CISPA cybersecurity bill backers hope second time’s a charm

Articles of Interest, Crimes & Criminal Activity (Organized Crime, Narcotics, Predators, Cyber Crime, Cyber Stalking, UnSolved), Law Enforcement, National security, Terrorism, Cyber Terrorism & Related Crimes, Social Media, Technology & Digital Security Comments Off

May 172013

CISPA cybersecurity bill backers hope second time’s a charm

NBC News
by Alina Selyukh & Deborah Charles (Reuters)
May 16, 2013

WASHINGTON (Reuters) –

Six months after a U.S. cybersecurity bill died in the Senate, some Obama administration officials and lawmakers are optimistic they can get a new law passed amid heightened public awareness of hacking attacks and cyber espionage.

With top intelligence officials warning that cyber attacks have replaced terrorism as the leading threat against the United States, the White House and lawmakers have spent months discussing how to improve the flow of information between the government and the private sector.

A second go-around for the Cyber Intelligence Sharing and Protection Act (CISPA) was approved by the Republican-controlled House of Representatives in a bipartisan vote on April 18, though the White House has again threatened to veto the bill unless more protections for privacy and civil liberties are added.

Still, senior Obama administration officials say behind-the-scenes talks with lawmakers this time around are constant, more serious and more productive.

“I actually think that the outlook is significantly better than it was last year,” the White House cybersecurity policy coordinator, Michael Daniel, told the Reuters Cybersecurity Summit in Washington this week. “What has impressed me has been the willingness of everybody involved to actually continue having those discussions and to continue that extensive level of dialogue trying to find some solutions.”

While Daniel cautioned that it is never easy to get the divided House and Senate to agree to anything, he predicted that final cyber legislation might be seen by the fall.

“A lot of us are concerned about getting a good piece of cybersecurity legislation before something really bad happens. As a general rule, legislation that is produced immediately after a crisis is not as good as the stuff that can be done when it’s more thought-out,” he said.

Last year, the Senate failed to pass a comprehensive cybersecurity bill that combined information-sharing provisions similar to those in the current CISPA with voluntary cybersecurity standards for businesses that control critical U.S. infrastructure.

Since then, President Barack Obama has signed an executive order that directs government officials to set voluntary standards to reduce cybersecurity risk and offer incentives to private companies to adopt them.

A series of high-profile cyber attacks — such as repeated disruptions of the online banking sites of major U.S. banks, or markets plunging on a fake message on the AP Twitter feed about a White House bombing that never happened — have built momentum behind cyber legislation.

* Separate bills

The Senate does not plan to vote on CISPA, but is expected instead to take up its own cyber-related bills. On Wednesday, Senate Intelligence Committee Chairman Dianne Feinstein, a California Democrat, said her panel was drafting a version of an information-sharing bill.

Congressional aides said staff and lawmakers from both sides of the aisle are constantly meeting on the issue. One Senate aide said it was a collaborative process to agree on multiple key elements to make the overall law stronger.

Representative Mike Rogers, chairman of the House intelligence committee and CISPA co-author, said key senators including Feinstein were “completely all in” on the need to pass a cybersecurity law. The Michigan Republican predicted that House and Senate lawmakers could work out an agreement on at least an information-sharing bill.

“I think we’re finally coming to the consensus here that hey, let’s pass what we can pass and take another bite. This isn’t the end-all cure-all,” Rogers told the summit.

He said a meeting was scheduled this week — with more to come — between the House and the Senate to discuss in detail the elements of cyber legislation and see where compromise could be reached, without starting completely from scratch.

Rogers predicted that if a bill could pass through both houses of Congress, Obama would sign it despite the veto threat.

* Urgent need

Top administration officials have underscored the urgent need for laws that would complement Obama’s executive order and help ensure the government and the private sector are on the same page when it comes to threats posed to critical U.S. infrastructure.

Homeland Security Secretary Janet Napolitano said many lawmakers received classified briefings last year on cyber threats, and better education on cyber risks means “we’re starting from a much better base” on legislation.

“There’s a lot of work going on behind the scenes,” Napolitano told the summit. “There are many fewer concerns than there were last time around.”

But officials acknowledge that hurdles remain. For example, some senators, like Homeland Security Committee Chairman Tom Carper, prefer a more comprehensive bill.

“While information sharing is an important part of our efforts, it is only one of many elements needed to properly bolster our cyber defenses,” Carper, a Delaware Democrat, said in a statement.

Other issues he says he would like to address in legislation include protections for critical infrastructure, security of federal agency networks, cyber workforce development and notification of data breaches.

Some private industry security experts were skeptical about the prospects for broad legislation, as well as the effectiveness of such laws in preventing cyber attacks. Shane Shook, chief knowledge officer at cybersecurity services company Cylance Inc, suggested the private sector should organize information sharing itself.

“Comprehensive legislation is never going to happen that can be effective over all 18 sectors,” Shook told the summit.

Ira Winkler, president of the Information Systems Security Association, said he was skeptical that any meaningful legislation would pass this year, barring a major cyber attack that damaged U.S. infrastructure.

“We hear about wake-up calls, but people keep hitting the snooze button,” he said.

— Additional reporting by Andrea Shalal-Esa and Thomas Ferraro

Direct Link: http://www.nbcnews.com/technology/cispa-cybersecurity-bill-backers-hope-second-times-charm-1C9948195#cispa-cybersecurity-bill-backers-hope-second-times-charm-1C9948195

HEADS UP!: Four ways your privacy is being invaded by The Government & Their Corporate Sidekicks!

Articles of Interest, Crimes & Criminal Activity (Organized Crime, Narcotics, Predators, Cyber Crime, Cyber Stalking, UnSolved), Firearms, Weapons & Personal Safety, Law Enforcement, National security, Terrorism, Cyber Terrorism & Related Crimes, Social Media, Technology & Digital Security Comments Off

Apr 112013

Four ways your privacy is being invaded

Slowly but surely, government and telecommunications companies have forged a police-corporate surveillance complex

Salon
by Davis Rosen
This article originally appeared on AlterNet
September 11, 2012

Four ways your privacy is being invaded

Americans’ personal privacy is being crushed by the rise of a four-headed corporate-state surveillance system. The four “heads” are: federal government agencies; state and local law enforcement entities; telecoms, web sites & Internet “apps” companies; and private data aggregators (sometimes referred to as commercial data warehouses).

Conventional analysis treats these four domains of data gathering as separate and distinct; government agencies focus on security issues and corporate entities are concerned with commerce. Some overlap can be expected as, for example, in case of a terrorist attack or an online banking fraud. In both cases, an actual crime occurred.

But what happens when the boundary separating or restricting corporate-state collaboration, e.g., an exceptional crime-fighting incident, erodes and becomes the taken-for-granted operating environment, the new normal? Perhaps most troubling, what happens when the traditional safeguards offered by “watchdog” courts or regulatory organizations no longer seem to matter? What does it say that the entities designed to protect personal privacy rights seem to have either been effectively “captured” or become toothless tigers?

In President Eisenhower’s legendary 1960 farewell address, he warned of the potential power of the military-industrial complex. Ike’s 20th century formulation represented the intertwining of the U.S. military and private contractors to achieve two complementary goals. First, it sought to help corporations make guaranteed, cost-plus profits and to provide glide-path retirement programs for the military brass. Second, it sought to influence Congress and thus shape foreign policy, helping fulfill the then just-emerging global imperialist strategy.

Today’s corporate-state surveillance complex demonstrates a comparable intertwining of U.S. policing forces and private companies in the monitoring of domestic life. It is being implemented thanks to the technology fruits of a half-century of the military-industrial complex. The Defense Department created the Internet and what it can do in Yemen it can do in Oakland. The global war on terrorism is coming home!

In the wake of the Great Recession, we are living through a great economic and social restructuring. The global world order is shifting and, accordingly, America’s class and social relations are being reordered. Occupy Wall Street’s formulation of the social crisis, the 1% vs. the 99%, has become the shorthand descriptor of this restructuring of American economic relations. No time is better to impose high-tech social disciple then one marked by economic and social crisis. The unanswered question is obvious: Are we witnessing the formation of the high-tech police state?

* * *

To reiterate, the four-headed corporate-state surveillance hydra consists of (i) federal agencies; (ii) state and local law enforcement entities; (iii) telecoms, web sites & Internet “apps” companies; and (iv) private data aggregators. The following overview sketches out the parameters of the ever-growing domestic spy state, how it’s being implemented and some of the more egregious examples of abuse of public trust if not the law.

#1 — Federal Surveillance

The attacks of 9/11 and the subsequent (and endless) “war on terror” continue to provide the rationale for an ever-expanding domestic security state. The leading agencies gathering data on Americans (and others) include the National Security Agency (NSA), Department of Homeland Security (DHS) and Department of Defense (DoD) as well as the FBI and IRS. In the wake of 9/11, the NSA took the lead in federal domestic cyber surveillance, but in 2010 the NSA ceded this authority to the DHS.

Personal information is gathered from a host of both public and private sources. One source is “public records” that can range from birth, marriage and death records; court filings, arrest records, driver’s license information, property ownership registrations (e.g., car or house), tax records, professional licenses and even Securities and Exchange Commission filings. Another source is “private” records from ChoicePoint and LexisNexis as well as credit reporting agencies such as Equifax, Experian Information Solutions and Trans Union LLC.

The most Kafkaesque example of federal tracking efforts has been the DHS Transportation and Safety Administration’s (TSA) No-Fly List. As of 2011, it was estimated to contain about 10,000 names. The list’s inherent absurdity was illustrated when, some years before his death, Ted Kennedy discovered he (as “T. Kennedy”) was on the list.

The No-Fly List is administered by the Terrorist Screening Center (TSC) which cannot reveal whether a particular person is on the list, nor does it have the authority to remove someone from the list — that’s up to the FBI. The TSC also manages what is known as the Terrorist Watch List. Administered by the FBI, the list, according to an ACLU estimate, consists of 1 million names and is continually expanding.

DHS also maintains the Automated Biometric Identification System (IDENT) that has the fingerprints, photographs and biographical information on 126 million people.

During the July 4, 2012, holiday weekend, Pres. Obama quietly released a new Executive Order, “Assignment of National Security and Emergency Preparedness Communications Functions.” While ostensibly seeking to ensure the continuity of government communications during a national emergency, it grants new powers to the DHS over telecom. It permits the agency to collect public communications information and the authority to seize private facilities when necessary. The Executive Order is legislation through the back door, the Obama Administration’s effort to implement a law that Congress rejected in 2011.

Parallel to the DHS efforts, the FBI maintains a number of operations tracking Americans. The Integrated Automated Fingerprint Identification System (IAFIS) keeps fingerprint records of some 62 million people; it makes this resource available to 43 states and 5 other federal agencies. Soon, the agency will switch over to the NGI (Next Generation Initiative), which will contain face recognition searchable photos, iris scans, fingerprints, palm prints, and a record of scars and tatoos. The FBI coordinates the Combined DNA Index System (CODIS) that has DNA evidence from blood and saliva sample on more than 10 million people. In addition, the FBI maintains the Nationwide Suspicious Activity Reporting Initiative (SAR) that includes some 160,000 reports on people who allegedly acted suspiciously.

(These activities are separate from the recent revelation from AntiSec that found on a FBI agent laptop a database of 12 million Apple device owners’ users unique identify, including owner’s personal information.)

In 2004, Congress established the National Counterterrorism Center (NCTC) to serve as the “center for joint operational planning and joint intelligence, staffed by personnel from the various agencies.” It maintains the Terrorist Identities Datamart Environment (TIDE) that includes records on an estimated 740,000 people. Federal authorities claim that less than 2 percent of the people on file are US citizens or legal permanent residents. Earlier this year, Att. Gen. Eric Holder extended the agency’s ability to maintain private information about U.S. citizens when there is no suspicion that they are involved in terrorism from 180 days to five years.

The NSA’s authority overrides 4th Amendment guarantees safeguarding a citizen’s right from unreasonable search and seizure through what is known as a National Security Letter (NSL). In 2008, Congress revised the Foreign Intelligence Surveillance Act freeing the NSA from the bothersome requirement of having to prove probable cause before intercepting a person’s phone calls, text messages or emails from someone in the U.S. suspected of involvement with terrorism. Between 2000 and 2010 (excluding 2001 and 2002 for which no records are available), the FBI was issued 273,122 NSLs; in 2010, 24,287 letters were issued pertaining to 14,000 U.S. residents.

In June 2011, the DoD originally launched a pilot program, the Defense Industrial Base (DIB) Cyber Pilot, with 20 private companies. It would allow intelligence agencies to share threat information with private military contractors. Among the companies who participated were Lockheed Martin, Northrop Grumman and Raytheon as well as telcos AT&T, Verizon and CenturyLink. The telcos filter incoming email for malicious software. In May 2012, DoD and DHS announced plans to expand the program to 200 participants and the DoD estimates that approximately 8,000 firms could potentially participate.

DoD is aggressively promoting the Cyber Intelligence Sharing and Protection Act of 2011 (CISPA), which recently passed the House and is now before the Senate. Under this law, there would be a significant expansion in sharing of information related to “cyber hacking” (a very ill-defined term) between federal agencies, including DoD, NSA and DHS, and private companies. The information to be shared would cover both classified and unclassified data. The ostensible purpose of such data sharing would be to protect the nation’s telecom networks and customers from hack-attacks. Sure.

#2 — State and Local Law Enforcement

On July 9th, Rep. Ed Markey (D-MA) released the first set of findings from the House’s Bipartisan Congressional Privacy Caucus. It found that over 1.3 million federal, state and local law enforcement data requests were made to cellphone companies for personal records in 2011. Among the tracking information provided to law enforcement entities were: geo-locational or GPS data, 911 call responses, text message content, billing records, wiretaps, PING location data and what are known as cell tower “dumps” (i.e., a carrier provides all the phones numbers of cell users that connect with a discrete tower during a discrete period of time).

In a separate and equally revealing disclosure, the ACLU found that, based on records from over 200 local law enforcement agencies, most law enforcement groups that engaged in cell-phone tracking did not obtain a warrant, subpoena or other court order.

The Associated Press received a 2011 Pulitzer Prize for revealing the role played by the New York Police Department’s (NYPD) secret demographics unit. It undertook a federally funded, multi-million-dollar, multi-state surveillance program of Muslims in the metro-NY area, involving citizens and noncitizens alike. Most recently, the AP reported that, based on the testimony of one of the program’s senior executives, the NYPD failed to identify a single attack or threat.

Another NYPD anti-terrorist program is known as the Domain Awareness System (DAS). It was developed as a commercial partnership between the NYPD and Microsoft at an estimated cost of $30 to $40 million. With DAS, investigators can track individuals or incidents (e.g., a suspicious package) through live video feeds from some 3,000 CCTV cameras, 2,600 radiation substance detectors, check license plate numbers, pull up crime reports and cross-check all information against criminal and terrorist databases. Big Brother has become America’s new normal.

One area in which local government and private interests come together involves automatic license plate recognition. In New York and other cities through the country, LPR cameras are being mounted on lampposts, bridges and police patrol cars and capture images of license plates. These photos are a being shared with the National Insurance Crime Bureau that represents hundreds of insurance companies. Thus, private location data of U.S. citizens are being acquired and shared with commercial entities without their knowledge or consent.

#3 – Telecom, Web Sites & Internet “Apps” Companies

Rep. Markey disclosure revealed a lucrative scheme involving the security state outsourcing data gathering to ten major telecommunications companies, including AT&T, Verizon and T-Mobile. These companies made million of dollars supplying law enforcement agencies with personal telecom information.

However, a far bigger issue involves most of the major websites, including Google, Facebook, Amazon and iTunes, that systematically collect user data and commercializes it for corporate purposes; the telecoms engage in the same practice.

Many web companies fulfill government requests for a user’s personal information, but Google is one of the few companies that publicly reveal such requests. Most recently, it reported that during the second-half of 2011, U.S. government agencies made 12,243 requests and that it complied with 93 percent of them (11,386). This is 1,000 a month; what’s going on?

Wireless devices are two-way technologies. In addition to uploaded valuable personal data, wireless customers are sitting ducks for downloaded junk. Most smartphone users are unaware that when they download a “free” app they are downloading a Trojan horse.

According to a recent study by Lookout Mobile Security, more than half of the free apps embed advertising in their offerings and that these offerings are provided by ad networks. It estimates that 5 percent of all smartphone apps (representing 80 million downloads) are embedded with “aggressive” ad networks that can change bookmark settings and deliver ads outside the app they are embedded in. Games, and especially Google Play, had the highest rate of ad placements. The data from all these apps are being collected, analyzed and exploited for commercial gain.

#4 – Private Data Aggregators

Private sector tracking can be divided between three types of companies. One consists of those companies that facilitate commercial transactions, the ostensible bank like Visa or PayPal. A second consists of the ad agencies (most notably Google) that capture personal data through “click-throughs” and “cookies.” Finally, private data aggregators like ChoicePoint, Intelius, Lexis Nexis and US Search Profile that collect personal data, repackage it and offering it for sale. They acquire, slice & dice your personal information as if they were running sausage factories – and your personal life is the unlucky pig Together, they prove that nothing private is secret: the whole world is watching!

These companies track one’s every keystroke, every order and bill payment one makes, every word and/or phrase in one’s emails, even one’s every mobile movement through GPS tracking. Data capture involves everything from your personal Social Security number, phone calls, arrest record, credit card transactions and online viewing preferences as well as your medical and insurance records and even personal prescriptions.

* * *

The Constitution was adopted on September 17, 1787, and reserved privacy to a citizen’s person, home and property; the 4th Amendment prohibits illegal search and seizure. In the intervening 225 years, the notion of personal privacy has been radically transformed, especially in light of technological advances and the globalization of the marketplace. It was written in a pre-industrial, agrarian era and informs decisions made in a post-modern world.

Today, the Supreme Court’s 1967 decision, Katz v. U.S. (389 US 347), is all but forgotten. It established a link between the modes of telecommunication and personal privacy that illuminates today’s debate over the limits of privacy in the post-modern age.

In this case, Charles Katz used a public pay phone booth to place illegal gambling bets. In writing for the majority, Justice Potter Stewart noted, “One who occupies [a telephone booth], shuts the door behind him, and pays the toll that permits him to place a call is surely entitled to assume that the words he utters into the mouthpiece will not be broadcast to the world.”

Does someone making a call on a wireless device today have comparable rights as someone in a phone booth a half-century ago? Are the keystrokes an individual enters on a personal computer or a smartphone equivalent to an old-fashion voice call? And what of the personal information an individual provides to a 3rd party like a credit-card company, insurance company and telephone, wireless and Internet service provider?

The Katz decision was farsighted for the mid-20th century and one can only hope that its insight will inform the debate over 21st century digital technology and communications. More so, it serves as an analogy for contemporary notions of social life and their reasonable expectations of privacy.

However, war has long provided the rationale for the imposition of state tyranny. World War I hysteria found expression in the Espionage Act of 1917 and the Palmer Raids of 1920; World War II hysteria resulted in the mass roundup and imprisonment of 120,000 Japanese and Japanese-Americans; the Cold War gave us anti-Communism.

One consequence of 9/11 is that Constitutionally protected privacy rights have come under increasing threat from both private corporations and government entities. These two domains, the private and the state, traditionally function as separate, if not parallel, worlds. Since 9/11, both domains have not only been very busy collecting raw digital and other information on ordinary Americans, but have increasingly joined forces.

In the marketplace of valued data, one’s digital self (or selves) is increasingly being sliced and diced, collated and repackaged, as an ever more exact commodity. Nothing about a person’s electronic self, whether a credit-card purchase, parking ticket, GPS location, medical record or viewing practices, is private.

The military-industrial complex formalized the fiction that separates the corporate and the federal, serving as the revolving door for deals mae and rewarded. A permanent militarized state is now engaged in wars against “terrorists,” good-old foreign cyber-espionage with China, Iran, Russia and others, battles with criminal gangs, cyber hackers (like Anonymous) and whistle-blowers. The same technologies being employed to fight the war on terror internationally are being imposed on Americans in their most private, personal lives.

The police-corporate surveillance “complex” is being consolidated, drawing ever-closer corporate tracking and government surveillance. These entities collect data sent from different devices, that takes different forms and use different distribution networks. Such devices include a phone or smartphone, PC or tablet; they are separate from the network one employs, whether wireline, wireless or cable; and are distinct from the type of information one communicates, from email message, commercial transaction and social network connection to video download and medical records. Nevertheless, in our increasingly digitally mediated universe, all 1s and 0s are alike.

Today, nearly all the personal data gathering that takes place does so under one of two conditions. First, it is done by a consumer under the “terms of use” required by a take-it-or-leave-it offer for whatever service is offered (e.g., making a call, use of an iPhone, doing a Google search, ordering a book through Amazon). Second, it is ostensibly done “legally” by a law enforcement agency with a court order (or without such legal niceties).

The line between the corporate and the government is eroding. There seems to be a widening two-way street between law-enforcement entities (both federal or local) and private companies over information sharing. One form of working relation is ostensibly passive, a fee for service arrangement, as when a telco provides a user’s GPS tracking data or Google supplies user data. The information is provided when the company receives a court-approved request. However, as the ACLU found, cordial relations between law enforcement entities and telecoms often bypass legal niceties.

A second form of information sharing comes from the more traditional out-sourcing deal, the apparent collusion between a federal government agency and one of its former spymasters, former CIA director Richard Helms. His Virginia-based company, Abraxas Corp., created TrapWire correlates video surveillance with other data, including criminal and terrorist watch lists, facial recognition profiles, license plate information, stolen vehicles reports and other event data. It was acquired by San Diego-based, Cubic Corp., in 2010 for $124 million in cash.

A third form is the partnership, a for-profit venture between a local government and a major corporation. Welcome to Domain Awareness System in which the NYPD and Microsoft entered into a commercial venture. A flurry of press releases and TV appearances promoted the venture of Mayor Bloomberg 21st century capitalism. It would be interesting to examine the final financial projections to see what New York’s rate-of-return would be given its estimated $30 to $40 million investment.

Earlier this year, in Jones v. U.S., the Supreme Court ruled that the police are required to get a warrant before attaching a Global Position System (GPS) device a suspect’s car. In its decision, the Court rejected the Obama Justice Department’s claim that citizens have no expectation of privacy in public places. This decision may provide the rationale for a redrawing of the lines protecting privacy, communication and personal information.

Direct Link: http://www.salon.com/2012/09/11/four_ways_your_privacy_is_being_invaded/

Bypass “Congress” & “The People”… Again! White House Mulls Move as Cybersecurity Bill Fails

Articles of Interest, Crimes & Criminal Activity (Organized Crime, Narcotics, Predators, Cyber Crime, Cyber Stalking, UnSolved), National security, Terrorism, Cyber Terrorism & Related Crimes, Social Media, Technology & Digital Security Comments Off

Nov 162012

White House Mulls Move as Cybersecurity Bill Fails

Security Week
by APF
November 15, 2012

WASHINGTON – The White House said Thursday it was considering an executive order on cybersecurity after legislation on infrastructure protection failed again in the Senate.

“The president is determined to protect our nation against cyber threats,” said Caitlin Hayden, spokeswoman for the White House National Security Council after Wednesday’s failure in the Senate of a bill aimed at protecting US “critical infrastructure” from cyber attacks.

Hayden said the White House was exploring ways “to more effectively secure the nation’s critical infrastructure by working collaboratively with the private sector” and that this may result in an executive order.

She said such an order “is not a substitute for new legislation” and “doesn’t create new powers or authorities (but) it does set policy under existing law.”

In the lame-duck session, the bill backed by President Barack Obama failed to get the 60 votes needed to proceed under Senate rules. It was backed by a 51-47 vote.

The failure of the bill for the second time in three months prompted political sniping from supporters and detractors.

“Once again, Senate Republicans have chosen to filibuster much-needed cybersecurity legislation and, in so doing, have ignored the advice of the country’s most senior military and national security officials,” said Senator Jay Rockefeller, a key backer of the measure.

“Republican members have once again sided with the Chamber of Commerce, and not our military officials, on a national security issue.”

Republican Senator Charles Grassley, however, claimed the bill was “flawed” and failed to see adequate debate.

“No one disputes the need for Congress to address cybersecurity,” Grassley said.

“However, members do disagree with the notion this problem requires legislation that increases the size of the federal government bureaucracy and places new burdens and regulation on businesses.”

The measure was blocked amid opposition from an unusual coalition of civil libertarians — who feared it could allow too much government snooping — and conservatives who said it would create a new bureaucracy.

US military officials have argued that legislation is needed to protect infrastructure critical to safeguarding national defense, including power grids, water systems and industries ranging from transportation to communication.

Senator Susan Collins, a Republican who supported the bill, said the issue remains of critical importance.

“Every day that we wait, our country becomes more vulnerable to a serious cyber attack, indeed a catastrophic attack,” she said in a statement.

“Experts have also repeatedly warned that the computer systems that run our critical infrastructure — our electric grid, pipelines, water systems, financial networks, and transportation systems — are vulnerable to a major cyber attack.”

Some industry leaders expressed disappointment on the failure of the bill.

“Stalemate doesn’t make the issue go away,” said Software Alliance president Robert Holleyman.

“There is no getting around the fact that we need to bolster America’s cybersecurity capabilities. We urge both parties to put this issue at the top of the agenda in the next Congress.”

The Electronic Frontier Foundation, which promotes online freedoms, called the Senate bill “dangerously vague” and a threat to privacy.

“We’re looking forward to having a more informed debate about cybersecurity next session, and hope Congress will bear in mind the serious privacy interests of individual Internet users,” said EFF attorney Lee Tien.

“We don’t need to water down existing privacy law to address the challenges of cybersecurity.”

In a related matter, the White House confirmed reports this week that Obama signed a directive which can help the US military thwart cyber attacks.

“This step is part of the administration’s focus on cybersecurity as a top priority. The cyber threat has evolved since 2004, and we have new experiences to take into account,” a senior US official said.

“The directive itself is classified, so we cannot discuss all of the elements contained in it,” the official said, adding that it “establishes principles and processes for the use of cyber operations so that cyber tools are integrated with the full array of national security tools we have at our disposal.”

Direct Link: http://www.securityweek.com/white-house-mulls-move-cybersecurity-bill-fails

The FBI’s Secret Surveillance Letters to Tech Companies

Jul 092012

The FBI’s Secret Surveillance Letters to Tech Companies

The Wall Street Journal

Digits

By Jennifer Valentino-DeVries

June 27, 2012

Just what kind of information can the government get with a so-called “national security letter” – the tool that allows investigators to seek financial, phone and Internet data without a judge’s approval?

It’s a secret.

: Information requested on phone records

The letters let the Federal Bureau of Investigation get information without going before a judge or grand jury if it’s relevant to a national security investigation. The letters have been around since the 1980s, but their use grew after the Sept. 11, 2001 terrorist attacks and passage of the USA Patriot Act. Tens of thousands of the requests are sent each year, but they are generally subject to strict secrecy orders.

In response to a Freedom of Information Act request by the American Civil Liberties Union, the Justice Department has revealed for the first time templates for each of the types of national security letters it sends – nine in all. Among other things, the letters show that the FBI is now informing people who receive the letters how they can challenge the documents in court.

But some key elements of the letters remain blocked from view – including lists of material the FBI says companies can send in response to the letter.

The most basic requests outlined in the templates are for name, address and length of service for either phone or Internet accounts. The broadest requests seek things such as entire credit reports, Internet activity logs, phone “billing records,” “financial records” or “electronic communications transactional records.”

What exactly do those terms mean? Well, there’s the rub.

A 2008 opinion from the Justice Department’s legal counsel found that the letters could request “only those categories of information parallel to subscriber information and toll billing records for ordinary telephone service.” What exactly counts as “parallel” could be debated.

In several of the templates, the FBI includes a list of specific items that “may be considered” by the companies to be responsive to the requests. The list for phone billing records includes 15 bullet points; there are 13 points on the list for electronic data. The items associated with financial records appear to stretch on for two pages. But we can’t know for sure what is there because it has been redacted.

Some broad outlines are available: Financial records include “any record held by a financial institution pertaining to a customer’s relationship with the financial institution.”

Electronic records involve “transaction/activity logs” and email “header information,” which includes things such as the “to” and “from” lines of a message.

The letters point out that companies aren’t supposed to tell investigators about the content of their customers’ messages; courts have long held that phone conversations and the texts of recent emails are available only with search warrants. The template to get electronic records specifically warns companies not to provide the subject lines of emails for this reason.

Beyond that, it’s unclear.

“There is a growing divide between the government’s and the public’s understanding of the government’s surveillance authority,” said Alexander Abdo, a staff attorney with the ACLU. “To this day, the government refuses to specify what certain surveillance laws—including ‘national security letters’—allow it to collect.”

The government says it seeks only the information it’s allowed to get and must maintain the secrecy of national security letters to avoid tipping off potential terrorists.

“NSLs are integral to determining whether, how, and by whom our nation is being put at risk,” then Acting Assistant Attorney General for National Security Todd Hinnen told a House Judiciary subcommittee last year in written remarks.

The templates disclosed in the ACLU files show how the FBI has changed the letters in response to court rulings and new laws. The gag order that accompanies most of the letters is no longer an “automatic feature,” the FBI says in instructions to agents. To get a secrecy order, the agent must certify that disclosure “may endanger the national security of the United States, interfere with a criminal, counterterrorism, or counterintelligence investigation, interfere with diplomatic relations, or endanger the life of physical safety of a person.”

In all of the letters, the FBI tells the recipient that it can challenge the letter “if compliance would be unreasonable, oppressive, or otherwise unlawful.” It also outlines a process for fighting the nondisclosure order: The company has 10 days to tell the FBI it wants to challenge the gag order, and the FBI says it will then “initiate judicial proceedings” to get a court order to enforce the gag.

In the first two years after the FBI began including this notice in its letters, only a handful of companies challenged the gag orders, the FBI has said.

Many major technology companies have guidelines for handling national security letters, although they cannot confirm or deny ever having received the letters, under the strict secrecy order that accompanies most of the requests. Mr. Hinnen told the subcommittee last year that a “small number of providers” had concluded that the FBI wasn’t entitled to electronic communications transactional records, because the law wasn’t clear.

Companies are reluctant to disclose their specific policies, though. In responses to questions from The Wall Street Journal, Facebook was the only company to say specifically what data it would give out.

“We interpret the national security letter provision as applied to Facebook to require the production of only two categories of information: name and length of service,” said Fred Wolens, a public policy spokesman for the social networking giant.

Other companies were more vague. Google and Twitter both said their companies comply with “valid legal process” and seek to notify users of requests whenever possible. Verizon and AT&T both said they do not comment on national security matters.

Direct Link: http://blogs.wsj.com/digits/2012/06/27/the-fbis-secret-surveillance-letters-to-tech-companies/

Important Topic: “How to Use PGP for More Secure Email” by Jennifer Valentino-DeVries ( Talented Writer & Very Easy on the Eyes! )

Articles of Interest, Crimes & Criminal Activity (Organized Crime, Narcotics, Predators, Cyber Crime, Cyber Stalking, UnSolved), Firearms, Weapons & Personal Safety, National security, Terrorism, Cyber Terrorism & Related Crimes, Social Media, Technology & Digital Security No Responses »

Jun 082012

How to Use PGP for More Secure Email

By: Jennifer Valentino-DeVries

January 22, 2012

If you want to communicate more securely, encryption can be a good solution. For email, I use a tool called PGP, which stands for “pretty good privacy” and which relies on a system of “keys” to lock and unlock data. PGP does a good job of protecting the content of your messages, but using it isn’t exactly simple, especially for the average person.

I’ve gotten a few questions in the past several months from journalists and others who want to email in a more secure way but don’t yet know how to use PGP, so I figured I’d provide some basic instructions. If you have any further questions, please feel free to let me know.

Before you get started, a word of caution: Using encrypted email can protect the contents of your messages, but it doesn’t hide the fact that you were sending the message in the first place.

FOR PC USERS

Download and install GPG4Win

(1) Go to Gpg4win.org and click download. Click gpg4win 2.1.0 to start the correct download.

(2) The program should now be in your downloads folder as gpg4win-2.1.0.exe. Click or double click to run the program, and hit run.

(3) Click Next to install. The only default option you should change in this process is to install links on the desktop. Otherwise keep clicking Next.

(4) Check Root certificate defined or skip configuration, then click Next. Reboot the computer.

(5) Once the computer reboots, you’ll see icons that say GPA, Kleopatra and Gpg4win Documentation. We will be dealing only with the GPA, or GNU Privacy Assistant, so you can “recycle” those other items if you wish.

Set up your keys

(1) Double click the GPA icon to open it. This is your “key manager.”

(2) The first thing we’ll do is create a new key. To do this, click on the Key menu and select New Key.

(3) Insert your name and click Forward. Then insert the email address with which you will associate this key and click Forward. Elect to make a backup copy of the key when prompted.

(4) You’ll then be asked to create the password you’ll use to access your key. Don’t use something silly such as “password” or “12345,” and don’t use a word you can find in the dictionary or an easy-to-guess series of numbers like your birthday.

Instead, use something memorable but hard to guess. I have several techniques, including thinking of phrases associated with my own childhood memories and then misspelling them or inserting other characters in them. Some more good ideas are here.

(5) While the key is being created, move your mouse around or type into another application. This helps the program create a better key. Don’t get worried if it takes a few minutes. Once the program has finished creating your key, you’ll see it in the main window.

(6) You’ll want to send the “public” version of your key out to a keyserver, so other people can find it. To do that, click on Server, then Send Keys. Sometimes it takes a while for your key to be sent, but don’t worry; it will get there.

(7) Now you’ll need to get the keys of the people you want to email. To retrieve keys, click on Server, then Retrieve Keys. You have to know the ID of the key you’re looking for; to get this, you can ask the person whose key you want.

However, I personally have had problems recently retrieving keys using GPA and the key server. Instead, it may be easier to import the keys of friends you want to email.

People can send you keys as files, or they might link to them online. My key is here. To save it as a file, right click and select “save as,” then save it to your desktop or downloads file. To import it into the GPA, select Import, then select the saved file and click “open.”

Start Encrypting

Now that you have keys, you’re ready to encrypt. GPG4win has the ability to integrate with certain email programs, including Outlook 2003 and 2007, but I find Outlook integration cumbersome on my work PC, because of several issues related to our network in the office. So I am going to describe what to do if you want to use Outlook but will also walk you through encrypting text and files so that you can paste encrypted messages into any email program.

Using Outlook

(1) After you install GPG4win, GnuPG and an Outlook extension called GpgOL should be available when you restart Outlook.

(2) Compose a new message in Outlook and address it to someone whose key you have. Then go to Extras and Encrypt Message, or click the “lock” icon button in the toolbar.

One word of caution: This does not work well if you are using Microsoft Word as your editing program, and it works better if you use plain text emails rather than HTML emails.

Using GPA

(1) If you click on the clipboard icon in the main window, it will bring up a window where you can type or paste text.

(2) Once you have put your message into the window, click “encrypt.”
Another window will pop up, where you can select the key of the recipient. Click OK.

(3) The message will be converted to encrypted text. You can paste this into the body of an email and send it.

(4) You can also encrypt entire files by clicking the “Files” button in the main window.

(5) If you are sending an encrypted email to someone for the first time, it’s polite to include your public key, so they don’t have to look for it on the key server. To do this, simply hit Export in the main window, choose a name for your key, and click save. Then attach that file to the email you are sending.

Decrypt

In Outlook, encrypted messages should be decrypted automatically. To decrypt messages using GPA, simply copy and paste the full encrypted message into the clipboard, and click “decrypt.”

FOR MAC USERS

Download and Install GPGTools

(1) Download GPGTools by clicking the “Download” button here.

(2) Open the .dmg file that is saved onto your machine. (It will probably be in your Downloads folder, depending on your settings.)

(3) Click on GPGTools.mpkg to run the installer. Just keep clicking “continue” to install the program.

Set Up Your Keys

(1) Your Applications folder should now contain a program called GPG Keychain Access. Start that program.

(2) First, you’ll want to create your own PGP key. Click on the key icon labeled “new” at the top left of the GPG Keychain Access window.

(3) Fill out the form with the name and email address you want to use. Using the drop-down menu, change the length to 4096. Choose an expiration date a year from now. Click “Generate Key.”

(4) A window will pop up asking you for a password. This is where you make up the password you’ll use to access your key. Don’t use something silly such as “password” or “12345,” and don’t use a word you can find in the dictionary or an easy-to-guess series of numbers like your birthday.

(5) Enter the password again to confirm it.

(6) While the key is being created, move your mouse around or type into another application. This helps the program create a better key. Don’t get worried if it takes a few minutes. Once the program has finished creating your key, you’ll see it in the main window.

(7) You’ll want to send the “public” version of your key out to a keyserver, so other people can find it. To do that, highlight your key, go to the Key menu and select “send to keyserver.” Sometimes it takes a while for your key to be sent, but don’t worry; it will get there.

(8) Now you’ll need to get the keys of the people you want to email. In the “Key” menu, select “Search for Key” and search for the name or email address of the person you want to contact. Generally, you should select only the most recent key, which will appear at the top of the list. This means you’ll need to uncheck the other keys; otherwise they will all be retrieved. Click “Retrieve Key” when you’re finished.

If someone has given you their public key as a file, you can import it by selecting the icon that says “Import” and selecting the file from your computer.

The person’s “public key” will now show up in your list, along with your own key.

Start Encrypting

Now you’re ready to encrypt! There are two main ways to do this, and I’ll outline both below. The first option is more straightforward for most users. The second option allows you to encrypt documents and other text, not just emails.

Using the Mac Email Program

(1) To use the Mac Email program with GPGMail, you must be using the email address that you have associated with your key. If that is the case, simply start up or restart your email program. GPGMail should have been integrated automatically.

(2) To send an encrypted message, type the name of a recipient whose key you have. You will see a little “lock” icon near the top right of the message pane. Set it in the “locked” position; your email will be encrypted.

Using OpenPGP Services (Works With Any Email, Not Just Mac Mail)

(1) You’ll need to set up your system to encrypt and decrypt text and files. To do this, go to the Apple menu and select System Preferences. Select the Keyboard icon and then click on Keyboard Shortcuts. In the left column, select Services.

On the right, you’ll see two sets of possible selections that start with “OpenPGP.” One will be under the “Files and Folders” section, while the other will be under “Text.” Make sure everything that starts with “OpenPGP” is selected on both sections. (Don’t worry if it tells you the shortcut is already used by another action. Just ignore that.) Then close out that window.

(2) Open up TextEdit or a word processing program and type a message. Once you’ve typed the message, select the text. Then go to the TextEdit menu (or the Microsoft Word menu, depending on which program you’re using) and hover over Services. Select OpenPGP:Encrypt. Check the name of your recipient, and then click “OK.”

(3) The program will convert your message into encrypted text. You can cut and paste that entire block (including the parts that say Begin PGP Message and End PGP Message) into whatever email program you use.

(4) One last thing to keep in mind: Make sure your recipient can find your public key, in case a response is required. You can do this by including your information in your original message, so your key can be found on the keyserver. Or you can go back to GPG Keychain Access, click on the “Export” key icon and save your public key as an ASCII file. This file can be attached to your email.

Decrypt

If you receive an encrypted email, you’ll need to decrypt it to read it. If you’re using Mac Mail, you’ll see options to do this when you get an encrypted message. If you’re using OpenPGP Services, simply select the entire block of encyrpted text, go to Services in the program drop-down and select OpenPGP:Decrypt.

Direct Link: http://jennifervalentinodevries.com/blog/2012/01/22/how-to-use-pgp-for-more-secure-email/

Older Entries