June Newsletter #3 2014

Edward Snowden’s Leaks One Year on

One year on from June 5th 2013, when The Washington Post published the first of Edward Snowden's leaks. Since then, many more revelations have come to light.

Recently The Register published a story containing explosive "above top secret" information about Britain's surveillance programs, including details of a "clandestine British base tapping undersea cables in the Middle East." Reporter Duncan Campbell, who wrote the story, said it was based on documents "leaked by fugitive NSA sysadmin Edward Snowden" that other news outlets had declined to publish.

No one knows exactly how many documents Edward Snowden illegally accessed and downloaded while working as a contract employee for a National Security Agency (NSA) signals intelligence facility in Hawaii; some estimate as many as 1.3 million. As a contracted NSA systems administrator with top-secret Sensitive Compartmented Information (SCI) clearance, Snowden certainly had access to millions of classified documents.

NSA officials claim the majority of the documents Snowden stole had little or nothing to do with domestic surveillance. But it is precisely the documents describing the NSA's purported domestic spying, and those related to its surveillance of foreign leaders, that have garnered the most attention.

Edward Snowden remains a polarizing figure in the U.S. on the one-year anniversary of the first published story based on his leaks about the National Security Agency's (NSA) surveillance practices.

Many people, especially younger Americans, see the former NSA contractor as a patriot for having the guts to expose what they perceive as illegal surveillance practices by the world's most powerful spy agency. Others, especially those within government and older Americans, see him as a traitor in exile whose revelations have done more to damage U.S. interests than anyone in recent memory.

The Snowden leaks that have garnered the most attention and stirred the most concern are those describing domestic NSA surveillance programs like Prism and the spy agency's bulk phone metadata collection effort. News of these programs have stoked considerable concern in the U.S. about the NSA engaging in dragnet domestic surveillance under the aegis of counterterrorism efforts that began after the Sept. 11, 2001 terror attacks.

The fact that these programs were being conducted in almost total secrecy and under questionable legal justification prior to the leaks only served to accentuate those concerns, and made Snowden a hero for exposing them. Many of those who support him argue that the leaks have forced the government to acknowledge the existence of the programs and take steps to make them more transparent and accountable.

In a recent poll of 1,007 employed adults conducted by cloud security firm Tresorit, 55% felt that Snowden was right in revealing details about Prism, a program under which the NSA purportedly collects customer data from major U.S. Internet companies.

The vast majority of the documents released by Snowden have little to do with domestic spying. Instead they pertain to activities that many believe all spy agencies engage in as part of their missions. Among the documents released are those that describe how the NSA collects information on intelligence targets in other countries, which it targets, the agencies it partners with and other details.

By releasing information on adversaries and rivals, Snowden has seriously set back U.S. intelligence capabilities, says Michael Hayden, former director of the NSA and CIA. "There is an absolutely genuine loss of American [intelligence] capability that has been identified by executive branch officials and legislative branch officials," Hayden said. "They have been specific to the point of saying we are aware of specific channels of information that [are] no longer available to us as a result of Snowden."

Pentagon Papers leaker Daniel Ellsberg (to whom Snowden has been compared) revealed deliberative policy documents, Hayden noted. "Snowden is leaking stuff about how America collects secrets. Therefore it is infinitely more damaging" than the Pentagon Papers release in 1971, he said.

Many of those following the Snowden story fail to understand the full implications of the leaks and simply see them as part of a broader narrative about executive branch and government overreach, Hayden said. "This story is really part of a perfect storm in American politics."

While Snowden's revelations about Prism and NSA metadata collection and similar programs have been a windfall for civil liberties groups, they have proved damaging to the U.S. technology industry. The leaks have painted an unclear picture of the role U.S. tech firms have played in the NSA's data collection -- both domestically and abroad.

One the one hand, the leaked documents suggests that the NSA worked with several companies in its data collection efforts. Others show that the NSA may have worked actively with IT vendors to weaken encryption tools and build backdoors in technology products. At the same time, the documents leave many questions unanswered about the exact nature of these apparent partnerships. The incomplete information raised serious trust issues for U.S. technology vendors and forced them on the defensive.

Companies like Cisco and IBM have already reported lower revenues in some parts of the world because of concerns prompted by the Snowden revelations. And there are some concerns that U.S. cloud service providers could lose tens of billions of dollars in overseas revenues as the result of the Snowden leaks.

One of Snowden's great fears one year ago was that nothing would change as a result of his disclosures – that the public would greet them with a shrug, or at any rate, with insufficient outrage to overcome the inertia of a Congress where the NSA’s allies controlled the intelligence committees. With respect to this one program, that fear has been at least partly dispelled. President Obama has ordered the NSA to seek specific judicial orders before querying its existing database, and the USA Freedom Act, legislation requiring the use of "specific identifiers" in government demands for information under a range of intelligence authorities, has already passed the House of Representatives. Already, then, we have powerful confirmation that surveillance secretly approved by "all three branches of government", as its defenders never tired of reminding us, will not necessarily pass muster with the public.

Glenn Greenwald is the journalist from the Guardian newspaper who helped former National Security Agency contractor Edward Snowden reveal confidential documents about the widely spread surveillance programs conducted by the government intelligence agency such as NSA and GCHQ.

Greenwald is promoting his latest forthcoming book, "No Place to Hide: Edward Snowden, the NSA, and the U.S. Surveillance State" that underlines the interest of NSA in conducting massive Internet surveillance program. He said the about to release list will be the biggest revelation out of the 2 million classified documents Snowden obtained working with the agency.

“One of the big questions when it comes to domestic spying,” says Greenwald. “‘Who have been the NSA’s specific targets?’ Are they political critics and dissidents and activists? Are they genuinely people we’d regard as terrorists? What are the metrics and calculations that go into choosing those targets and what is done with the surveillance that is conducted? Those are the kinds of questions that I want to still answer.”

His new book is based upon the leaked documents from 2010 provided by the former NSA contractor Edward Snowden that detailed the NSA receiving or intercepting various devices in the US before exporting them to foreign countries, which he apparently obtained from Snowden.

And finally - Google has decided to provide end-to-end encryption for any of its Gmail users who want it. One could ask, "What took you so long?" but that would be churlish. (Some of us were unkind enough to suspect that the reluctance might have been due to commercial considerations: after all, if Gmail messages are properly encrypted, then Google's computers can't read the content in order to decide what ads to display alongside them.) But let us be charitable and thankful for small mercies. The code for the service is out for testing and won't be made freely available until it's passed the scrutiny of the geek community, but still it's a significant moment, for which we have Edward Snowden to thank.

Israel and Iran wage cyber future warfare

Reports of an elaborate and extensive Iranian online espionage network, which may have tracked hundreds of high-value targets with the help of fictitious social media accounts, should come as no surprise.

The purpose of a state-sponsored online espionage network is usually not only to gather information but also to use that information to prepare cyber attacks. Due to the resources at their disposal, governments can develop cyber-attack capabilities many times more powerful than other types of hackers.

As Esti Peshin, a former senior member of Unit 8200 of Military Intelligence and currently head of the Cyber Program Section at Israel Aerospace Industries’ Elta subsidiary, told The Jerusalem Post last year, “Attackers must know the structure of the network, who is working with it, and what defenses are in place. It’s very easy to get a list of employees, for example, by creating a fake social network identity.”

Often, the goal of such espionage is identifying weaknesses in networks that are critical for national security and basic state functions, including networks that are not linked up to the Internet.

Related Links:
http://cyberwar.einnews.com/article/

Robotic Arm responding to Brain Waves

University of Toronto student Ryan Mintz and his team have connected an Emotiv EPOC BCI headset to a robotic arm, demonstrating that one day robotic limbs or prosthetic will be easily controllable with the wearer’s brain waves.

No more than a slight head movements, such as clenching your jaw or winking your eye, is enough to control the arm, but the robot can also be calibrated to respond to relaxed mind state, which is no surprise knowing the amazing feature set of the headset in question.

Although high-end scientific research projects in the field have already led too much more advanced results, just think of the first mind-controlled robotic arm that has been approved by the FDA, it is definitely a good thing that more and more student projects involve the use of BCI.

Related Links:
http://neurogadget.com/2014/05/15/

Exposing Cybersecurity Cracks: A Global Perspective

2014 Cost of Data Breach Study
Ponemon Institute presents the findings of its two-part study, Exposing the Cybersecurity Cracks: A Global Perspective sponsored by Websense, Inc. This first Report uncovers the deficient, disconnected and in-the-dark conditions that challenge IT security professionals. Areas of focus include a deficit in security solution effectiveness; a disconnect regarding the perceived value of confidential data; and limited visibility into cybercriminal activity.

Findings reveal that security professionals have systems that fall short in terms of protection from cyber attacks and data leakage. On average, companies around the globe are spending $3.5 million to respond to a data breach

A study, sponsored by Websense, surveyed 4,881 IT and IT security practitioners in 15 countries including India, United Kingdom and the United States, with an average of 10 years’ experience in the field.

Results show a worrisome CyberSecurity trend. When asked about the state of CyberSecurity today, 57 percent of respondents do not think (100 percent – 43 percent) that their organization is protected from advanced cyber attacks.

Highlights of the study
*Fifty-seven percent of respondents do not think their organization is protected from advanced cyber attacks and 63 percent doubt they can stop the exfiltration of confidential information.

*Most respondents (69 percent) believe CyberSecurity threats sometimes fall through the cracks of their companies’ existing security systems. -Forty-four percent of companies represented in this research experienced one or more substantial cyber attacks in the past year.

*Eighty percent of respondents say their company’s leaders do not equate losing confidential data with a potential loss of revenue, despite Ponemon Institute research indicating the average cost of an organizational data breach is $5.4 million.

DARPA prepares $2 million cyber warfare challenge

Two-year cyber contest will lead to a battle in Vegas
The Defense Advanced Research Projects Agency is preparing to kick off the Cyber Grand Challenge, a tournament that will pit 30 teams of security researchers from industry, academia, and “the larger security community” against each other in a capture-the-flag style battle of network warfare domination. The contest, which is designed to help DARPA identify the best in automated network and computer security defense systems, will culminate in a final battle to be held at the DEF CON security conference in Las Vegas in 2016.

The winning team of the tournament will take home a cash prize of $2 million. The second and third place teams will be awarded $1 million and $750,000, respectively.

DuckDuckGo from Apple boosts 'anti-Google'

It was one of the more surprising (and low key) announcements from Apple’s developer conference last week, but all future versions of the company’s operating systems will include DuckDuckGo - the “first privacy-focused search engine” - as built-in option for the Safari browser.

DuckDuckGo positions itself as the ‘anti-Google’ and doesn’t track its users over multiple searches; instead it serves ads based only on the keywords from any single search. This means that advertisers can still try and sell you life insurance if you search for it, but they won’t have access to a detailed customer profile that joins up lots of different data points from a longer period of time.

DuckDuckGo is still a tiny service compared to the likes of Google (it handles just over 5 million daily searches compared to Google’s 5.9 billion) but becoming a built-in option for iOS 8 and OS X Yosemite users could certainly give it a sizeable boost.

Apple devices might not control the greatest market share when it comes to making or breaking a browser, but they do offer access to the more affluent demographics prized by advertisers.
The iPhone-maker continues to swing back and forth between Google and Microsoft’s Bing, making the latter the default search engine for all queries in Siri in iOS 7.

Google remains the default for web searches (and can be used in voice searches by simply saying ‘Google’) but Apple’s inclusion of DuckDuckGo shows that the company is happy to look outside the traditional players in the search industry to keep customers happy.

MH370 - Families of the missing passengers launch $5m reward to tempt whistleblower to expose ‘cover-up’

The families of those on board the missing Malaysia Airlines flight MH370 have launched a campaign calling for a “whistleblower” to come forward and reveal how the plane has lost, offering a reward of up to $5 million (£3 million). They plan to raise the money via the crowd-funding website Indiegogo, and hope that a large enough sum will entice a military insider or aviation expert to expose what many relatives believe to be a cover-up.

Since the Boeing 777 went missing on 8 March with 239 people on board, investigators have failed to find a single piece of wreckage and the search zone still spans up to 60,000 square km (24,000 square miles). The lack of any firm details has fuelled a huge range of conspiracy theories online, and the families have repeatedly accused the Malaysian government of holding back important information.

The full web site is currently under development and will be available during 2014