text:
Hartlepool 01429 852 100
Leeds 01132 445 599
Doncaster 01302 772 070
Hartlepool 01429 852 100
Leeds 01132 445 599
Doncaster 01302 772 070
Are you looking for a reliable fuel supplier in the East of England? Then you have come to the right place!
F. Peart & Co. supplies quality heating oil, fuels and lubricants to customers from Northumberland to Nottinghamshire; helping homes, farms, and businesses keep warm and working by delivering fuel when and where they need it.
Over 80 years of trading gives us a deep knowledge of the oil market and the areas we serve. Our bases are in Hartlepool, Leeds and Doncaster although we serve customers from a number of local depots throughout the East of England.
We take pride on our local friendly teams who have the knowledge and expertise to answer any queries you may have. Our expert depot staff and drivers provide prompt, reliable deliveries so your oil is delivered quickly and efficiently.
We know that all our customers have different requirements so we will always strive to deliver the products you need when you need them. Click on the links below for more information on how we can help.
Kerosene, Premium kerosene and gas oil for domestic heating.
Heating oil for your home
plus fuels and lubricants
for your farm equipment.
Wide range of specialist fuels and lubricants for transport, heating and industrial applications.
F. Peart & Co. is a trading name of Certas Energy UK Ltd. Registered Office: 302 Bridgewater Place, Birchwood Park, Warrington, Cheshire WA3 6XG.
Registered in England (Company No: 04168225)


text:
Katey Sagal Gossip
Katey Sagal gossip, latest news, photos, and video.
Smutty Social Media, September 29, 2016
I would very much like to go for lunch at Oprah's house. Look who came for [email protected] . Gettin' ready for SUGAR time tonite.#GimmeSugar #QueenSugar Full Story
Resetting Lea Michele
Wenn, Splash
Lea Michele continues to work on Sons Of Anarchy. Here she is shooting a scene with Katey Sagal yesterday. As I wrote earlier this week, with the imminent conclusion of Glee, Lea's professional strategy seems to be an image change. This is not Rachel Berry hanging out with Gemma Teller Morrow. Full Story
The Bellas and Gemma Teller
Pitch Perfect was on my Top 10 Movies List of 2012. It was the best. It's on repeat on my iPad for the plane. I'll never tire of Pitch Perfect. And you must know, there's a sequel, directed by Elizabeth Banks. Banks has been very active on social media, posting photos from the set, like this one, of the Bellas. Full Story
Charlie Hunnam is not Henry Cavill
Wenn, Splash
Yet. Ever? As you know, Henry Cavill is no longer with Gina Carano. He's now with the Big Bang Theory's Kaley Cuoco. Because he's Superman and a movie star now…? Man Of Steel is a Warner Bros property. So is Pacific Rim, starring Charlie Hunnam who's been dating jeweller designer Morgana for a few years now. Full Story
Gemma & Nero
Just...ignore Mario Lopez in the corner. (Sidebar: Congratulations X-Factor, because you just guaranteed that I won't be watching anymore by bringing on Lopez and a Kardashian to host your show, which impressed me, and now I have to give up on it. Am I in the minority on this?) Here are Katey Sagal and Jimmy Smits on Extra the other day promoting Sons Of Anarchy which I finally caught up on last weekend - 3 episodes - and God I love him on the show, so much. Full Story
Frederick M. Brown/Getty
Haven't decided yet if I'll be watching S5 of Sons of Anarchy premiering this week. I don't give a sh-t how sexy Charlie Hunnam is; last season was just so weak. But I just saw a teaser clip of Jimmy Smits who's guesting on the show. It's short, a quick glimpse, and but I'm into it. Full Story
Charlie Hunnam's Comic-Con 2012
Kevin Winter/Michael Buckner/Getty
But first, I missed these photos of Charlie Hunnam at the Critics' Choice TV Awards last month with his long-time girlfriend Morgana. Charlie was in San Diego this weekend to promote Guillermo Del Toro's Pacific Rim and the upcoming 5th season of Sons Of Anarchy. Pacific Rim is about horrible monsters and nice robots working with humans to take them down. Full Story
It's not just Charlie…
The Sons of Anarchy Season 4 premiere happened last night in Hollywood. As I've been saying, seemingly on repeat, the new season begins next Tuesday on F/X. You ready? Not surprisingly, because he's having his picture taken, Charlie Hunnam looks like sh-t. So I get it. I get it for those of you who don't watch Sons of Anarchy, or who've never watched his work, why you might be cocking your eye at me like I'm a crazy bitch for insisting he's hot. Full Story

subset: commoncrawl


text:
|Oracle® Fusion Middleware Reference for Oracle Security Developer Tools
11g Release 1 (11.1.1)
Part Number E10037-04
|PDF · Mobi · ePub
This chapter provides information about using the Oracle Security Engine Software Development Kit (SDK) certificate package. Oracle Security Engine is a superset of Oracle Crypto. It contains all of the libraries and tools provided with Oracle Crypto, plus additional packages and utilities for generating digital certificates.
The use of the Oracle Security Engine library is not recommended beginning with Oracle AS 11gR1. Instead use the JDK's Certificate APIs.
For details, see the JDK documentation at:
However, the following Public-Key Cryptography Standards (PKCS) have no JCE equivalents:
Signed Public Key And Challenge (SPKAC)
and you can continue using Oracle Security Engine for these features.
Oracle Crypto allows Java developers to develop applications that ensure data security and integrity. For more information about the Oracle Crypto functionality, see "Oracle Crypto" in Chapter 3.
For an overview of public key infrastructure, see "Public Key Infrastructure (PKI)" in Chapter 1.
This chapter contains the following topics:
Oracle Security Engine provides the following features:
X.509 Version 3 Certificates, as defined in RFC 3280
Full PKCS#12 support
PKCS#10 support for certificate requests
certificate revocation list (CRL) functionality as defined in RFC 3280
Implementation of Signed Public Key And Challenge (SPKAC)
Support for X.500 Relative Distinguished Names
PKCS#7 support for wrapping X.509 certificates and CRLs
Implementation of standard X.509 certificates and CRL extensions
The Oracle Security Developer Tools are installed with Oracle WebLogic Server in
ORACLE_HOME. This section provides information for setting up your environment for Oracle Security Engine. It contains the following topics:
In order to use Oracle Security Engine, your system must have the Java Development Kit (JDK) version 1.6 or higher.
CLASSPATH environment variable must contain the full path and file names to the required jar and class files. Make sure the following items are included in your
To set your
CLASSPATH on Windows:
In your Windows Control Panel, select System.
In the System Properties dialog, select the Advanced tab.
Click Environment Variables.
In the User Variables section, click New to add a
CLASSPATH environment variable for your user profile. If a
CLASSPATH environment variable already exists, select it and click Edit.
Add the full path and file names for all of the required jar and class files to the
For example, your
CLASSPATH might look like this:
%CLASSPATH%; %ORACLE_HOME%\modules\oracle.osdt_11.1.1\osdt_core.jar; %ORACLE_HOME%\modules\oracle.osdt_11.1.1\osdt_cert.jar;
Click OK.
To set your CLASSPATH on UNIX, set your
CLASSPATH environment variable to include the full path and file name of all of the required jar and class files. For example:
setenv CLASSPATH $CLASSPATH: $ORACLE_HOME/modules/oracle.osdt_11.1.1/osdt_core.jar: $ORACLE_HOME/modules/oracle.osdt_11.1.1/osdt_cert.jar:
This section provides information and code samples for using the certificate facility classes of Oracle Security Engine. Oracle Security Engine also includes all of the classes provided with Oracle Crypto. See Chapter 3, "Oracle Crypto" for an overview of the core Oracle Crypto classes.
Class Changes in OracleAS 11gR1
In OracleAS 11gR1, the oracle.security.crypto.cert.X509 class for certificate management has been replaced with java.security.cert.X509Certificate
The Core Certificate Classes
The core certificate facility classes are:
This class represents an X.500 Relative Distinguished Name (RDN). This is the building block for X.500 names. A RDN consists of a set of attribute-value pairs. Typically, there is a single attribute-value pair in each RDN.
Example 4-1 Code Example for Creating and Retrieving an
X500RDN Object
// Create the X500RDN object
X500RDN rdn = new X500RDN(PKIX.id_at_commonName, "Joe Smith");
// Retrieve the value
X500Name n = Instance of oracle.security.crypto.cert.X500Name;
String name = n.getAttribute(PKIX.id_at_commonName).getValue().getValue();
This class represents distinguished names as used in the X.500 series of specifications, defined in X.520. An
X500Name object is made of
X500RDN objects. An X500Name holds attributes defining an entity such as the common name, country, organization, and so on.
To create an
X500Name object, use the standard constructor and then populate the object with attributes. Once created, the object can then be DER-encoded to make it available to other processes:
Example 4-2 Code Example for Creating an X500Name Object
X500Name name = new X500Name(); name.addComponent(PKIX.id_at_commonName, "Joe Smith"); name.addComponent(PKIX.id_at_countryName, "USA"); name.addComponent(PKIX.id_at_stateOrProvinceName, "NY"); name.addComponent(PKIX.id_at_localityName, "New York"); name.addComponent(PKIX.id_at_organizationName, "Oracle"); name.addComponent(PKIX.id_at_organizationalUnitName, "Engineering"); name.addComponent(PKIX.emailAddress, "email@example.com"); // Make object DER-encoded so its available to other processes byte[] encodedName = Utils.toBytes(name); X500Name n = new X500Name(new ByteArrayInputStream(encodedName)); String name = n.getAttribute(PKIX.id_at_commonName).getValue().getValue(); String email = n.getAttribute(PKIX.emailAddress).getValue().getValue();
This class represents a PKCS#10 certificate request containing information about an entity and a signature of the content of the request. The certificate request is used to convey information and authentication data (the signature) that will be used by a Certificate Authority (CA) to generate a certificate for the corresponding entity.
Creating a new certificate request involves the following high-level steps:
Create a new instance of
CertificateRequest by using the empty constructor and setting the keys and the subject name, or by using the constructor taking an
X500Name and a
KeyPair object.
Add X.509 extensions to the certificate request.
Sign the certificate request and save it to a file.
Send the certificate request you created to a Certificate Authority.
Example 4-3 Code Example for Creating a Certificate Request
//Create CertificateRequest by setting the keys and subject name CertificateRequest certReq = new CertificateRequest(); certReq.setPrivateKey(privKey); certReq.setPublicKey(pubKey); certReq.setSubject(subjectName); //OR // Create CertificateRequest by taking an X500Name and KeyPair object CertificateRequest certReq = new CertificateRequest(subjectName, keyPair); // Add X.509 certificate extensions in a extensionRequest attribute X509ExtensionSet extSet = new X509ExtensionSet(); // Basic Constraints: non-CA, critical extSet.addExtension(new BasicConstraintsExtension(false, true)); // Key Usage: signature, data encipherment, key agreement // & non-repudiation flags, critical extSet.addExtension(new KeyUsageExtension(new int[] { KeyUsageExtension.DIGITAL_SIGNATURE, KeyUsageExtension.DATA_ENCIPHERMENT, KeyUsageExtension.KEY_AGREEMENT, KeyUsageExtension.NON_REPUDIATION}, true)); // Subject Alternative Name: email address, non-critical if (email.length() > 0) extSet.addExtension(new SubjectAltNameExtension( new GeneralName(GeneralName.Type.RFC822_NAME, email), false)); // Subject Key Identifier: key ID bytes, non-critical extSet.addExtension(new SubjectKeyIDExtension (CryptoUtils.generateKeyID(kp.getPublic()))); req.addAttribute(PKIX.extensionRequest, extSet); // Sign the certificate request and save to file req.sign(); req.output(reqOS); reqOS.close(); } // The certificate request can then be sent to a CA
This class replaces oracle.security.crypto.cert.X509 for X.509 certificate management in Oracle WebLogic Server 11g.
The java.security.cert.X509Certificate class supports the generation of new certificates as well as parsing of existing certificates.
Complete documentation of the java.security.cert.X509Certificate class is available at
Converting Your Code to Use java.security.cert.X509Certificate
You can create the X509Certificate object using the certificate factory java.security.cert.CertificateFactory.
The certificate is generated from an input stream, which can be:
a FileInputSream, if the certificate is stored in a file, or
a ByteArrayInputStream, if the encoded bytes are from an existing X509 object, or
any other source.
An example follows:
// Generating an X.509 certificate from a file-based certificate CertificateFactory cf = CertificateFactory.getInstance("X.509"); X509Certificate cert = (X509Certificate)cf.generateCertificate( new FileInputStream(certFileName);
The Oracle Security Engine Java API reference (Javadoc) is available at:
Oracle Fusion Middleware Security Engine Java API Reference for Oracle Security Developer Tools


text:
|THIRD RAIL burst onto the American literary scene in 1975 with a fresh take on
how far a poetry magazine could go beyond the editorial and graphic conventions
of its genre to link writing with cultural-historical movements and political and
artistic changes of the era.
THIRD RAIL immediately cut an uncompromising and expressive path across a
broad spectrum of writing and the arts starting with the publication of its earliest
issues. Co-edited by founding editors Uri Hertz and Doren Robbins, the magazine
set out its editorial concept based on a historically-minded approach to literature
as a living cultural force. THIRD RAIL's dynamic appeal caught the interest of
leading writers such as Henry Miller, Kenneth Rexroth, Robert Bly, Jack Micheline
and George Hitchcock, who contributed writing to early issues. Full editing and
publishing responsibilities were left in the hands of Uri Hertz when Doren Robbins
left his editorial post with the magazine after five years. As THIRD RAIL continued
to carve its unique course through the shifting landscape of post-sixties to late
twentieth century American culture, this innovative and imaginative review of
international arts and literature continued to capture and hold the attention of
poets, writers, scholars and practitioners as well as appreciators of the visual,
theatrical and cinematic arts.
This website is the return of THIRD RAIL to the literary, artistic and cultural flow of
creative production and critical discourse. Presented on these opening pages are
writing and art selected for reprint here from among the most recent of the nine
issues published from 1975 to 1989.
An art installation titled Lo real maravilloso, Puppet Sculpture by Linda Haim, is
mounted on this site.
Kazuo Ohno is featured here with writing by and about the centenarian Japanese
Butoh master with photographs from his classic performances.
|Frank Ward
|Kenneth Rexroth
part one
for Kenneth Rexroth
poem by John Solt
Introduction to Japanese
Rexroth's Selected Poems
Tetsuya Taguchi
Adding to our Nature
Doren Robbins
The King is Dead.
Long Live the King!
Uri Hertz
With a Tabloid Biographer,
Who Needs an Oeuvre?
Eros Until the End
John Solt
Three Sparks
in the Tinder of Knowing
Rachelle Lerner
|international literature & arts
|poems torn from a life
is a new book of poems by Uri
Hertz, published by
To order online, follow the link to
|Kazuo Ohno
October 27, 1906 - June 1, 2010
|interview by Uri Hertz
from Third Rail # 4, 1980
Literatureandarts.com is the official website of THIRD RAIL,
the legendary review of international arts and literature
that appeared in print from 1975-89 and is published
online here. Be wary of simulations.
|photo: Victor Aleman


text:
Welcome to the Kumoricon Forums! Remember: Have fun! – Forum code of conduct.
0 Members and 1 Guest are viewing this topic.
About MegaUpload getting shut down, and also Uploaded.to deciding to disable service to IPs in the USA, there are other services such as Rapidshare, SendSpace, etc. We work with any download links that we don't have to pay membership, or create a login account.
Yes! We got an AMV from ROMANIA!(The *real* Dracula had his *real* castle there...)So why not celebrate with some of our FAVORITE anime vampires!
I'm fairly certain that not all the characters in this picture are vampires.
i have an amv with over 100 anime titles in it (yes, this is a true story), and the song fits the qualification of the "retro" category but i have a couple animes that are only like 2-3 yrs old, it still doesn't count as retro, right?
Alright, a question about audio. I'm playing around with two songs, both by Lady GaGa (Bad Romance and Judas). I really like them for the content and videogames I'm using (Bad Romance for an anime though...) Is there a list somewhere of what's considered 'illicit' words.
Here's the verse:In the most Biblical senseI am beyond repentanceFame hookerProstitute wenchVomits her mindBut in the cultural senseI just speak in future tenseJudas kiss me if offencedOr wear a condom next time


text:
DeLorme Pn-60w, Digging Deeper
It is worth digging a little deeper into the technologies behind the new DeLorme PN-60w, and specifically the "w" (wireless) part. While some of the wireless features won't be out until Fall, we'll fuel some of the appetite now. We've seen many of the "front and center" features, now lets dig under the hood a bit more.
Updated Circuitry
While the form factor stays the same, the chipset is sill 32 channels, and you still get a dual processor, not everything else is the same. You also get more memory, the wireless features, and the light sensor which automatically adjusts the display brightness. But other internal circuitry changes have been made as well, and the newly designed guts will help achieve better battery life. Battery life has been a sticking point with many DeLorme PN-40 owners.
Storage for Waypoints and Tracklogs
GPS devices are often compared against each other by how many points you can store in your tracklogs or how many waypoints you can store on the device. Hard-core geocachers for example love to store thousands upon thousands of geocache locations on their device. Hard limits are all but gone on the new PN-60. You can store as many waypoints and tracks as you can fit into either the internal memory or on SD card. When only limited by memory, you will soon be measuring the limit (if you want to call it that) in millions.
New Topo USA
There is also a new version of Topo USA that will come with the PN-60. While details are still a bit sketchy, it sounds like the infamous "Exchange Dialog" will be radically updated. Here, it is time to think more about "syncing" your PN device with a Topo USA project where you don't need to worry about copying files in one direction or another and one button might sync up an entire project (tracks, waypoints, etc).
802 who? 802.15.4 also known as ZigBee…. Leaving the two most interesting features for last, 802.15.4 is the protocol used for wireless communications between devices. I wasn't too familiar with this protocol, but it looks like a very interesting application well suited for GPS devices. You may be familiar with wifi protocols like 802.11b/g/n. Those protocols are often high speed, and thus high battery drain. 802.15.4 is a slower speed at 250 kbit/s, but the advantage is that it uses very little power. So there is little chance of doing any wireless syncing to your computer– keep your USB cable handy. But sending tiny packets of data between devices should be trivial and not kill your battery.
Mesh Networking
Another aspect of wireless and 802.15.4 is that it uses a mesh network. The DeLorme folks say that two devices can communicate pretty consistently when within a one half mile range, but that they've also had it working reasonably well up to one mile apart. But this is unlike the wireless router in your house where you need to be a certain distance from the central router to pass data. In a Mesh network, each device essentially becomes an access point for the rest of the devices. So imagine a long straight stretch of train tracks ten miles long. You have twenty people spaced about one half mile apart. In theory, the two people furthest away from each other, ten miles apart will be able to find each other on the network with their data having been relayed between each other.
It sounds like you will be able to determine who you make yourself visible to and remain stealthy from others. For those people familiar with the game "Capture the Flag", can you imagine how fun it would be to have a massively large game in the woods where you can look down at your GPS and see the position of everyone on your team, yet remain invisible from the opposing team? That sounds like an amazingly good time to me!


text:
Photo Credit: Gathering of Nations
Native American Events: Pow Wows Feature Native American Dance
What is a Native American Pow Wow?
Powwows are American Indian events that feature, among other things, Native American dance and song. They are a celebration of heritage and traditions, and a way for Native Americans to connect with each other while keeping their culture alive through dance, song and storytelling. Most powwows are open to the public, offering opportunities to educate non-natives about their culture and traditions, including many different styles of Native American dance styles. While powwows occur year-round, most are held between Memorial Day and Labor Day throughout the US and Canada. They are an important part of Native American life and lots of fun for all who attend. For a list of Native American events, see our Native American Dance Calendar.
Women's Fancy Shawl Dance :: Fast Paced Native American Dance Style
The Women's Fancy Shawl Dance is a beautiful and very strenuous Native American dance style typically performed by younger ladies and girls at Native American events. It is a fast dance that requires stamina and gracefulness, along with intricate footwork. Each dancer wears a fancy shawl decorated with colorful designs made of appliqué, ribbons and painting. The shawl has long fringe or ribbons that flow with the movements of the dancer. Fancy Shawl Dancers create the illusion of a butterfly floating through the air by dancing light on their feet and twirling around with their shawl extended like butterfly wings.
Women's Fancy Shawl Regalia
Women's Fancy Shawl regalia, like that of other Native American dance styles, accentuates the movement of the dancer. This dance outfit includes: a dress or skirt, leggings, moccasins, and , of course, a beautifully decorated fancy shawl. The shawl is worn draped over the shoulders and is usually made of colorful lightweight fabric. It is decorated with appliqués, paint, and ribbons in a way that has meaning to the dancer. The dress or skirt and leggings can either be plain or decorated, but they are made of fabric and colors that coordinate with the fancy shawl.
Your Source for Native American Dance Regalia Craft Supplies
Crazy Crow Trading Post has long been your number one source for powwow craft supplies for your Native American dance regalia and other needs. This photo gallery represents Women's Fancy Shawl Dance outfits, mostly taken at Gathering of Nations Pow Wow in Albuquerque, New Mexico. We thank Derek Matthews of Gathering of Nations, and others who have given permission to present these photos in this gallery.
Crazy Crow Trading Post – Crafts Supplies for Native American Pow Wow Dance Clothes & Accessories!
Fancy Shawl | Native American Regalia | Fancy Shawl Dance | Fancy Shawl Dancers | Fancy Shawl Regalia | Native American Event | Fancy Shawl Dance | Fancy Shawl Dancer | Fancy Shawl Outfits | Womens Fancy Dance | Women's Fancy Shawl Dance | Native American Dress | Native American Clothes | American Indian Dance | Pow Wow Regalia | Shawl Dancing | Pow Wow Outfits | Native American Womens Clothing | Fancy Shawl Dresses


text:
DEV522: Defending Web Applications Security Essentials Sold Out
Mon, July 28 - Sat, August 2, 2014
Not only does DEV522 teach the defenses for securing web apps, it also shows how common and easy the attacks are thus the need to secure the apps.
Specific and hands on training regarding webserver and browser security as it is presented in DEV522 is valuable! The cost of bugs and vulnerabilities can be immeasurable.
This is the course to take if you have to defend web applications!
Traditional network defenses, such as firewalls, fail to secure web applications. The quantity and importance of data entrusted to web applications is growing, and defenders need to learn how to secure it. DEV522 covers the OWASP Top 10 and will help you to better understand web application vulnerabilities, thus enabling you to properly defend your organization's web assets.
Mitigation strategies from an infrastructure, architecture, and coding perspective will be discussed alongside real-world implementations that really work. The testing aspect of vulnerabilities will also be covered so you can ensure your application is tested for the vulnerabilities discussed in class.
To maximize the benefit for a wider range of audiences, the discussions in this course will be programming language agnostic. Focus will be maintained on security strategies rather than coding level implementation.
DEV522: Defending Web Applications Security Essentials is intended for anyone tasked with implementing, managing, or protecting Web applications. It is particularly well suited to application security analysts, developers, application architects, pen testers, and auditors who are interested in recommending proper mitigations to web security issues and infrastructure security professionals who have an interest in better defending their web applications.
The course will cover the topics outlined by OWASP's Top 10 risks document as well as additional issues the authors found of importance in their day-to-day web application development practice. The topics that will be covered include:
- Infrastructure Security
- Server Configuration
- Authentication mechanisms
- Application language configuration
- Application coding errors like SQL Injection and Cross-Site Scripting
- Cross-Site Request Forging
- Authentication Bypass
- Web services and related flaws
- Web 2.0 and its use of web services
- XPATH and XQUERY languages and injection
- Business logic flaws
- Protective HTTP Headers
The course will make heavy use of hands-on exercises. It will conclude with a large defensive exercise, reinforcing the lessons learned throughout the week.
Course Syllabus
DEV522.1: Web Basics and Authentication Security
Johannes Ullrich, Ph.D.
Mon Jul 28th, 2014
We begin day one with an overview of the recent web application attack trends and and security. We follow that up with an overview of the essential technologies that are at play in Web applications. You can't win the battle if you don't understand what you are trying to defend. We arm you with the right information so you can understand how Web applications work and the security concepts related to them.
We discuss the authentication aspect of Web applications in depth. The vulnerability of authentication is covered, followed by examples of exploitation and the mitigations that could be implemented in the short and long term. We complete the discussion by giving information on how to discover and test for the vulnerabilities.
Authorization is the last topic of discussion for the day. Making sure the application properly controls access to the appropriate resources is the goal of the discussion. You will learn the right way to plan for access during the development life cycle and the common pitfalls with access control. Similar to the discussion in authentication, we start with the vulnerabilities and then move on to mitigations and testing, followed by a section on the best practice on authorization.
CPE/CMU Credits: 6
- HTTP basics
- Overview of web technologies
- Web application architecture
- Recent attack trends
- Authentication vulnerabilities and defense
- Authorization vulnerabilities and defense
DEV522.2: Web Application Common Vulnerabilities and Mitigations
Johannes Ullrich, Ph.D.
Tue Jul 29th, 2014
Since the Internet does not guarantee secrecy of information being transferred, encryption is commonly used to protect the integrity and secrecy of information on the Web. We cover the security of data in transit or on disk and how encryption can help with securing that information in the context of Web application security.
We continue with a discussion about session management in Web applications. We will go over a hacker's technique in attacking the session mechanism and related defense strategies. The best practice of session security will be discussed to ensure your application's session management is as strong as possible. Advanced session topics like Cross-Site Request Forgery will also be covered.
Next we will cover business logic flaws and concurrency. These are difficult topics to detect by automated scanners, so it is essential for the security personnel to understand these problems and avoid them at all costs.
The day ends with some basic input-related flaws, as well as SQL injection. The basic mechanics of these vulnerabilities are covered, followed by the real-world attack trends. Most importantly, we delve into the mitigation of these vulnerabilities and the best practice in avoiding these critical vulnerabilities.
CPE/CMU Credits: 6
- SSL vulnerabilities and testing
- Proper encryption use in web application
- Session vulnerabilities and testing
- Cross Site Request Forgery
- Business logic flaws
- Concurrency
- Input related flaws and related defense
- SQL Injection vulnerabilities, testing and defense
DEV522.3: Proactive Defense and Operation Security
Johannes Ullrich, Ph.D.
Wed Jul 30th, 2014
Day three begins with a detailed discussion on Cross-Site Scripting, related mitigation, and testing strategy, as well as HTTP response splitting.
The code in an application may be totally locked down; however, if the server setting is insecure, the server running the application can be easily compromised. Locking down the Web environment is an essential topic for discussion, so this basic concept of defending the platform and host is covered.
To enable any detection of intrusion, logging, and error handling must be done correctly. We will discuss the correct approach to handling incidents and handling logs. We even dive further to cover the intrusion detection aspect of Web application security.
In the afternoon we turn our focus to the proactive defense mechanism so that we are ahead of the bad guys in the game of hack and defend. Topics such as file upload handling, intrusion detection, honeypot, redirection, extra in-depth authentication information, and practical input validation strategy will be covered. The afternoon material is designed to give you the extra edge in defending your application.
CPE/CMU Credits: 6
- Cross Site Scripting vulnerability and defenses
- Web environment configuration security
- Intrusion detection in web application
- Incident handling
- Honeytoken
DEV522.4: AJAX and Web Services Security
Johannes Ullrich, Ph.D.
Thu Jul 31st, 2014
Day four of the course is dedicated to AJAX and Web services security. Asynchronous JavaScript and XML (AJAX) and Web services are currently the most active areas in Web application development. Security issues continue to arise as organizations are diving head first into insecurely implementing new Web technologies without first understanding them.
We cover the security issues, mitigation strategies, and general best practices for implementing AJAX and Web Services. We also examine real-world attacks and trends to give you a better understanding of exactly what you're protecting against. Discussion focuses on the Web services in the morning and AJAX technologies in the afternoon.
CPE/CMU Credits: 6
- Web services overview
- Security in parsing of XML
- XML security
- AJAX technologies overview
- AJAX attack trends and common attacks
- AJAX defense
DEV522.5: Cutting Edge Web Security
Johannes Ullrich, Ph.D.
Fri Aug 1st, 2014
Day five has a strong focus of cutting edge web application technologies and current research area. Topics such as Clickjacking and DNS rebinding are covered. These vulnerabilities are difficult to defend against and require multiple defense strategies to be successful.
Another topic of discussion is the new generation of single sign on solution such as OpenID. We cover the implication of using these authentication systems and the common gotchas to avoid.
With the Web2.0 adoption, the use of Java applet, Flash, ActiveX and Silverlight are on the increase. The security strategies of defending these technologies are discussed so these client side technologies can be locked down properly.
CPE/CMU Credits: 6
- Clickjacking
- DNS rebinding
- Flash security
- Java applet security
- Single Signon solution and security
- IPv6 impact on web security
DEV522.6: Capture & Defend the Flag Exercise
Johannes Ullrich, Ph.D.
Sat Aug 2nd, 2014
Day six starts with an introduction to the secure software development life cycle and how to apply it to web development. But the major focus of Day six is a large lab. This lab will tie the lessons learned during the week together and reinforce the lessons by practicing them hands on. The student is provided with a virtual machine implementing a complete database driven dynamic web site. In addition, a custom tool is used to enumerate security vulnerabilities and simulate a vulnerability assessment of the web site. It will be up to the student to decide which vulnerabilities are real and which are false positives. The student is then asked to mitigate the vulnerabilities. The scanner will score the student as vulnerabilities are eliminated or checked off as false positives. Advanced students will be able to extend this exercise and find vulnerabilities not presented by the scanner.
The student will learn hands on how to secure the web application, starting with the operating system, the web server, finding configuration problems in the application language setup, finding and fixing coding problems in the site.
CPE/CMU Credits: 6
- Mitigation of server configuration errors
- Discovering and mitigating coding problems
- Testing business logic issues and fixing problems
- Web services testing and security problem mitigation
- This day will use the exercise to re-enforce most topics discussed earlier.
Additional Information
Laptop Required
It cannot be stressed enough that if your laptop does not meet minimum configuration requirements, you will not be able to participate in this course.
Students attending this course are required to bring their own laptops pre-configured per the instructions below. This must be done before class starts.
Mandatory Laptop Hardware Requirements:
- 2GHz processor
- 4GB RAM with 6 GB or higher recommended
- 6GB free hard disk space
- DVD-ROM drive
- An unused USB slot
A laptop with Windows 2000, XP, Vista, 7, or 8 is required with the latest Service Packs and patches.
Install VMware Player or VMware Workstation on the laptop. (GSX and ESX will not work.) VMware player can be downloaded for free at http://www.vmware.com. VMWare Fusion for Mac OS X can be used for Apple MacBooks provided the hardware requirements above are met.
You must have administrative privileges on the laptop with the ability to disable the host firewall (Windows firewall or other third party firewall) and anti-virus running on your desktop. At the beginning of class you will be given a Linux VMWare image. This image will be booted within VMware as a virtual machine for all the exercises.
If you have additional questions about the laptop specifications, please contact firstname.lastname@example.com.
Who Should Attend
- Application developers
- Application security analysts or managers
- Application architects
- Penetration testers who are interested in learning about defensive strategies
- Security professionals who are interested in learning about web application security
- Auditors who need to understand defensive mechanisms in web applications
- Employees of PCI compliant organizations who need to be trained to comply with PCI requirements
Press & Reviews
Not only does Dev522 teach the defenses for securing web apps, it also shows how common and easy the attacks are thus the need to secure the apps. - Brandon Hardin, ITC
"As the world moves everything online, Dev 522 is a necessity." - Chris Spinder, B/E Aerospace, Inc.
"I think Dev522 is absolutely necessary to all techies who work on web applications. I don�t think developers understand the great necessity of web security and why it is so important." - Mahesh Kandru, Cabela's
"Dev 522 provides good web application basics and gives an excellent understanding of application from security perspective." - Tarun Madiraju, NOPSEC
"Specific and hands on training regarding webserver and browser security as it is presented in Dev 522 is valuable! The cost of bugs and vulnerabilities can be immeasurable." - Josh Hegg, Tripwire
Author Statement
Too many websites are getting compromised these days. Our goal for this course is to arm the students with defensive strategies that can work for all web applications. We all know it is very difficult to defend a web application; there are so many different types of vulnerabilities and attack channels. Overlook one thing and your web app is owned. The defensive perimeter needs to extend far beyond just the coding aspects of web application. In this course, we cover the security vulnerabilities so students have a good understanding of the problems at hand. We then provide the defensive strategies and tricks as well as overall architecture that are proven to help secure sites. I have also included some case studies throughout the course so we can learn from the mistakes of others and make our own defense stronger. The exercises in class were designed to help you further the understanding and help retain the knowledge by hands-on practice. By the end of the course, you will have the practical skills and understanding of the defensive strategies to lock down existing applications,as well as building more secure applications in the future.


text:
No timetable announced for Simmons' ankle sprain
SEATTLE -- Donning a soft cast and tape around his left ankle, Braves shortstop Andrelton Simmons gingerly limped around the Safeco Field visitors' clubhouse Wednesday morning. Crutches leaned against his locker.
Simmons was forced to exit in the fourth inning of Tuesday's 4-2 loss on an odd play that began when Mariners first baseman Logan Morrison grounded an RBI single into left field. As Justin Upton's throw sailed high over home plate, Simmons looped around the infield and caught his foot covering third base, then crumpled to the ground. After being examined by a trainer and manager Fredi Gonzalez, he was replaced by Ramiro Pena.
Shortly after, the club announced that Simmons sprained his ankle.
"I was really mad I had to come out of the game," Simmons said. "You have no idea. I wish it was a play where I was running and sliding -- something productive."
Simmons maintained that the ankle was feeling better Wednesday than it did the night before, but he added he had no idea if the sprain might require a stint on the disabled list. He is considered day to day.
"I'm just going to get treatment, see how it develops, see how it keeps feeling," Simmons said. "As soon as I can run a little bit, I'll be ready to go."
The 24-year-old Curacao native posted a .249/.297/.340 slash line in 107 games this season. Before the injury, he was 7-for-43 (.163) over the last 14 games.
The Braves have an off-day Thursday before they begin a critical 10-game homestand against three teams -- the Nationals, Dodgers and Athletics -- that are currently in first place in their division.
Simmons was out of the lineup Wednesday, as the Braves, who had lost seven straight entering the finale, wrapped up a two-game series with the Mariners. He remained hopeful that he could return sooner rather than later.
"It's definitely better," Simmons said. "I can walk a little with less pain, and that's progress for me."


text:
VESTAL, N.Y. (AP) Ferg Myrick posted his third double-double of the season and Chris Matagrano his first as New Hampshire defeated Binghamton 63-45 Saturday night to snap its winless streak in America East Conference play.
The Wildcats (5-14, 1-6) scored the initial 10 points of the game and extended their lead to 16 at the 10:21 mark. After the Bearcats got within eight points, at 25-17, New Hampshire closed the half on an 8-2 run, pushing the lead into double digits for good.
Myrick finished with 16 points and 10 rebounds, while Matagrano had 12 points and 10 boards. Chandler Rhoads added 15 points, five assists and five steals and Patrick Konan contributed 12 points for New Hampshire.
Binghamton (3-17, 1-6), coming off a 57-56 win over Maine that snapped a 12-game skid, was 0 for 12 from beyond the arc.
Jordan Reed scored 18 points and Brian Freeman 11 for the Bearcats.


text:
Goal $150.00
Thank you for supporting me and Mason District Little League!
Mason District Little League Hit-A-Thon is similar to a walk-a-thon. The idea is that each player solicits sponsors who pledge to make a tax-deductible donation to MDLL. Pledges can be based either on the total distance a player hits or a flat donation amount.
Hit-a-thon funds are used for equipment and caretaking of the fields, participation scholarships for families in need, to keep the registration fees low for all families, and to support coaches clinics. Although the Nationals funded the overall renovation of Mason District Park Field in 2017, there are additional items and funds required to support the best possible player experience at that site and across the fields and teams. As our league continues to grow, the 2019 fundraiser is critically important. We appreciate your generous donation in any amount.
Winners based on distance are welcome to participate in the MDLL Home Run Derby on June 2. Individual fundraising leaders will also win prizes, and the team with the most funds raised will receive funds for a team party.
Family (about 9 months ago)
Go, Olivia, go! Good luck with the fundraiser and season!$20.00
Elsy (about 9 months ago)
Go Olivia! Love, Bryan and Lily Marin$25.00
|My Status
|Number of pledges received:
|Goal achievement:
|Number of page visits:
|Days since event:
|I am a member of 'Softball Raiders'
|See the Team Softball Raiders
Event Information
|2019 Mason District Little League Hit-a-thon
|Saturday May 4, 2019 at 12:00 AM


text:
Back to Product: EO/EO-2 Tee, Union - T
Click Image to Zoom
EO/EO-2 Tee, Union - T
EO/EO-2 Tee, Union - 24° Flareless
|Part #: T42LMS
|Manufacturer: Parker
Price/UOM: $753.39
|In-Stock: Backordered
|Pkg Qty: N/A UOM: N/A
Order by Noon, Ship Today
Normally Ships in 1 - 2 weeks
Partial Order by Noon, Ship Today - Balance 1 - 2 weeks
Parker EO and EO-2 metric flareless bite type tube fittings have become the "world standard' for many industrial manufacturers requiring dependable leak free hydraulic tube fittings. The EO progressive ring (ferrule) has two cutting edges that bite the tube outer diameter. EO-2 fittings incorporate elastomeric seals on all joints to insure leak free systems.
Email this page to a friend
Recipient email address:
Product Resources
Prop 65: Warning


text:
Three Ways to Style a Fold-Over Mini
Want a twist on pleats, pencils, and A-lines? This versatile update to the wrap is super-flattering, thanks to an asymmetrical cut and strategically placed piping. From the workplace to brunch with the girls, we show you three different ways to style your new favorite spring staple--the fold-over mini (Cotton-polyester, Sea, $310; at the Webster, 305-674-7899).
1. A quilted jacket and ankle-strap flats take the skirt to work—at least in creative fields. Is your office more formal? Slip on tights and sleek heels.
Jacket Cotton-polyester, ATM Anthony Thomas Melillo, $415; barneys.com. T-shirt Modal-silk, Kain Label, $88; kainlabel.com. Cuff Silver plate, R.J. Graziano, $45; rjgraziano.com. Bag Leather, Rag & Bone, $395; at Rag & Bone, 212-219-2204. Flats Leather, Vince Camuto, $98; vincecamuto.com.
2. Put on a fuzzy pink sweater, and this go-anywhere piece even suits weekends. A compact backpack and shiny brogues are the only accessories you need for a laid-back yet stylish brunch look.
Sweater Angora-nylon, Topshop, $110; topshop.com. Backpack Leather, Kara, $480; karastore.com. Oxfords Patent leather, Elk, $185; elkaccessories.com.
3. To emphasize the oh là là factor of the peekaboo cutout, pair the mini with sexy booties. An untucked textured top and a cobalt shoulder bag add to the playful mood.
Sweatshirt Cotton blend, Vince, $275; saks.com. Necklace Nylon rope and brass, Holst + Lee, $175; holstandlee.com. Bag Leather, Michael Michael Kors, $248; at select Michael Kors Lifestyle stores. Booties Leather, VC Signature by Vince Camuto, $275; lordandtaylor.com.
For more styling tips, pick up the March issue of InStyle, available on newsstands and for digital download now.
MORE:• Here's How to Find Your Perfect Jumpsuit• Nicole Kidman in the March InStyle: "I'm Very Country at Heart"• Exclusive! Take a Tour of Carolina Herrera's Home[instyle_context_cmad url="http://img2.timeinc.net/instyle/images/2014/WRN/021314-march-issue-digit..."]


text:
My employer recently posted an opening for a C# Developer with 3-5 years of experience. The requirements and expectations for the position were fair, up until the criteria for salary determination. It was stated clearly that compensation would depend ONLY on experience with C#, and that years of programming experience with other languages & frameworks would be considered irrelevant and not factored in. I brought up my concern with HR that good candidates would see this as a red flag and steer away. I attempted to explain that software development is about much more than specific languages, and that paying someone for their experience in a single language is a very shortsighted approach to hiring good developers (I'm telling this to the HR dept of a software company).
The response: "We are tired of wasting time interviewing developers who expect 'big salaries' because they have lots of additional programming experience in languages other than what we require." The #1 issue here is that 'big salaries' = Market Rate. After some serious discussion, they essentially admitted that nobody at the company is paid near market rate for their skills, and there's nothing that can be done about it. The C-suite has the mentality that employees should only be paid for skills proven over years under their watch. Entry-level developers are picked up for less than $38K and may reach 50K after 3 years, which I'm assuming is around what they plan on offering candidates for the C# position. Another interesting discovery (not as relevant) - people 'promoted' to higher responsibilities do not get raises. The 'promotion' is considered an adjustment of the individuals' roles to better suit their 'strengths', which is what they're already being paid for.
After hearing these hard truths straight from HR, I would assume that most people who are looking out for themselves would quickly begin searching for a new employer that has a better idea of what they're doing in the industry (this company fails in many other ways, but I don't want to write a book). Here is my dilemma however:
This is the first official software development position I've held, for barely 1 year now. My previous position of 3 years was with a very small company where I performed many duties, among them software development (not in my official job description, but I tried very hard to make it so). I've identified local openings that I'm currently qualified for, most paying at least 50% more than I'm getting now. Question is, is it too soon for a jump? I am getting valuable experience in my current position, with no shortage of exciting projects. The work environment is very comfortable, and I'm told by many that I'm in the spotlight of the C-level guys for the stuff that I've been able to accomplish during my short time (for what that's worth). However, there is a clear opportunity cost to staying, knowing now with certainty that I will have to wait 3-5 years only to be capped at what I could potentially be earning elsewhere this year. I am also aware that 'job hopper' is a dangerous label to have, regardless of the reasons.
UPDATE: I've just accepted an offer at another company, paying significantly more and with even cooler projects. Thanks to all for the insightful responses.


text:
Joe Hart has warned Manchester City they need to bounce back instantly from their St Stephen's Day disappointment at Sunderland if they are to defend their title.
The Barclays Premier League champions slipped seven points off the pace being set by derby rivals Manchester United when they succumbed to old boy Adam Johnson's lone strike at the Stadium of Light.
City head for Norwich tomorrow under orders from manager Roberto Mancini to become more ruthless in front of goal, and Hart knows they cannot afford too many repeats of their off-day on Wearside.
He told citytv: "It's how football goes sometimes.
"I don't think we have not tried or not given 100 per cent or not shown quality, it's just that it wasn't there and we need to turn that around quickly."
United's lead may be commanding at the halfway point of the season, but both Mancini and Alex Ferguson know from experience that is far from decisive.
Indeed, having chased down their neighbours during the final seconds of the last campaign, City will be confident of doing the same again with plenty of football still to be played.
Hart said: "It's difficult every game to win. To be leading is difficult and to be chasing is even harder, so we will see.
"Hopefully it will do what it did last year."
Norwich had gone 10 league games without defeat before losing 2-1 at West Brom on December 22, and they were unable to make amends on Boxing Day when Chelsea left Carrow Road with the three points courtesy of Juan Mata's first-half strike.
The Canaries could be forgiven for approaching the fixture with some trepidation after losing the corresponding match last season 6-1 on a day when Carlos Tevez plundered a hat-trick and Sergio Aguero struck twice.
Adam Johnson completed the scoring on April 14 and by coincidence, he found the back of the next on Wednesday, although this time wearing the red and white of Sunderland against City.
Hart was unable to keep out his former team-mate's long-range 53rd-minute strike on a day when opposite number Simon Mignolet frustrated the visitors with a string of fine saves.
Hart said: "We dominated the game and lost, but we have got to move forward.
"Their goalkeeper had a special game, which he has done against us recently. He is a good keeper. We just couldn't quite get it in."


text:
Introducing the ACC Vault, Another Great Way to Idle Away Hours of Your TimePosted by rtmsf on December 15th, 2010
Matt Patton is an RTC contributor.
Everyone has a first memory as a fan. Mine came in 1997, the day before my seventh birthday. I'm sure I went to college basketball games before this, but none of them stand out. I was in first grade, headed to the ACC Tournament championship game. The game was between N.C. State and North Carolina. The Wolfpack were the electric underdogs, if you can call a team that runs a modified Princeton offense electric. They were the eighth seed in a nine-team conference, having put away Georgia Tech, Maryland and top seeded Duke in the process.
My most vivid memories from the game were Ramses and Mr. Wuf (the mascots) getting into a fight ending with a one-horned sheep and a victorious wolf; N.C. State losing the game; and my younger brother switching his allegiances to the Tar Heels for the rest of the day much to the chagrin of my parents. A surprisingly thick head of hair topped Herb Sendek's head, as he led a team of overachievers to the conference championship game in his first year of coaching. But the real history was held by the man coaching the Tar Heels. I'm embarrassed to say this, but until yesterday I never knew that was Dean Smith's last ACC game. I had no idea.
This game, along with dozens of "full-length, classic Tournament and regular season men's basketball games from all 12 ACC member institutions," is now available online at the ACC Vault. You've likely seen the NCAA Vault (another must-visit site for any college hoops fan), and the ACC and Raycom Sports have followed suit. The site features games from 1983 through the present with some really cool features that make the viewing process more user-friendly. I'll list some highlights for each school after the jump, but seriously, how cool is this?


text:
Theranda Hotel Tirana is an elegant hotel in a central position; only minutes from "Blloku" area, the entertainment hub of Tirana, yet located away from city noises.
Rooms and bathrooms are modern, individually designed and offer all the comforts of a superior hotel. It also offers Free Wi-Fi , private parking, car rental and laundry services. The buffet breakfast is served in our stylish bar, while when sunny it is simply wonderful in our pretty garden.
Clients have noted all the above facilities in their many reviews, but have praised the most our staff, confirming our continuous efforts to carefully select and train them, to provide a friendly and personalized service.
These efforts have paid off by making Theranda one of the top rated Tirana hotels by clients since its opening in 2008.


text:
3% off
If McAlister's Deli is one of your favorite lunch spots, calculate your weekly budget by checking your gift card balance with any of the methods listed below.
Boston Market
Fire Mountain Grill
Hometown Buffet
Honey Dew Donuts
Jason's Deli
Jersey Mike's
Ninety Nine Restaurants
Port of Subs
Santa Fe Cattle Co.
Tim Hortons
Get points towards free gift cards with Granny Rewards. Sign up today and receive 100 points for signing up and points with your purchase.
Get points towards free gift cards with Granny Rewards. Sign up today and receive 100 points!
Oops, an error occurred. Please try again or contact customer service.
Already have an account? Log In
Oops, the username or password you entered was incorrect. Please try again.
Claim your 100 points by verifying your email address. Gift Card Granny has sent you an email with instructions.
No Thanks, Take Me To My Deal


text:
Watch Magnetic Conveyors in Action
There are 0 comments | Post a comment
Wednesday, July 1, 2009
While they might not earn an Academy Award, a series of new videos posted to the website of Industrial Magnetics, Inc., Boyne City, MI, do a great job of illustrating the variety of applications where magnetic conveyors function.
Check out the videos at www.magnetics.com/media_videos.asp. They show, among other applications, conveyors moving large pieces of scrap sheetmetal to a collection bin, and scrap cutoff rounds and chips being conveyed from an automated cutting station into a recycling bin.
See also: Industrial Magnetics, Inc.
Related Enterprise Zones: Automation


text:
Having a family history means that a person has one or more
blood relatives with a certain health problem. A doctor can look at a person's
family history to get some idea of the person's risk for that health
Blood relatives include relatives who are alive and those
who have died. They may be:
Some family histories are stronger than others. How strong
a family history is depends on:
Last Revised:
April 6, 2012
Healthwise Staff
Medical Review:
Rakesh K. Pai, MD, FACC - Cardiology, Electrophysiology & Robert A. Kloner, MD, PhD - Cardiology
This information does not replace the advice of a doctor. Healthwise, Incorporated disclaims any warranty or liability for your use of this information. Your use of this information means that you agree to the Terms of Use. How this information was developed to help you make better health decisions.
To learn more visit Healthwise.org
© 1995-2012 Healthwise, Incorporated. Healthwise, Healthwise for every health decision, and the Healthwise logo are trademarks of Healthwise, Incorporated.


text:
Java Enterprise Edition (Java EE) continues to be one of the leading Java technologies and platforms. Beginning Java EE7 is the first tutorial book on Java EE7.Step by step and easy to follow, this book describes many of the Java EE7More Java Enterprise Edition (Java EE) continues to be one of the leading Java technologies and platforms. Beginning Java EE 7 is the first tutorial book on Java EE 7.Step by step and easy to follow, this book describes many of the Java EE 7 specifications and reference implementations, and shows them in action using practical examples.
This definitive book also uses the newest version of GlassFish to deploy and administer the code examples.Written by an expert member of the Java EE specification request and review board in the Java Community Process (JCP), this book contains the best information possible, from an expert's perspective on enterprise Java technologies.What you'll learn Get started with the latest version of the Java EE Platform.
Explore and use the EJB and JPA APIs from entities to session beans to message driven beans, and more. Discover web tier development APIs including JSF, Facelets and Expression Language. Uncover SOAP web services, RESTful web services, and more available in this latest Java EE. Create dynamic user interfaces for your enterprise and transactional Java applications. Who this book is for This book is for Java or Spring programmers with some experience and those new to Java EE platform.
Architects will also find information about how to layer their Java EE applications.Table of Contents Java EE 7 Environment Context and Dependency Injection Bean Validation Java Persistence API Object-Relational Mapping Managing Persistent Object Enterprise Java Beans Callbacks, Timer Service, and Authorization Interceptors and Transactions JavaServer Faces Processing and Navigation XML and JSON Messaging SOAP Web Services RESTful Web Service
©2010-2015 | DMCA | Contact us


text:
The Sticky Questions Surrounding Drones And Kill Lists
This is FRESH AIR. I'm Terry Gross. The story that the Obama administration has a kill list of terrorists targeted for drone attacks, a list personally approved by the president, was revealed in the New York Times by my guest Scott Shane, along with Jo Becker. Shane is a national security correspondent at The Times. The principal coordinator of the kill list is John O. Brennan, President Obama's counterintelligence advisor who is now seeking confirmation to head the CIA.
Last week, just before the confirmation hearing, Shane co-wrote an article revealing that drone strikes have been launched from a U.S. base in Saudi Arabia. Several news organizations had known for months about the location but had been sitting on the information at the urging of the Obama administration.
Navigating this terrain between national security and the public's right to know led Shane and Times reporter Charlie Savage to file a lawsuit under the Freedom of Information Act to get access to a Justice Department memo that gives the administration's legal justification for the drone strike that killed U.S. citizen Anwar al-Awlaki in Yemen. That suit was filed in December of 2011.
Last week, the Obama administration released that memo to members of the Congressional Intelligence Committees after a shorter white paper about those legal justifications was leaked to NBC News.
Scott Shane, welcome back to FRESH AIR. So let me start with the very important article you co-wrote last week. That was an article about drone strikes and how they're likely to figure into the Brennan confirmation story. Within that story, you broke some major news, which is that drone strikes in Yemen have been - including the one that killed Anwar al-Awlaki - have been launched from a secret American base in Saudi Arabia.
Why is this revelation about the secret base such big news?
SCOTT SHANE: Well, you know, it's sort of a journalistic story. When Anwar al-Awlaki, the American-born Yemeni cleric who famously is the first American citizen to have been deliberately targeted and killed in one of these drone strikes - when he was killed in September of 2011, you know, we and others learned that the drone had been launched, had taken off from a base in Saudi Arabia.
And the government asked, the Obama administration asked us not to use that information and asked others not to use it. And the explanation was essentially that it would interfere with sort of ongoing operations and, you know, potentially spark a backlash in Saudi Arabia that would cause the Saudi government to shut down the base and, you know, kick out the Americans.
And we, you know, certainly way above my level, folks at the - my bosses decided to go along with that request and withheld the information. But it, you know, it popped up elsewhere on the Internet, and we and others were using the phrase: a drone base on the Arabian Peninsula.
So it was - you know, we, you know, eventually our editors decided that we really should not be withholding it anymore. It didn't seem that the, you know, that the reasons the government was asking us to withhold the information were really adequate to cause us to keep something out of the paper.
And so when we were writing about drone strikes in Yemen in connection with the confirmation hearings for John Brennan as CIA director, we decided to put it in there.
GROSS: Why didn't you think that the Obama administration's reasons for keeping this story quiet were adequate? And here's why I ask. Apparently, Saudi Arabia was afraid that if it became public, there'd be a backlash. But also they might be afraid of terrorist attacks because, you know, bin Laden was furious when there was an American base in Saudi Arabia. And so I can easily imagination al-Qaeda planning attacks against Saudi Arabia because of the revelation of this drone base there.
SHANE: Well, those are indeed the two reasons that were given to us by administration officials over, you know, many months on several occasions, but, you know, oddly enough in the Internet age, it seems very hard to keep a secret - harder to keep a secret - and this information has been sitting on the Fox News website.
I don't know if they ever said it on the air on Fox News, but the fact that there was a U.S. drone base in Saudi Arabia has been on Fox News website for many months. It was reported actually before the death of Awlaki in the Times of London along with a couple of other supposed drone bases that we actually do think do exist.
But, you know, if you Googled before any of this came out in various papers including ours last week, you could Google Saudi and drone, and you would come up with multiple references to a drone base. So that was also part of the thinking.
But, you know, we - you know, we're a newspaper, and we're always inclined to publish things unless there's a really compelling reason not to.
GROSS: Now, not only did the New York Times know about the secret Saudi drone base, a couple of other journalistic organizations knew about it too, and decided because the Obama's administration request not to publish. So - and I think one of those was the Washington Post. Am I right?
SHANE: I think that's right. I think maybe the Wall Street Journal was one.
GROSS: Yeah, so were they angry with The Times, that the times went forward while they continued to sit on the information as the Obama administration had asked them to?
SHANE: Well, actually what happened was when we informed the administration that we intended to use the location of the base in Wednesday's paper, which would mean it would go up on the Web normally Tuesday night, the, you know, national security officials called around, as, you know, an understandable thing to other publications that had been withholding that information and said you're free to use it because The Times has said they're going to use it.
And so I believe that it was up on the Washington Post site before it was up on ours because we only posted our story online after the Post had already posted a story about the Saudi base. So, you know, despite our stating that we were going to use the information, I think in the end we were not the first to sort of break this informal embargo that had gone on for many months.
GROSS: How did you feel about that?
SHANE: I mean, I - you know, the competitive part of this didn't bother me particularly one way or the other because I don't think the location of the base is the most interesting part of the story. The most interesting part of the story is how are we using a new military technology in countries where we're not at war to kill suspected terrorists, how's that going, what are the, you know, sort of long-term consequences, is this the way we'll sort of be dealing with multiple problems perhaps even beyond terrorism in the future.
Those are the questions that interest me. Whether the drones fly out of Djibouti or fly out of Saudi Arabia or fly out of somewhere else, you know, it's certainly worth noting, but I don't think it's necessarily the, you know, the most interesting question about this.
GROSS: So part of that same story was about how, for instance, in one of the drone strikes a couple of members of al-Qaeda were meeting with a Muslim imam who had just preached against al-Qaeda, and they asked to meet with him afterwards. And this imam was killed, along with the members of al-Qaeda, and you offer that as an example of a drone strike that's killing exactly the kind of person we should be working with, the kind of person we should be happy is around but is now no longer around.
Do you think that's a fairly representative example of the kind of problem we're having with drone strikes?
SHANE: I think it is representative of, you know, how a drone strike can go wrong. But I think that case was so interesting because it shows the dangers of operating from the air even when you have reasonably good intelligence. Obviously, they had good enough intelligence to know that three members of al-Qaeda were having a meeting.
What they apparently did not know, at least according to the reporting of my colleague Bobby Worth, who actually talked to folks in Yemen about that, what they did not know was that the two other people at this meeting of five men were this anti-al-Qaeda imam and another guy who was a police officer he brought along for protection, essentially, because he was, you know, meeting with three militants; didn't know, you know, what that meant exactly.
And, you know, you can kind of imagine what the thinking might had been at the military or at CIA. We don't know always who's carrying out these strikes, whether it's the CIA or the Joint Special Operations Command of the military. But you can imagine they're saying, well, there are three guys we know are al-Qaeda, and they're having a meeting and, you know, there's two other men there, and, you know, as far as we can tell, you know, they're militants, too.
You know, and so someone has to make a decision, and they say, you know, take the shot. But the consequences, the aftermath of that, you know, you can imagine is quite damaging to the U.S. Not only have they lost this voice against al-Qaeda at the local level, but the relatives of the imam, the relatives of the police officer, have every reason to be extremely angry about this.
Whether the net impact of killing three al-Qaeda guys was worth the obvious backlash and the elimination of people who are actually on the side of the U.S. in this fight is a very good question.
GROSS: If you're just joining us, my guest is Scott Shane. He covers national security for the New York Times. Let's take a short break here, and then we'll talk some more. This is FRESH AIR.
GROSS: If you're just joining us, my guest is Scott Shane. He writes about national security for the New York Times. Scott, let's back up to last May, when you and Jo Becker of the Times broke the story that the Obama administration had a targeted kill list and the people being killed by drones and that the names on this targeted kill list were being approved by the president himself.
Is there anything you can tell us, without breaching the confidentiality of sources, about how you got onto the story about the president approving the names himself?
SHANE: Well, we set out to essentially do a big story on Obama's counterterrorism record in connection with the upcoming election to sort of, like, what's his record been in various areas, and this was the areas of counterterrorism in his first term. And so we talked to a lot of officials current, to the degree that they would talk to us, and former, and we - you know, perhaps the most striking thing that we learned was the degree that President Obama had decided to become involved in approving these counterterrorism operations.
And I think the administration, President Obama, John Brennan, his counterterrorism advisor who's deeply involved in all this stuff, would say that they saw them - their role as a restraining influence in an area where they're taking on immense responsibility - in other words, they're carrying out what may not be under the technical language of American law an assassination, but essentially they're killing people deliberately overseas in places where we're not at war.
That's a very unusual thing to be doing, and it also is politically obviously extremely volatile. There's always the old question that Don Rumsfeld, when he was secretary of defense, once raised in a memo of, you know, are we creating more terrorists than we're killing or capturing? So he wanted - President Obama - we were told, wanted to be very hands-on.
He insisted on approving all strikes outside of Pakistan, this is at least at that point, I think it may be, his role may be a little more hands-off now than it was back in May when we wrote about this, but he also wanted to sign off on the more high-risk strikes in Pakistan, which we were told amounted to perhaps a third of the strikes in Pakistan.
But it was, you know, it was quite extraordinary in the sense that you had actual target approval by a president. You usually think of this stuff as being distanced from the president, you know, maybe the president given as they used to say plausible deniability or at least sort of, you know, his hands kept clean of the details of this kind of thing.
But he insisted on being very involved, and that has all kinds of I suppose political reverberations both good for him and perhaps bad for him.
GROSS: You know, a lot of people have interpreted this as being really horrible, the president himself is approving targeted assassinations. The flipside of that, which is I think the side that the Obama administration has used to justify this, is that we're going to be doing this, the president himself wants the final moral responsibility so that he can know what's going on and feel that it's justifiable.
Have, like in your analysis, have you come to see one side more than the other?
SHANE: Well, I think the motivation was very much the latter. I don't think it's that he's, you know, bloodthirsty and really enjoys trying to put people's names on lists to be killed. I think there's a certain wariness, probably a proper wariness, that any president would have toward agencies.
Agencies, you know, kind of want to do what they are good at doing or what their job is. So, you know, certainly according to what we've heard, both the CIA and JSOC as it's called - the element of the military that does these strikes - are pretty aggressive. They want to, you know, they want to find targets and kill them.
And so I think the role that President Obama assigned to the White House was - and to himself was really one of restraining the agencies, double-checking the agencies, making sure that at this sort of broader strategic political level that there was good judgment being exercised, that you weren't taking a shot in a very marginal situation for a marginal gain and risking a big backlash that would put the United States in a worse position.
GROSS: So with a story like this, did you tell the White House that - did you or the editors of the New York Times tell the White House before publishing?
SHANE: We talked to the White House throughout the reporting process because we were trying to talk to as many people who had - you know, obviously this was not a new topic, the topic of targeted killing and drone strikes and so on. And what we wanted to get a better handle on was what Obama's personal role was, what his own involvement was, what his views were.
So that meant talking to as many people who had contact with him in this context as we could. Most of those people were obviously at the White House. Some were at other agencies. Some were former officials, who usually are more chatty than current officials. So we talked to all those people. So the White House was quite aware that we were doing the story in the two or three months that we worked on it.
And we sought an interview, among others, with President Obama, didn't get one, sought interviews with Tom Donnell and the national security advisor, with John Brennan, the counterterrorism advisor, and did get those. So yeah, they were quite aware that we were running the article. My impression after it ran was that they were a little concerned about the emphasis on President Obama's personal role in approving some of these targets for targeted killings that indeed as you suggested it was being interpreted in some quarters as almost sort of, you know, the killer president, the sort of bloodthirsty president and that, you know, that that was being misconstrued, that his role was really the opposite of that and that perhaps that hadn't come across adequately in the article.
GROSS: So as you have pointed out, you report the story, and then a lot of people read it too quickly, misinterpret it and then go on their blogs and give their misinterpretation to the world.
GROSS: So what are some of the worrisome misinterpretations that your story got?
SHANE: Well, I guess the kind of parody version was that Obama would call a meeting. There was some confusion of different meetings. There's a meeting, a weekly meeting on terrorism on Tuesdays, which is sometimes referred to as the terror Tuesday meeting. And, you know, I think some people wrote that Obama, you know, gathers everybody on Tuesday and then tells them who he wants them to kill.
And obviously that's not, that's not what happens. I mean, as far as we are able to tell in this very secretive process, there's one process for the military, which is quite interesting because it can involve as many as 100 people watching on video monitors in multiple agencies, and somebody presents a set of possible targets. These are individuals, nominations as they call them, to the kill list, and people even refer to these as baseball cards sometimes because it's essentially here's what the guy's, you know, name is, here's his age, here's his background, here's what we know about him, here's why we think he's a dangerous terrorist.
And then it's all kicked around, you know, in this secret but, you know, fairly open within the government process where an agency, perhaps on the periphery of this like the State Department, can say, you know what? We think that guy is not important enough to kill, or we have different information, we don't think he's that bad, or we think if you took a shot at him, it would disrupt our relations with such and such a country, and we don't think it's worth it.
And there's really kind of a debate, which ends up with either a name on the list or a name not on the list. But, you know, part of what John Brennan has been doing for many months now is overseeing a process where they're trying to write more clear rules for these strikes, when they're justified, when they should take place, who should do them and so on.
It's, you know, unfortunately like almost everything in this area, it's a secret book of rules that's sometimes referred to in the government as the playbook, and it's still a work in progress. But even at the White House, there's a sense that they are sort of pioneering a new kind of warfare, a new kind of, you know, organized violence against suspected terrorists and that they need to make sure there are clear written rules for how it should be done.
GROSS: Scott Shane will be back in the second half of the show. He's a national security correspondent for the New York Times. I'm Terry Gross, and this is FRESH AIR.
GROSS: This is FRESH AIR. I'm Terry Gross back with Scott Shane, a national security correspondent for The New York Times. He and Times reporter Joe Becker broke the story that the Obama administration has a kill list of terrorists abroad targeted for drone attacks - a list personally approved by the president. In this and other related stories that have revealed formerly secret information, Shane has had to think about the line between national security and the public's right to know.
Last week, Michael Isikoff broke the story about a white paper that was leaked to him that summarized some of the justifications for the drone strikes and for having drone strikes without judicial review - drone strikes against American citizens in other countries who are considered terrorists. But there's a larger document, offering the legal justification for the drone strikes, that you've been trying to get your hands on. In fact, you sued the government through the Freedom of Information Act to get access to these governments and so far you've been denied, not only by the government but by a judge.
So describe what you know about the document that you are suing to get.
SHANE: Well, the document is a long memo prepared by the Office of Legal Counsel, which is part of the Justice Department. It's essentially the government's last word on what the law says. So when somebody wants to do something novel and, you know, in a way extreme, such as kill an American citizen in another country without trial, without, you know, criminal charges as part of a counterterrorism operation - OLC, as it's called, the Office of Legal Counsel - are the lawyers who you go to, to say, you know, can we do this? Is this legal? And they spent months on an opinion which was prepared in 2010, specifically about Anwar Awlaki, the American-born cleric in Yemen who had joined al-Qaida, and essentially laying out both the facts about Awlaki's, history, his involvement in, not only propaganda, in favor of terror strikes to kill Americans, but also his personal involvement in the so-called underwear bomber attack, that jetliner over Detroit that was a young Nigerian man tried to blow up. And so they laid out not only the facts but a lot of law. And this, you know, I don't know exactly how long this memo is - probably 75, 100 pages - and it kind of made sense for us to try to get a hold of it - just as we and other the news organizations under President Bush had tried to get a hold of the OLC memos - as they're called - justifying brutal interrogation techniques.
GROSS: So on what grounds have you been denied access to the memo?
SHANE: Well, the government came up with a lot of different reasons. Under the Freedom of Information Act there are various exemptions and they claim that this is classified, you know, the information is too sensitive to be let out and they claim various other exemptions for internal deliberations. And for the president to get sort of candid legal advice he can't be having these legal memos sort of shown to the world. And the judge who wrote the opinion ruling against us and against the American Civil Liberties Union, who filed a similar lawsuit, seemed quite frustrated with the situation that she found herself in. She described it as an Alice in Wonderland kind of moment. But she's...
GROSS: Let me step in. I'll quote what she said. She said, it's an Alice in Wonderland - she referred to the Alice in Wonderland nature of her decision. And she said "but I can find no way around the thicket of laws and precedents that effectively allow the executive branch of our government to proclaim it's perfectly lawful certain actions that seem on their face incompatible with our Constitution and laws, while keeping the reason for their conclusion a secret.
SHANE: Yeah, that's - I mean that was quite interesting. You know, I know that courts for decades have tended to defer to the executive branch on questions involving national security and judgments, for example, on what should or should not be classified. Judges rarely substitute their own judgment for those of executive officials on those issues. So essentially the judge was saying, if the Obama administration doesn't want to make this memo public it doesn't have to. We have appealed that decision, as has the ACLU so we'll see what happens at the appeals level.
GROSS: So what did you find most interesting about the white paper relating to this memo that was leaked last week?
SHANE: Well essentially, it says that if America is a leading member - a leader of al-Qaida - and is plotting, you know, against the U.S. to try to Americans, and that the capture of the person is infeasible, you know, sort of whatever that means, that it is permissible, it's legal to go ahead and kill them. The, you know, it touched on a number of different justifications but the all along the administration has claimed two different sort of theories by which they could kill members of al-Qaida and associated forces in other countries. One is that they say we are at war with al-Qaida and associated forces. And so in that sense it's not like unlike killing a German American who had decided to fight with the Germans in World War II, we're just killing a member of the enemy, but and citizenship is irrelevant.
But the sort of backup argument is one of international self-defense. And this is partly necessary because a lot of other countries don't accept the idea that the United States is at war with a terrorist group. So their sort of plan B, legally speaking is that if you under international law have a right to self-defense. If someone is about to attack you, you're allowed to attack them first, essentially. So if we know that Anwar al-Awlaki was plotting against the United States to kill a lot of Americans, we could under international law legally target him and kill him to prevent that attack.
The where that becomes, the two points that become debatable, one is the question of whether the attack is eminent. And one thing this white paper laid out is that is a sort of stretched definition of eminence, rather than meaning that he literally is in the process of, you know, launching an attack, sending a, you know, and underwear bomber, making a phone call somehow, you know, beginning the process of an attack on the United States, the definition of eminence that the government has adopted is simply that these are guys, Anwar Awlaki, other members of al-Qaida, these are guys who want to attack America and will do it at their next possible opportunity. So that in that sense they're always a threat, the threat is always eminent. That, of course, has never been tested in a court, but that's their claim.
And then there's the second issue of feasibility. How feasible it to capture someone? If it is feasible for you to capture them, you're supposed to capture them. And, you know, in this case the argument would be that Awlaki was out in the tribal areas of Yemen. It would be extremely dangerous and perhaps impossible to catch them without loss of American lives or Yemeni lives on the part of the team that was sent to capture him.
GROSS: So you're in the process of appealing a judge's decision that denied you access to a memo you're trying to get from the Justice Department's Office of Legal Counsel, a memo justifying the drone strikes against American citizens believed to be affiliated with terrorist organizations. So when do you think the next step will happen? Like you're appealing, when is that going to go to court?
SHANE: It will be months. So, you know, we're not holding our breath. We're certainly, you know, pursuing the case and coming up with, you know, the best arguments that we can to try to get an appeals court to rule in our favor. But it is tough because the courts almost always defer to the executive branch in terms of what should be secret. They don't usually step in and say well, it's ridiculous that it's a secret; you have to declassify it. They differ on those grounds, so it's tough. And, you know, I think that, you know, the other route would be there is considerable pressure now, certainly on the administration, to share this OLC memo with more people. They started last week under, you know, considerable pressure from Congress, by making the memo available to members of the House and Senate Intelligence Committees - although, interestingly not to their staff members, who obviously are the ones who have more time and sometimes more expertise to devote to reading something like this. But at least the senators and representatives who are on the intelligence committees can look at this memo for the first time. It's remarkable in a sense because those committees were created in the late '70s to be the kind of eyes and ears of the American public over the activities of the secret agencies - the oversight committees, the watchdogs, but the government had taken the - the Obama administration had taken the position that even the members of those committees were not permitted to see this memo, which they sought for many months and only caved on that, you know, on the eve of John Brennan's confirmation hearing.
GROSS: Are you hoping that somebody is going to leak this to you?
SHANE: ., you know, I would love that. People can look up the address of the bureau and...
SHANE: ...put it in a brown plain wrapper and put it in the mail. I think that would be great. Well, you know, people may remember way back in 2004, there was a very important memo - sometimes referred to as the torture memo, one of the torture memos, that was a parallel of OLC memo - a Justice Department memo - in that case justifying interrogation techniques like waterboarding, the sort of near drowning technique that was being used by the CIA under the Bush administration. And, you know, it was leaked and set off a huge public debate.
It's interesting to think back that the other big controversy in the Bush administration in the counterterrorism area, was the National Security Agency's domestic eavesdropping program, the warrantless wiretapping program, as it was sometimes called, which was also a top secret. No one knew about it until my colleagues at The New York Times got a, you know, got the information from sources and put it in the newspaper. So that also led to a huge, you know, year's long debate about the appropriate limits of government surveillance, just as the leak of the torture memos sort of set off a, you know, a debate that still going on with the movie "Zero Dark 30" about, you know, should the United States be engaging in torture or indeed coerce of any interrogation methods of any kind.
GROSS: If you're just joining us, my guest is Scott Shane. He covers national security for The New York Times. Let's take a short break here and then we'll talk some more. This is FRESH AIR.
GROSS: If you're just joining us, my guest is Scott Shane. He covers national security for The New York Times.
Have you asked yourself what it would mean if countries not allied with the United States had their own drone program?
SHANE: Very much. I mean and this is on the mind of officials at the White House, at the State Department, other places, because it's happening. I mean this is not a super sophisticated technology. The sophisticated part is the satellites that make it easier to, you know, control and locate these planes. But the planes themselves are, you know, not that terribly hi-tech and they basically have missiles strapped under their wings. So it's something that not only a state could do, but even a terrorist group could do.
The very interesting question that has arisen as the U.S. has pioneered this technology is: what happens the Russians send an armed drone into Georgia to the south claiming that there's a Chechen terrorists who's hiding in Georgia they have no other way to kill them and so they're going to kill him with a drone? It's going to be a very interesting moment internationally and for the United States because the Obama administration, if that who is in power, will have to say, you know, we accept this because they're doing exactly what we do. I think one, you know, there's increasing awareness on the part of American officials that they are setting a precedent for the rest of the world, and I think that's another reason that the administration and John Brennan in particular have been working on a set of rules because there is this sort of increasing awareness that they are the model for whatever is going to happen with this technology in the future.
GROSS: I want to ask you about another story you've been directly involved in and this is a story about the Obama administration prosecuting a former CIA agent for leaking. And there were two journalists involved in this case and you were one of them. You were officially Journalist B. So what was the Journalist B part of the story?
SHANE: Well, just to, sort of, set the stage for this, John Kiriakou is 48. He has been out of the CIA since 2004 but he served for about 15 years first as an analyst, then as an overseas, you know, undercover agent against terrorism, mostly in Greece and Pakistan. He is one of six people now who has been charged, criminally, with leaking classified information to the press under President Obama.
And this is attracting a lot of attention because, depending on how you define it, you might get slightly different numbers, but most people would agree that no more than three people had been prosecuted for leaking to the press in all previous administrations in the entire history of the United States. So it's (unintelligible) cases proceed.
And my involvement with John Kiriakou began, as did the involvement of many reporters with him, after he went on television on ABC in December 2007 and spoke with surprising candor about water boarding. He had been the leader of the team - the CIA team that captured Abu Zubaydah, a sort of terrorist training camp official and travel facilitator, who was considered, in 2002 when he was caught, to be, you know, sort of the biggest terrorist that they had gotten their hands on.
He had led that capture, but he had not been present for the water boarding. You know, when you have a CIA guy talking about water boarding on TV, you know, that's a fairly rare bird. I, like many reporters, called him up and got to know him. You know, I talked to him on a number of occasions after that.
What got him in trouble in his criminal case, when charges were ultimately brought against him in 2012, in January of 2012, was that he had given me a phone number that he had from a business card of another former CIA officer, a guy who had never worked undercover but who had worked in Pakistan with John Kiriakou.
That man's name was Deuce Martinez and he had become a fairly important interrogator, we were told, of al Qaida suspects. Well, the government took the position that even though Deuce Martinez was not undercover, his involvement in the interrogation - the capture and interrogation of Abu Zubaydah was classified. And that by essentially confirming to me, what I had already heard, which was that there was a guy named Deuce Martinez who had been involved in this, that Kiriakou was breaking the law, was disclosing classified information.
In the end, John Kiriakou pleaded guilty to one count that was actually something else. It was sharing the name of a CIA officer who wasn't still undercover with a freelance journalist, a different journalist. And so, the charge involving me was dropped. But it was still very much part of the case against him. And he has been sentenced to 30 months in prison and is expected to report to prison soon.
GROSS: I wonder if the fact that, you know, he was charged for what he told you and now he's going to prison because of a name he gave another journalist - I wonder if that and other related cases are having a chilling effect on your sources, or on you and your fellow journalists.
SHANE: I think it is having a chilling effect. It's extremely distressing, what's happened to John Kiriakou to me, personally, because I feel that I played at least some role in sending him to prison. And, as I tried to explain in a long piece that I did for the Times, what he did with me and even with this freelance journalist, was not nearly as unusual as it might seem if you read it in his indictment.
You know, for decades the journalists who try to cover national security in Washington are always operating at the fringes of classified information. When we write about drone strikes in Pakistan, technically speaking, that's a covert action. It's top secret. But we are able to get officials to tell us, you know, bits and pieces of information. And indeed, sometimes the government itself is quite inconsistent.
President Obama has given fairly detailed interviews to CNN about the drone program. He went on YouTube and Google+ and talked about it on the Web. So we're always operating in this, sort of, you know, this DMZ, this sort of gray zone between what's classified and what's unclassified. And so it's not unusual for someone to give you the name, even of an undercover CIA officer.
Not so that you can publish it but so that you can approach that - you can find that person, approach that person, and see if that person wants to talk to you. Usually on, as we call it, a background basis. In other words, you know, the person gives you the information but you don't attribute it to that person by name.
That's common way business has been done in Washington for many, many years. And it's the only way, frankly, we're able to write about these secret agencies and the activities that they perform with, you know, the money the American tax payer in the name of American citizens.
GROSS: OK. Scott Shane, thank you so much.
SHANE: Thank you.
GROSS: Scott Shane is a national security correspondent for the New York Times. Coming up, Maureen Corrigan reviews a new memoir by a teacher who was cyberstalked by a student. This is FRESH AIR.
Copyright © 2013 NPR. All rights reserved. Visit our website terms of use and permissions pages at www.npr.org for further information.
NPR transcripts are created on a rush deadline by Verb8tm, Inc., an NPR contractor, and produced using a proprietary transcription process developed with NPR. This text may not be in its final form and may be updated or revised in the future. Accuracy and availability may vary. The authoritative record of NPR's programming is the audio record.