Former MS privacy chief warned of NSA spying

Two years before Snowden in 2011, Microsofts then Chief Privacy Officer tried to warn his company that any cloud computing solutions sold to foreign governments would mean unlimited mass surveillance on their clients by by the NSA. Two months later Caspar Bowden was fired from Redmond.

Speaking at the 31st Chaos Computer Congress in Hamburg Bowden said that he warned 40 Microsoft National Technical Officers, effectively ambassadors of Microsoft, about the implication of US laws on privacy. The law underpinning PRISM, the NSA-GCHQ clandestine mass surveillance programme, was the 2008 Foreign Intelligence Surveillance Act Amendment Act (FISAAA). This law is about obtaining foreign intelligence, targeting non-US persons outside of the US, which is 95% of the worlds population.

Providers must provide government facilities to accomplish this action in secret.

Bowden said that the bottom line of FISAAA means that if you are not American, you cannot trust cryptographic services, or in general, software services provided by US companies. Even if that software is cryptographically sound to begin with, if you are not an American in the US, a software update can be pushed to subvert your security.

As Yahoos Marissa Mayer later pointed out, any company not complying would be found in contempt of court and potentially committing an offence under the espionage act liable to 20 years imprisonment or worse.

It doesnt have to be about criminality or national security. It can purely mean political surveillance in the political and economic interests of the United States. There is no constitutional protection for foreigners in foreign lands and the US congress was laughing, laughing that you have privacy rights he said.

Bowden met a wall of indifference from journalists. Nobody at the Guardian, New York Times or Washington Post showed any interest; nor from mainstream European politicians who did not understand. Of course, its encrypted isnt it? was the general response.

Link:
Former MS privacy chief warned of NSA spying

Katie Benner: Online privacy and the Edward Snowden documentary

SAN FRANCISCO Laura Poitras' new documentary about mega-leaker Edward Snowden, "Citizenfour," makes no pretense at being evenhanded. It's a polemic against the National Security Agency's effort to spy on people in the United States and around the world innocent, guilty or simply suspect all in the name of national security.

Snowden, a former government contractor who famously stole and delivered information to the press about the NSA's spying efforts, is portrayed as an intellectually thoughtful hero (albeit young and often nave).

Poitras shot her documentary in a grainy, verite style and it has the pace and feel of a John le Carre novel. That's because Poitras wants us to believe that the real-life story of U.S. mass surveillance is as incredible and gripping as a well-told thriller. The twist, of course, is that the tale is true. Thus, the outrage.

Like so much of le Carre's work, Poitras' film doesn't have a tidy or satisfying conclusion. The ostensible good guys in her story Snowden and, later on, the journalists who help him get his message out are left in limbo. Snowden still lives in exile in Russia, and Poitras herself is unwilling for a time to return to the United States because of concerns about her own freedom. Snowden, Poitras and others continue to fight, despite the odds that the bad guys in "Citizenfour" national security authorities and espionage agencies will prevail because the system that would otherwise hold them in check has been seriously compromised.

If you don't agree with Poitras' politics and point of view in "Citizenfour," you're not alone. Michael Cohen at the Daily Beast is (rightfully) concerned that she and fellow reporter Glenn Greenwald work from the assumption that the government's actions have black-and-white parameters, and thus mine the Snowden data to support that story. (Of course, Poitras has been spied on, and she says that she was followed while working in Hong Kong, so for her the politics are also deeply personal.)

"Citizenfour" leaves little room for a more nuanced look that takes into account the reality that countries around the world are using cyber espionage (and increasingly cyber warfare) to wage an unseen and seemingly never-ending war.

Concerns like Cohen's, however valid, don't make Poitras' film any less significant. "Citizenfour" may spark the same kind of outrage about the surveillance state that Matt Taibbi's Rolling Stone article about (the "vampire squid") Goldman Sachs and Michael Lewis' book about the mortgage market, "The Big Short," sparked about the financial crisis several years ago. Lots of solid, nuanced and hard-won reporting from other media surrounded the financial meltdown and Taibbi and Lewis' work relied on all of that reporting. But Taibbi and Lewis used rhetorical, narrative power to define the financial crisis in ways that gave the event meaning and clarity for a broader audience.

Poitras' documentary is considered a likely Oscar winner by some observers, and while nothing has arisen proving that the NSA has used data it has collected to harm innocent citizens, the threats created by unfettered data collection are what animate "Citizenfour."

By Snowden's reckoning, a huge database that can be used to monitor our communiqus is potentially a "weapon of oppression." Even some of Snowden and Poitras' critics largely agree that this threat to our privacy and freedoms should be taken seriously.

The roots of this issue run deep and extend, of course, well beyond the NSA. Concerns about online privacy ramped up in the late '90s as the Internet's popularity and accessibility boomed, and heightened further when we began voluntarily ceding ever greater quantities of our personal data to telco and data giants such as Verizon, Facebook, Google and Apple.

The rest is here:
Katie Benner: Online privacy and the Edward Snowden documentary

Obama administration backs disclosing software vulnerabilities in most cases

The administration of U.S. President Barack Obama favors disclosing to the public vulnerabilities in commercial and open source software in the national interest, unless there is a national security or law enforcement need, the country's spy agency said.

The government was on Friday countering a news report that said the U.S. National Security Agency knew about the recently identified Heartbleed vulnerability for at least two years and had used it for surveillance purposes.

The administration said the NSA was not aware of Heartbleed until it was made public in a private sector cybersecurity report.

"When Federal agencies discover a new vulnerability in commercial and open source software -- a so-called 'Zero day' vulnerability because the developers of the vulnerable software have had zero days to fix it -- it is in the national interest to responsibly disclose the vulnerability rather than to hold it for an investigative or intelligence purpose," the Office of the Director of National Intelligence said in a statement Friday.

The ODNI statement added that the White House had reviewed its policies in response to the recommendations of the President's Review Group on Intelligence and Communications Technologies, set up to review the surveillance practices of the NSA.

Under an inter-agency process called the Vulnerabilities Equities Process, unless there is a clear national security or law enforcement need, the process is "biased toward responsibly disclosing such vulnerabilities," according to the spy agency.

One of the recommendations in December of the review group was that U.S. policy should ensure that zero-day vulnerabilities are quickly blocked and the underlying vulnerabilities are patched on U.S. government and other networks. The group allowed that in "rare instances," the policy of the government may briefly authorize using a zero-day flaw for intelligence collection after inter-agency review involving all relevant departments at a senior level.

Referring to allegations that the U.S. government introduced "backdoors" into commercially available software, enabling the decryption of apparently secure software, the review group said it was not aware of any such incidents, but advised that the US Government should make it clear that the NSA will not engineer vulnerabilities into "encryption algorithms that guard global commerce."

The Heartbleed vulnerability takes advantage of a problem in certain versions of OpenSSL, a set of encryption tools used for securing Web connections, and could allow a remote attacker to expose critical data such as user authentication credentials and secret keys.

Internet companies rushed to fix the problem, while the Canada Revenue Agency halted online filing of tax returns by the country's citizens as a preventive measure. The CRA's systems were restored on Sunday after applying a "patch" that addresses the vulnerability. "We could not allow these systems back online until we were fully confident they were safe and secure for Canadian taxpayers," said CRA Commissioner Andrew Treusch in a statement. The U.S. Internal Revenue Service said it continued to accept tax returns ahead of an April 15 deadline, as its systems were not affected by Heartbleed

See the article here:
Obama administration backs disclosing software vulnerabilities in most cases

NSA’s penetration of RSA security was two-pronged: researchers

Infiltrated: Two NSA tools exacerbated the RSA software's vulnerability. Photo: Reuters

Security industry pioneer RSA adopted not just one but two encryption tools developed by the US National Security Agency (NSA), greatly increasing the spy agency's ability to eavesdrop on some internet communications, according to researchers.

In December it was reported the NSA had paid RSA $US10 million ($10,800,000) to make a now-discredited cryptography system the default in software used by a wide range of internet and computer security programs. The system, called Dual Elliptic Curve, was a random-number generator, but it had a deliberate flaw or "back door" that allowed the NSA to crack the encryption.

A group of professors from Johns Hopkins, the University of Wisconsin, the University of Illinois and elsewhere now say they have discovered that a second NSA tool exacerbated the RSA software's vulnerability.

The professors found that the tool, known as the Extended Random extension for secure websites, could help crack a version of RSA's Dual Elliptic Curve software tens of thousands of times faster, according to an advance copy of their research shared with Reuters.

Advertisement

While Extended Random was not widely adopted, the new research sheds light on how the NSA extended the reach of its surveillance under cover of advising companies on protection.

RSA, now owned by EMC, did not dispute the research when contacted by Reuters for comment. The company said it had not intentionally weakened security on any product and noted that Extended Random did not prove popular and had been removed from RSA's protection software in the past six months.

"We could have been more sceptical of NSA's intentions," RSA chief technologist Sam Curry said. "We trusted them because they are charged with security for the US government and US critical infrastructure."

Mr Curry declined to say if the government had paid RSA to incorporate Extended Random in its BSafe security kit, which also housed Dual Elliptic Curve.

Read more:
NSA's penetration of RSA security was two-pronged: researchers

Julian Assange has cost Britain £9m to police at Ecuador embassy

Julian Assange has claimed asylum at Ecuador embassy since June 2012 Metropolitan police officers have been standing outside building ever since Has cost taxpayers 9million as police officers stationed round the clock He is wanted in Sweden after allegedly sexually assaulting two women Fears he could be sent to US on charges of leaking government documents

By Thomas Burrows for MailOnline

Published: 07:25 EST, 3 January 2015 | Updated: 11:37 EST, 3 January 2015

2.4k shares

506

View comments

Guarding the Ecuadorian embassy in London where Julian Assange has claimed asylum has now cost taxpayers 9million, it has been revealed.

Metropolitan Police officers have been standing outside the Knightsbridge building since the WikiLeaks founder took refuge there in June 2012 - a vigil costing 11,000 per day.

The 43-year-old is wanted in Swedenafter allegedly sexually assaulting two women in Stockholm in 2010.

Scroll down for video

See more here:
Julian Assange has cost Britain £9m to police at Ecuador embassy