New York Times | WikiLeaks, Donald Tusk, European Central Bank: Your Friday Briefing New York Times The founder of WikiLeaks, Julian Assange, moved to seize the moment after his organization released a new trove of classified information about the C.I.A.'s cyberweaponry. Speaking from the Ecuadorean Embassy in London, where he has sought refuge ... |
Go here to see the original:
WikiLeaks, Donald Tusk, European Central Bank: Your Friday Briefing - New York Times
Over the weekend, the longtime Trump confidant tweeted that he had a "back channel" to WikiLeaks during the presidential campaign -- only to later delete it.
"[N]ever denied perfectly legal back channel to Assange who indeed had the goods on #CrookedHillary," Stone tweeted late Saturday night. The post was gone after almost 40 minutes.
Last weekend's Twitter flare-up raised questions anew about Stone, who worked for the Trump campaign in 2015 and claims to have a connection to WikiLeaks and its leader, Julian Assange.
WikiLeaks took to Twitter, saying it was unaware of communications between Stone and the organization or Assange.
Stone said on Twitter more than a week later that it would soon be Hillary Clinton campaign chairman John Podesta's "time in the barrel."
The message proved prescient. In early October, WikiLeaks began posting Podesta's emails online for public consumption.
WikiLeaks has denied that Russia was the source for its disclosures, and the Russian government has emphatically denied any connection with the theft as well.
"I do have a back-channel communication with Assange because we have a good mutual friend," he said in the October interview.
Throughout these media appearances, Stone has also categorically denied any contact with Russia besides an affinity for its alcoholic beverages.
And from the margins, Stone cheered on his friend and insulted his critics.
With that nod toward victory, Stone has continued what he's done all along: making profane statements attacking his political opponents, stirring up fights and defending his longtime friend -- who now occupies the Oval Office.
Read this article:
As Russia probe looms, Roger Stone touts relationship to WikiLeaks - CNN
Sri Lankan refugee Supun Thilina Kellapatha (3rd L), 32, his partner Nadeeka (L), 33, with their baby boy Dinath, daughter Sethumdi, 5, Sri Lankan refugee Ajith Puspa (3rd R), 45, and Filipino refugee Vanessa Rodel (R), 40, with her daughter Keana, 5, pose for a photo in front of the government buildings of Hong Kong on Feb. 23, 2017, after attending a press conference where they said Sri Lankan Criminal Investigation Division (CID) is searching for them.ISAAC LAWRENCEAFP/Getty Images
Refugees who sheltered former NSA contractor Edward Snowden in Hong Kong are now seeking asylum in Canada, their lawyers said on Thursday.
The three families are at risk for persecution and grave consequences if they stay in Hong Kong, according to their layers from a non-profit called For the Refugees. More than ever, relocating our clients to Canada is a question of life and death, one of the Canadian attorneys, Marc-Andr Sguin, said in a statement.
Snowden fled the United States in 2013 after leaking thousands of files about the NSAs surveillance operations. The refugee families fed and housed him for two weeks before he left for Russia , according to the BBC .
In recent weeks, the refugees lawyers felt they needed to speed up their asylum process, Sguin told the South China Morning Post . Two of the refugees have said they are being pursued by police from Sri Lanka, where they are originally from, according to the newspaper. They fear the Sri Lankan government could torture them if they were captured.
Snowden tweeted about the effort to secure asylum for the refugees on Thursday, and others, including Joseph Gordon-Levitt, who played the whistleblower in the recent film about him, have also tried to raise awareness, according to the BBC.
Excerpt from:
Edward Snowden: Refugees Who Helped Him Seek Canada ... - Time - TIME
Why it matters to you
Are you curious to know just how many Americans are affected by the NSA's mass-surveillance programs. Well, the agency still isn't talking.
With the legislation that effectively legalizes the National Security Agency mass surveillance programs Prism and Upstream set to expire at the end of 2017, Congress is once again asking for numbers on how many Americans have been surveilled. Just as it has for the past six years, though, the NSA isnt playing ball.
Although most Americans only learned of the countrys large-scale spying operations after NSA whistleblowerEdward Snowden revealed them, Congress has been aware a little longer. Since 2011, several key members have been trying to find out how many Americans the NSA has collected personal information from, but theyvealways been denied, according to Ars Technica.
More:The NSA and GCHQ can see data from your phone when youre 10,000 feet in the air
The reason Congress is making a big case to have those numbers revealed this year is because, as during the Obama administration, Section 702 of the Foreign Intelligence Surveillance Act (FISA) will expire on December 31. While the Trump administration is keen to see this legislation remain in place, according toThe Intercept, Congress wants the numbers to know just how effective it is and how much useless information is potentially collected from regular citizens.
The NSA says that it cant reveal them, even in top-secret briefings. Just as it did whenSen. Ron Wyden (D-Oregon) requested them in 2011, 2012 and 2014, it claims that by revealing how many Americans were affected, it would require identifying them. That, it claims, would mean destroying their anonymity as part of the data, thereby making their information more vulnerable.
That sort of circular logic isnt sitting well with senators, norwith privacy champion the Electronic Frontier Foundation. It is urging Congress to allow FISA to expire, thereby making the mass spying conducted by the NSA and other intelligence agencies illegal in the future.
As it stands, the NSA uses Prism to siphon mass data from popular online services like Facebook, Google, Microsoft, and Yahoo, while Upstream lets it tap into the fiber cables that transmit the internet across the country and around the world.
Although the NSA and others argue that such technologies are vital in helping protect Americans, many have argued that mass surveillance breaches the Constitution and undermines the idea of a free and democratic society.
Continue reading here:
NSA Spying: We Still Don't Know How Many Americans Are Affected ... - Digital Trends
BOSTON, Mass. (March 10, 2017) A Massachusetts bill would generally prohibit the warrantless use of stingray devices and the collection of electronic data stored by service providers. Final passage of the bill would not only protect privacy in Massachusetts, but would also hinder at least two aspects of the federal surveillance state.
More than 100 representatives and senators have signed on to cosponsor House Bill 2332 (H2332), The legislation would help block the use of cell site simulators, known as stingrays. These devices essentially spoof cell phone towers, tricking any device within range into connecting to the stingray instead of the tower, allowing law enforcement to sweep up communications content, as well as locate and track the person in possession of a specific phone or other electronic device.
H2332 would only allow law enforcement agencies to use a stingray device pursuant to a warrant based on probable cause, a persons informed consent, or in accordance with a judicially recognized exception to the warrant requirement. The proposed law would apply the same requirements to collecting electronic data held by a service provider. The bill covers metadata, communications content and location information. It does include exceptions to the warrant requirement for certain emergency situations.
The legislation also includes protection to limit the retention of data. It requires that police must take all steps necessary to permanently delete any information or metadata collected from any person or persons not specified in the warrant immediately following such collection and ensure that such information or metadata is not used, retained, or transmitted for any purpose whatsoever; and delete any information or metadata collected from the person or persons specified in the warrant authorization within thirty days if there is no longer probable cause to support the belief that such information or metadata is evidence of a crime.
Evidence obtained in violation of the law would be inadmissible in court.
No information obtained in violation of this section and no information provided beyond the scope of the materials authorized to be obtained shall be admissible in any criminal, civil, administrative or other proceeding.
IMPACT ON FEDERAL SURVEILLANCEPROGRAMS
The federal government funds the vast majority of state and local stingray programs, attaching one important condition. The feds require agencies acquiring the technology to sign non-disclosure agreements. This throws a giant shroud over the program, even preventing judges, prosecutors and defense attorneys from getting information about the use of stingrays in court. The feds actually instruct prosecutors to withdraw evidence if judges or legislators press for information. As the Baltimore Sun reported in April 2015, a Baltimore detective refused to answer questions on the stand during a trial, citing a federal non-disclosure agreement.
Defense attorney Joshua Insley asked Cabreja about the agreement.
Does this document instruct you to withhold evidence from the states attorney and Circuit Court, even upon court order to produce? he asked.
Yes, Cabreja said.
As privacysos.org put it, The FBI would rather police officers and prosecutors let criminals go than face a possible scenario where a defendant brings a Fourth Amendment challenge to warrantless stingray spying.
The feds sell the technology in the name of anti-terrorism efforts. With non-disclosure agreements in place, most police departments refuse to release any information on the use of stingrays. But information obtained from the Tacoma Police Department revealed that it uses the technology primarily for routine criminal investigations.
Some privacy advocates argue that stingray use can never happen within the parameters of the Fourth Amendment because the technology necessarily connects to every electronic device within range, not just the one held by the target. And the information collected by these devices undoubtedly ends up in federal databases.
The feds can share and tap into vast amounts of information gathered at the state and local level through a system known as the information sharing environment or ISE. In other words, stingrays create the potential for the federal government to track the movement of millions of Americans with no warrant, no probable cause, and without the people even knowing it.
According to its website, the ISE provides analysts, operators, and investigators with information needed to enhance national security. These analysts, operators, and investigators have mission needs to collaborate and share information with each other and with private sector partners and our foreign allies. In other words, ISE serves as a conduit for the sharing of information gathered without a warrant.
The federal government encourages and funds stingrays at the state and local level across the U.S., thereby undoubtedly gaining access to a massive data pool on Americans without having to expend the resources to collect the information itself. By placing restrictions on stingray use, state and local governments limit the data available that the feds can access.
In a nutshell, without state and local cooperation, the feds have a much more difficult time gathering information. Passage H2332 would representa major blow to the surveillance state and a win for privacy.
PARALLEL CONSTRUCTION
By prohibiting the use of information obtained outside the scope of the law, H2332 would hinder one practical effect of NSA spying in Massachusetts.
Reuters revealed the extent of such NSA data sharing with state and local law enforcement in an August 2013 article. According to documents obtained by the news agency, the NSA passes information to police through a formerly secret DEA unit known Special Operations Divisions and the cases rarely involve national security issues. Almost all of the information involves regular criminal investigations, not terror-related investigations.
In other words, not only does the NSA collect and store this data, using it to build profiles, the agency encourages state and local law enforcement to violate the Fourth Amendment by making use of this information in their day-to-day investigations.
This is the most threatening situation to our constitutional republic since the Civil War, Binney said.
NEXT STEPS
H2332 was referred to the Joint Judiciary Committee where it must pass by a majority vote before moving forward in the legislative process.
See the original post:
Massachusetts Bill Would Ban Warrantless Stingray Spying - Tenth Amendment Center (blog)
TechnoBuffalo | What the CIA WikiLeaks Dump Tells Us: Encryption Works New York Times NEW YORK If the tech industry is drawing one lesson from the latest WikiLeaks disclosures, it's that data-scrambling encryption works, and the industry should use more of it. Documents purportedly outlining a massive CIA surveillance program suggest ... No, the CIA hasn't cracked Signal and WhatsApp's encryption These messaging apps are safe from all of the CIA's known hacking tools |
Read the original post:
What the CIA WikiLeaks Dump Tells Us: Encryption Works - New York Times
The WikiLeaksstashof CIA hacking documents shows tools used by the CIA to hack individual cell-phones and devices. There are no documents yet that suggest mass snooping efforts on a very large scale. Unlike the NSA which has a collect it all attitude towards internet traffic and content the CIA seems to be more interested in individual hacking.
This suggests that the CIA can not decipher the modern encrypted communication it adversaries use. It therefore has to attack their individual devices.
But it does not mean that the CIA can not engage in mass snooping.
The New York Timesdescriptionis wrong:
Some technical experts pointed out that while the documents suggest that the C.I.A. might be able to compromise individual smartphones, there was no evidence that the agency could break the encryption that many phone and messaging apps use.If the C.I.A. or the National Security Agency could routinely break the encryption used on such apps as Signal, Confide, Telegram and WhatsApp, then the government might be able to intercept such communications on a large scale and search for names or keywords of interest. But nothing in the leaked C.I.A. documents suggests that is possible.
Instead, the documents indicate that because of encryption, the agency must target an individual phone and then can intercept only the calls and messages that pass through that phone. Instead of casting a net for a big catch, in other words,C.I.A. spies essentially cast a single fishing line at a specific target, and do not try to troll an entire population.
The difference between wholesale surveillance and targeted surveillance is huge, said Dan Guido, a director at Hack/Secure, a cybersecurity investment firm. Instead of sifting through a sea of information, theyre forced to look at devices one at a time.
Snake-oil alert: Right diagnosis, wrong conclusion and therapy.
If the CIA breaks into an individual Samsung Galaxy 7 it can record what is typed on the screen, and whatever gets transferred via the microphone, camera and loudspeaker. No encryption can protect against that. But why should the CIA break into only one Galaxy 7?
It is wrong to conclude that the CIA can therefore not intercept such communications on a large scale. It can. Easily.
If you can break into one individual Samsung Galaxy 7 you can break into all of them. This can be automated.
The CIA also breaks into internet routers and network infrastructure systems. By watching the network traffic flowing by the CIA (and NSA) systems can see who uses encrypted communication. They can then launch programs to silently take over the communicating devices. Then the communication can be recorded from the devices and read in the clear. There is nothing at all that prohibits this to take place on a massive scale.
The reaction to the Snowden leaks about gigantic NSA snooping on internet lines led to an increased use of encryption. Suddenly everyone used HTTPS for web traffic and the user numbers of Signal, Telegram, WhatsApp and other encrypting communication applications exploded.
But encrypted traffic still sticks out. One can detect an encrypted skype call by watching the network traffic on this or that telecom network. One can detect what kind of end-devices are taking part in a specific call. With a library of attack tools for each of the usual end-devices (Iphone, Android, Windows, Mac) the involved end-devices can be silently captured and the call can be recorded without encryption.
The Times writes: Instead of casting a net for a big catch, in other words, C.I.A. spies essentially cast a single fishing line at a specific target, and do not try to troll an entire population.
It is right in one sense. There is not one central point in the river of traffic where one casts the net. But it is wrong in to conclude that the CIA or other services would then use a single fishing line. What hinders them from using hundreds of fishing lines? Thousands? Hundred-thousands?
Wide use on encryption simply moves the snooping efforts from the networks towards the end-devices. It might be a little more expensive to snoop on hundred-thousands of end-devices than on a few network backbones but budget or manpower restriction are not a problem the NSA and CIA have had in recent decades.
To tell users that it encryption really restricts the CIA and NSA is nonsense. Indeed it is irresponsible.
The sellers of encryption are peddling snake-oil. The dude from a cybersecurity investment firm the Times quotes is just selling his rancid wares.
Your neighbor snoops on your open WLAN traffic? Yes, chat encryption might prevent him from copying your session with that hot Brazilian boy or girl. But it does not prevent professionals from reading it. For that you would need secure devices on both ends of the communication. Good luck finding such.
See the original post here:
Snake-Oil Alert Encryption Does Not Prevent Mass-Snooping - Center for Research on Globalization
Archives: By Topic Select a Topic 113th Congress 114th Congress 1267 terrorist sanctions 1997 Mine Ban Treaty 2001 AUMF 2002 AUMF 2016 Presidential Electio 9/11 Commission Review Aamer v. Obama Abdirahman Sheik Mohamud Abdullah al-Shami Abu Ghaith Abu Ghraib Abu Khattala Abu Omar Abu Wa'el Dhiab Abu Zubaydah v. Poland Accountability ACLU ACLU v. CIA ACLU v. Clapper ACLU v. DOJ act of state Adam Schiff Additional protocol I Adnan Syed Adobe Afghanistan Africa African Commission on Hum African Court of Human an African Court of Justice African Union African Union Mission in African Union Regional Ta Aggression Ahmad Al Faqi Al Mahdi Ahmed Ghailani Ahmed Godane Ahmed Warsame Airstrikes Ajam v. Butler Akbar Akhtar Muhammad Mansur Al Bahlul IV Symposium Al Qaeda Al Shabaab Al Shumrani Al-Bahlul al-Iraqi Al-Janko v. Gates Al-Libi Al-Maqaleh v. Hagel Al-Nashiri Al-Nashiri v. Poland Al-Shimari v Caci et al. Al-Skeini v. United Kingd Al-Zahrani v. Rodriguez Alexander Litvinenko Algeria Ali v. Obama Alien Tort Statute All Writs Act Ambassador Robert Ford Ambassador Stephen Rapp Amends Amerada Hess American Law Institute American Samoa American Society of Inter Americans Amicus Brief amnesty Amnesty International Amos Guiora and Ibrahim al-Qosi Andrew Kleinfeld Andy Wright Angela Merkel Anonymity Ansar Dine Anthony Kennedy Anti-Muslim discriminatio Anti-Terrorism Act (ATA) Anti-Torture Amendment Antonin Scalia Anwar al-Awlaki AP I AP II APA Appellate Jurisdiction Apple AQAP AQIM Arab Spring armed attack armed conflict Armed Opposition Groups Arms Control army field manual Artesia Article 51 Article II Article III Ash Carter Ashraf Ghani Aspen Publishers Assad Assassination Ban Associated Forces asylum Atomic Energy Act atrocities prevention Attacks on Cultural Herit Attorney General attribution Auden AUMF AUMFs Australia authorization for the use Automated Searches Automated Weapons Autonomous Weapons Autonomous Weapons System Avril Haines Ba Odah v. Obama back doors Bagram Air Force Base Bankovic v. Belgium Baraawe Barack Obama Barbara Tuchman Barrel Bombs Barton Gellman Bashar al-Assad Bashir Belfast Peace Agreement Belgium Belhaj v. Straw Bemba Ben Emmerson Ben Wittes Benghazi Bernand Kleinman Bill Banks Bimenyimana Biodefense Bioterror Bivens Suit Black Sites Blackwater Blue Ribbon Study Panel o BND Boasberg body cameras Boim v. Holy Land Foundat Boko Haram Bond v. US Book Reviews Books We've Read Bosnia-Herzegovina Botnets Boumediene v. Bush Brad Heath Brazil Brett Kavanaugh Brexit Brian Egan British Library Bruce Ackerman Brussels Attacks BSA bulk collection Burkina Faso Burundi Bush Administration CAAF CALEA California Call for Papers Cambodia Cameron Munter Canada Canadian Security Intelli Canadian Supreme Court Cardozo Law Review Carly Fiorina Carnegie Mellon Universit Castro v. DHS CAT Ceasefire Cell Site Location Inform cell tracking Censorship Center for Civilians in C Center for Constitutional Center for Democracy and Center for National Secur Center for Naval Analysis Central African Republic Central District of Calif cert petitions Cessation of Hostilities Chad Chapter VII Charles Taylor Charleston Church Shootin Charlie Hebdo Charlie Savage Chatham House mini forum Chelsea Manning Chemical Weapons Chilcot Report Chile China Chivalry Chris Jenks Church Commission CIA CIDT CISA Civil Liberties Civil service Civilian Casualties Civilian-Military divide Civilian-Military relatio Claire McCaskill Clapper Clapper v. Amnesty Intern Clarence Thomas Classified Information Clipper Chip Cluster Munitions CMCR collective self-defense Colombia Colvin v. Syria combat troops Comey Commission on the Wartime Committee Against Torture Committee on the Eliminat Common Article 1 Common Article 3 Community Outreach Compliance with Court Ord Complicity Computer Security Inciden Conflict of interest Conflicts of Interest Congress congressional authorizati Congressional Hearing Congressional Hearings Congressional Investigati Congressional Oversight Consolidated Appropriatio Conspiracy Constitution constitutional law Contempt Content Continuous Combat Functio Convention Against Tortur Convention on Cluster Mun Convention on Conventiona Corporate Liability corporations Corruption Council of Europe Council on Foreign Relati Countering Violent Extrem Counterinsurgency counterintelligence Counterterrorism Court of Appeals for the Court of Military Commiss Courts Martial Couture-Rouleau Covert Action CQ Roll Call crime crime of aggression Crimea Crimes Against Humanity criminal trial Critical Infrastructure Cross-Border Data Request cross-ruffing Cruel cryptography CSIS Cuba Cully Stimson Customary International L CVE CWC Cy Vance Cyber Cyber Bonds Cyber Warfare Cyberattacks Cybersecurity Cybersecurity Act of 2015 Daily News Daily News Roundup Dan Markel Data Data Localization Data Protection Data Sharing David Barron David Ellis David Golove David Hicks David Kaye David Kris David Medine David Miranda David Sentelle David Tatel DC Circuit DC District Court DDoS DEA Deborah Pearlstein Deep Web Defense Directive 2310.01 Defense Select Committee Democracy Democratic Republic of Co Denmark Department of Defense Department of Homeland Se Department of Justice Department of State deradicalization detainee treatment Detention Detention Review Boards development Device Encryption DHS DIA Dianne Feinstein Diarmuid O'Scannlain Diplomacy diplomatic assurances Direct Participation in H Disinformation Dissent Dissent Channel Cable Distinction Division 30 Djibouti DNC DNC Hack DOD DoD Directive 2310.01E DOD Directive 5230.09 DOD Instruction 5230.29 DOJ Domestic Surveillance Dominic Ongwen Donald Trump Dreyer drone court Drone Papers Drones Drones Report due process Duncan Hunter Dustin Heard Dylann Roof Early Edition Ebola ECHR Economic Espionage ECPA ECPA Reform Editors' Picks EDNY Edward Snowden EFF v. DoJ Effective Control Egypt el salvador Electronic Frontier Found Elena Kagan Email Privacy Act Emergency Powers Emoluments Clause Empirical Research Encryption End-to-End Encryption Enemy Belligerents Engines of Liberty EO 12333 EPIC Eric Garner Eric Holder Espionage Act Ethics EU Data Retention Directi Europe European Commission European Convention on Hu European Convention on Na European Court of Human R European Court of Justice European Parliament European Union Evan Liberty event Events evidence Executive Order 12333 Executive Order 13470 Executive Order 13567 Executive Orders Executive Power Executive Privilege extradition Extrajudicial Release Extraordinary African Cha Extraordinary Renditions Extraterritoriality F Facebook FARC Fast & Furious Fatou Bensouda FBI FBI Director FBI v. Apple Featured Federal Communications Co Federal Courts federal program Federal Trade Commission federalism Feminism Ferguson Fifth Amendment Filartiga financing First Amendment FISA FISA Amendments Act of 20 FISA Improvements Act FISA Reform FISC Five Eyes Florence Hartmann FOIA force-feeding Foreign Affairs Foreign Claims Act Foreign Fighters Foreign Law Foreign Policy Foreign Sovereign Immunit foreign sovereign immunit Foreign Surveillance foreign terrorist fighter Foreign Terrorist Organiz Forever War Fourth Amendment Fourth Circuit France Frank Wolf Fred Korematsu Freedom of Association freedom of expression Freedom of the Press FSIA FTC fugitive Gabor Rona Gabriel Schoenfeld Gag Order Garcetti v. Ceballos Gaza GCHQ Gender General Warrants Geneva Conventions genocide Geoff Corn George W. Bush Georgia Gerald Seib Germany Gideon v. Wainwright GJIL Summit Glenn Greenwald Going Dark golden key golden number Google Goran Hadi Government Shutdown Greece Group of Governmental Exp Guantanamo Guardian Guatemala Guest Post Guide to Torture Report Gulf War Guns of August Guns of September Habeas Habre hacking Hae Min Lee Hagel Haiti Hamdan Hamdi v. Rumsfeld Hamid Karzai Handschu Agreement Harold Koh Harvard Law Review Harvard Law School Hassan v. City of New Yor Hate Crimes Hate Speech Hatim v. Obama Heikkila v. Barber Helms Amendment Hernandez v. United State Hezbollah Hicks High commissioner for hum High-Value Detainee Inter Hillary Clinton Hoffman report Holder v. Humanitarian La Holidays Holocaust Holy See Hossam Bahgat Hostage Act Hostile Intent House Armed Forces Commit House Committee on Foreig House Demolitions House Judiciary House lawsuit House Permanent Select Co House Un-American Activit HPSCI HTTPS Huawei Human Right Law human rights Human Rights Committee Human Rights Council Human Rights First Human Rights Law Human Rights Watch Human Shields human trafficking Humanitarian Intervention Humanitarian Law Humanitarian relief opera Hussain v. Obama Hybrid Justice IACHR Ibrahim v. DHS Ibrahim v. US ICC ICCPR ICRAC ICRC ictr ICTY IDF IHL IHR immigration Imminent Threat Immunity immunity for official act Imran Khan Incendiary Weapons India individual self-defense Information Sharing inhuman and degrading tre injury in fact INS v. St. Cyr Inspector General Insular Cases Insurance Intelligence activities Intelligence and Security intelligence community Intelligence Community Di Intelligence Reform International Arm International Armed Confl International Convention international court International Court of Ju International Courts International Criminal Co International Criminal La International Law International Law Commiss International Right to En International Right to Pr internet Internet freedom Internet of Things Interrogation Investigatory Powers Bill Investigatory Powers Trib Iqbal Iran Iran Negotiations Act Iran Nuclear Agreement Re Iran nuclear deal Iran nuclear negotiations Iran Nuclear Negotiations Iraq Iraqi Kurdistan Irek Hamidullan Ireland ISAF ISIL ISIL AUMF Islam Islamic Islamic State Israel Italy Jack Goldsmith James Clapper James Comey James Foley James Risen Jamie Orenstein Jamshid Muhtorov Janice Rogers Brown Jason Smith Jean Pierre Bemba Jeffrey Brand Jeh Johnson Jennifer Granick Jeremy Ridgeway Jerry Brown Jim Sensenbrenner Joe Biden John Bellinger John Brennan John Gleeson John Kerry John McCain John Reed John Walker Lindh John Yoo Joint Committee on Human joint criminal enterprise Jon Cornyn Jonathan Horowitz Jones v. UK Jordan Joseph McCarthy Joshua Arap Sang Journalist journalists JSOC Judge Bates Judge Raymond Randolph Judicial Appointments Judicial Review Judith Rogers Junaid Hussain Jus ad Bellum jus cogens violations jus in bello Just Security Just Security anniversary Just Security Candidates Just Security interns Just Security internship Just security jobs Just War Justice Against Sponsors Justin Raimondo Karen Greenberg Karen LeCraft Henderson Katz v. United States Kazemi v. Iran Keith Alexander Kennedy v. Mendoza-Martin Kenneth Dahl Kenya Kevin Heller Khadr Khalid Sheikh Mohammed Khouzam Killer Robots Kiobel v. Royal Dutch Pet Kiyemba v. Obama Klayman v. Obama Korean landmines Korematsu Korematsu v. United State Kristen Gillibrand KSM Kunduz Kyrgyzstan Laird vs Tatum Lakhdar Brahimi landmines Latif v. Holder Laurence Silberman Lavabit Law enforcement Law Enforcement Hacking Law of Armed Conflict Law of War Manual Law of War Manual Forum Law of War Manual. ICRC Lawfare Lawful Hacking Laws of War Leak Investigations Leaks Lebanon Legal Adviser Legal Adviser, DoS legal offices Legal Services Corp. v. V Letters to the Editor Lewis Kaplan Lex Specialis LGBT Libertarianism Libya Limburg Lindsey Graham Lithuania Livestream Logan Act Lord Peter Goldsmith Lords Resistance Army LTTE Luban Lujan v. Defenders of Wil Luther v. Borden Mac Thornberry Magistrate Judges Maher Arar Mahmoud Abbas Majid Khan Mali Manmohan Singh Mar-a-Lago Marco Rubio Marcy Wheeler Margo Brodie Marine Corps Mark Martins Mark VIsger Marketplace of Ideas Marne Marsha Berzon Martin Luther King Jr. Marty Lederman Material Support Matt Blaze Matthew Waxman Mauritania Mavi Marmara MCA McCain-Feinstein Amendmen McCarthyism McClatchy Mdecins Sans Frontire Media Media Shield Law Medical Personnel membership Memorial Day Mercenaries Merrick Garland Meshal v. Higgenbotham Metadata Mexico Michael Brown Michael Flynn Michael Ratner Michael Weiss Michel Foucault Microsoft Microsoft v. DOJ Microsoft Warrants Case Middle East midterm elections midterms Migrant migration Mike Rogers Military Military aid Military Commissions Military Extraterritorial Military Justice Review G military justice system Military Objective Minimization Procedures Ministry of Defense v. Ra Mitch McConnell MLAT Mohamed v. Jeppesen Datap Mohammed v. MOD Monday Reflection Money Monsanto Montreaux Document Mootness Mosaic Theory Mosul Munitions murder Muslim ban Muslim Brotherhood Mustafa al-Shamiri Mutual Legal Assistance namibia narco-trafficking Nasr v. Italy Nathalie Weizmann National Archives National Institute of Sta national security National Security Council National Security Lawyeri National Security Letters NATO Nawaz Sharif NCIS NCTC NDAA NDU Speech negotiations Network Investigative Tec New York Times New York Times v. DOJ Nicholas Lewin Nicholas Merrill Nicholas Slatten Niger Nigeria No-Fly List Non-international Armed C non-refoulement non-self-executing treati Nonproliferation Treaty Noor Uthman Muhammed Norms Watch North Korea Northern Ireland Notice NSA NSA Reform NSLs Nuclear Nuclear Weapons Nuremberg NYPD Obama administration occupation October Office of Legal Counsel Office of the Director of official act immunity OLC Drone Memo Oman Omar al-Bashir Omar Khadr Oona Hathaway Operation Operation Barkhane Operation Inherent Resolv Operation Protective Edge Operation Storm of Resolv Opinion Poll OPM Organization for Security Organization for the Proh Orin Kerr Osama bin Laden OTP Strategic Plan Ottawa Convention Ottawa shootings Oversight Oversight v. Holder Pakistan Palestine Palmer Raids Panetta Panetta Review Paris Attacks Paris Climate Accord parli Particularity Partition Parwan Patrick Leahy Patrio Patriot Act Paul Slough Paul Wolfson PCLOB Peace Talks Peacekeeping Pen Registers Pentagon Pentagon Papers perfidy Periodic Review Boards Periodic Review Boards (P persecution Peter Burke Peter Margulies Peter Raven-Hansen Philippines Pinochet Plea Agreement PMC PNSDA Poland Police militarization political question doctri Posse Comitatus Power Wars Symposium PPD-28 PPD-30 PPG PRB Pre-publication Review Pr President Obama President's NDU Spee President's Review G Presidential Campaign 201 Presidential Policy Guida Presidential Powers Presidential Review Board Presidents Day PRISM Privacy Private Military and Secu private military contract proportionality protected persons Provisional measures Public Surveys Q+A Qualified Immunity Queen's Speech R2P Rachel Kleinfeld racial discrimination Radovan Karadi Ramzi Bin al-Shibh Rand Paul Raner Collins Ranger School Ransomware rape Rasul v. Bush Ray Mabus Raza v. City of New York Readers' Guide Reagan Real Estate Recusal Red Scare reddit Reengagement Assessment refugee Refugee Crisis Religion remedies Rendition Rep. Adam Schiff Republic of Korea Resolution 2170 Responsibility to Protect Restis Restis v. United Against Rewards for Justice Rex Tillerson Reyaad Khan Rhetoric Richard Burr Richard Leon Right to Be Forgotten Right to Life Right to Privacy Right to Truth Riley v. California Robert Gates Robert H. Jackson Robert Litt Robert Sack Rodriguez v. Swartz Rogue Justice Rome Statute Ron Wyden Roof Knocking Rosenberg vs Pasha Rothstein v. UBS AG Roy Cohn Royce Lamberth Rule 41 Rules of Engagement Rumsfeld v. Padilla Russia Rwanda Ryan Vogel Saddam Hussein SAFE Act of 2015 Safe Harbor safe zones Sahel Salahi Saleh v. Titan Corp Salim v. Mitchell Samantar v. Yousuf San Bernardino Shooting sanctions Sarah Cleveland Sarah Koenig SASC Saudi Arabia Schengen Zone Schlesinger v. Councilman Schrems Scotland Scott Shane SCOTUS SDNY Second Circuit Secrecy Secret Law Secret Service Section 215 Section 702 Security security agreement Security Assistance security clearance self-defense Senate Senate Armed Services Com Senate Foreign Relations Senate HSGAC Senate Intelligence Commi Senate Judiciary Committe Senegal Separation of powers Serdar Mohammed v. SSD Serial Service Providers Sexual Assault Sexual Violence Seymour Hersh SFRC SGBV Sgt. Bowe Bergdahl Sharia shooting Siege Warfare signals collection Silicon Valley Sir John Chilcot SJC Slahi slavery Smith v. Maryland Smith v. Obama Snooper's Charter Snowden Snowden Treaty social Social Media Solicitor General Somalia Sonia Sotomayor Sony South Africa South Ossetia South Sudan Special Forces special rapporteur Spying Sri Lanka SSCI SSCI Report SSCI Torture Report standing Stanley McChrystal Starvation state immunity State of the Union State Responsibility state secrets state secrets privilege State v. Andrews Statehood Staten Island Status of Forces Agreemen status-based immunity statute of limitations StellarWind Stephen Williams Steve Dycus Stimson Center StingRays Stored Communications Act Sudan Sunshine Week superior responsibility Supreme Court Supreme Court of Canada Surveillance Suspension Clause Sustainable Development G Sweden Syria Syrian opposition Syrian refugees Szabo v. Hungary TACT 2000 Tadic Tahir-ul-Qadri Taliban Taliban Sources Project Tallinn Manual target Targeted Killing Targeting Decisions Taylor v. KBR Teaching Technology Ted Cruz term limits terrorism terrorist Terrorist Expatriation Ac Third Circuit Thomas Ambro Thomas Griffith Thomas Lubanga Dyilo Tim Kaine Tim Starks Title III Tony Blair Tor Tor Browser torture Torture Report trafficking transitional justice Transparency transparency reports Treasury Department Treaties Treaty Implementation Treaty Law Trump Trump Administration Trump Administrations truth commission Tuaua Tunisia Turkey Turkmen Turkmenv.Hasty Turner v. Safley Tweet Roll Twitter UANI UDHR Uganda Uhuru Kenyatta Uighurs UK UK Elections UK High Court UK Parliament UK Supreme Court UK Terrorism Act 2000 Ukraine Umm Sayyaf UN Assistance Mission in UN Charter UN High Commissioner for UN High Commissioner on H UN Human Rights Committee UN Security Council Uniform Code of Military United Kingdom United Nations United Nations General As United Nations Human Righ United Nations Human Righ United States ex rel. Acc United States v. Graham United States v. Moalin Universal Declaration of Universal Jurisdiction Universal Periodic Review Unlawful Combatants UNSC UNSC Resolution 1441 UNSC Resolution 2178 UNSC Resolution 2249 unwilling or unable US AID US Army US Holocaust Museum and M US v. al-Darbi US v. al-Shibh US v. Garcia US v. Khadr US v. Mehanna US v. Mohammed US v. Warshak USA Freedom USA Freedom Act Use of Force USS Cole Vance v. Terrazas Verdugo-Urquidez Veterans Veterans Day Veto Victor Restis Video Vietnam Vladimir Putin Vojislav eelj voluntary manslaughter Vulnerabilities Equities war War Crimes War Crimes Act war memorial War on Drugs War on Terror War Powers War Powers Resolution Warafi warrant canary Warsame Wartime Contracts Washington Post Wassenaar Arrangement Waziristan weapons Weapons of Mass Destructi Weekly Recap West Bank Westgate WhatsApp Whistleblowing White House Wikimedia v. NSA William Bradford William Ruto William Samoei Ruto Wiretap Women Women in combat Women's Rights Wong Kim Ark Yahoo Year End 2015 Year End 2016 Yemen Yezidis Yugoslavia Zakharov v. Russia Zehalf-Bibeau Zero-Day Vulnerabilities Zimbabwe Zivotofsky v. Clinton Zivotofsky v. Kerry
Surely without a hint of irony, just a day after WikiLeaks dumped a vault-load of documents detailing the Central Intelligence Agencys use of hacking tools and software exploits, FBI Director James Comey told an audience at a Boston College conference on cybersecurity that [t]here is no such thing as absolute privacy in America. Comeys elevator pitch in support of his claim was that there is no place outside of judicial reach, citing the fact that even time-tested testimonial privileges of the spousal, clergypenitent, and attorneyclient sort can be pierced by judges in appropriate circumstances. Comeys argument, which hes made at a steady drumbeat for several years now, is that sure, privacy is important, but law-enforcement access is paramount. The government and judges, not technology, should decide when the government can get to your private information.
If only things were that simple. Comey has at various times tried to disclaim any desire to have Congress mandate backdoors to encryption-enabled devices and services, even getting himself laughed off of C-SPAN when he suggested that his approach would provide a front door instead. When it comes to encryption, doors are doors, andas Julian Sanchez comprehensively explained more than two years ago, at the dawn of the Crypto Wars sequelthey are a truly terrible idea. To briefly recapitulate Julians post: it is damn near impossible to create a security vulnerability that can only be exploited by the good guys; there are lots of governments out there that no freedom-loving person would classify as the good guys (an observation that takes on a chilling new cast in light of recent events); any backdoor or retention mandate both implicitly assumes and, if it is to be effective, must effectivelyencouragecentralized over decentralized computing and communications architectures; and even if encryption really is law enforcements digital-age bte noire, it is a small price to pay in the Golden Age of Surveillance.
So what does this all have to do with the Vault 7 leak? Its a fair question. Software exploits of the type disclosed by Wikileaks and encryption backdoors might both technically be lines of computer code, but the stakes surrounding each are distinct. For the reasons Julian put forward (and more), encryption backdoors should be a complete non-starter. Mandating backdoors would present a grave security threat to critical internet infrastructure. As a quartet of leading security researchers put it in a highly regarded paper in 2014, mandating built-in encryption backdoors amounts to intentionally and systematically creating a set of predictable new vulnerabilities that despite best efforts will be exploitable by everyone.
When law enforcement or intelligence agencies exploit existing security vulnerabilities, things are perhaps less clear cut. Unlike with backdoors, not every exploit of a software vulnerability poses a systemic risk. (While a backdoor to the iPhone would put a hole in every pocket, the targeted deployment of an exploit would not.) Still, many vulnerability exploits have widespread consequences, putting internet security at risk. As the security quartet put it, the danger of proliferation means each use of an exploit, even if it has previously run successfully, increases the risk that the exploit will escape the targeted device. Call it the Jurassic Park Rule of Internet Security:
Jim, the kind of control youre attempting simply is . . . its not possible. If there is one thing the history of internet security has taught us its that vulnerabilities will not be contained. Vulnerabilities break free, they expand to new territories and crash through barriers, painfully, maybe even dangerously, but, uh . . . well, there it is. . . . Im simply saying that vulnerabilities . . . find a way.
For example, despite reportedly rigorous testing before deployment, the Stuxnet worm used by the United States and Israel to attack an Iranian nuclear facility unexpectedly spread to non-target computers. And when the government sits on a zero-day exploit to be able to exploit it later, there is always the chance that an adversary is doing the same thing. These risks are, for the most part, inherently unknowable beforehand.
While its true that there are unknown risks associated with both exploits and encryption backdoors, only the latter amount to deliberately introduced vulnerabilities. Nevertheless, Comey has been quite skeptical of the notion that giving the government a golden key into the encrypted devices of millions of users would present a broad threat to the security of the internet. His theory, after all, is that the governmentwith judges as gatekeeperwill use such a key responsibly and with oversight. But Vault 7 is a visceral reminder that the public cant trust the government to keep this stuff safehell, not even the government can trust the government to do so. And backdoors present an even more cut-and-dried case than exploits.
Even if an exploit or a backdoor is yours and yours alone for now, your monopoly is either a chimera, or it will be short-lived. And the consequences of spillover can beas Jeff Goldblum learned the hard wayequally unpredictable and devastating. While WikiLeaks did not publish any malicious code this week, it did claim that the contents of Vault 7 have been circulating among former U.S. government hackers and contractors in an unauthorized manner.
What happens when a highly weaponized suite of hacking tools makes its way into the broader internet? I hope we are not about to find outbut if we are, I suspect that Comey and his colleagues at the FBI are unlikely to be happy with what they find. Heres hoping the experience gives them pause the next time they ponder whether their solution to the threat of absolute privacy is really such a good one after all.
Image: Darin McCollister/Getty.
Continue reading here:
Encryption Backdoors, Vault 7, and the Jurassic Park Rule of Internet Security - Just Security
This list of five of the best encryption software on the market includes examples of platforms that enable a cutting edge, interactive experience by harnessing the storage capabilities of the cloud, and special decoy, deterrent features.
Also included in our list are systems that might be less high-tech and intuitive to use, but will equip a user with high-level, industry standard protection by incorporating multiple encryption methods. Some examples in this list are rooted in a specific operating system, while there are also systems included that provide maximum mobility.
Price is also factored into this list of the best options, with some of the free options presenting extremely effective safeguards from the free version of the system.
In contrast to systems such as Veracrypt, the only free element of this encryption software is the trial, however the product is widely considered robust, with capabilities to support small teams and individuals within a business setting.
AxCrypt was launched in 2001 with the intention of addressing the sharing of confidential data over the Internet, and to find security solutions for Internet services while aiming to make an easy to use design and appearance.
The specs behind the software include 128-bit or 256-bit advanced encryption standard (AES), and differs to some of the competition in that the software utilises cloud storage. This will mean the protection you receive with the product sill also span files saved on Dropbox or Google Drive.
A high level of interaction and control is made available with the software, as encrypted files can be accessed through a smartphone app. The software can also be used widely on a global scale, as advanced multilingual abilities are integrated within the software; some of these are Korean, Portuguese and Swedish.
More:
Best encryption software: Top 5 - Computer Business Review
Our digital lives are powered by programming philosophers who choose to develop their code out in the open.
All programs begin with lines of instruction. When ready for execution these lines of instruction are converted to a binary format that the computer can execute. Open source programs are programs where the human readable code is accessible to anyone. This philosophy of openness and freedom has allowed these projects to impact the lives of everyone.
The Linux kernel is the core of all Android devices, and nearly a third of all Internet traffic rides on just one openly developed project, Netflix. (Read the excellent article in Time magazine about this.) How does the choice of using open source software as part of a project plan affect the amount and type of risk to a project within an organization?
Risk is both a perception and a reality. Tools help us move from perception toward reality the same way good thermometers helped us move from very generalized use of the terms hot and cold to more specific quantifiable temperatures (see an example in Google). Over time we've adopted different standards and techniques for discussing specific temperatures, whichdependon the audience and the standard's limitations. Kelvin, Celsius, Fahrenheit, and even RealFeel are now established standards for measuring temperature.
Illustration 1: Quantifying temperatures
Every project has risk and every PM (project manager) perceives and articulates that risk differently with various levels of accuracy. The understanding of risk may be as simple as a good or bad description similar to the terms hot and cold. The PMBOK (Project Management Body of Knowledge) states that the process for discussing risk management should move from a qualitative evaluation to a quantitative one (as stated in the Project Management Institute's publication, "A guide to the project management body of knowledge/PMBOK Guide" (5th ed.)). Like temperature, the discipline of project management has different quantifiable standards for measuring project risk. At least one of these standards for risk evaluation communicates why open source software is often rejected as a possible consideration for projects during the project planning process.
The Risk Complexity Index discussed in Tom Kendrick's book Identifying and Managing Project Risk(Kendrick, 2015) serves as our foundation. Complexity indexes aren't uncommon in project risk management. David Bearden used a complexity index to show how NASA's adoption of its FBC (Faster, Better, Cheaper) philosophy has impacted project risk. While his index is based upon near recent data points, the risk complexity index in Kendrick's book attempts to be more predictive. Kendrick articulates the formula for the index as:
Index = (Technology + Architecture + System) X Scale
Technology, Architect, and System are scored from 0 to 5, based on the PM's experience and capabilities. "Architecture refers to high-level functional components and any external interfaces, and System is the internal software and hardware that will be used in the product. The Technology dimension is defined as the basis for development used on the project," Kendrick said in his book. He explains that the Index could be scored using the following key:
0. Only existing technology required 1. Minor extensions to existing technology needed in a few areas 2. Significant extensions to existing technology needed in a few areas 3. Almost certainly possible, but innovation needed in some areas 4. Probably feasible, but innovation required in many areas 5. Completely new, technological feasibility in doubt
Scale is assigned a value based on the number of people expected on the project:
In this index a result of 0 to 20 is considered low risk, 20 to 40 is medium risk, while the range from 40 to 100 is high risk. Just as a price tag is a summary of the cost of production elements for a given item on the grocery store shelves, this index is a summary of items that contribute to project risk. At this point of risk management, the risks have been identified and quantified. Initially, the entire risk index refers to the risk of the project internal to the organization conducting it. After mitigation measures are developed the project can be re-scored with the matrix.
Scoring risk
In Adrienne Watt's chapter in the book Risk Managementon risk management planning, she discusses four strategies for mitigating risk. These are risk avoidance, risk sharing, risk reduction, and risk transfer. After applying some combination of these strategies, the PM team can rework the risk complexity index to determine if they reduced the project's overall risk to an acceptable level.
The key issue with open source is that when it is used, the risk is assumed by the organization. Open source code licenses such as BSD's very brief license includes language expressly transferring the responsibility from the code's originators to the code's users. It does this through its statement that "this software is provided 'as is' and without any express or implied warranties." For Linux, the GPL 3.0 preamble states, "for the developers' and authors' protection, the GPL clearly explains that there is no warranty for this free software" (Free Software Foundation, 2007).
This undermines several key aspects of the mitigations listed previously. If the organization assumes technical responsibility for the code, they have a reduced capacity to avoid, share, reduce or transfer the risk. Open source code can still be a part of the solution for a risk management strategy and in some cases, open source code is a huge factor in mitigating risk.
Software from major vendors includes the added risk of the strategy tax for that vendor. The strategy tax associated with Microsoft Windows reached a critical point with Valve, the creator of Steam, a popular game distribution platform. Valve chose to mitigate the increased risk and developed SteamOS, which ported their distribution software to run on open sourced code (Dingman, 2013). The code they chose for their foundation has a much lower strategy tax, significantly reducing their risk.
While Valve's talent pool of programmers meant they had the technical knowledge to audit and understand the relevant source code, not every business is as well resourced. Businesses that do have a sizable number of programmers tend to incorporate open source applications into their project planning. In 2010, Google switched a large number of their machines from Windows to Linux. Netflix runs FreeBSD to take advantage of the technology built into ZFS.
Brand value plays a large role in a business asset portfolioand projects that could damage that brand can be viewed as putting the company at higher risk. One of the more sensitive brand sectors is that of IT Security firms who work projects for each one of their clients. From my private conversations with employees from this sector, I've learned that one way they transfer their risk is through policies on company communications channels. Precisely none of their communications channels are internal. Instead, each employee is required to use multiple external communications technologies. The organization's reality is that if their brand becomes victim to a successful attack and any part of the news cycle includes the organization's name, this causes severe damage to the brand, so for email they use Gmail and for chatthey use Slack (Pen Testing, 2016). They rely on a myriad of other applications and services to reduce their attack surface and transfer risk to as many organizations as possible.
The true cost of risk to a project doesn't end at project completion but rather with customer satisfaction throughout the product's lifecycle. To precisely illustrate brand risk from open source projects the recent past contains a poignant example. When Trend Micro's team conducted a project to build their organization's website they chose the popular open source WordPress suite. Recently, WordPress had a vulnerability that was exploited by hackers and received mostly positive attention for its measured response to patch this vulnerability. In contrast, Trend Micro's site received similarly bad press (McCaskill, 2017 and JupiterBroadcasting, 2017) from the decisions of earlier project managers.
With this type of negative press surrounding open source, it's no wonder why many PMs overlook the advantages open source may have in actuallyreducing the complexity index for a project. KDE's website recently published an interview with a Thomas Weissel, a developer working for the Austrian school system who concluded a project to incorporate KDE into the Austrian school where he worked. In the interview, he describes one critical advantage for open source, the accessibility of the team to resolve issues. In his words:
"That's yet another reason why I picked Plasmashell: The KIOSK system. I reported a lot of issues with the KIOSK system and Plasma developers did an amazing job finding and fixing all the bugs I've found for 5.8. We now have a desktop that is completely locked to make sure nobody accidentally removes or reconfigures important parts of the user interface," said Weissel(Riddell, 2017).
Chris Fisher, a long-time open source commenter, rhetorically asked PMs how long they believed it would take a closed source vendor to respond to identified bugs during a project's execution. This is a terrific example of architecture cost being shifted from the organization to the developers. For enterprise-scale projects, large, closed sourced vendors may be willing to work with their clients. For smaller-scale projects, the responsiveness of a project team may be their only way to tool the software to their specific needs.
Open source solutions have been adopted by various sectors of the market to fit key roles in our technology infrastructure. The risk complexity index developed by Tom Kendrick helps us to understand the difficulties with the adoption of open source solutions across all dimensions of the market.
In general, open source solutions shift the risk from a software vendor to the organization. In today's environment where branding is both costly and crucial, open source solutions represent a direct risk to the brands who use them. Despite this risk, many large- and small-scale projects are still choosing open source solutions for projects where the complexity index is reduced by their implementation. The example of the KDE development team working with a small project manager in Austria to develop the best code possible is a clear example of a significant advantage within the field of open source. While the authors of the code may not be legally liable, their pride in their product generally serves as a terrific motivator for them to deliver their best.
Kendrick, T. (2015). Identifying and managing project risk: essential tools for failure-proofing your project. New York: American Management Association.
Pen Testing [Personal interview]. (2016, December).
Project Management Institute (PMI, 2013). A guide to the project management body of knowledge/PMBOK Guide (5th ed.). Newton Square, Pennsylvania: Project Management Institute, Inc.
Read more from the original source:
Understanding the difficulties of the adoption of open source ... - Opensource.com