Intelligence Committee Pins A ‘Surveil Me’ Sign On Wikileaks’ Back In Latest Authorization Bill – Techdirt

President Trump seemed to think Wikileaks was a fine establishment while on the campaign trail. As long as Wikileaks kept serving up DNC documents, it could do nothing wrong. Since his election, however, things have changed. The administration is plagued by leaks. Even though Wikileaks hasn't played a part in those leaks, it has continued to dump CIA documents -- something the White House isn't thrilled with.

Back in April, the new DOJ -- under the leadership of 80s throwback AG Sessions -- announced it had prepared charges to arrest Julian Assange. This was something Obama's administration talked about, but never actually got around to doing. Pursuing Assange and Wikileaks for publishing leaked documents would set a dangerous precedent, paving the way for domestic prosecutions of news agencies.

Fortunately, nothing has moved forward on that front yet. But it appears at least a few Senators would like to further distance Wikileaks from any definition of journalism. As Spencer Ackerman reports for The Daily Beast, the Senate Intelligence Community wants to redefine Wikileaks as a hostile entity.

The committee wants Congress to declare WikiLeaks a non-state hostile intelligence service, which would open Julian Assange and the pro-transparency organization which most of the U.S. government considers a handmaiden of Russian intelligence to new levels of surveillance.

On Friday, the committee quietly published its annual intelligence authorization, a bill that blesses the next years worth of intelligence operations. The bill passed the committee late last month on a 14-1 vote, with Democrat Ron Wyden of Oregon as the lone dissenter, owing to what he calls the legal, constitutional and policy implications that the WikiLeaks provision may entail.

The latest intelligence authorization bill runs nearly 60 pages. Perhaps the committee members adding this toxic little pill thought no one would read it all the way to the end. The very last section of the bill (Section 623 to be precise) is titled "Sense of Congress on Wikileaks." It asks for legislators to take an official stance on the group.

It is the sense of Congress that WikiLeaks and the senior leadership of WikiLeaks resemble a non-state hostile intelligence service often abetted by state actors and should be treated as such a service by the United States.

As Ackerman points out, the language in the bill channels CIA head Mike Pompeo, who is understandably (and continually) incensed by Wikileaks' publication of documents pertaining to CIA surveillance tools. Pompeo himself is a fair-weather friend of transparency, having tweeted his praise for Wikileaks while it was still dumping DNC documents.

This could put Wikileaks under (even more) surveillance and would likely allow site visitors, donors, and correspondents to become surveillance targets themselves.

It would allow the intelligence community to collect against them the same way they collect against al-Qaeda, [former House Intelligence Committee staffer Mieke] Eoyang said. If you think youre helping WikiLeaks to aid a transparency organization, the US government fundamentally disagrees with you and you could find yourself on other end of NSA scrutiny.

As is usually the case when the Senate Intelligence Committee offers up questionable or terrible proposals, Senator Ron Wyden was the sole committee member to vote against the authorization bill.

Go here to read the rest:
Intelligence Committee Pins A 'Surveil Me' Sign On Wikileaks' Back In Latest Authorization Bill - Techdirt

Chelsea Manning: Beauty Is ‘An Expression of My Humanity’ – Us … – Us Weekly

After being released from prison in May,Chelsea Manning is feeling like a whole new woman. The 29-year-old penned an essay for Yahoo Beauty about her experience finally being open with the world about her identity, and exploring that through the self-expression of style and beauty.

To Manning, beauty has a deeper meaning beyond lipgloss and eyeshadow. "I choose my lipstick colors carefully," she revealed in the essay. "I'm not just saying, 'I like this edgy color.' This is an expression of my humanity. And beauty, to me, is self-expression."

She continued, "Now that I'm out and free, I love experimenting with makeup. I use it to project different moods and emphasize what I'm trying to say in a particular moment."

Her fairly extensive daily makeup routine now involves playing with bold shades, for an important reason: "Most days I put on a liquid foundation, some powder for highlights, eyeliner, a mascara base, and mascara, with either a lipstick or gloss for the day. I'm wearing a lot of bold lipsticks, because I'm trying to make bold statements: I'm here and I'm free and I can do whatever I want."

She also reflected on her past, and how her story of being a transgender person in the military quickly gained media attention. "The first time the world saw me as I see me is that picture that went viral of me in the blond wig, which I sent to my superior," Manning wrote. "I took that picture for myself when I was on leave in January of 2010. I took it as a little memento of who I was at that moment. I never intended it to be shared with the world. When I look at that picture now, I see me but I see me in a phase of trying to figure myself out. I'm much closer to who I am today than I was in that photo. But it was a process to get here."

Be a trendsetter! Sign up now for the Stylish by Us Weekly newsletters to get celeb fashion, beauty tips, and more delivered directly to your inbox.

See more here:
Chelsea Manning: Beauty Is 'An Expression of My Humanity' - Us ... - Us Weekly

Edward Snowden will appear at the Free Library of Philadelphia … – PhillyVoice.com

Its already been four years since the events surrounding Edward Snowden, the former CIA employee who disclosed classified government information and rose to global prominence, unfolded,leading him to spend40 days living in the Russian airport after he was charged with espionage.

Though Snowden is still living in Russia, now at an undisclosed location, he will be here in Philly sort of for a conversation at the Free Library of Philadelphia.

Appearing via live closed-circuit video link, he will speak with Jeremy Scahill, an investigative journalist and editor of the online publication The Intercept.The two will converse about Snowden's disclosures and the surveillance state in thenation under President Donald Trump.

Though Snowden will appear through the video link, Scahill will be at the Free Library in person.

The event will be held on Monday, Sept. 11, at 7:30 p.m. at the Free Librarys Parkway Central location, near Logan Circle.

Tickets go on sale Tuesday at 10 a.m. for $35 and are available here.

As the Free Library expects the event to sell out, additional $15 tickets will be sold so that people can watch a live broadcast of the event in a separate room at the Parkway Central branch.

Excerpt from:
Edward Snowden will appear at the Free Library of Philadelphia ... - PhillyVoice.com

Trump, former top spy trade verbal barbs – Honolulu Star-Advertiser

Top News

Associated Press

Posted August 24, 2017

August 24, 2017

Updated August 24, 2017 9:45am

ASSOCIATED PRESS

Ten-National Intelligence Director James Clapper testifies on Capitol Hill in Washington. President Donald Trump and Clapper, the former national intelligence chief, are trading verbal barbs that started after Clapper questioned Trumps fitness to be in the Oval Office.

WASHINGTON >> President Donald Trump and James Clapper, the former national intelligence chief, are trading verbal barbs that started after Clapper questioned Trumps fitness to be in the Oval Office.

Trump tweeted Thursday that Clapper was caught lying to Congress.

Clapper says he simply misspoke a few years ago when he said the U.S. was not collecting Americans data. Documents leaked by Edward Snowden later indicated widespread domestic surveillance.

Trump also said Clapper sent him a beautiful letter.

Clapper tells CNN that he wrote Trump the night before the election saying he hoped the president would support the intelligence agencies practice of speaking truth to power.

Clapper says Trump thanked him for the note, then later depicted the intelligence community as Nazis for delivering information about Russian interference in the election.

Visit link:
Trump, former top spy trade verbal barbs - Honolulu Star-Advertiser

This fellowship program brings tech knowledge to Congress – Technical.ly

When Edward Snowden released thousands of classified NSA documents,Travis Moore was tasked with learning about the information fast. Asthe former legislative director for U.S. Rep.Henry Waxman, Moore scrambled to find technical expertise on bulk metadata, the NSAs programs, and the implications of the breach. Ultimately, he had to look outside the halls of Congress.

With tech-related issues continuing to gain importance, the experience left him looking to bring more expertise to the Capitol Hill. Moore created TechCongress, a 13-month fellowship that places technologists either in congressional offices or committees to provide knowledge on various legislation, emerging technologies, and concerns.

From now until September 28, TechCongress will accept applications for next years cohort.

According to Moore, successful candidates possess three traits:

TechCongress is a young program, having only started in 2015, but theyve already stumbled upon interesting takeaways. One was the level of veteran interest. In their first year, three of their top five candidates included veterans. Two of them later became inaugural fellows. For 2017, Moore and his team plan to focus on bringing in more veterans and diversifying their program with more female fellows.

Sunmin Kim (left), TechCongress first female fellow, with U.S. Sen. Brian Schatz of Hawaii (Courtesy photo).

Fellows receive first-hand experience on the Hill as a staffer. JC Cannon, former TechCongress fellow from the inaugural class, told Technical.ly that the most important thing the fellows gain is an understanding of how Congress works. He came to quickly understand the need for his expertise.

Legislative issues such as communication encryption, drones and bulk collection require input from those familiar with the technology. I soon became the go-to person for [congressional] staffers with technical questions, Cannon said.

He wasnt only weighing in on the hot-button issues about the future of technology. During his time on the Hill, Cannon worked on a health subcommittee. For his part, Moore figured that the fellowship program would focus on more traditional tech policy like IT or cybersecurity in their first few years before branching out to other committees. It was another sign of the need for the expertise that the fellows can offer.

Decent government decision making and policymaking in the 21st century requires having an understanding of technology infrastructure that underlies all of these issues, Moore said.

Nia Dickens is a writer and recent transplant to Philadelphia. She received a Fulbright grant in 2015 and spent two years teaching English in Europe. When she's not busy acclimating back to the fact that everything is open on Sundays, she's catching up on endless hours of TV, especially Jane the Virgin.

View original post here:
This fellowship program brings tech knowledge to Congress - Technical.ly

FACT CHECK: Did Clapper Get ‘Caught Lying To Congress’? – The Daily Caller

FACT CHECK: Did Clapper Get 'Caught Lying To Congress'?
The Daily Caller
Snowden then disclosed thousands of classified and confidential NSA documents to journalists and in doing so revealed a vast NSA spying apparatus on millions of Americans by the NSA. The exact size of the leak or number of documents leaked by ...

and more »

More here:
FACT CHECK: Did Clapper Get 'Caught Lying To Congress'? - The Daily Caller

How to use EFS encryption to encrypt individual files and folders on Windows 10 – Windows Central


Windows Central
How to use EFS encryption to encrypt individual files and folders on Windows 10
Windows Central
Encrypting File System (EFS) is an encryption service found in Windows 10 Pro, Enterprise, and Education. A cousin to BitLocker, which can encrypt entire drives at once, EFS lets you encrypt individual files and folders. Encryption is tied to the PC ...

View post:
How to use EFS encryption to encrypt individual files and folders on Windows 10 - Windows Central

Sophos, Trend Micro, Symantec Lauded for Cloud Encryption – Channel Partners

The global cloud encryption market is expected to quadruple from $645.4 million this year to $2.4 billion by 2022. Thats a compound annual growth rate of 30 percent.

Thats according to a new report by MarketsandMarkets, which IDs Sophos, Trend Micro and Symantec among the major vendors. Others includeThales e-Security, Gemalto, Skyhigh Networks, Netskope, CipherCloud, HyTrust, Vaultivand TWD Industries.

The demand for cloud encryption mostlyis driven by stringent government regulations and the need to protect mission-critical data residing in the cloud, the report says. With the rising demand for cloud and virtualization across numerousverticals, the adoption rate of cloud encryption among enterprises is expected to gain major tractionover the next five years.

The infrastructure-as-a-service (IaaS) model is expected to hold the largest market share. Itsused to run applications on the public cloud and it allowsorganizations to reduce the total cost of ownership since its being provided by third-party vendors in the form of cloud-based data centers. However, virtualization introduces new security challenges, so enterprises are adopting cloud encryption to run business-critical functions securely.

The telecom and IT vertical is expected to grow the fastest.Thats due to heavy useof cloud-based applications for business operations, frequent targets forcybercriminals.

North Americais expected to have the largest market share and to dominate themarketfrom 2017 to 2022, dueto the early adoption of new and emerging technologies and the presence of a large number of players in this region. Asia Pacific offers extensive growth opportunitiesdueto the largenumber of SMEs that are extensively adopting cloud technology.

Here is the original post:
Sophos, Trend Micro, Symantec Lauded for Cloud Encryption - Channel Partners

Hedvig storage upgrade adds flash tier, encryption options – TechTarget

Hedvig today launched the third version of its software-defined storage product featuring support for flash tiering, built-in encryption technology, and new plugins for third-party backup and container technologies.

NVMes no longer just a protocol for fast flash drive connections to a PC via the PCI Express bus. Discover the future of NVMe usage here, including exclusive details on how the M.2 SSD form factor is approaching server-ready capacity and speed.

By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.

You also agree that your personal information may be transferred and processed in the United States, and that you have read and agree to the Terms of Use and the Privacy Policy.

Hedvig storage software runs on commodity hardware. Hedvig doesn't sell the hardware, but supports moving data between fast flash-based solid-state drives(SSDs) and a tier of slower, less expensive hard disk drives (HDDs). Hedvig's new FlashFabric enables two storage tiers in all-SSD server clusters that can span on-premises and public cloud environments.

Hedvig Distributed Storage Platform 3.0 detects performance differences in SSDs, according to Rob Whiteley, Hedvig vice president of marketing. He said those SSDs can be traditional SAS or SATA, newer latency-lowering NVMe-based PCI Express, or emerging 3D XPoint technology from Intel and Micron.

"There are configurations where the customer will have some amount of higher performance, higher cost NVMe flash plus some amount of more traditional enterprise-grade flash," Whiteley said. "And what they actually want is the ability to automatically tier in and out of different flavors of flash."

Howard Marks, founder and chief scientist at storage test lab DeepStorage LLC, said Hedvig's 3.0 release is major from a technological standpoint, but the company is early with its support for "all-flash hybrids" with more than one type of SSD.

"The majority of the all-flash systems we see today have one pool of flash. But between NVMe and upcoming post-flash memories like 3D XPoint, we are going to have at least two tiers of solid state," Marks said. "That means folks like Hedvig, who have the logic for dealing with multiple tiers built into their system, have an advantage."

Whitely said the Hedvig storage software tracks data reads and writes at a granular level to ensure the hottest data lands on the highest performing storage media. To enable the SSD tiering, Hedvig engineers created write-through read caches that could take advantage of different flash tiers, he said.

"Our system has always been very flash friendly from a write perspective," Whitely said. "There were just some additional things we wanted to do from a read perspective."

New Hedvig storage security features include software-based encryption for data in use, in flight and at rest; advanced audit logging designed to enhance the product's monitoring and analytics engines; and improved multitenant role-based access control tying into Lightweight Directory Access Protocol (LDAP) and Microsoft Active Directory.

Hedvig's 256-bit Encrypt360 technology secures data through proxy software deployed on host compute servers to minimize the performance hit. The software supports the Advanced Encryption Standard New Instructions from Intel to accelerate host encryption.

Hedvig software deduplicates data before encryption. As with deduplication and replication, Hedvig enables customers to turn encryption on and off on a per-volume, or virtual disk (vDisk), basis, Whiteley said.

In the past, Hedvig advised customers to use self-encrypting drives or third-party products for in-flight encryption, Whiteley said.

"What we've found in the software-defined storage world is self-encrypting drives are often a generation or two behind in hardware technology, and they're a lot more expensive," Whiteley said. "Plus, how you then do the key management becomes a very difficult proposition for a lot of large enterprises."

Hedvig does not supply a key management system. The company tested and validated Amazon Web Services' Key Management Service option, and depending on the API, could plug into other third-party key management systems, according to Whiteley.

When setting up a cluster, the Hedvig storage proxy reaches out to the key management system for a unique encryption key for each vDisk. The vDisk keys are cached at the proxy and stored in Hedvig's metadata engine, according to Eric Carter, the company's senior director of product management.

The third feature set in Hedvig's new 3.0 storage software is CloudScale Plugins for Veritas, VMware and Red Hat products, to add to the company's existing support for Docker and OpenStack.

The new Veritas OpenStorage Technology plugin will enable NetBackup customers to connect to Hedvig for deduplicated backup storage. Whiteley said the Veritas NetBackup plugin is "probably the most requested customer feature besides encryption."

Hedvig already had a VMware vSphere Web Client plugin, but it is now certified, with new backup and security capabilities. In addition, Hedvig Storage Proxy containers are now Red Hat-certified and published in the Red Hat Container Catalog. The containers support Red Hat Enterprise Linux and Red Hat's OpenShift container application development platform.

Pricing remains unchanged for the Hedvig Distributed Storage Platform, which becomes generally available Friday. Hedvig partners with Cisco, Dell, Hewlett Packard Enterprise (HPE), Lenovo, Quanta and Super Micro on hardware.

Hedvig and HPE in June launched a validated bundled option combining Hedvig's software-defined storage with HPE Apollo 4200 servers. Whiteley said the bundled product, for which HPE provides first-line support, has already grown to about half the opportunities in the company's sales pipeline.

"Just having the HPE sales force boots on the ground is going to be a big driver for both their growth and their market acceptance," Marks said. "If an HPE sales guy sells Hedvig, it counts against their storage quota. Sales guys sell what you incent them to sell."

Hedvig CEO sees public, private clouds blurring

Scale-out software-defined storage on the rise

Guide to software-defined market and products

Read the original post:
Hedvig storage upgrade adds flash tier, encryption options - TechTarget

Open-Source Software Won’t Ensure Election Security – Lawfare (blog)

The technology behind elections is hard to get right. Elections require security. They also require transparency: anyone should be able to observe enough of the election process, from distribution of ballots, to the counting and canvassing of votes, to verify that the reported winners really won. But if people vote on computers or votes are tallied by computers, key steps of the election are not transparent and additional measures are needed to confirm the results.

In a New York Times op-ed a couple weeks ago, James Woolsey and Brian Fox proposed using "open-source systems that can guard our votes against manipulation." Their hypothesis is that "open-source software is less vulnerable to hacking" than proprietary voting software because "anyone can see how open-source systems operate. Bugs can be spotted and remedied, deterring those who would attempt attacks. This makes them much more secure than closed-source models." This sounds reasonable, but in fact, open-source systems are only one step towards guarding our votes against manipulationand the hypothesis that using open source software willby itselfimprove security is questionable at best.

First, with the systems in use today, there is no guarantee that the software running on any machine is in fact the software it is supposed to be running, open source or not. And even if we could know with certainty that the installed software matches the software source, the quality of the software is critical. Poorly written software, whether open source or not, creates vulnerabilities, and is thus vulnerable to hacking. Open source software allows anyone to detect vulnerabilities. We do not believe in "security through obscurity"that is, relying on secrecy as a primary security strategybut making source code available to everyone for inspection makes it available to the attackers for inspection. And the attackers are often highly motivated to find vulnerabilities.

Complicating this is the relative ease of identifying one vulnerability and the difficulty of finding them all. Attackers need to find just a single flaw in order to exploit a system. On the other hand, it is very easy for reviewers to miss somethingthe Heartbleed bug that affected millions of websites and devices in 2014 occurred in open source softwareor to make assumptions about the environment in which the source code is executed that turn out to be wrong. Software authors, maintainers, election officials, and other defenders must find every flaw, fix them all, and then distribute the fixed system (or patches) to everyone using the system.

Patch distribution creates its own set of potential problems, as it informs attackers that there was a vulnerability (and where in the code it is), leaving anyone who does not immediately install the patch especially vulnerable. For example, many years ago, a response group announced a patch to a well-known, widely used piece of software. Within thirty minutes, that vulnerability was being exploited around the world. Many sites did not have the time or resources to install the fix. The patch was announced at 5 p.m. East Coast time on a Friday, making things worse.

Open source software is a good thing. Published source, a lower bar, is a useful if less optimal alternative. But visibility of the source is not enough. Security analysts need access to everything that is used to create the system, including operating system source, driver source, compiler source, hardware, and hardware fabrication information, and then directions on how to create the systems used in the voting (such as the voting system, the tally system, and any systems and software used to display the results). Even that isn't enough, as (for example) the fabrication facilities may not follow the directions the analysts are given. The supply chain matters, toomanufacturers or their employees may even be malicious! So the analysts need to monitor the actual system construction to verify everything. Even then, they must be aware that what is done today may not be what is done tomorrow, or what was done yesterday.

Finally, even perfect software does not guarantee trustworthy elections. Trustworthiness is also a product of the way the system, and software, are used. For example, consider a system that uses a difficult-to-guess password, but that password can be found on a website. No amount of scrutiny of the system will reveal this flaw.

So assuming that open source systems are more secure than other systems is a dangerous fallacy, just as assuming closed source systems are more secure than other systems. Properly evaluating security requires more than simply considering the openness of the source.

The question we should be asking is "how can we ensure that election results are accurate when we cannot trust the computers used to run elections?" rather than "how do we make electronic voting secure?" Nothing is ever absolutely secure. But we can often make computers, systems, and processes "secure enough" for their tasks, provided we have an independent way to check the results. One technique is to produce a voter-verified paper trail, ensure that the paper trail is trustworthy, and manually audit the electronically tabulated results against the paper audit trail. Another technique called "end-to-end verifiability" allows individual voters to verify that their vote was recorded and counted correctly. Simply enabling everyone to examine the source is not sufficient, and could even give voters and election officials a belief that the system is secure when it is not.

We believe there are excellent reasons to move to open-source voting systems. For instance, there are good arguments that the public should own the voting system. Open-source systems allow vendor claims about software to be verified. Open-source systems running on commercial, off-the-shelf (COTS) hardware could be far cheaper to acquire and maintain than proprietary voting systems. Adopting open-source systems could promote a competitive market for technical support for local election officials, also decreasing costs. Open-source systems could be designed to facilitate auditing against the paper trail more efficiently than commercial systems permit. And using open-source systems would make it possible for jurisdictions to customize the software to their needs.

All this needs to be considered as we work to improve the security and transparency of our election systems. But adopting open-source systems would not by itself provide any assurance that computers used in voting are doing what they are supposed to do. Nor would it obviate the need to audit the results.

This piece reflects the contributions of the following individuals:

Matt Bishop, University of California, Davis Philip Stark, University of California, Berkeley Josh Benaloh, Microsoft Research Joseph Kiniry, Free and Fair Ron Rivest, MIT Sean Peisert, University of California, Davis Joseph Hall, Center for Democracy and Technology Vanessa Teague, University of Melbourne (Australia)

Read more:
Open-Source Software Won't Ensure Election Security - Lawfare (blog)