Skating on Stilts

Huawei's pride goeth before the fall

Here's the head of Huawei's enterprise business last year, telling the Financial Times that the whole security thing is overblown:

Mr Xu said Huawei represented no threat to national security anywhere.

“There has never been a single network security breach case that has ever happened with Huawei.”

Whoops.  Here's a recent ComputerWorld report on the penetration testing of Huawei's routers:

Security researchers disclosed critical vulnerabilities in routers from Chinese networking and telecommunications equipment manufacturer Huawei at the Defcon hackers conference on Sunday.

The vulnerabilities -- a session hijack, a heap overflow and a stack overflow -- were found in the firmware of Huawei AR18 and AR29 series routers and could be exploited to take control of the devices over the Internet, said Felix Lindner, the head of security firm Recurity Labs and one of the two researchers who found the flaws.

The researcher, who also analyzed the security of Cisco networking equipment in the past, described the security of the Huawei devices he analyzed as "the worst ever" and said that they're bound to contain more vulnerabilities.

"This stuff is distrusting," said security researcher Dan Kaminsky, who is best known for discovering a major vulnerability in the world's DNS (Domain Name System) infrastructure in 2008 and who worked for Cisco in the past. "If I were to teach someone from scratch how to write binary exploits, these routers would be what I'd demonstrate on."

"What FX [Lindner's moniker in security circles] has shown is that the 15 years of secure coding practices that we've learned about -- the things to do or not do -- have not been absorbed by the engineers at Huawei," Kaminsky said.

The Recurity Labs researchers specified during the talk that they didn't test any "big boxes" like the Huawei NE series routers -- which are intended for telecom data communication networks -- because they couldn't obtain them.

Lindner and Kopf also criticized Huawei for its lack of transparency when it comes to security issues. The company doesn't have a security contact for reporting vulnerabilities, doesn't put out security advisories and doesn't say what bugs have been fixed in its firmware updates, the researchers said.

Maybe Huawei, which is also suffering from an intelligence committee investigation it requested publicly, should follow former Defense Secretary Gates's advice about talking to the press.  After the White House gave out a lot of questionable information in early press briefings about the bin Laden raid, Gates is reported in David Sanger's new book to have suggested "a new press strategy" to the national security staff: "Shut the F*** Up."

UPDATE: Huawei has now responded to the DefCon report:

"We are aware of the media reports on security vulnerabilities in some small Huawei routers, and are verifying these claims. Huawei adopts rigorous security strategies and policies to protect the network security of our customers, and abides by industry standards and best practices in security risk and incident management. Huawei has established a robust response system to address product security gaps and vulnerabilities, working with our customers to immediately develop contingency plans for all identified security risks, and to resolve any incidents in the shortest possible time. In the interests of customer security, Huawei also calls on the industry to promptly report all product security risks to the solutions provider so that the vendor’s CERT team can work with the relevant parties to develop a solution and roll-out schedule," the company said in a statement.

 

The Hacker Protection Act of 2012

The latest draft cybersecurity bill contains information sharing provisions that were heavily negotiated between the Obama administration and privacy groups. This effort at compromise has yielded the usual ambiguous praise from privacy groups. The Electronic Frontier Foundation pronounced itself "pleased" but then complained that the measure still "contains broad language around the ability for companies to use security as a reason to partake in 'nearly unlimited' data monitoring of users."

In fact, the privacy groups have added so much baggage to the information sharing provisions that the new law is nearly useless to private sector companies who want to improve cybersecurity.  And it may actually impose an entire new regulatory and liability yoke on companies that treat cybersecurity seriously.

It’s worth remembering why the information sharing provisions are necessary. The reason is that, with the support of privacy groups in years past, Congress prohibited many companies from sharing customer information with the government in the absence of a subpoena. Congress also authorized states to adopt “two-party consent” restrictions on interception of communications. In an age of widespread network intrusions, both of these laws have the effect of protecting hackers and spies.

How so? Controlling spearphishing requires that incoming packets be monitored for malware; and that in turn means intercepting the communications. Since it’s unlikely the attacker who is sending malware will consent to such monitoring, this monitoring creates legal risks in two-party consent states. Similarly, unless private companies can tell the government in real time which of their customers are sending malware, the government cannot protect itself. All of the bills pending in Congress override these poorly conceived and overbroad privacy provisions.

Privacy groups don’t like to be reminded that privacy laws they supported are now protecting bad guys, so it’s no surprise that they aren’t comfortable with the new bills. I suspect they'd rather have no bill at all than admit that the old privacy laws contributed to the fix we're in. 

If that was their goal, they've just about managed to achieve it. They've made information sharing so complex that it's nearly impossible to do. Indeed, there’s a real risk that the new provisions will end up creating new limitations on information sharing, new liabilities for security officers, and new legal protections for the people breaking into our networks.

To see how, let’s take a simple example. A company, US Petroleum, asks its ISP to monitor incoming messages for malware. A week later, the ISP tells US Petroleum that it has detected malware that it attributes to the Peoples Liberation Army. In fact, because it exchanges information with other companies and the government, it can name the unit and perhaps even the individuals who launched the attack; it further assesses based on those sources that the intrusion was aimed at helping Chinese state oil companies outbid US Petroleum on crucial offshore tracts.

US Petroleum decides not to take this lying down. It prepares a press release denouncing the PLA’s intrusions and asks its lawyers whether it can sue its bid-stealing Chinese competitor. Then its lawyers reread the information sharing provisions of the 2012 cybersecurity bill. Sections 701 and 702 both say that private companies who obtain threat indicators of this sort under the law must “make reasonable efforts to safeguard … information that can be used to identify specific persons from unauthorized access or acquisition.” And section 702 further says that a private entity may not disclose threat indicators to a private entity that is “reasonably likely to violate” the elaborate restrictions imposed on the use of threat indicators.

On its face, then, the new law prohibits US Petroleum from using the information it obtained from its ISP to name and shame the attacker. After all, publicly releasing the attacker's name is not a "reasonable effort to safeguard" the attacker’s identity, and public disclosure of the data by definition supplies the information to parties who will not abide by the law's restrictions on handling such information.

In short, the new provisions demanded by the privacy groups could just as easily be called the “Hacker Protection Act of 2012.”

The price of eliminating two unfortunate laws that protect hackers is a new and far more elaborate regulatory scheme for how private entities handle information about attacks on their system -- a scheme that also protects hackers.

To add to the irony, the new law creates special first amendment protections for critical infrastructure companies at the same time that it imposes sweeping, direct and burdensome restrictions on the first amendment rights of US Petroleum.

The one saving grace is that the new legislation only regulates information obtained “under” the legislation. Under section 707(a), information obtained lawfully in some other way is not supposed to be regulated. But this is a dubious protection for US Petroleum, which cannot be sure it didn't obtain the information that way. After all, it’s quite possible that some of the ISP’s monitoring occurred in a two-party consent state; if so, that information was likely obtained “under” section 702. Or the ISP may have picked up clues about the attacker's identity “under” section 701(b) by participating in an exchange of information with the government. Uncertainty about the source of such information means that the protection the new law gives to attackers may actually be wider than existing law.

That’s true not just because the definition of protected “threat indicator” is quite broad but also because the new law is so affirmative and sweeping in laying down rules for handling such information. While the legislation doesn’t in so many words give the PLA a cause of action against US Petroleum for its planned press release, anyone reading the law could reasonably fear that a court would say, “Congress clearly prohibited certain actions, and we cannot presume that it meant its rules to be ignored without penalty. Therefore, we will allow lawsuits to enforce the rules that Congress set.”

To counter this inclination, US Petroleum cannot point to a single law expressly allowing it to gather information on its network, or to authorize monitoring by its ISP (in fact, in a two party consent state, that authorization itself may create liability), or to speak openly about the attack. All the company can say in its defense is that no law prohibited it from speaking out before the new bill passed. A prudent lawyer might conclude that, in lawsuits as in life, nothing rarely beats something.

The new privacy provisions, in short, make the task of sharing information to defeat hackers harder than it is today. In place of two bad privacy laws – one of which only restricts the flow of data to the government – the new bill creates an entire regime of restrictions on private handling of private data, a regime whose scope is indeterminable but whose deterrent effect on information sharing will be great.

The privacy groups that demanded this as the price for correcting their old errors have outdone themselves.

New Book on National Security Law

The ABA's Standing Committee on Law and National Security has just released a sequel to its first book on national security legal topics. The first book, Patriot Debates, focused heavily on the USA Patriot Act.

The second book, Patriots Debate, is a wider-ranging look at law and national security. Both volumes are distinguished by several rounds of remarkably civil -- and pointed -- disagreements on topics that include executive power, National Security Letters, targeted killing, and a range of cybersecurity topics.

Copyright v. Conservatives

Conservatives have grown more skeptical of copyright maximalism since SOPA forced newly elected Republicans to choose sides in the copyright wars. And copyright owners aren’t doing much to win them back, judging by Bertelsmann’s latest ham-fisted foray into US politics.  The large German publisher, which owns BMG Rights Management, recently forced YouTube to take down Mitt Romney’s new campaign video because it included footage of President Obama singing Al Green’s “Let’s Stay Together.” The takedown is still in effect, even though the clip was almost certainly fair use; the President sang the song at a public event that was widely covered in the press and even on YouTube itself. 

Embarrassingly for Bertelsmann, the company had never issued a takedown notice for the YouTube clips of the President singing the song, even though many of them were posted six months ago. When that imbalance was pointed out, Bertelsmann quickly issued takedown notices for the President’s performance as well.

Ironically, though, it still has not issued takedown notices for all the YouTube clips of Al Green himself performing  the same song.

Does China have “pervasive access” to 80% of global communications through Huawei and ZTE?

Maybe so, but the stories and podcasts repeating this claim by former Pentagon analyst F. Michael Maloof don’t provide much new supporting evidence. Maloof’s own report is interesting and extensive, and it does indeed make the claim I've headlined:

The Chinese government has “pervasive access” to some 80 percent of the world’s communications, giving it the ability to undertake remote industrial espionage and even sabotage electronically of critical infrastructures in the United States and in other industrialized countries.

The Chinese government and its People’s Liberation Army are acquiring the access through two Chinese companies, Huawei Technologies Co. Ltd and ZTE Corporation, telecommunications experts have told WND.

With this access, the sources say, the Chinese are working on the other 20 percent. The two companies give the Chinese remote electronic “backdoor” access through the equipment they have installed in telecommunications networks in 140 countries. The Chinese companies service 45 of the world’s 50 largest telecom operators.

Read closely, though, the report is long on Pentagon suspicions and short on new facts. It probably is an accurate reflection of Defense Department assumptions – that any network relying on Huawei and ZTE is likely to be compromised. But there's a difference between assuming and knowing.

Sometimes common-sense assumptions turn out to be wrong.  After all, Saddam Hussein acted like a man hiding a WMD program, and that common-sense assumption was widespread in the run-up to war with Iraq. Maloof at the time was part of a Defense Department unit set up by Doug Feith to provide a conservative analytical counterweight to the intelligence community’s assessments on Iraq, WMD, and terrorism. A former aide to Richard Perle, Maloof remains close to conservative defense hard-liners – and is not surprisingly loathed by liberal Defense-watchers. 

That background doesn’t mean Maloof is wrong; in fact, it means that he probably has some pretty good Pentagon sources. But it isn’t a background that would lead outsiders to share his suspicions without more evidence.

If you read the article through that lens, it offers a lot of reasons for suspicion, but most of the facts that Maloof reports could also be viewed benignly by someone with fewer suspicions. 

I was, however, struck by a different claim that Maloof buries pretty deep:

The sources tell WND that not only was Huawei allegedly caught trying to bribe an apparent federal official, but the FBI has launched an investigation into the allegation.

Bribery of government officials, whether by U.S. companies to a foreign government official or foreigners toward U.S. government officials, is regarded as a serious violation of the Foreign Corrupt Practices Act, or FCPA.

That’s interesting because it’s the kind of fact that would be known to Pentagon sources, and one that I haven’t seen reported elsewhere. If it’s accurate, then Huawei’s insistence that it be investigated by the US government is coming true, though not in a good way.  Huawei may have joined its smaller Chinese telecom sibling, ZTE, in facing criminal investigation by the FBI. And that story may turn out to be far more significant than yet another “Defense doesn’t trust Huawei” report.

And you think you’re having a bad day?

A kind of perfect storm has struck ZTE, the huge Chinese telecom equipment manufacturer.  A storm largely of ZTE’s own making.

For starters, ZTE and its larger Chinese rival, Huawei, have been the subjects of great national security concern for years.  The US intelligence community fears that, if allowed to install equipment here, the two companies will surreptitiously permit Chinese government wiretaps inside the United States .  But proof of this suspicion has been hard to find.  And the firms, backed by Chinese government-subsidized loans, have been able to offer enormous discounts to carriers, devastating the global telecom equipment market and leaving carriers eager to buy their products.  Whether the US government would continue to act on its suspicions in the face of commercial pressure was an open question.

While that drama was brewing, another morality tale was shaping up among the NGOs and journalists covering unrest in the Muslim world.  Story after story points a damning finger at Western technology companies accused of enabling wiretaps and surveillance gear to authoritarian Muslim regimes.  Some of the sales are alleged to have violated US export controls.

Not surprisingly, the two stories eventually intersected.  In March, Reuters reported that ZTE was supplying the Iranian mullahs with telecoms gear that could spy on Iran’s restive population. ZTE, the news agency reported, “has sold Iran's largest telecom firm a powerful surveillance system capable of monitoring landline, mobile and internet communications, interviews and contract documents show.”

That was bad.  But it got worse. Reuters further revealed that the ZTE system sold to Iran included equipment from US companies, like HP, Dell, Cisco and Juniper. Such sales violate US export control law. So ZTE soon faced an investigation by the US Commerce Department.

And, to judge from a recent report in The Smoking Gun, that’s when ZTE took a bad situation and turned it into a perfect storm: “Concerned that they could no longer “hide anything” in the wake of the Reuters report, ZTE lawyers discussed shredding documents, altering records, and lying to U.S. government officials, according to an insider’s account provided to FBI agents by a Texas lawyer who last year began serving as general counsel of ZTE’s wholly owned U.S. subsidiary.”

That brought the FBI in.  Indeed, most of the recent allegations about ZTE are drawn from an FBI affidavit in support of a search warrant, which is full of colorful details like ZTE meetings with US lawyers in which damning documents were displayed on screens but never provided to the lawyers. In fact, the search affidavit strongly suggests that ZTE’s general counsel was cut out of internal communications after he refused to go along with a coverup. 

In the end, rather than actively lying to the US government, the company simply refused to comply with the Commerce Department subpoena.  In so doing, the company got the backing of its principal owner, the Chinese government, which claimed that compliance with the subpoena would violate Chinese law.

Ironically, this debacle climaxed just as ZTE was trying to deal with a House Intelligence Committee investigation that Huawei had practically demanded last year, thinking that it could put the intelligence community’s suspicions to rest at last. The committee was moving to the last stages of that investigation.  It had already served ZTE with detailed questions and conducted interviews of its executives in China as the export control mess began to spread. 

Now, though, the mess is everywhere, and the House intelligence investigation will surely be heavily influenced by the new evidence that ZTE at least is quite capable of carrying out sophisticated telecommunications surveillance, of violating US law, and perhaps even lying about it later. 

Which, come to think of it, is pretty much what US intelligence agencies have been saying all along.

LA Times to BioWatch: Bend over and drop your shorts

The Los Angeles Times has an endless article trying to make a scandal out of a simple technical constraint: the tools we use to test for biological agents aren’t perfect.  Sometimes the machines go off because of a natural event rather than a terrorist attack (“Test says tularemia; somebody put another rabbit through a woodchipper,” I was once told when I was in government). Knowing about the risk of these “false positives” means that officials must choose between the risk of overreacting or of underreacting whenever an alarm goes off. And at the same time the tests may not be sensitive enough to catch every terrorist attack.

That makes our BioWatch program remarkably similar to PSA tests for prostate cancer:  plenty of false positives and false negatives, and a lot of accurate warnings as well.  I guess it’s not surprising that some people would like to do to BioWatch what they’d like to do to PSA tests:  stop gathering the information so that they don’t have to agonize over what to do once they have it. Except that with PSA testing, most of the agonizing is done by a very large group of men, and followup tests and treatments can have a big cost if nothing is really wrong.  In the case of BioWatch, though, the cost of the agonizing mainly falls on government officials, who naturally resent being forced to make high-profile decisions that could turn out to be wrong.  For the rest of us, though, the backstage agonizing and multiple tests are pretty low-cost, and they could have a big payoff if they give government several days’ headstart in reacting to a bioterror attack when it comes.

I’d love to have a better solution (in fact, the Gen3 approach that LAT criticizes is at least somewhat better), but why in the world would we kill the program entirely, at the LAT seems to be suggesting?  Sure, we’d spare all those poor officials some agonizing over test results; they would be as bone ignorant as the rest of us if and when an attack came.  A lot of people might be dead, but they’d be safe from blame. 

I can see why that might appeal to the Centers for Disease Control, but what's in it for the rest of us?

PHOTO via iStockPhoto

First Circuit Finds Someone to Sue over Cybersecurity

The sound you hear is legal ground shifting under the banks' feet.

Keylogging software now infects many small businesses.  Hackers use it to steal banking credentials and make wire transfers.  Keeping the hackers out is very difficult, at least for small businesses. The most promising way to defeat such fraud is for banks to deplay back-end systems that evaluate each transaction to identify unusual transfers.

We're all familiar with that solution.  Back-end systems prompt your bank to call you whenever your credit card has an unusual charge. Banks do that because they're liable for consumer credit card charges. For small businesses, though, the shoe is on the other foot.  

Under the UCC, a bank can impose liability for cybersecurity failures on its commercial customers as long as the bank uses a "commercially reasonable" method to authenticate its customers. So banks have less incentive to monitor small-business transfers aggressively. All they need to do is follow a standard contractual security protocol -- unless the courts decide that the protocol is no longer commercially reasonable.

That's exactly what's starting to happen, as the trickle of keylogger fraud turns into a flood.  The most recent decision, the Patco case from the First Circuit, overturns a recent lower court ruling against bank liability. After this decision, banks cannot feel comfortable relying on their contracts to protect them.  Instead, facing a newly fluid and unpredictable liability environment, banks (and courts) will be struggling to find a reasonable way to use back-end systems to monitor wire-transfer hacking fraud.

On the whole, that's a good thing.  Small businesses can't keep hackers out reliably, so they need help from the banks, which have greater visibility into fraud patterns.

But I can't help pointing out that the decision, which at first glance seems to be Sticking it to the Man, is in fact going to result in much more intrusive monitoring of money transfers by banks. In short, it means less privacy.

Maybe you're thinking that banking privacy has been dead for years, so this is no big deal.  But the lesson can be generalized.  Banking is not the only online activity where good security requires centralized authorities to engage in more aggressive and detailed behavioral monitoring of network transactions. Corporate security has also shifted to internal monitoring in the hope that spotting anomalous behavior will identify compromised machines. It's the only technique that seems to offer much hope.

But what happens when those compromised computers go out on the Internet?  Who's watching for signs of compromise there? Right now, nobody.  That makes privacy advocates very happy. But it seems to me that there's a growing gulf between what makes the privacy advocates happy and what makes users of the net safe. 

UPDATE: Typo fixed

China-US "Proxy" Talks On Cyberwar

For the past three years, a couple of think tanks, one in China and one in the US, have been conducting what could be called "proxy" negotiations on cyberwar and cyberespionage.  The China Institute of Contemporary International Relations  and the US Center for Strategic and International Studies are both establishment institutions, with just enough independence from their governments to make the talks deniable. But both governments have been sending "observers," so the interest on both sides is obvious.

What's the result? It's been hard to say from the outside, but the two sides recently agreed to release a public description of the issues raised in the talks and of the US and Chinese positions on those issues.  The document is here (scroll for the English version).  It's surprisingly candid, by the low standards usually set for such releases, noting for example that both the US and China are concerned about their IT supply chain because "both believe that the other will seek to exploit the supply chain to introduce vulnerabilities in to networks and infrastructures." True, that.

Overall, you get a sense that there may be some movement toward confidence-building measures to head off full-fledged cyberwar, reflecting what a nightmare that could be for both countries.  Cyberespionage?  Not so much, which may suggest that the advantages in cyberespionage are seen as asymmetric.

DHS Takes a Regulatory Turn

The Department of Homeland Security is a settled part of the federal landscape now, and Osama bin Laden is dead. So DHS is finding budget increases harder to come by. And as funds grow tighter, it's inevitable that the Department will begin to look for less expensive ways to achieve its security goals. 

Up to now, DHS has been a remarkably operational federal department.  Like the other two behemoth departments, DOD and Veteran Affairs, DHS mostly delivers its services directly, unlike departments like Labor, or Justice, who mostly write regulations and briefs telling other people how to deliver services. But direct delivery is expensive; more services means hiring more people. If you want tougher border enforcement, you pretty much have to hire more Border Patrol agents or buy more stuff.  

As money grows tighter, though, I've been expecting DHS to pivot to a more regulatory approach, pressing the private sector to do more about security. Now that seems to be happening. My partner Stephen Heifetz, who blogs at Security Debrief, sees signs of new regulatory vigor at two of DHS's main components, the first at the Transportation Security Administration, and more recently at Customs and Border Protection. 

I think we're in for a decade or more of tight federal budgets, so industry can expect a more regulatory approach from DHS for years to come. That's not always a bad thing,; sometimes industry can accomplish the goal less expensively than federal employees. But based on my experience DHS is going to find it challenging to develop the traditions needed to run good regulatory programs.

Did the Supreme Court's Healthcare Deliberations Leak?

Recent news reports purport to tell the story of the Chief Justice switching his vote while drafting what began as an opinion striking down Obamacare.  CBS News says it has inside details from two sources:

There were countless news articles in May warning of damage to the Court - and to Roberts' reputation - if the Court were to strike down the mandate. Leading politicians, including the President himself, had expressed confidence the mandate would be upheld.

Some even suggested that if Roberts struck down the mandate, it would prove he had been deceitful during his confirmation hearings, when he explained a philosophy of judicial restraint.

It was around this time that it also became clear to the conservative justices that Roberts was, as one put it, "wobbly," the sources said.

I have no such sources, but the internal clues in the opinions certainly seem consistent with such a switch.  If it's true, I wonder whether word of the Chief Justice's wobbliness leaked. 

I remember defenders of the law conducting what seemed like a weirdly belated public lobbying campaign on the Chief Justice.  For example, here's CNN reporting on a Senator Leahy speech on May 14:

In a floor speech Monday, Sen. Patrick Leahy, D-Vermont and chairman of the Senate Judiciary Committee, directly addressed Chief Justice John Roberts, urging him in a sharply partisan tone to keep the law, passed in 2010, in place.

"I trust that he will be a chief justice for all of us and that he has a strong institutional sense of the proper role of the judicial branch," said Leahy. "The conservative activism of recent years has not been good for the court. Given the ideological challenge to the Affordable Care Act and the extensive, supportive precedent, it would be extraordinary for the Supreme Court not to defer to Congress in this matter that so clearly affects interstate commerce."

It is unusual for a member of Congress to tell the high court how it should vote on a case during the weeks that the justices are crafting their opinion. Oral arguments were held in late March, and the court has been quietly working behind the scenes. An opinion is expected by late June. The Vermont Democrat attended the three-day oral arguments at the Supreme Court.

CNN was underplaying how unusual it is for a member of Congress to make such statements. That's because such statements are usually stupid, and particularly so when delivered weeks after the argument, with the Justices' votes already cast.

 Why, I wondered at the time, would the chair of the Judiciary Committee risk the appearance of trying to harshly strongarm the Court when his remarks wouldn't make the slightest difference?

Equally weird was the senator's focus on the Chief Justice at a time when most Court-watchers still expected Justice Kennedy to play his traditional swing-vote role. But Senatory Leahy's remarks don't even mention Justice Kennedy.  Instead, he zeroes in on the Chief, offering only the thinnest of justifications; here's how his remarks begin:

I was fortunate to be able to attend the argument before the United States Supreme Court on the constitutionality of the provision in the Affordable Care Act providing that individuals should take personal responsibility for paying for their health care by obtaining health insurance, or pay a fine.  There was a good deal of instant analysis from commentators after the argument, including their predictions for how the Court will rule.  I have not seen much devoted to the Chief Justice’s role. 

That's it.  The Chairman of the Judiciary Committee has not seen much commentary devoted to the Chief Justice's role in the health care case, so he decides to give a speech that reads like like it was written for an audience of one.  It offers flattery and it offers threats, all of them personalized to appeal to Chief Justice Roberts alone.

Again, I wondered, why would defenders of the law be personalizing their focus so aggressively and harshly on a man more likely to be the sixth than the fifth vote for their side?

Now, though, CBS News tells us that the Chief Justice was the defenders' only hope for a fifth vote -- and one that started looking "gettable" right around the time of Senator Leahy's remarks.  Suddenly, the Senator's remarks look a lot less foolhardy.  In fact, they look like a miraculously prescient and well-timed gamble. 

So well-timed and prescient a gamble that I can't help wondering whether it was a gamble at all.

I'd like to be wrong. A leak about Court deliberations, especially a leak that went only to one side in a pending case, would truly be a scandal.

And there are certainly other explanations. After all, every Supreme Court watcher, in the Administration and out, was probably collecting stories about the Justices' body language when healthcare came up at cocktail parties and dinners with friends. Not to mention the clerks -- twenty-somethings with a taste of importance they won't have again for decades, if at all. It might not take more than an indiscretion or two to get the Court-watchers' network humming. Maybe someone clever simply added four and one and got five. That's still a scandal, but less damaging.

Or maybe Senator Leahy is miraculously prescient.

Still, I'd love to know who persuaded Senator Leahy to give that speech.