about WikiLeaks went beyond attacks on their infrastructure. He wrote in a separate document that WikiLeaks was having trouble getting money because its payment sources were being blocked. "Also need to get people to understand that if they support the organization we will come after them," he wrote. "Transaction records are easily identifiable."

........

At 7:30am the next morning, Barr had another great idea—find some way to make WikiLeaks supporters like Glenn Greenwald feel like their jobs might be at stake for supporting the organization.

"One other thing," he wrote in his morning message. "I think we need to highlight people like Glenn Greenwald. Glenn was critical in the Amazon to OVH [data center] transition and helped WikiLeaks provide access to information during the transition. It is this level of support we need to attack. These are established professionals that have a liberal bent, but ultimately most of them if pushed will choose professional preservation over cause, such is the mentality of most business professionals. Without the support of people like Glenn WikiLeaks would fold."

This seems an absurd claim on a number of levels, but it also upped the "creep factor" dramatically. Barr was now suggesting that a major US corporation find ways to lean on a civil liberties lawyer who held a particular view of WikiLeaks, pressuring him into silence on the topic. Barr, the former Navy SIGINT officer who had traveled around the world to defend the US right to freedom of speech, had no apparent qualms about his idea.

from newcomplex

------

spy

At a senate hearing March 1, Centcom commander James N. Mattis said, "Our enemies operate within cyberspace (and its associated relevant physical infrastructure) to plan, coordinate, recruit, train, equip, execute and garner support for operations against the U.S., its allies and interests. Clearly, in the information age, our military must adapt to this new domain of warfare."

The online persona project is thought to fall under the domain of Operation Earnest Voice, which oversees Centcom's Information Operations, and in the words of Mattis, "seeks to disrupt recruitment and training of suicide bombers; deny safe havens for our adversaries; and counter extremist ideology and propaganda."

The users controlling the personas would be hidden in a variety of ways, including randomizing the IP addresses they accessed the software with, and "traffic mixing," or blending web traffic with that outside of Centcom to provide "excellent cover and powerful deniability."

The strategy may sound familiar. Last month, hacker group Anonymous unloaded a batch of 50,000 emails from security firm HBGary, where documents indicated that the firm was in the process of developing their own persona management software. The document outlined some of the proposed strategies for creating verisimilitude:

    Using hashtags and gaming some location based check-in services we can make it appear as if a persona was actually at a conference and introduce himself/herself to key individuals as part of the exercise, as one example. There are a variety of social media tricks we can use to add a level of realness to all fictitious personas

http://www.huffingtonpost.com/2011/03/17/online-persona-management_n_837153.html?utm_source=DailyBrief&utm_campaign=031811&utm_medium=email&utm_content=NewsEntry&utm_term=Daily+Brief

dailykos http://www.dailykos.com/story/2011/02/16/945768/-UPDATED:-The-HB-Gary-Email-That-Should-Concern-Us-All

perm:

<a href="http://wikileaks.org/the-gifiles.html">http://www.dailykos.com/story/2011/02/16/945768/-UPDATED:-The-HB-Gary-Email-That-Should-Concern-Us-Al</a>l

Wed Feb 16, 2011 at 10:56 PM EST

UPDATED: The HB Gary Email That Should Concern Us All

As I  wrote yesterday , there is a leaked email that has gotten surprisingly little attention around here. It's the one where Aaron Barr discusses his intention to post at Daily Kos - presumably something negative about Anonymous, the hacking group. But that's not the email I'm talking about here.

As I also mentioned yesterday, in some of the emails, HBGary people are talking about creating "personas", what we would call sockpuppets. This is not new. PR firms have been using fake "people" to promote products and other things for a while now, both online and even in bars and coffee houses.

But for a defense contractor with ties to the federal government, Hunton & Williams, DOD, NSA, and the CIA -  whose enemies are labor unions, progressive organizations,  journalists, and progressive bloggers,  a persona apparently goes far beyond creating a mere sockpuppet.

According to an embedded MS Word document found in one of the HBGary emails, it involves creating an army of sockpuppets, with sophisticated "persona management" software that allows a small team of only a few people to appear to be many, while keeping the personas from accidentally cross-contaminating each other. Then, to top it off, the team can actually automate some functions so one persona can appear to be an entire Brooks Brothers riot online.

    Persona management entails not just the deconfliction of persona artifacts such as names, email addresses, landing pages, and associated content.  It also requires providing the human actors technology that takes the decision process out of the loop when using a specific persona.  For this purpose we custom developed either virtual machines or thumb drives for each persona.  This allowed the human actor to open a virtual machine or thumb drive with an associated persona and have all the appropriate email accounts, associations, web pages, social media accounts, etc. pre-established and configured with visual cues to remind the actor which persona he/she is using so as not to accidentally cross-contaminate personas during use.

And all of this is for the purposes of infiltration, data mining, and (here's the one that really worries me) ganging up on bloggers, commenters  and otherwise "real" people to smear enemies and distort the truth.

This is an excerpt from one of the Word Documents, which was sent as an attachment by Aaron Barr, CEO of HBGary's Federal subsidiary, to several of his colleagues to present to clients:

    To build this capability we will create a set of personas on twitter,? ?blogs,? ?forums,? ?buzz,? ?and myspace under created names that fit the profile? (?satellitejockey,? ?hack3rman,? ?etc?)?.?  ?These accounts are maintained and updated automatically through RSS feeds,? ?retweets,? ?and linking together social media commenting between platforms.?  ?With a pool of these accounts to choose from,? ?once you have a real name persona you create a Facebook and LinkedIn account using the given name,? ?lock those accounts down and link these accounts to a selected? ?#? ?of previously created social media accounts,? ?automatically pre-aging the real accounts.

Yes!!! That's how democracy and the first amendment are supposed to work.

In another Word document, one of the team spells out how automation can work so one person can be many personas:

    Using the assigned social media accounts we can automate the posting of content that is relevant to the persona.  In this case there are specific social media strategy website RSS feeds we can subscribe to and then repost content on twitter with the appropriate hashtags.  In fact using hashtags and gaming some location based check-in services we can make it appear as if a persona was actually at a conference and introduce himself/herself to key individuals as part of the exercise, as one example.  There are a variety of social media tricks we can use to add a level of realness to all fictitious personas

...

HBGary and its subsidiary, HBGary Federal, as well as Berinco and Palantir, employed a lot of extremely qualified people with backgrounds in the NSA and ATT and other major organizations/corporations. These guys are pros.

----

idea: dataviz of money (and ----) analogous to blood flow in brain catscan

biz:

<dl>

<dt><a rel="author" href="http://www.bizjournals.com/sacramento/bio/5171/Mark+Anderson">Mark Anderson</a></dt>

<ol><li>Staff Writer- Sacramento Business Journal</li></ol></dl>

</div>

Sacramento cyber security company HBGary Inc. is being bought by <a href="http://www.bizjournals.com/profiles/company/us/va/fairfax/mantech_international_corp/3250702/" ct="APT: Company Link" class="ct saveLink">ManTech International Corp.</a>

Terms of the deal are not being disclosed.

HBGary’s office in Sacramento will remain open and its 40 employees are expected to stay with the company, which will now become a division of Fairfax, Va.-based ManTech (NASDAQ: MANT).

The deal is expected to close in March.

“This is great news. We have a billion-dollar company backing us,” said <a href="http://www.bizjournals.com/sacramento/search/results?q=Greg%20Hoglund">Greg Hoglund</a>, founder and chief executive officer of HBGary.

Hoglund started HBGary nine years ago. The company was entirely privately held and was privately financed by its founders.

ManTech has clients in many departments of the government. Its technologies and solutions are used by the Department of State, Department of Defense, Homeland Security, Department of Energy, Department of Justice and the Federal Bureau of Investigation.

HBGary has been selling its cyber intrusion detection and forensics suite of products to private businesses, corporations and law enforcement.

“This expands our opportunities for products and sales,” Hoglund said, adding that both companies will benefit from the merger.

HBGary will become an integral part of ManTech’s broad cyber security offering, according to ManTech release.

“This acquisition enhances our capabilities in the growing cyber security market,” said <a href="http://www.bizjournals.com/sacramento/search/results?q=L.%20William%20Varner">L. William Varner</a>, president and chief operating officer of ManTech’s mission, cyber and technology solutions group, in a statement. “The HBGary leadership team are recognized thought leaders in this market. The combination of ManTech and HBGary will create a broader cyber security solution capability for both our commercial and government customers.”

HBGary’s products search for intrusions and also infections of malicious software on computers and computer networks.

“Cyber security is getting worse every day,” Hoglund said. “In a large enterprise, intrusion is inevitable.”

HBGary products seek out intrusions and reconstruct a timeline of the intrusion to show what was done, how it was done and what was changed.

Sophisticated hackers are not just looking to be malicious, they can be searching out high-value intellectual property such as schematics, legal documents, construction and design information or financial information, he said.

HBGary’s own email server <a href="http://www.bizjournals.com/sacramento/news/2011/02/17/hbgary-hacked-reports-violent-threats.html">was hacked a year ago</a> by the anarchist collective of hackers called Anonymous, which found a way into the shared email server of an affiliate of HBGary and published its email online. The now-closed affiliate was called HBGary Federal.

Interestingly, HBGary saw rapid growth in the year since that it got all the notoriety of having its email server hacked.

In September, London’s Metropolitan Police Service’s Central e-Crime Unit arrested two men for hacking crimes and computer misuse, including one of the men thought to be <a href="http://www.bizjournals.com/sacramento/news/2011/09/02/english-police-arrest-hbgary-hacker.html">associated with the HBGary incident.</a>

The arrests came as part of an ongoing investigation in collaboration with the FBI, South Yorkshire Police and other law enforcement bodies in the United Kingdom and overseas.

</div>

</div>

</div></div>