6 ms·

The FOIA documents are up on archive.org now: https://archive.org/details/nsa-furby-memo/ https://archive.org/details/nsa-furby-memo/ I'm amused at page 8 of t

The FOIA documents are up on archive.org now: https://archive.org/details/nsa-furby-memo/ https://archive.org/details/nsa-furby-memo/ I'm amused at page 8 of the listserve doc, in which someone points out that the ongoing discussion may at some point be released to the public under FOIA and to consider how it might look after showing up on the front page of a news site

j-wags 3y ago
It's interesting to see how quickly the norms around cybersecurity changed. In 1999 the NSA was worried about avoiding ridicule for banning simple electronics in secure areas. In 2010 Stuxnet was introduced via simple electronics into a secure area and set back the Iranian nuclear program by several years. Some of the people receiving these furby emails were probably already conceiving of (or actively working on) Stuxnet-like capabilities. Maybe a future FOIA request will reveal several teams quietly emailing up the org chart to absolutely not relax the rule for furbies.
- wolverine876 3y ago
  NSA is a military agency; their norm has always been to protect US assets and attack others.
  - halJordan 3y ago
    The NSA is not a military agency. It is within the dod, it provides combat support. But it is emphatically not a military agency.
    - deleted 3y ago
      [deleted]
    - crmd 3y ago
      Emphatically? The director of the NSA is required to be a four star general and concurrently serves as commander of US Cyber Command. Ostensibly non-military, perhaps.
      - CuriousCosmic 3y ago
        The director is required to be a commissioned officer (and upon taking the role gets the O-10 grade) because they also head Cyber Command and the CSS (Central Security Service) but they don't really "run" the NSA like you'd expect say the director of the FBI or CIA to. Their role instead is mostly to coordinate the interaction between the NSA, CSS, and CYBERCOM on top of running CYBERCOM itself. When it comes to actual day to day operations however the deputy director (who is required to be a technically experienced civilian) actually runs things and reports directly to the president. The director isn't actually in the deputy director's chain of command however one of their job roles is to provide advisory support to the director when needed.
      - dmix 3y ago
        The assistant Secretary of Health is also a commissioned 4 star admiral but they have never seen been the inside of a Navy ship. The last one was a pediatrician before joining. There's a lot of symbolic and tradition based commissions like that through the US gov.
        jki275 3y ago
        Commissioned in the US Public Health Service, not the US Navy. Their ranks are the same as the Navy's, but they have no connection to the Navy.
    - pharrington 3y ago
      The NSA literally performs cyber attacks on foreign countries.
    - jandrewrogers 3y ago
      You are incorrect. There are two categories of intelligence agencies in the US as a matter of law, with significantly different legal authority and structure. Intelligence agencies like the CIA, FBI, et al are non-military. NSA is explicitly a military agency and operates under military authority. The easiest way to tell the difference is that the Director of military agencies is always an active military flag officer. It isn't just a superficial distinction, they operate quite differently.
    - callalex 3y ago
      It’s important to remember that “DOD” is a pathetic rebranding attempt of what it was originally founded as and continues to operate as: the Department of War.
      - deleted 3y ago
        [deleted]
    - wolverine876 3y ago
      How are you defining "military"?
      - DANmode 3y ago
        Subscribed.
  - sandworm101 3y ago
    It is no more a military agency than NASA or the USGS. Having military customers doesn't make an agency or company part of that military.
    - wolverine876 3y ago
      NSA is in the Department of Defense, commanded by a uniformed officer, employing many (how many?) members of the military.
- gnfargbl 3y ago
  NSA dealt with cases of espionage via the introduction of simple electronics into secure areas decades before [1] [2], so awareness of the risk was likely widespread. The issue here seems to have been that in 1999, it was a relative novelty for random consumer devices to have a recording functionality. Hard to imagine now, but there we are. [1] https://en.wikipedia.org/wiki/The_Thing_(listening_device) https://en.wikipedia.org/wiki/The_Thing_(listening_device) [2] https://www.cryptomuseum.com/covert/bugs/selectric/index.htm https://www.cryptomuseum.com/covert/bugs/selectric/index.htm
  - FirmwareBurner 3y ago
    >in 1999, it was a relative novelty for random consumer devices to have a recording functionality. Hard to imagine now, but there we are. For added context, the plot of the movie Charlie's Angels from the year 2000, was about stopping an evil guy from using some evil software he developed to ... track people using their cellphones. (ㆆ _ ㆆ)
    - deleted 3y ago
      [deleted]
    - thaumasiotes 3y ago
      > For added context, the plot of the movie Charlie's Angels from the year 2000, was about stopping an evil guy from using some evil software he developed to ... track people using their cellphones. This makes me think we should have a big revival for that movie. On the other hand, essentially the same functionality in a more grandiose presentation was prominently featured in Batman Begins (2005) and the explicit message was "not even Batman should be able to do this".
      - nickpeterson 3y ago
        I believe you’re thinking of the sequel, the dark knight, 2008
        3y ago
- halJordan 3y ago
  Wikipedia claims the nsa's active cyber mission (anachronistic terminology ) was up and running from as early as 1997, so there were definitely people having those thoughts and working those capabilities. And we're totally ignoring people like Markus Hess in the 80s. Thank you for taking the time to add perspective to the knee jerk reactions.
- kevin_thibedeau 3y ago
  The IR transmit capability of the Furby was a legitimate threat. PalmPilots of the era were permitted inside a SCIF providing they had their IR ports covered by an opaque sticker and weren't a model with a radio.
jdewerd 3y ago
They wanted to avoid FURBYGATE. They avoided FURBYGATE. Sounds reasonable to me!
- nerdponx 3y ago
  Right. The whole email thread seems very reasonable to me. TFA characterizing this as "freaking out" is nonsense.
- deleted 3y ago
  [deleted]
kotaKat 3y ago
Yep. Who would have guessed 25 years later I'd be bored and then a year later this packet showed up at my doorstep? It's oddly perfect timing, around all the AI discourse. :)
- 0xEF 3y ago
  I'm surprised it only took them a year. Would you care to share more about your experience on filing FOIA? The circles I run in seem to view it as a clunky, bloated process, but I feel like it has gotten better than when it was introduced. I have zero first-hand experience, though.
  - kotaKat 3y ago
    No problem to help, but bad news: Every government agency has different processes. You'll have to go through their own FOIA office. The NSA FOIA form is actually really easy: https://www.nsa.gov/about/contact-us/Submit-a-FOIA-Request/ https://www.nsa.gov/about/contact-us/Submit-a-FOIA-Request/ I simply asked for what I wanted (information about policy memos about 'Furby Alerts' and recording devices at the NSA from late 1998 to early 1999) and submitted the form. About a month later I got a response back from the NSA acknowledging they got my request, and located records that were part of another FOIA request being processed as well, so I'd get those documents as well once released. And then... yesterday afternoon I got the message "hey what did you get from the DoD?" - bewildered, sending me a photo of the cover (in the full article). They finally delivered, and I hastily scanned my spoils for everyone. :)
    - qingcharles 3y ago
      And to piggyback on your comment. State FOIA is a different beast to federal FOIA. Lots of states have much tighter timelines. Illinois requires the government body to respond with the records within 5 business days.
    - trevyn 3y ago
      https://www.muckrock.com/ https://www.muckrock.com/ seems to have a lot of good information on this too, and fun-to-look-through archives of requests and responses.

j-wags 3y ago

It's interesting to see how quickly the norms around cybersecurity changed. In 1999 the NSA was worried about avoiding ridicule for banning simple electronics in secure areas. In 2010 Stuxnet was introduced via simple electronics into a secure area and set back the Iranian nuclear program by several years. Some of the people receiving these furby emails were probably already conceiving of (or actively working on) Stuxnet-like capabilities. Maybe a future FOIA request will reveal several teams quietly emailing up the org chart to absolutely not relax the rule for furbies.

wolverine876 3y ago
NSA is a military agency; their norm has always been to protect US assets and attack others.
- halJordan 3y ago
  The NSA is not a military agency. It is within the dod, it provides combat support. But it is emphatically not a military agency.
  - deleted 3y ago
    [deleted]
  - crmd 3y ago
    Emphatically? The director of the NSA is required to be a four star general and concurrently serves as commander of US Cyber Command. Ostensibly non-military, perhaps.
    - CuriousCosmic 3y ago
      The director is required to be a commissioned officer (and upon taking the role gets the O-10 grade) because they also head Cyber Command and the CSS (Central Security Service) but they don't really "run" the NSA like you'd expect say the director of the FBI or CIA to. Their role instead is mostly to coordinate the interaction between the NSA, CSS, and CYBERCOM on top of running CYBERCOM itself. When it comes to actual day to day operations however the deputy director (who is required to be a technically experienced civilian) actually runs things and reports directly to the president. The director isn't actually in the deputy director's chain of command however one of their job roles is to provide advisory support to the director when needed.
    - dmix 3y ago
      The assistant Secretary of Health is also a commissioned 4 star admiral but they have never seen been the inside of a Navy ship. The last one was a pediatrician before joining. There's a lot of symbolic and tradition based commissions like that through the US gov.
      - jki275 3y ago
        Commissioned in the US Public Health Service, not the US Navy. Their ranks are the same as the Navy's, but they have no connection to the Navy.
  - pharrington 3y ago
    The NSA literally performs cyber attacks on foreign countries.
  - jandrewrogers 3y ago
    You are incorrect. There are two categories of intelligence agencies in the US as a matter of law, with significantly different legal authority and structure. Intelligence agencies like the CIA, FBI, et al are non-military. NSA is explicitly a military agency and operates under military authority. The easiest way to tell the difference is that the Director of military agencies is always an active military flag officer. It isn't just a superficial distinction, they operate quite differently.
  - callalex 3y ago
    It’s important to remember that “DOD” is a pathetic rebranding attempt of what it was originally founded as and continues to operate as: the Department of War.
    - deleted 3y ago
      [deleted]
  - wolverine876 3y ago
    How are you defining "military"?
    - DANmode 3y ago
      Subscribed.
- sandworm101 3y ago
  It is no more a military agency than NASA or the USGS. Having military customers doesn't make an agency or company part of that military.
  - wolverine876 3y ago
    NSA is in the Department of Defense, commanded by a uniformed officer, employing many (how many?) members of the military.
gnfargbl 3y ago
NSA dealt with cases of espionage via the introduction of simple electronics into secure areas decades before [1] [2], so awareness of the risk was likely widespread. The issue here seems to have been that in 1999, it was a relative novelty for random consumer devices to have a recording functionality. Hard to imagine now, but there we are. [1] https://en.wikipedia.org/wiki/The_Thing_(listening_device) https://en.wikipedia.org/wiki/The_Thing_(listening_device) [2] https://www.cryptomuseum.com/covert/bugs/selectric/index.htm https://www.cryptomuseum.com/covert/bugs/selectric/index.htm
- FirmwareBurner 3y ago
  >in 1999, it was a relative novelty for random consumer devices to have a recording functionality. Hard to imagine now, but there we are. For added context, the plot of the movie Charlie's Angels from the year 2000, was about stopping an evil guy from using some evil software he developed to ... track people using their cellphones. (ㆆ _ ㆆ)
  - deleted 3y ago
    [deleted]
  - thaumasiotes 3y ago
    > For added context, the plot of the movie Charlie's Angels from the year 2000, was about stopping an evil guy from using some evil software he developed to ... track people using their cellphones. This makes me think we should have a big revival for that movie. On the other hand, essentially the same functionality in a more grandiose presentation was prominently featured in Batman Begins (2005) and the explicit message was "not even Batman should be able to do this".
    - nickpeterson 3y ago
      I believe you’re thinking of the sequel, the dark knight, 2008
      - 3y ago
halJordan 3y ago
Wikipedia claims the nsa's active cyber mission (anachronistic terminology ) was up and running from as early as 1997, so there were definitely people having those thoughts and working those capabilities. And we're totally ignoring people like Markus Hess in the 80s. Thank you for taking the time to add perspective to the knee jerk reactions.
kevin_thibedeau 3y ago
The IR transmit capability of the Furby was a legitimate threat. PalmPilots of the era were permitted inside a SCIF providing they had their IR ports covered by an opaque sticker and weren't a model with a radio.

jdewerd 3y ago

They wanted to avoid FURBYGATE. They avoided FURBYGATE. Sounds reasonable to me!

nerdponx 3y ago
Right. The whole email thread seems very reasonable to me. TFA characterizing this as "freaking out" is nonsense.
deleted 3y ago
[deleted]

kotaKat 3y ago

Yep. Who would have guessed 25 years later I'd be bored and then a year later this packet showed up at my doorstep? It's oddly perfect timing, around all the AI discourse. :)

0xEF 3y ago
I'm surprised it only took them a year. Would you care to share more about your experience on filing FOIA? The circles I run in seem to view it as a clunky, bloated process, but I feel like it has gotten better than when it was introduced. I have zero first-hand experience, though.
- kotaKat 3y ago
  No problem to help, but bad news: Every government agency has different processes. You'll have to go through their own FOIA office. The NSA FOIA form is actually really easy: https://www.nsa.gov/about/contact-us/Submit-a-FOIA-Request/ https://www.nsa.gov/about/contact-us/Submit-a-FOIA-Request/ I simply asked for what I wanted (information about policy memos about 'Furby Alerts' and recording devices at the NSA from late 1998 to early 1999) and submitted the form. About a month later I got a response back from the NSA acknowledging they got my request, and located records that were part of another FOIA request being processed as well, so I'd get those documents as well once released. And then... yesterday afternoon I got the message "hey what did you get from the DoD?" - bewildered, sending me a photo of the cover (in the full article). They finally delivered, and I hastily scanned my spoils for everyone. :)
  - qingcharles 3y ago
    And to piggyback on your comment. State FOIA is a different beast to federal FOIA. Lots of states have much tighter timelines. Illinois requires the government body to respond with the records within 5 business days.
  - trevyn 3y ago
    https://www.muckrock.com/ https://www.muckrock.com/ seems to have a lot of good information on this too, and fun-to-look-through archives of requests and responses.