Search the Community

We live in the social mobile era, where we all collect and share vast amounts of data about ourselves and others. By handing over that data to corporations and governments we are promised great benefits in everything from our health and our wealth to our safety from criminals. But of course there are dangers too and I've been hearing some horror stories about when Big Data becomes Big Brother. The first was from one of the technology industry's more colourful figures. John McAfee, who is in London this week for the Infosecurity Europe conference, is the man who virtually invented the anti-virus industry. He sold his stake in McAfee more than 20 years ago and has since had numerous adventures, culminating in his flight from Belize in 2012 after police in the Central American state tried to question him about a murder. He was described by Belize's prime minister at the time as "extremely paranoid, even bonkers". So, perhaps not surprising, that the Infosecurity crowd who gathered to hear him speak were treated to dire warnings about the threat to their security from two sources - their mobile phones and their governments. But of course just because you are paranoid it does not mean they are not out to get you, and when I meet John McAfee after his speech he gives a perfectly coherent account of why we should be worried. We are now all carrying around smartphones, he explains, but security has not caught up with the fact that they are very advanced computers which can be used to spy on us if we install any number of untested apps that may have been created by people with criminal intent. But it's government spying on those phones that really worries him. He cheers the brake which the Senate applied to the US government's surveillance powers at the weekend, but fears that in Britain no such limits are in place. In particular, he rails against any attempt to try to crack the encryption that protects many personal messages. When I suggest that there might be a need to know what criminals and terrorists are planning, he bats that away: "We have lived with criminals for ever - does that mean we should all have to suffer?" He compares encryption with whispering a message in your wife's ear and asks whether we would have thought it justified years ago to ban whispering. "If it sounds insane for govenment to say you are not allowed to whisper to your wife - it is insane." And he says the big technology companies should have the courage to stand up to governments on this issue: "If enough people stand up the government will back down." When I suggest delicately that his colourful past might make people disinclined to take him seriously, he bats that straight back at me. "My colourful life implies that I've done some serious things," he says, explaining that his experiences in Belize have shown him just how dangerous a rogue government can be. You can hear my interview with John McAfee on Tech Tent, which this week comes live from the Cheltenham Science Festival. Here too, the question of what we are doing with our data has been a major theme. Last night I was the moderator at an event called Big Data, Big Brother, where the panel expressed their worries about the uses to which our data could be put, in front of an audience which shared their fears. The lawyer Marion Oswald mentioned the Samaritans' Radar Twitter app as an example of where public data posted by people who might or might not have been suicidal could have been used in a questionable way without their consent. A software engineer Martyn Thomas advised us to be wary of claims that data was anonymised, explaining how easy it was to identify someone once you had pieced together just a few data points. Here in the home of GCHQ, the audience seemed more concerned about corporate surveillance than government spies, and many were enthusiastic about ad-blocking software and other means of throwing the likes of Google off your trail. But afterwards in the more relaxed setting of the Festival's Ideas Cafe, data scientists from Warwick University reminded us of the positive aspects of their work. I sat at a table where a computer scientist explained how he was mapping London to spot which areas should be targeted for diabetes prevention measures. He was using data from a variety of sources, including a credit rating agency, to examine lifestyles and hence vulnerability to Type 2 diabetes. While some will be concerned about how medical and financial data are combined in this way, many will see the benefits of applying data science to this kind of task. As the Big Data gold rush continues, lawyers, ethicists and consumer groups are all going to have their work cut out to help us get a good balance between the risks and rewards of crunching the numbers. Source

Without public notice or debate, the Obama administration has expanded the National Security Agency's warrantless surveillance of Americans' international Internet traffic to search for evidence of malicious computer hacking, according to classified NSA documents. In mid-2012, Justice Department lawyers wrote two secret memos permitting the spy agency to begin hunting on Internet cables, without a warrant and on American soil, for data linked to computer intrusions originating abroad—including traffic that flows to suspicious Internet addresses or contains malware, the documents show. The Justice Department allowed the agency to monitor only addresses and "cybersignatures"—patterns associated with computer intrusions—that it could tie to foreign governments. But the documents also note that the NSA sought to target hackers even when it could not establish any links to foreign powers. The disclosures, based on documents provided by Edward J. Snowden, the former NSA contractor, and shared with the New York Times and ProPublica, come at a time of unprecedented cyberattacks on American financial institutions, businesses, and government agencies, but also of greater scrutiny of secret legal justifications for broader government surveillance. While the Senate passed legislation this week limiting some of the NSA's authority, it involved provisions in the USA Patriot Act and did not apply to the warrantless wiretapping program. Government officials defended the NSA's monitoring of suspected hackers as necessary to shield Americans from the increasingly aggressive activities of foreign governments. But critics say it raises difficult trade-offs that should be subject to public debate. The NSA's activities run "smack into law enforcement land," said Jonathan Mayer, a cybersecurity scholar at Stanford Law School who has researched privacy issues and who reviewed several of the documents. "That's a major policy decision about how to structure cybersecurity in the US and not a conversation that has been had in public." It is not clear what standards the agency is using to select targets. It can be hard to know for sure who is behind a particular intrusion—a foreign government or a criminal gang—and the NSA is supposed to focus on foreign intelligence, not law enforcement. The government can also gather significant volumes of Americans' information—anything from private e-mails to trade secrets and business dealings—through Internet surveillance because monitoring the data flowing to a hacker involves copying that information as the hacker steals it. One internal NSA document notes that agency surveillance activities through "hacker signatures pull in a lot." Brian Hale, the spokesman for the Office of the Director of National Intelligence, said, "It should come as no surprise that the US government gathers intelligence on foreign powers that attempt to penetrate US networks and steal the private information of US citizens and companies." He added that "targeting overseas individuals engaging in hostile cyberactivities on behalf of a foreign power is a lawful foreign intelligence purpose." The effort is the latest known expansion of the NSA's warrantless surveillance program, which allows the government to intercept Americans' cross-border communications if the target is a foreigner abroad. While the NSA has long searched for specific e-mail addresses and phone numbers of foreign intelligence targets, the Obama administration three years ago started allowing the agency to search its communications streams for less-identifying Internet protocol addresses or strings of harmful computer code. The surveillance activity traces to changes that began after the Sept. 11 terrorist attacks. The government tore down a so-called wall that prevented intelligence and criminal investigators from sharing information about suspected spies and terrorists. The barrier had been erected to protect Americans' rights because intelligence investigations use lower legal standards than criminal inquiries, but policy makers decided it was too much of an obstacle to terrorism investigations. The NSA also started the warrantless wiretapping program, which caused an outcry when it was disclosed in 2005. In 2008, under the FISA Amendments Act, Congress legalized the surveillance program so long as the agency targeted only noncitizens abroad. A year later, the new Obama administration began crafting a new cybersecurity policy—including weighing whether the Internet had made the distinction between a spy and a criminal obsolete. "Reliance on legal authorities that make theoretical distinctions between armed attacks, terrorism and criminal activity may prove impractical," the White House National Security Council wrote in a classified annex to a policy report in May 2009, which was included in the NSA's internal files. About that time, the documents show, the NSA—whose mission includes protecting military and intelligence networks against intruders—proposed using the warrantless surveillance program for cybersecurity purposes. The agency received "guidance on targeting using the signatures" from the Foreign Intelligence Surveillance Court, according to an internal newsletter. In May and July 2012, according to an internal timeline, the Justice Department granted its secret approval for the searches of cybersignatures and Internet addresses. The Justice Department tied that authority to a pre-existing approval by the secret surveillance court permitting the government to use the program to monitor foreign governments. That limit meant the NSA had to have some evidence for believing that the hackers were working for a specific foreign power. That rule, the NSA soon complained, left a "huge collection gap against cyberthreats to the nation" because it is often hard to know exactly who is behind an intrusion, according to an agency newsletter. Different computer intruders can use the same piece of malware, take steps to hide their location, or pretend to be someone else. So the NSA, in 2012, began pressing to go back to the surveillance court and seek permission to use the program explicitly for cybersecurity purposes. That way, it could monitor international communications for any "malicious cyberactivity," even if it did not yet know who was behind the attack. The newsletter described the further expansion as one of "highest priorities" of the NSA director, Gen. Keith B. Alexander. However, a former senior intelligence official said that the government never asked the court to grant that authority. Meanwhile, the FBI in 2011 had obtained a new kind of wiretap order from the secret surveillance court for cybersecurity investigations, permitting it to target Internet data flowing to or from specific Internet addresses linked to certain governments. To carry out the orders, the FBI negotiated in 2012 to use the NSA's system for monitoring Internet traffic crossing "chokepoints operated by US providers through which international communications enter and leave the United States," according to a 2012 NSA document. The NSA would send the intercepted traffic to the bureau's "cyberdata repository" in Quantico, Virginia. The disclosure that the NSA and the FBI have expanded their cybersurveillance adds a dimension to a recurring debate over the post-Sept. 11 expansion of government spying powers: Information about Americans sometimes gets swept up incidentally when foreigners are targeted, and prosecutors can use that information in criminal cases. Citing the potential for a copy of data "exfiltrated" by a hacker to contain "so much" information about Americans, one NSA lawyer suggested keeping the stolen data out of the agency's regular repository for information collected by surveillance so that analysts working on unrelated issues could not query it, a 2010 training document showed. But it is not clear whether the agency or the FBI has imposed any additional limits on the data of hacking victims. In a response to questions for this article, the FBI pointed to its existing procedures for protecting victims' data acquired during investigations but also said it continually reviewed its policies "to adapt to these changing threats while protecting civil liberties and the interests of victims of cybercrimes." None of these actions or proposals had been disclosed to the public. As recently as February, when President Obama spoke about cybersecurity at an event at Stanford University, he lauded the importance of transparency but did not mention this change. "The technology so often outstrips whatever rules and structures and standards have been put in place, which means that government has to be constantly self-critical and we have to be able to have an open debate about it," Obama said. source

AROUND THE SAME time the US and Israel were already developing and unleashing Stuxnet on computers in Iran, using five zero-day exploits to get the digital weapon onto machines there, the government realized it needed a policy for how it should handle zero-day vulnerabilities, according to a new document obtained by the Electronic Frontier Foundation. The document, found among a handful of heavily redacted pages released after the civil liberties group sued the Office of the Director of National Intelligence to obtain them, sheds light on the backstory behind the development of the government’s zero-day policy and offers some insight into the motivations for establishing it. What the documents don’t do, however, is provide support for the government’s assertions that it discloses the “vast majority” of zero-day vulnerabilities it discovers instead of keeping them secret and exploiting them. “The level of transparency we have now is not enough,” says Andrew Crocker a legal fellow at EFF. “It doesn’t answer a lot of questions about how often the intelligence community is disclosing, whether they’re really following this process, and who is involved in making these decisions in the executive branch. More transparency is needed.” The timeframe around the development of the policy does make clear, however, that the government was deploying zero-days to attack systems long before it had established a formal policy for their use. Task Force Launched in 2008 Titled “Vulnerability Equities Process Highlights,” (.pdf) the document appears to have been created July 8, 2010, based on a date in its file name. Vulnerability equities process in the title refers to the process whereby the government assesses zero-day software security holes that it either finds or buys from contractors in order to determine whether they should be disclosed to the software vendor to be patched or kept secret so intelligence agencies can use them to hack into systems as they please. The government’s use of zero-day vulnerabilities is controversial, not least because when it withholds information about software vulnerabilities to exploit them in targeted systems, it leaves every other system that use the same software also vulnerable to being hacked, including U.S. government computers and critical infrastructure systems. According to the document, the equities process grew out of a task force the government formed in 2008 to develop a plan for improving its ability “to use the full spectrum of offensive capabilities to better defend U.S. information systems.” Source

Yahoo received nearly 5,000 requests for user data from the United States government in the last six months of 2014 and disclosed some content in nearly 25 percent of those cases. The company said in its new transparency report that it received between 0-999 National Security Letters from the U.S. government, too. The latest report from Yahoo on government requests covers the period of July through December of 2014 and the company reported 4,865 total requests from the U.S. during that period. Those requests covered a total of 9,752 user accounts and the company disclosed some content in 1,157 of those cases. Yahoo rejected 258 of the U.S. government’s requests and disclosed solely non-content data in 2,887 cases. Yahoo defines non-content data as “the information captured at the time of registration such as an alternate e-mail address, name, location, and IP address, login details, billing information, and other transactional information”. The U.S. was by far the most active government in this report, with Taiwan coming in a distant second with 2,081 total requests. Germany sent 1,910 requests to Yahoo and the United Kingdom sent 1,570. In the previous six months, the U.S. sent 6,791 total requests to Yahoo and the company reported the same range of NSLs, 0-999. The government only allows companies to report the number of NSLs they receive in bands of 1,000. Yahoo and other technology companies have been pressuring the government for the ability to report those letters in more specific detail. In addition to the transparency data, Yahoo also provided an update on its efforts to protect users from attacks by governments and other attackers. “We’ve encrypted many of our most important products and services to protect against snooping by governments or other actors. This includes encryption of the traffic moving between Yahoo data centers; making browsing over HTTPS the default on Yahoo Mail and Yahoo Homepage; and implementing the latest in security best-practices, including supporting TLS 1.2, Perfect Forward Secrecy and a 2048-bit RSA key for many of our global properties such as Homepage, Mail and Digital Magazines. We’ve also rolled out an end-to-end (e2e) encryption extension for Yahoo Mail, now available on GitHub. Our goal is to provide an intuitive e2e encryption solution for all of our users by the end of 2015,” the company said in the report. Yahoo released the end-to-end encryption extension last week, something that was the result of an effort that Alex Stamos, the company’s CISO, announced at Black Hat last year. “Just a few years ago, e2e encryption was not widely discussed, nor widely understood. Today, our users are much more conscious of the need to stay secure online,” Stamos wrote on Yahoo’s Tumblr. He said that Yahoo’s extension will satisfy users’ needs to share sensitive information securely. “Wherever you land on the spectrum, we’ve heard you loud and clear: We’re building the best products to ensure a more secure user experience and overall digital ecosystem.” Yahoo, like its counterparts at Google, has been investing in encrypting more and more of its services and infrastructure. Much of this has come in the wake of the Edward Snowden revelations, but some of the efforts were in motion before the leaks about NSA capabilities against the companies’ services began to surface. Source

The Judicial Conference Advisory Committee on Criminal Rules voted 11-1 to modify a federal rule – known as Rule 41 – that expands hacking authority for the FBI, the National Journal reported on Monday, citing a Department of Justice (DOJ) spokesperson. As the rule stands, judges can only approve search warrants for materials within their own judicial district – modified, courts would have the ability to grant search warrants for electronic information located outside their judicial district, the report indicates. A variety of organizations – including Google and a number of other civil rights and civil liberties groups – have spoken out against the proposal, but David Bitkower, deputy assistant attorney general of the Criminal Division in the Justice Department, defended it in a December 2014 memo. Bitkower wrote that “the proposed amendment would ensure that a court has jurisdiction to issue a search warrant in two categories of investigations involving modern Internet crime: cases involving botnets and cases involving Internet anonymizing techniques.” He went on to say, “The proposal would not authorize the government to undertake any search or seizure or use any remote search technique not already permitted under current law. As with all search warrant applications, such concerns must ultimately be resolved through judicial determination on a case-by-case basis.” Google responded in February with comments written by Richard Salgado, director of law enforcement and information security with Google. Salgado took issue that the amendment makes it so the government may use “remote access” to search and seize or copy electronic data, stating that the wording is too vague and does not specify how searches will be conducted and what may be searched. “The term “remote access” is not defined,” Salgado wrote. “Sample search warrants submitted by the DOJ to the Committee indicate that “remote access” may involve network investigative techniques, or NITs, which include, for example, the installation of software onto a target device to extract and make available to law enforcement certain information from the device, including IP address, MAC address, and other identifying information.” Salgado went on to add, “In short, “remote access” seems to authorize government hacking of any facility wherever located,” and later wrote that the amendment would authorize remote searches of millions of computers because, according to the FBI, botnets can grow to include of a large number of computers. The Electronic Frontier Foundation (EFF) shared in Google's concerns. In a comment emailed to SCMagazine.com on Tuesday, Hanni Fakhoury, EFF senior staff attorney, called the amendment a substantive legal change masquerading as a mere procedural rule change. “That is, by seeking to change the procedural rules about how the government can execute remote searches (which in essence means how they can deploy malware), the government is essentially pushing for approval of the idea that it should have the power to deploy malware and execute remote searches,” Fakhoury said. “To us, it seems like that's a decision Congress should make.” Piggybacking on that idea, Nathan Freed Wessler, staff attorney with the American Civil Liberties Union (ACLU), said in a comment emailed to SCMagazine.com on Tuesday that the amendment expands the government's ability to use malware and zero-day exploits, and without imposing necessary protections. “The current proposal fails to strike the right balance between safeguarding privacy and internet security and allowing the government to investigate crimes,” Freed said. The National Journal report indicated that a number of other steps must a occur before the changes are made official, and the process could take longer than a year. A Justice Department spokesperson did not respond to a SCMagazine.com request for additional information. Source

In the wake of news-making attacks on Sony Pictures, Home Depot and many others, the federal government is establishing a new information integration center to focus on cyber threats. The center will analyze intelligence contributed by several agencies, along with the private sector, a model that will face some serious hurdles. The proposed Cyber Threat Intelligence Integration Center will fall under the Office of the Director of National Intelligence and it will not be responsible for actually gathering any threat intelligence. Rather, it will serve as an aggregation point for information collected by intelligence agencies and, the Obama administration hopes, private companies. A major piece of the plan for the CTIIC is for it to be a point of information exchange with the private sector, said Lisa Monaco, Assistant to the President for Homeland Security and Counterterrorism, in a speech Tuesday. That’s a strategy that the United States government has been trying to implement for the better part of two decades now in various incarnations. But there are two main issues with the information-sharing model: the government tends to hoard its intelligence and the private sector tends not to want to give and get nothing in return. Monaco said that for the CTIIC to be effective, both sides need to get past those challenges and start helping one another. “We’re not going to bottle up intelligence. We want the flow of information to go both ways,” Monaco said. In her speech at the Wilson Center in Washington, Monaco said that the CTIIC will be modeled after the National Counterterrorism Center and will draw on what the government and intelligence community learned about responding to and tracking threats after 9/11. She also hinted that the administration is going to be more aggressive in the future in tracking and prosecuting cyber criminals and other attackers. “There are structural, cultural and organizational shifts made in the government in counter-terror that also apply to cyber,” she said. “Those who would do us harm should know they will be found and they will be held to account.” Monaco cited the attack on Sony Pictures late last year as a key example of the kind of attack that the new CTIIC will be able to deal with. “That was a game-changer, because it wasn’t about profit, it was about a dictator trying to impose censorship,” she said. “Which is why we took the extraordinary step of identifying the attackers publicly.” Administration officials blamed the Sony hack on North Korea and later imposed more sanctions on the country as a result. Monaco did not specify when the CTIIC would be operational or who would be part of the new group. Sursa

Twitter has seen a surge in government requests for user information, according to its latest transparency report. The social media platform has seen a 40% rise in the number of requests from governments around the world since its last report, in July 2014. Hundreds came from the government of Turkey, which has previously attempted to ban Twitter. The most requests came from the US government. All of the large internet companies, including Google, Facebook and Yahoo, now release regular transparency reports in order to keep users informed about how much data is shared with governments. It is part of the industry's response to revelations from former National Security Agency contractor Edward Snowden, which pointed to mass government surveillance programs in the US and abroad. "Providing this insight is simply the right thing to do, especially in an age of increasing concerns about government surveillance," Twitter senior manager of legal policy Jeremy Kessel said in a blogpost. Twitter received 2,871 requests from governments across the world asking it to reveal data about 7,144 of its users in the second half of 2014. Just over half (52%) of the requests had been fulfilled, it said. Most of the requests came from the US government - with 1,622 requests. 80% of which were complied with. The Turkish government made 356 requests, putting it second place behind the US. None of its data requests had been complied with, said Twitter, although it did not go into details about what they had been about. The company also saw an 84% increase in government demands to remove content from Twitter. The top three requesting countries were: Turkey (477) Russia (91) Germany (43) In Turkey, these requests tended to focus on claimed violations of personal rights either for citizens or government officials. Prime Minister Recep Tayyip Erdogan blocked Twitter in Turkey in March after an anonymous source posted allegations of government corruption. The ban was overturned in the courts and the service restored. Russia had sent 108 requests for account information since July, according to Twitter. Previously it had not sent any. It had also sent 91 requests for the removal of content, ranging from posts promoting illegal drugs to attempts to suppress non-violent demonstration. "We denied several requests to silence popular critics of the Russian government and other demands to limit speech about non-violent demonstration in Ukraine," said Mr Kessel. In August, Russia passed laws placing restrictions on users of social media. Bloggers with more than 3,000 daily readers were forced to register with the media regulator, social networks were required to retain six months' worth of data on its users and bloggers were not allowed to remain anonymous. Source

Telecoms security has been in and out of the headlines for almost two years now, ever since patriot/traitor/hero/villain (delete as your opinion dictates) Edward Snowden revealed the PRISM campaign and the rest in 2013. We've since learned that GCHQ has a pretty tight grip on the communications flowing around the UK and the rest of the world. So you'd think the folks at the top at GCHQ and the government would be adept at keeping their own comms secure. Not so, it seems. Sneak was amused to read that David Cameron received a prank phone call from someone who managed to bypass the switchboard security (the mind boggles as to how) and was given the mobile phone number of the head of GCHQ, Sir Robert Hannigan. Cameron explained that the hoax call took place while he was out for a walk, and was told, presumably by a government switchboard operator with a heavy case of 'Sunday afternoon lull', that he was being put into a conference call from Hannigan. Cameron, however, was not taken in and said he was immediately suspicious when the caller said sorry for 'waking him up' at the start of the call. Sneak knows politicians are often characterised as lazy, feckless types, but even he wouldn't have thought Cameron was in bed at 11am on a Sunday. "I thought that was strange as it was eleven o'clock in the morning," Cameron said, with James Bond-like calm. He then confirmed that he ended the call without revealing any national security information, such as Trident's tactical nuke launch codes, his inner thigh measurements or the location of the Holy Grail. Phew. Source

The number of subpoenas, total orders and warrants that the United States government delivered to Verizon all dropped in the second half of 2014, according to the company’s latest transparency report. The giant telecom provider released data on Thursday that showed a decrease in subpoenas of about 10 percent from the first half of last year to the second half. The volume of pen register and trap and trace orders fell by a little less than 10 percent, and the number of warrants served on Verizon by law enforcement also dropped from 14,977 to 13,050. Verizon officials said in the report that the company received between 0-999 National Security Letters during the second half of 2014, the same range it reported for the first half of the year. The government only allows companies to report the number of NSLs they receive in bands of 1,000. The volume of wiretap orders that Verizon receives remained virtually unchanged from 2013 to 2014, falling slightly from 1,496 in all of 2013 to 1,433. In addition to releasing the data on government orders, Verizon officials also said that the company has been working on privacy issues throughout the past year. “While much of our work to protect our customers’ privacy is done behind the scenes, in the past year we took public positions on issues of significance to our customers. We’ve opposed the United States government’s position that it could issue a search warrant to obtain customer emails stored in a Microsoft server in Ireland. We have a particular interest in this issue as we provide cloud computing and data storage services to business customers around the world, including many non-U.S. customers in data centers outside the United States,” said Craig Silliman, executive vice president and general counsel. “Although Verizon has not received any warrants from the U.S. government for our customers’ information stored in our overseas data centers, we filed briefs in courts and worked with Senators on a bill (The LEADS Act) to help defeat this overreach by the U.S. government. We also continue to support legislation that will add privacy protections to the Foreign Intelligence Surveillance Act (FISA) statute, including ending bulk collection of communications data.” In terms of secret orders from the Foreign Intelligence Surveillance Court, Verizon said it received between 0-999 FISA orders in the first half of 2014. Those orders targeted between 3,000-3,999 customer selectors, meaning that Verizon definitely received some non-zero number of FISA orders. The government makes companies wait six months before reporting FISA data, so the numbers from the first half of last year are the most recent information Verizon can publish. Source