Tag Archives: internet

| PRISM UK: MoD serves news outlets with D notice over surveillance leaks!

Posted on by
1

MoD serves news outlets with D notice over surveillance leaks ~

  • , The Guardian.

    BBC and other media groups issued with D notice to limit publication of information that could ‘jeopardise national security.’

    Defence officials censor BBC coverage of surveillance tactics

    It is not clear what impact the censorship warning has had on media coverage of Snowden’s revelations relating to British intelligence. Photograph: Handout/Reuters

    Defence officials issued a confidential D notice to the BBC and other media groups in an attempt to censor coverage of surveillance tactics employed by intelligence agencies in the UK and US.

    Editors were asked not to publish information that may “jeopardise both national security and possibly UK personnel” in the warning issued on 7 June, a day after the Guardian first revealed details of the National Security Agency’s (NSA) secret Prism programme.

    The D notice, which was marked “private and confidential: not for publication, broadcast or use on social media”, was made public on the Westminster gossip blog, Guido Fawkes. Although only advisory for editors, the self-censorship system is intended to prevent the media from making “inadvertent public disclosure of information that would compromise UK military and intelligence operations and methods”.

    The warning was issued by defence officials in the UK as the BBC, ITN, Sky News and other newspapers and broadcasters around the world covered the surveillance revelations disclosed by the NSA whistleblower Edward Snowden. The leaks, reported extensively in the Guardian and also the Washington Post, have made headlines on both sides of the Atlantic for more than a week.

    However, it is not clear what impact the warning has had on media coverage of Snowden’s revelations relating to British intelligence. William Hague, the foreign secretary, who is reponsible for GCHQ, was not asked when he appeared on Monday’s BBC Radio 4 Today programme about reports that the spy agency was involved in monitoring communications made by foreign delegates at the G20 summit in London 2009. Instead the subject was discussed in an item aired towards the end of the programme at 8.45am.

    A BBC spokeswoman declined to comment on the D notice, but pointed out that the broadcaster did cover the G20 surveillance story on its radio news bulletins. She said the BBC believed it had “afforded the story” what the broadcaster described as “the appropriate level of coverage” among other significant news items, “including the ongoing G8 summit, the sentencing of Stuart Hall, the Co-op Bank bailout and the Ian Brady hearing”.

    According to the Guido Fawkes website, the warning said: “There have been a number of articles recently in connection with some of the ways in which the UK intelligence services obtain information from foreign sources.

    “Although none of these recent articles has contravened any of the guidelines contained within the defence advisory notice system, the intelligence services are concerned that further developments of this same theme may begin to jeopardise both national security and possibly UK personnel.”

    __________________________________________________________________

HypocrisyPainful

Related articles

Mushroom 3 Paranoia1

| GCHQ intercepted foreign politicians’ communications at G20 summits!

Posted on by
1

GCHQ intercepted foreign politicians’ communications at G20 summits ~

  • , , ,  and , The Guardian.

    Exclusive: phones were monitored and fake internet cafes set up to gather information from allies in London in 2009!

  • GCHQ composite
    Documents uncovered by the NSA whistleblower, Edward Snowden, reveal surveillance of G20 delegates’ emails and BlackBerrys. Photograph: Guardian

    Foreign politicians and officials who took part in two G20 summit meetings in London in 2009 had their computers monitored and their phone calls intercepted on the instructions of their British government hosts, according to documents seen by the Guardian. Some delegates were tricked into using internet cafes which had been set up by British intelligence agencies to read their email traffic.

    The revelation comes as Britain prepares to host another summit on Monday – for the G8 nations, all of whom attended the 2009 meetings which were the object of the systematic spying. It is likely to lead to some tension among visiting delegates who will want the prime minister to explain whether they were targets in 2009 and whether the exercise is to be repeated this week.

    The disclosure raises new questions about the boundaries of surveillance byGCHQ and its American sister organisation, the National Security Agency, whose access to phone records and internet data has been defended as necessary in the fight against terrorism and serious crime. The G20 spying appears to have been organised for the more mundane purpose of securing an advantage in meetings. Named targets include long-standing allies such as South Africa and Turkey.

    There have often been rumours of this kind of espionage at international conferences, but it is highly unusual for hard evidence to confirm it and spell out the detail. The evidence is contained in documents – classified as top secret – which were uncovered by the NSA whistleblower Edward Snowden and seen by the Guardian. They reveal that during G20 meetings in April and September 2009 GCHQ used what one document calls “ground-breaking intelligence capabilities” to intercept the communications of visiting delegations.

    This included:

    • Setting up internet cafes where they used an email interception programme and key-logging software to spy on delegates’ use of computers;

    • Penetrating the security on delegates’ BlackBerrys to monitor their email messages and phone calls;

    • Supplying 45 analysts with a live round-the-clock summary of who was phoning who at the summit;

    • Targeting the Turkish finance minister and possibly 15 others in his party;

    • Receiving reports from an NSA attempt to eavesdrop on the Russian leader, Dmitry Medvedev, as his phone calls passed through satellite links to Moscow.

    The documents suggest that the operation was sanctioned in principle at a senior level in the government of the then prime minister, Gordon Brown, and that intelligence, including briefings for visiting delegates, was passed to British ministers.

    A briefing paper dated 20 January 2009 records advice given by GCHQ officials to their director, Sir Iain Lobban, who was planning to meet the then foreign secretary, David Miliband. The officials summarised Brown’s aims for the meeting of G20 heads of state due to begin on 2 April, which was attempting to deal with the economic aftermath of the 2008 banking crisis. The briefing paper added: “The GCHQ intent is to ensure that intelligence relevant to HMG’s desired outcomes for its presidency of the G20 reaches customers at the right time and in a form which allows them to make full use of it.” Two documents explicitly refer to the intelligence product being passed to “ministers”.

    GCHQ ragout 1One of the GCHQ documents. Photograph: GuardianAccording to the material seen by the Guardian, GCHQ generated this product by attacking both the computers and the telephones of delegates.

    One document refers to a tactic which was “used a lot in recent UK conference, eg G20″. The tactic, which is identified by an internal codeword which the Guardian is not revealing, is defined in an internal glossary as “active collection against an email account that acquires mail messages without removing them from the remote server”. A PowerPoint slide explains that this means “reading people’s email before/as they do”.

    The same document also refers to GCHQ, MI6 and others setting up internet cafes which “were able to extract key logging info, providing creds for delegates, meaning we have sustained intelligence options against them even after conference has finished”. This appears to be a reference to acquiring delegates’ online login details.

    Another document summarises a sustained campaign to penetrate South African computers, recording that they gained access to the network of their foreign ministry, “investigated phone lines used by High Commission in London” and “retrieved documents including briefings for South African delegates to G20 and G8 meetings”. (South Africa is a member of the G20 group and has observer status at G8 meetings.)

    GCHQ Ragout 2Another excerpt from the GCHQ documents. Photograph: GuardianA detailed report records the efforts of the NSA’s intercept specialists at Menwith Hill in North Yorkshire to target and decode encrypted phone calls from London to Moscow which were made by the Russian president, Dmitry Medvedev, and other Russian delegates.

    Other documents record apparently successful efforts to penetrate the security of BlackBerry smartphones: “New converged events capabilities against BlackBerry provided advance copies of G20 briefings to ministers … Diplomatic targets from all nations have an MO of using smartphones. Exploited this use at the G20 meetings last year.”

    The operation appears to have run for at least six months. One document records that in March 2009 – the month before the heads of state meeting – GCHQ was working on an official requirement to “deliver a live dynamically updating graph of telephony call records for target G20 delegates … and continuing until G20 (2 April).”

    Another document records that when G20 finance ministers met in London in September, GCHQ again took advantage of the occasion to spy on delegates, identifying the Turkish finance minister, Mehmet Simsek, as a target and listing 15 other junior ministers and officials in his delegation as “possible targets”. As with the other G20 spying, there is no suggestion that Simsek and his party were involved in any kind of criminal offence. The document explicitly records a political objective – “to establish Turkey’s position on agreements from the April London summit” and their “willingness (or not) to co-operate with the rest of the G20 nations”.

    The September meeting of finance ministers was also the subject of a new technique to provide a live report on any telephone call made by delegates and to display all of the activity on a graphic which was projected on to the 15-sq-metre video wall of GCHQ’s operations centre as well as on to the screens of 45 specialist analysts who were monitoring the delegates.

    “For the first time, analysts had a live picture of who was talking to who that updated constantly and automatically,” according to an internal review.

    A second review implies that the analysts’ findings were being relayed rapidly to British representatives in the G20 meetings, a negotiating advantage of which their allies and opposite numbers may not have been aware: “In a live situation such as this, intelligence received may be used to influence events on the ground taking place just minutes or hours later. This means that it is not sufficient to mine call records afterwards – real-time tip-off is essential.”

    In the week after the September meeting, a group of analysts sent an internal message to the GCHQ section which had organised this live monitoring: “Thank you very much for getting the application ready for the G20 finance meeting last weekend … The call records activity pilot was very successful and was well received as a current indicator of delegate activity …

    “It proved useful to note which nation delegation was active during the moments before, during and after the summit. All in all, a very successful weekend with the delegation telephony plot.”

    _____________________________________________________________________

    Internet-cyber-crimeA

Related articles

BB CYBERCRIME

Paranoia1

| Worried about Mass Surveillance? How to Practice Safer Communication!

Posted on by
2

Worried about the Mass Surveillance? How to Practice Safer Communication ~ Quinn Norton, Special to ProPublica.

With all the news coming out about possiblemass surveillance and the relationshipbetween an alphabet soup of federal agencies and the companies that hold huge swaths of your electronic life, it’s easy to feel powerless. But you’re not. Technology taketh away your privacy, but technology can giveth quite a bit of it back too.

Much of the news of the past week has been about government access to phone and internet “metadata,” which is a part of communications that we almost never think about in the course of normal life.

Here’s what you need to know to make your communications more private:

What is “Metadata” and Why Do You Care?

All communication is broken up into two parts – metadata and message. Metadata is what’s needed for your message to arrive at its intended destination. An address on an envelope is metadata, as is an email address, a phone number and a twitter handle. When you shout someone’s name across a room to get their attention, that’s metadata too.

The message is the letter inside the envelope. It’s everything below the “to/from/subject” information in an email. Everything you say after you connect with someone, either by calling them or shouting at them, is the message.

If the distinction between metadata and message seems a bit arbitrary, that’s because it is. In technology, what’s metadata and what’s message are designated by the programmer’s design, rather than some great dividing line. This is a problem in American law, because message is usually protected by strong laws, but metadata isn’t. Programmers, who are almost never also lawyers, put sensitive material in metadata all the time. And legislators, even fewer of whom are programmers, have never fixed the metadata loopholes in the law.

Given a couple decades of communication technology, you get a situation like the one revealed by the Verizon court order. The mobile phone companies track all cellphone locations and call data, and can uniquely identify every phone, SIM and user. This isn’t because the mobile phone companies are cackling evilly as they put trackers on nearly everyone in America, it’s because in order for cell phones to work, towers need to know where phones are. That’s not surveillance, it’s just how radio waves work. What’s more, in order to build out capacity and maintain service, the telcos need to keep track of how people move around. It’s all part of making their networks work. To the phone company, metadata about who you are and where you go is useful for running their network. Despite some of their ads, they aren’t particularly interested in your personal life. On the other hand, to you, where you go and who you talk to is sensitive information. Right now, you can’t do anything about keeping all of that a secret from your mobile phone company, except not having your phone with you.

The messages that come to and from your phone are another matter. There’s a lot you can do about keeping those private and secure, and doing so helps you live in a safer world – not just from government surveillance, but from anyone who wants to snoop on you for any reason.

On computers and smartphones (which are just smaller computers with hard-to-use keyboards) your main tool for protecting your information, both message and metadata, is cryptography. Cryptography (often also called “crypto”) is a way of using math to rewrite information in a secret code. Since metadata is needed to get information across the network, some level of it is always exposed. For you, the question is where does your metadata end, and the message begin?

Making Crypto Work for You

A warning: Computer scientists are terrible at naming things, and trying to get them to explain how things they make work is a world of Lovecraftian horrors. Nowhere is this worse than in crypto, which is full of unintuitive names and nonsensical metaphors. Fortunately you don’t really need to know how cryptography works to use it, though if you want to, there’s a video series that explains the concepts in some detail for a general audience.

Communication crypto works by exchanging “keys,” or long strings of numbers that each side of a conversation uses to encrypt and decrypt each other’s messages. The various schemes for coming up with these shared numbers include symmetric-key exchange,Diffie–Hellman key exchange, and public-key cryptography – but you definitely don’t need to understand the details in order to use keys. All you need to know is that they all involve performing math functions that are easy for a computer to do, but extremely hard to undo. These methods are strong. There’s evidence that even the NSA can have trouble circumventing well-done key exchange crypto, and cracking it en masse is probably still not practical. There are two basic ways to use crypto:

Talking to Bob

Let’s say you’re trying to talk to your friend Bob. Over the internet, you’re generally going to pass your messages through a server. Let’s say you’re talking to Bob over a Google service (though most other services work similarly).

 

 

 

Obviously, Google can see all of this. But if someone steps into the stream they can see everything, too. This was the case with the cable splices detailed in the 2006 stories of warrantless wiretapping, and in last week’s story about the Verizon order.

 

 

 

In an attempt to be witty, cryptographers always call the party stepping into the stream Eve. Because Google is good at security, they use something called SSL to hide your traffic from Eve as it passes through the wires (or over the air). You can tell you’re using SSL, also called TLS for no good reason, when you visit a web address that starts with https instead of http. (Gee, thanks for making that so clear, computer scientists.) SSL is effective in blocking Eve, which is why the Electronic Frontier Foundation developed a browser plug-in called HTTPS Everywhere, which helps you put the majority of your web browsing inside SSL and out of view. You should use that. (Disclosure: I’m legally married to an EFF employee, and occasionally seek advice from their legal department.)

HTTPS Everywhere Logo

But if Eve has a special relationship with Google, you have another problem. With SSL, Google still has a copy of all your information, metadata and message. You can’t avoid Google having your metadata – the like cell phone towers, they need it to make the network work.

Encrypting Message Data

What now? There’s a fix: You can encrypt your message with a deeper layer of public-key cryptography called “end-to-end encryption.” Even the server that passes the message can’t look at it. Google can still give Eve your metadata, but even Google can’t see your messages, only encrypted gobbledegook. There’s a catch: This kind of encryption isn’t always easy to use. More on that in Part 2.

Even with end-to-end encryption, you have the same problem with metadata being visible to Google that you had before you encrypted anything. You’ve just made Eve go through one extra step – talking to Google – to get it. That might be all the protection you need, depending on your service provider legally resisting blanket requests from the government. If you don’t trust them to do that, then you should use a different service.

But here is where most people, even cryptographers, make their big mistake. We encrypt our messages and feel safe. But without using SSL, even when using a provider that won’t give information to Eve, the metadata is being transmitted unencrypted. You’re not even making Eve take the extra step of asking your provider. Eve can just step into the stream and capture a copy of your metadata as it passes by.

So let’s say you’ve moved to a new chat service. You trust it. It’s run entirely by Swedish hacker teenagers on offshore servers who respond to legal queries with pictures of sarcastic lolcats, not to cooperate with Eve. This new service requires you to encrypt your messages.

But being teenagers, they’ve overlooked a few details, and are accidentally leaking your metadata back to Eve, which is just fine with Eve, since your message data was legally protected anyhow, and when Eve is the NSA, she’s not supposed to keep it.

Oops. You were probably better off staying with your last service.

You abandon the Swedish teenagers then and turn to their somewhat more learned cousins, who have set up independent services around the world with an eye towards security being able to resist intrusion from outside actors. With services like Dukgo.com, and Riseup.net, you can have the best of both worlds: SSL and encrypted messages inside it.

Now you’ve got some privacy back.

Caveat: Who’s Out to Get You?

This advice assumes you’re trying to avoid mass surveillance, of the type that’s been in the news over the last few days, raising constitutional and societal questions. In security we call this an “untargeted attack.” If someone is investigating, surveilling or watchingyou personally, the rules and the advice change. You can no longer count on hiding in plain sight using SSL and encrypted messages. If you believe you need to resist targeted surveillance, things are more complex. Check out Security in Box to start learning more.

End of Part 1

Coming soon, in Part 2: Let’s Get Specific. Tools, Techniques, and Services.

________________________________________________________________________

BlackHole1

Related articles

Paranoia1

| The NSA Black Hole: 5 Basic Things We Still Don’t Know About the Agency’s Snooping!

Posted on by
1

The NSA Black Hole: 5 Basic Things We Still Don’t Know About the Agency’s Snooping ~ Justin Elliott and Theodoric Meyer, ProPublica.

Last week saw revelations that the FBI and the National Security Agency have been collecting Americans’ phone records en masse and that the agencies have access to data from nine tech companies.

But secrecy around the programs has meant even basic questions are still unanswered.  Here’s what we still don’t know:

 The headquarters of the National Security Agency at Fort Meade, Maryland.

Has the NSA been collecting all Americans’ phone records, and for how long?

It’s not entirely clear.

The Guardian published a court order that directed a Verizon subsidiary to turn over phone metadata — the time and duration of calls, as well as phone numbers and location data — to the NSA “on an ongoing daily basis” for a three-month period. Citing unnamed sources, the Wall Street Journal reported the program also covers AT&T and Sprint and that it covers the majority of Americans. And Director of National Intelligence James Clapper himself acknowledged that the “collection” is “broad in scope.”

How long has the dragnet has existed? At least seven years, and maybe going back to 2001.

Senate Intelligence Committee chair Dianne Feinstein, D-Calif., and vice chair Saxby Chambliss, R-Ga., said last week that the NSA has been collecting the records going back to 2006. That’s the same year that USA Today revealed a similar-sounding mass collection of metadata, which the paper said had been taking place since 2001. The relationship between the program we got a glimpse of in the Verizon order and the one revealed by USA Today in 2006 is still not clear: USA Today described a program not authorized by warrants. The program detailed last week does have court approval.

What surveillance powers does the government believe it has under the Patriot Act?

That’s classified.

The Verizon court order relies on Section 215 of the Patriot Act. That provision allows the FBI to ask the Foreign Intelligence Surveillance Court for a secret order requiring companies, like Verizon, to produce records – “any tangible things” – as part of a “foreign intelligence” or terrorism investigation. As with any law, exactly what the wording means is a matter for courts to decide. But the Foreign Intelligence Surveillance Court’s interpretation of Section 215 is secret.

As Harvard Law Professor Noah Feldman recently wrote, the details of that interpretation matter a lot: “Read narrowly, this language might require that information requested be shown to be important or necessary to the investigation. Read widely, it would include essentially anything even slightly relevant — which is to say, everything.”

In the case of the Verizon order – signed by a judge who sits on the secret court and requiring the company to hand over “all call detail records” — it appears that the court is allowing a broad interpretation of the Patriot Act. But we still don’t know the specifics.

Has the NSA’s massive collection of metadata thwarted any terrorist attacks?

It depends which senator you ask. And evidence that would help settle the matter is, yes, classified.

Sen. Mark Udall, D-Colo., told CNN on Sunday, “It’s unclear to me that we’ve developed any intelligence through the metadata program that’s led to the disruption of plots that we could [not] have developed through other data and other intelligence.”

He said he could not elaborate on his case “without further declassification.”

Sen. Feinstein told ABC that the collection of phone records described in the Verizon order had been “used” in the case of would-be New York subway bomber Najibullah Zazi. Later in the interview, Feinstein said she couldn’t disclose more because the information is classified. (It’s worth noting that there’s also evidence that old-fashioned police work helped solve the Zazi case — and that other reports suggest the Prism program, not the phone records, helped solve the case.)

How much information, and from whom, is the government sweeping up through Prism?

It’s not clear.

Intelligence director Clapper said in his declassified description that the government can’t get information using Prism unless there is an “appropriate, and documented, foreign intelligence purpose for the acquisition (such as for the prevention of terrorism, hostile cyber activities, or nuclear proliferation) and the foreign target is reasonably believed to be outside the United States.”

One thing we don’t know is how the government determines who is a “foreign target.” The Washington Post reported that NSA analysts use “search terms” to try to achieve “51 percent confidence” in a target’s “foreignness.” How do they do that? Unclear.

We’ve also never seen a court order related to Prism — they are secret — so we don’t know how broad they are. The Post reported that the court orders can be sweeping, and apply for up to a year. Though Google has maintained it has not “received blanket orders of the kind being discussed in the media.”

So, how does Prism work?

In his statement Saturday, Clapper described Prism as a computer system that allows the government to collect “foreign intelligence information from electronic communication service providers under court supervision.”

That much seems clear. But the exact role of the tech companies is still murky.

Relying on a leaked PowerPoint presentation, the Washington Post originally described Prism as an FBI and NSA program to tap “directly into the central servers” of nine tech companies including Google and Facebook. Some of the companies denied giving the government “direct access” to their servers. In a later story, published Saturday, the newspaper cited unnamed intelligence sources saying that the description from the PowerPoint was technically inaccurate.

The Post quotes a classified NSA report saying that Prism allows “collection managers [to send] content tasking instructions directly to equipment installed at company-controlled locations,” not the company servers themselves. So what does any of that mean? We don’t know.

_____________________________________________________________________

BlackHole1

 

Related articles

Paranoia1

| Digital Blackwater: Meet the contractors analyzing your private data!

Posted on by
1

Meet the contractors analyzing your private data ~  , Salon.

Private companies are getting rich probing your personal information for the government. Call it Digital Blackwater.

Meet the contractors analyzing your private data(Credit: Reuters/Jason Reed)

Amid the torrent of stories about the shocking new revelations about the National Security Agency, few have bothered to ask a central question. Who’s actually doing the work of analyzing all the data, metadata and personal information pouring into the agency from Verizon and nine key Internet service providers for its ever-expanding surveillance of American citizens?

Well, on Sunday we got part of the answer: Booz Allen Hamilton. In a stunning development in the NSA saga, Guardian reporter Glenn Greenwald revealed that the source for his blockbuster stories on the NSA is Edward Snowden, “a 29-year-old former technical assistant for the CIA and current employee of the defense contractor Booz Allen Hamilton.” Snowden, it turns out, has been working at NSA for the last four years as a contract employee, including stints for Booz and the computer-services firm Dell.

The revelation is not that surprising. With about 70 percent of our national intelligence budgets being spent on the private sector  – a discovery I made in 2007 and first reported in Salon – contractors have become essential to the spying and surveillance operations of the NSA.

From Narus, the Israeli-born Boeing subsidiary that makes NSA’s high-speed interception software, to CSC, the “systems integrator” that runs NSA’s internal IT system, defense and intelligence, contractors are making millions of dollars selling technology and services that help the world’s largest surveillance system spy on you. If the 70 percent figure is applied to the NSA’s estimated budget of $8 billion a year (the largest in the intelligence community), NSA contracting could reach as high as $6 billion every year.

But it’s probably much more than that.

“The largest concentration of cyber power on the planet is the intersection of the Baltimore Parkway and Maryland Route 32,” says Michael V. Hayden, who oversaw the privatization effort as NSA director from 1999 to 2005. He was referring not to the NSA itself but to the business park about a mile down the road from the giant black edifice that houses NSA’s headquarters in Fort Meade, Md. There, all of NSA’s major contractors, from Booz to SAIC to Northrop Grumman, carry out their surveillance and intelligence work for the agency.

With many of these contractors now focused on cyber-security, Hayden has even coined a new term — “Digital Blackwater” – for the industry. “I use that for the concept of the private sector in cyber,” he told a recent conference in Washington, in an odd reference to the notorious mercenary army. “I saw this in government and saw it a lot over the last four years. The private sector has really moved forward in terms of providing security,” he said. Hayden himself has cashed out too: He is now a principal with the Chertoff Group, the intelligence advisory company led by Michael Chertoff, the former secretary of Homeland Security.

One of NSA’s most important contractors may be Narus, a subsidiary of Boeing that makes a key telecommunications software that allows government agencies and corporations to monitor huge amounts of data flowing over fiber-optic cables. According to Bill Binney, one of four NSA whistle-blowers who’ve been warning about NSA’s immense powers, one Narus device can analyze 1,250,000 1,000-character emails every second. That comes to over 100 billion emails a day.

“Narus is the one thing that makes it all possible,” Binney told me over the weekend, of the Verizon surveillance program unveiled by the Guardian. “They probably pick up 60 to 80 percent of the data going over the [U.S.] network.” The Narus technology, he added, “reconstructs everything on the line and then passes it off to NSA for storage” and later analysis. That includes everything, he said, including email, cellphone calls, and voice over Internet protocol calls such as those made on Skype.

NSA’s use of the Narus technology first came to attention in 2006. That was when an AT&T technician named Mark Klein went public with his discovery that NSA had hooked Narus devices to AT&T’s incoming telecom stream in San Francisco and set up a secret room that allowed NSA to divert AT&T’s entire stream to its own databases. Binney believes the equipment was hooked up to as many as 15 sites around the country.

The Narus devices can’t pick up everything, however, because large amounts of traffic (such as domestic calls and Internet messages) don’t go through the switches. That’s why NSA apparently decided in 2006 to create the PRISM program to tap into the databases of the Internet service providers such as Yahoo and Google, Binney says. “Even though there’s so many Narus devices collecting on the Net, they don’t get it all,” he explained. “So if they go to the ISPs with a court order, they fill in the gaps from the collection on Narus.”

But once the data is downloaded, it has to be analyzed. And that’s where Booz and the other contractors that surround the NSA come in.

Booz Allen Hamilton is one of the NSA’s most important and trusted contractors. It’s involved in virtually every aspect of intelligence and surveillance, from advising top officials on how to integrate the 16 U.S. spy agencies to detailed analysis of signals intelligence, imagery and other critical collections technologies. I first introduced Booz’s intelligence business in a 2007 profile in Salon when President Bush appointed Michael McConnell, a Booz veteran and former NSA director, to be director of national intelligence (he’s now back at Booz).

Among other secret projects, Booz was deeply involved in “Total Information Awareness,” the controversial data-mining project run for the Bush administration by former National Security Adviser John Poindexter that was outlawed by Congress in 2003.

Another major presence at NSA’s Business Park is SAIC. Like Booz, it stands like a private colossus across the whole intelligence industry. Of its 42,000 employees, more than 20,000 hold U.S. government security clearances, making it one of the largest private intelligence services in the world. “SAIC provides a full suite of intelligence, surveillance and reconnaissance (ISR) and cybersecurity solutions across a broad spectrum of national security programs,” it claims on its website.

Despite its grandiose claims, however, SAIC is also known for several spectacular intelligence failures, including NSA’s ill-fated Trailblazer project to privatize its analysis of signals intelligence. Other companies acting as pillars of NSA’s SIGINT analysis team include Northrop Grumman, Raytheon, CACI International, and hundreds of smaller companies scattered around the Washington Beltway (you can read detailed explanations of what they do for NSA in my book “Spies for Hire”). They, in turn, are surrounded by a small army of “big data” companies that are hired by NSA to sift through data for suspicious patterns and map the creation of “illicit networks” that can be followed or investigated.

In April, I wrote about one of those companies, Palantir Technologies Inc., in Salon. It sells a powerful line of data-mining and analysis software that maps out human social networks that would be extremely useful to NSA analysts trying to make sense of all the telephone and Internet data downloaded from Verizon and nine Internet companies that was described in the latest blockbuster stories in the Guardian and the Post.

“Their bread and butter is mapping disparate networks in real time,” a former military intelligence officer who has used Palantir software told me. “It creates a spatial understanding that can be easily used by analysts.” (See the detailed profile of Palantir I posted on my website last Friday.)

But how did NSA, long considered the crown jewel of U.S. intelligence, become so privatized in the first place?

In the late 1990s, faced with a telecommunications and technological revolution that threatened to make the NSA’s telephonic and radar-based surveillance skills obsolete, the agency decided to turn to private corporations for many of its technical needs.

The outsourcing plan was finalized in 2000 by a special NSA Advisory Board set up to determine the agency’s future and codified in a secret report written by a then-obscure intelligence officer named James Clapper. “Clapper did a one-man study for the NSA Advisory Board,” recalls Ed Loomis, a 40-year NSA veteran who, along with Binney and two others, blew the whistle on corporate corruption at the NSA.

“His recommendation was that NSA acquire its Internet capabilities from the private sector. The idea was, the private sector had the capability and we at NSA didn’t need to reinvent the wheel.”

Hayden, who was the NSA director at the time, “put a lot of trust in the private sector, and a lot of trust in Clapper, because Clapper was his mentor,” added Loomis. And once he got approval, “he was hell-bent on privatization and nothing was going to derail that.” Clapper is now President Obama’s director of national intelligence, and has denounced the Guardian leaks as “reprehensible.”

Hayden was relentless in shifting NSA from an agency that relied on in-house experts for its technology to one of the most privatized agencies in government today. His first action, a project known as Groundbreaker, outsourced all of NSA’s internal communications system. In one fell swoop, hundreds of longtime NSA employees left their government jobs one day and walked in the next morning wearing their green badges from CSC and its many subcontractors.

“To this day, the IT at Fort Meade is owned by a private sector company,” Hayden boasted recently. “That worked. That was a really good idea.” CSC remains the head of the “Eagle Alliance” consortium, and is now one of NSA’s biggest suppliers of cybersecurity services.

But Hayden’s master project, the grandiose Trailblazer project to private NSA’s analysis of signals intelligence flowing over the Internet, didn’t fare so well.  Managed by SAIC in a consortium that included Northrop Grumman and Booz Allen Hamilton, it burned through over $5 billion without producing any actionable intelligence, and was canceled in 2005.

Despite the scandals and massive amount of money spent on private intelligence contractors, however, the mainstream media has been slow to report on the topic. It took until 2010, years after the spending spree began, for the Washington Post to highlight intelligence outsourcing in its famous series on “Top Secret America.” The paper, despite its work on the PRISM story, is stillbehind the curve.

On Monday, it reported for the first time the 70 percent figure I discovered back in 2007 and wrote about for Salon. But no credit was given to me or this publication for that blockbuster finding. Maybe next time.

_________________________________________________________________

YesWeSCAN

Related articles

Paranoia1

| Now Obama orders US to draw up overseas target list for cyber-attacks!

Posted on by
6

Obama orders US to draw up overseas target list for cyber-attacks ~

Exclusive: Top-secret directive steps up offensive cyber capabilities to ‘advance US objectives around the world’

• Read the secret presidential directive here

Link to video: Obama defends internet surveillance programmes

Barack Obama has ordered his senior national security and intelligence officials to draw up a list of potential overseas targets for US cyber-attacks, a top secret presidential directive obtained by the Guardian reveals.

The 18-page Presidential Policy Directive 20, issued in October last year but never published, states that what it calls Offensive Cyber Effects Operations (OCEO) “can offer unique and unconventional capabilities to advance US national objectives around the world with little or no warning to the adversary or target and with potential effects ranging from subtle to severely damaging”.

It says the government will “identify potential targets of national importance where OCEO can offer a favorable balance of effectiveness and risk as compared with other instruments of national power”.

The directive also contemplates the possible use of cyber actions inside the US, though it specifies that no such domestic operations can be conducted without the prior order of the president, except in cases of emergency.

The aim of the document was “to put in place tools and a framework to enable government to make decisions” on cyber actions, a senior administration official told the Guardian.

The administration published some declassified talking points from the directive in January 2013, but those did not mention the stepping up of America’s offensive capability and the drawing up of a target list.

Obama’s move to establish a potentially aggressive cyber warfare doctrine will heighten fears over the increasing militarization of the internet.

The directive’s publication comes as the president plans to confront his Chinese counterpart Xi Jinping at a summit in California on Friday over alleged Chinese attacks on western targets.

Even before the publication of the directive, Beijing had hit back against US criticism, with a senior official claiming to have “mountains of data” on American cyber-attacks he claimed were every bit as serious as those Chinawas accused of having carried out against the US.

Presidential Policy Directive 20 defines OCEO as “operations and related programs or activities … conducted by or on behalf of the United StatesGovernment, in or through cyberspace, that are intended to enable or produce cyber effects outside United States government networks.”

Asked about the stepping up of US offensive capabilities outlined in the directive, a senior administration official said: “Once humans develop the capacity to build boats, we build navies. Once you build airplanes, we build air forces.”

The official added: “As a citizen, you expect your government to plan for scenarios. We’re very interested in having a discussion with our international partners about what the appropriate boundaries are.”

The document includes caveats and precautions stating that all US cyber operations should conform to US and international law, and that any operations “reasonably likely to result in significant consequences require specific presidential approval”.

The document says that agencies should consider the consequences of any cyber-action. They include the impact on intelligence-gathering; the risk of retaliation; the impact on the stability and security of the internet itself; the balance of political risks versus gains; and the establishment of unwelcome norms of international behaviour.

Among the possible “significant consequences” are loss of life; responsive actions against the US; damage to property; serious adverse foreign policy or economic impacts.

The US is understood to have already participated in at least one major cyber attack, the use of the Stuxnet computer worm targeted on Iranian uranium enrichment centrifuges, the legality of which has been the subject of controversy. US reports citing high-level sources within the intelligence services said the US and Israel were responsible for the worm.

In the presidential directive, the criteria for offensive cyber operations in the directive is not limited to retaliatory action but vaguely framed as advancing “US national objectives around the world”.

The revelation that the US is preparing a specific target list for offensive cyber-action is likely to reignite previously raised concerns of security researchers and academics, several of whom have warned that large-scale cyber operations could easily escalate into full-scale military conflict.

Sean Lawson, assistant professor in the department of communication at the University of Utah, argues: “When militarist cyber rhetoric results in use of offensive cyber attack it is likely that those attacks will escalate into physical, kinetic uses of force.”

An intelligence source with extensive knowledge of the National Security Agency’s systems told the Guardian the US complaints again China were hypocritical, because America had participated in offensive cyber operations and widespread hacking – breaking into foreign computer systems to mine information.

Provided anonymity to speak critically about classified practices, the source said: “We hack everyone everywhere. We like to make a distinction between us and the others. But we are in almost every country in the world.”

The US likes to haul China before the international court of public opinion for “doing what we do every day”, the source added.

One of the unclassified points released by the administration in January stated: “It is our policy that we shall undertake the least action necessary to mitigate threats and that we will prioritize network defense and law enforcement as preferred courses of action.”

The full classified directive repeatedly emphasizes that all cyber-operations must be conducted in accordance with US law and only as a complement to diplomatic and military options. But it also makes clear how both offensive and defensive cyber operations are central to US strategy.

Under the heading “Policy Reviews and Preparation”, a section marked “TS/NF” – top secret/no foreign – states: “The secretary of defense, the DNI [Director of National Intelligence], and the director of the CIA … shall prepare for approval by the president through the National Security Advisor a plan that identifies potential systems, processes and infrastructure against which the United States should establish and maintain OCEO capabilities…” The deadline for the plan is six months after the approval of the directive.

The directive provides that any cyber-operations “intended or likely to produce cyber effects within the United States” require the approval of the president, except in the case of an “emergency cyber action”. When such an emergency arises, several departments, including the department of defense, are authorized to conduct such domestic operations without presidential approval.

Obama further authorized the use of offensive cyber attacks in foreign nations without their government’s consent whenever “US national interests and equities” require such nonconsensual attacks. It expressly reserves the right to use cyber tactics as part of what it calls “anticipatory action taken against imminent threats”.

The directive makes multiple references to the use of offensive cyber attacks by the US military. It states several times that cyber operations are to be used only in conjunction with other national tools and within the confines of law.

When the directive was first reported, lawyers with the Electronic PrivacyInformation Center filed a Freedom of Information Act request for it to be made public. The NSA, in a statement, refused to disclose the directive on the ground that it was classified.

In January, the Pentagon announced a major expansion of its Cyber Command Unit, under the command of General Keith Alexander, who is also the director of the NSA. That unit is responsible for executing both offensive and defensive cyber operations.

Earlier this year, the Pentagon publicly accused China for the first time of being behind attacks on the US. The Washington Post reported last month that Chinese hackers had gained access to the Pentagon’s most advanced military programs.

The director of national intelligence, James Clapper, identified cyber threats in general as the top national security threat.

Obama officials have repeatedly cited the threat of cyber-attacks to advocate new legislation that would vest the US government with greater powers to monitor and control the internet as a means of guarding against such threats.

One such bill currently pending in Congress, the Cyber Intelligence Sharing and Protection Act (Cispa), has prompted serious concerns from privacy groups, who say that it would further erode online privacy while doing little to enhance cyber security.

In a statement, Caitlin Hayden, national security council spokeswoman, said: “We have not seen the document the Guardian has obtained, as they did not share it with us. However, as we have already publicly acknowledged, last year the president signed a classified presidential directive relating to cyber operations, updating a similar directive dating back to 2004. This step is part of the administration’s focus on cybersecurity as a top priority. The cyber threat has evolved, and we have new experiences to take into account.

“This directive establishes principles and processes for the use of cyber operations so that cyber tools are integrated with the full array of national security tools we have at our disposal. It provides a whole-of-government approach consistent with the values that we promote domestically and internationally as we have previously articulated in the International Strategy for Cyberspace.

“This directive will establish principles and processes that can enable more effective planning, development, and use of our capabilities. It enables us to be flexible, while also exercising restraint in dealing with the threats we face. It continues to be our policy that we shall undertake the least action necessary to mitigate threats and that we will prioritize network defense and law enforcement as the preferred courses of action. The procedures outlined in this directive are consistent with the US Constitution, including the president’s role as commander in chief, and other applicable law and policies.”

_____________________________________________________________________

NSA1

Related articles

BB CYBERCRIME

| Exposed: NSA collecting phone records of millions of Verizon customers daily!

Posted on by
1

NSA collecting phone records of millions of Verizon customers daily ~ , The Guardian.

Exclusive: Top secret court order requiring Verizon to hand over all call data shows scale of domestic surveillance under Obama. 

• Read the Verizon court order in full here

 
Phone records data
Under the terms of the order, the numbers of both parties on a call are handed over, as is location data and the time and duration of all calls. Photograph: Matt Rourke/AP

The National Security Agency is currently collecting the telephone records of millions of US customers of Verizon, one of America’s largest telecoms providers, under a top secret court order issued in April.

The order, a copy of which has been obtained by the Guardian, requires Verizon on an “ongoing, daily basis” to give the NSA information on all telephone calls in its systems, both within the US and between the US and other countries.

The document shows for the first time that under the Obama administration the communication records of millions of US citizens are being collected indiscriminately and in bulk – regardless of whether they are suspected of any wrongdoing.

The secret Foreign Intelligence Surveillance Court (Fisa) granted the order to the FBI on April 25, giving the government unlimited authority to obtain the data for a specified three-month period ending on July 19.

Under the terms of the blanket order, the numbers of both parties on a call are handed over, as is location data, call duration, unique identifiers, and the time and duration of all calls. The contents of the conversation itself are not covered.

The disclosure is likely to reignite longstanding debates in the US over the proper extent of the government’s domestic spying powers.

Under the Bush administration, officials in security agencies had disclosed to reporters the large-scale collection of call records data by the NSA, but this is the first time significant and top-secret documents have revealed the continuation of the practice on a massive scale under President Obama.

The unlimited nature of the records being handed over to the NSA is extremely unusual. Fisa court orders typically direct the production of records pertaining to a specific named target who is suspected of being an agent of a terrorist group or foreign state, or a finite set of individually named targets.

The Guardian approached the National Security Agency, the White House and the Department of Justice for comment in advance of publication on Wednesday. All declined. The agencies were also offered the opportunity to raise specific security concerns regarding the publication of the court order.

The court order expressly bars Verizon from disclosing to the public either the existence of the FBI’s request for its customers’ records, or the court order itself.

“We decline comment,” said Ed McFadden, a Washington-based Verizon spokesman.

The order, signed by Judge Roger Vinson, compels Verizon to produce to the NSA electronic copies of “all call detail records or ‘telephony metadata’ created by Verizon for communications between the United States and abroad” or “wholly within the United States, including local telephone calls”.

The order directs Verizon to “continue production on an ongoing daily basis thereafter for the duration of this order”. It specifies that the records to be produced include “session identifying information”, such as “originating and terminating number”, the duration of each call, telephone calling card numbers, trunk identifiers, International Mobile Subscriber Identity (IMSI) number, and “comprehensive communication routing information”.

The information is classed as “metadata”, or transactional information, rather than communications, and so does not require individual warrants to access. The document also specifies that such “metadata” is not limited to the aforementioned items. A 2005 court ruling judged that cell site location data – the nearest cell tower a phone was connected to – was also transactional data, and so could potentially fall under the scope of the order.

While the order itself does not include either the contents of messages or the personal information of the subscriber of any particular cell number, its collection would allow the NSA to build easily a comprehensive picture of who any individual contacted, how and when, and possibly from where, retrospectively.

It is not known whether Verizon is the only cell-phone provider to be targeted with such an order, although previous reporting has suggested the NSA has collected cell records from all major mobile networks. It is also unclear from the leaked document whether the three-month order was a one-off, or the latest in a series of similar orders.

The court order appears to explain the numerous cryptic public warnings by two US senators, Ron Wyden and Mark Udall, about the scope of the Obama administration’s surveillance activities.

For roughly two years, the two Democrats have been stridently advising the public that the US government is relying on “secret legal interpretations” to claim surveillance powers so broad that the American public would be “stunned” to learn of the kind of domestic spying being conducted.

Because those activities are classified, the senators, both members of the Senate intelligence committee, have been prevented from specifying which domestic surveillance programs they find so alarming. But the information they have been able to disclose in their public warnings perfectly tracks both the specific law cited by the April 25 court order as well as the vast scope of record-gathering it authorized.

Julian Sanchez, a surveillance expert with the Cato Institute, explained: “We’ve certainly seen the government increasingly strain the bounds of ‘relevance’ to collect large numbers of records at once — everyone at one or two degrees of separation from a target — but vacuuming all metadata up indiscriminately would be an extraordinary repudiation of any pretence of constraint or particularized suspicion.” The April order requested by the FBI and NSA does precisely that.

The law on which the order explicitly relies is the so-called “business records” provision of the Patriot Act, 50 USC section 1861. That is the provision which Wyden and Udall have repeatedly cited when warning the public of what they believe is the Obama administration’s extreme interpretation of the law to engage in excessive domestic surveillance.

In a letter to attorney general Eric Holder last year, they argued that “there is now a significant gap between what most Americansthink the law allows and what the government secretly claims the law allows.”

“We believe,” they wrote, “that most Americans would be stunned to learn the details of how these secret court opinions have interpreted” the “business records” provision of the Patriot Act.

Privacy advocates have long warned that allowing the government to collect and store unlimited “metadata” is a highly invasive form of surveillance of citizens’ communications activities. Those records enable the government to know the identity of every person with whom an individual communicates electronically, how long they spoke, and their location at the time of the communication.

Such metadata is what the US government has long attempted to obtain in order to discover an individual’s network of associations and communication patterns. The request for the bulk collection of all Verizon domestic telephone records indicates that the agency is continuing some version of the data-mining program begun by the Bush administration in the immediate aftermath of the 9/11 attack.

The NSA, as part of a program secretly authorized by President Bush on 4 October 2001, implemented a bulk collection program of domestic telephone, internet and email records. A furore erupted in 2006 when USA Today reported that the NSA had “been secretly collecting the phone call records of tens of millions of Americans, using data provided by AT&T, Verizon and BellSouth” and was “using the data to analyze calling patterns in an effort to detect terrorist activity.” Until now, there has been no indication that the Obama administration implemented a similar program.

These recent events reflect how profoundly the NSA’s mission has transformed from an agency exclusively devoted to foreign intelligence gathering, into one that focuses increasingly on domestic communications. A 30-year employee of the NSA, William Binney, resigned from the agency shortly after 9/11 in protest at the agency’s focus on domestic activities.

In the mid-1970s, Congress, for the first time, investigated the surveillance activities of the US government. Back then, the mandate of the NSA was that it would never direct its surveillance apparatus domestically.

At the conclusion of that investigation, Frank Church, the Democratic senator from Idaho who chaired the investigative committee, warned: “The NSA’s capability at any time could be turned around on the American people, and no American would have any privacy left, such is the capability to monitor everything: telephone conversations, telegrams, it doesn’t matter.”

Additional reporting by Ewen MacAskill and Spencer Ackerman

Related articles

sheepoA

| Gang stole $45m from cash machines across globe in hours, say prosecutors!

Posted on by
Reply

Gang stole $45m from cash machines across globe in hours, say prosecutors ~ Associated Press in New York, guardian.co.uk.

‘Virtual criminal flash mob’ used bogus swipe cards loaded with data from hacked bank databases to commit thousands of thefts.

cash machine theft

Seven people are being held in connection with a case US prosecutors describe as a ‘massive 21st-century bank heist’. Photograph: Gene J Puskar/AP

A gang of criminals stole $45m (£29m) in a matter of hours by hacking their way into a database of prepaid debit cards and then draining cash machines around the globe, US prosecutors have said.

Seven people were being held on Thursday in connection with the case, which prosecutors said involved thousands of thefts from machines using bogus magnetic swipe cards carrying information from Middle Eastern banks. The fraudsters moved quickly, working in cells to loot financial institutions around the world.

US attorney Loretta Lynch called it “a massive 21st-century bank heist”.

One of the suspects was caught on surveillance cameras, his backpack loaded down with cash, authorities said. Others took photographs of themselves with giant wads of notes as they made their way up and down Manhattan.

Here’s how it worked:

Hackers got into bank databases, eliminated withdrawal limits on prepaid debit cards and created access codes. Others loaded that data on to any plastic card with a magnetic stripe – old hotel key card or expired credit card worked fine as long as they carried the account data and correct access codes.

A network of operatives then fanned out to rapidly withdraw money in multiple cities, authorities said. The cells would take a cut of the money, then launder it through expensive purchases or ship it wholesale to the global ringleaders.

It appears no individuals lost money. The thieves plundered funds held by the banks that back up prepaid credit cards, not individual or business accounts, Lynch said.

She called it a “virtual criminal flash mob”, and a security analyst said it was the biggest cash machine fraud case she had heard of.

There were two separate attacks, one in December that reaped $5m (£3.2m) worldwide and another in February that brought in about $40m in 10 hours in about 36,000 transactions. The scheme involved attacks on two banks, Rakbank in the United Arab Emirates and the Bank of Muscat in Oman, prosecutors said.

The plundered machines were in Japan, Russia, Romania, Egypt, Colombia, Britain, Sri Lanka, Canada and several other countries. Law enforcement agencies from more than a dozen countries were involved in the investigation.

The accused ringleader in the US cell, Alberto Yusi Lajud-Pena, was reportedly killed in the Dominican Republic late last month, prosecutors said.

An indictment accused him and the other seven New York suspects of withdrawing $2.8m in cash from hacked accounts in less than a day.

Such cash machine fraud schemes are not uncommon.

Some of the fault lies with the ubiquitous magnetic strips on the back of the cards. Much of the world has abandoned them in favour of chip and pin cards. But because US banks and merchants have stuck to cards with magnetic strips, they are still accepted around the world.

Lynch would not say who masterminded the attacks globally, who the hackers are or where they were located, citing an ongoing investigation.

Lajud-Pena was found dead with a suitcase full of about $100,000 in cash. Dominican officials said they arrested a man in the killing who said it was a botched robbery.

___________________________________________________________________

Crime 1

 

Related articles

| Your online freedom is worth fighting for, isn’t it?

Posted on by
1

Your online freedom is worth fighting for, isn’t it? ~

    • ____________________________________________________________

      We need to find a means of realigning the balance between who profits from personal information and who loses.
      ____________________________________________________________

 

 

Courtesy of technology, we are all authors today as well as audiences – not to mention our own part-time publicists, social secretaries, agents and ambassadors. Though some people still shun social media, for most of us “identity” is something we forge in the eyes of the world, composed of countless comments, tags, status updates, images, and half-forgotten submitted forms.

If there’s one thing that publicists and ambassadors alike have long known, it’s that we cannot control the afterlife of our words. As soon as they are written or spoken they become the property of the world, grist to its mills of rumour and opinion and to a vengeful eternity of quotation and misquotation. When it comes to our online outpourings, forgetfulness is equally impossible. Data only accumulates, and the uses to which it can be put defy all anticipation.

This doesn’t mean anticipation isn’t a game worth playing, though. What might the thousands of words and images sent out by a teenager today be used for decades down the line, not to mention the gigabytes of data representing their recorded actions and preferences? The right algorithms can crunch this information into almost any context, from credit scores to health and motor insurance premiums; from indexes of employability and influence to net worth.

Hence the European Union’s recent emphasis on revising the rules around data protection, and on our so-called right to be forgotten – a proposition that raises important questions: what counts as personal data in the first place, where burdens of proof and administrative effort will lie, and how amenable present business models are to such a notion in the first place.

For some people it’s a losing battle, and scarcely worth debating. When you sign up to the terms and conditions of a particular service, they argue, you should know what you’re getting into. And if you’re using that service for free, you should accept that your words and actions themselves form the product that’s being sold.

It’s an appealingly absolute argument: shut up and put up, or opt out. Yet what it fails to acknowledge is the degree to which many alleged options are becoming less optional. Don’t want to own a mobile phone, have a social media account or provide your personal details to online merchants? Count yourself out of the running for an increasing number of jobs, insurance schemes and government services. And don’t forget that the gaping holes in your data will set red flags waving across a host of algorithms every time you do pop up on the grid.

baby's and man's hand on keyboard

What might the gigabytes of data representing our recorded actions and preferences be used for decades down the line? Photograph: Garry Gay/Alamy

Apocalyptic pictures are easy to paint, of course. Yet personal privacy already looks like the rock on which one utopian vision of technology will founder. This is the notion that openness is a certain good, and that “free” is automatically aligned with “freedom” – a faith that’s hard to maintain in the light of the consequences of putting so much of our identities into the hands of third (and fourth, and fifth) parties.

As the author and computer scientist Jaron Lanier puts it in his recent book,Who Owns the Future?, “It is all too easy to forget that ‘free’ inevitably means that someone else will be deciding how you live.” As they stand, most free and open online business models rest on a grotesque inequality between what is given by the many – detailed, constantly updated personalised data – and what is taken by the few: profit, knowledge, and the indefinite and largely unaccountable possession of both.

Realigning this balance is a more complex business than just earmarking certain types of data for deletion. It’s also, though, a battle eminently worth fighting. To protect our rights as 21st-century citizens, able to participate in society on an equal footing, means affording our digital shadows some of the same protections that guarantee our own freedom – freedom from lies and abuse, from indefinite detention, from the unappealable verdicts of unseen tribunals.

All of the above describes the ways in which some information systems work now – as if we were nothing more than data ourselves. Yet – to quote Lanier again – “people are the only sources or destinations of information, or indeed of any meaning to the machine at all”. We must not betray the great gifts of our tools by valuing ourselves too little.

______________________________________________________________________

online spying BB CYBERCRIME

Related articles

| Facebook hacked but says no user data compromised!

Posted on by
Reply

Facebook hacked, says no user data compromised ~ Heather Kelly, CNN.

_______________________________________________________

  • Facebook says it was hacked in January when employees visited a compromised website.
  • The social network has found no evidence that any user data was obtained by the hackers.
  • This is latest in a string of high-profile hacks this year. _______________________________________________________
(CNN) – Facebook says it was recently hacked, though it says no data about its more than a billion users was compromised.

The company described the “sophisticated attack” in a blog post on Friday, saying it took place in January when a small number of employees visited a compromised website that installed malware on their machines.

“As soon as we discovered the presence of the malware, we remediated all infected machines, informed law enforcement and began a significant investigation that continues to this day,” Facebook Security said in the post.

Facebook, the largest social network in the world, is the latest high-profile site to be hacked this year. Twitter announced a similar intrusion earlier this month, and major news organizations including The New York Times, Wall Street Journal and Washington Post have also admitted to being hacked.

The news sites attributed the breaches to hackers working for the Chinese government, but neither Facebook nor Twitter mention China when describing their attacks.

“Facebook was not alone in this attack. It is clear that others were attacked and infiltrated recently as well,” said the blog post. “As one of the first companies to discover this malware, we immediately took steps to start sharing details about the infiltration with the other companies and entities that were affected. “

Unlike Twitter, Facebook said it has found no evidence that any user information was compromised. Twitter said that user names, encrypted passwords and e-mail addresses for as many as 250,000 users were potentially grabbed by the hackers. It reset passwords for all affected accounts.

The string of hacks have primarily exploited vulnerabilities in the programming language Java, which is installed on most computers by default. Facebook said the site responsible for its attack took advantage of a previously unknown Java vulnerability, which Oracle patched on February 1.

In January, the Department of Homeland Security issued an alert about the security-challenged software and recommended people turn it off on their computers. Apple turned off Java by default for its OS X users as a precaution. Full instructions on how to disable Java on any computer can be found on Oracle’s website. If you must use Java, make sure that you have downloaded the latest updates, which include key security patches.

Facebook said it will continue to work with law enforcement and others in the industry to prevent future attacks.

_________________________________________________________________

FB Hack 1

Dislike FB 1

Related articles