One Year Later, No One Has Been Punished for the IRS Leak of Billionaires’ Tax Data – Reason

In June 2021, ProPublica published confidential IRS tax information about wealthy Americans provided by a still-unidentified source. While we don't yet know who dumped the data, we do know that this is far from the first time that the tax agency, which forces people to reveal sensitive details about their finances, has proven to be an unreliable custodian of that information, and that's putting it nicely. Too often, federal tax collectors misuse official records for fun, profit, and political advantage.

"Today, ProPublica is launching the first in a series of stories based on the private tax data of some of our nation's richest citizens," ProPublica's Stephen Engelberg and Richard Tofel wrote on June 8, 2021. "Many will ask about the ethics of publishing such private data. We are doing soquite selectively and carefullybecause we believe it serves the public interest in fundamental ways, allowing readers to see patterns that were until now hidden."

Included in the treasure trove of tax data were details about the tax bills of people including Jeff Bezos and Warren Buffett. Drawn from IRS records, the information was provided through "secure systems that allow whistleblowers to transmit information to us without revealing their identity." The data revealed that many wealthy Americans successfully minimize their tax burdens, which might have been the source's purpose, though that's anybody's guess. People have many motivations for releasing information and ProPublica admits it doesn't know the source's intentions.

In fact, the IRS leaks like a sieve on a regular basis for all sorts of reasons.

"[T]he IRS completed 1,694 investigations into the willful unauthorized access of tax data by employeesand 27% were found to be violations," the U.S. Government Accountability Office reported last month.

"[Michael Kasper] was almost certainly one of the more than 330,000 Americans who fell victim to an audacious hack of the Internal Revenue Service (IRS), which was disclosed earlier this year," Quartz noted in 2015 of a man who discovered that somebody else collected his tax refund.

"Tea Party, anti-abortion and other conservative groups told Congress on Tuesday that the Internal Revenue Service held up their applications for tax exemptions, harassed them with questions and leaked their donor lists to political opponents," USA Today reported in 2013.

Outsiders penetrate inadequate security for gain while IRS employees often access and disclose financial information to satisfy personal curiosity, to make money, and to advance political causes. Sometimes those political causes are their own, and other times they're part of the agenda of whoever holds power in the federal government.

"The history of the I.R.S is riddled with repeated instances of agents acting out of self-interest or pursuing their own ideological agenda, as well as examples of Presidents, White House staff and Cabinet officials pressuring the tax agency to take political actions," The New York Times pointed out in 1989.

That abuse began early in the accumulation of the tax agency's powers.

"My father," Elliott Roosevelt, son of former President Franklin Delano Roosevelt, once commented, "may have been the originator of the concept of employing the IRS as a weapon of political retribution."

FDR's administration may have been the first to weaponize the tax-collection agency, but it wasn't the last. John F. Kennedy established an "Ideological Organizations Audit Project" within the IRS to target his conservative political critics. Richard Nixon infamously used the tax agency as a political hit man against prominent Democrats. That the misuse of tax information continued is obvious from the Times story on the matter during the administration of Bush Sr. as well as from the scandal over the Obama-era mistreatment of Tea Party groups and, more recently, the ProPublica leak.

So, the use of tax data by ProPublica and its source to make a policy point isn't exactly groundbreaking. Some of the agents and politicians who weaponized the IRS in the past intended to make the world a better place by their lights, or at least to hurt only people and organizations they were convinced were bad. And leaks from government agencies often do achieve beneficial ends. Where would we be without Daniel Ellsberg's copies of the Pentagon Papers, Mark Felt's role as "Deep Throat" in the Watergate scandal, or Edward Snowden's revelations of government surveillance?

But leaks from the IRS aren't war plans, misuses of power, or politicians' schemes; they're sensitive, private financial information that we're forced to surrender to government agents. We have no choice but to fill out our tax forms even though we know that the federal employees receiving our information have a track record of abusing that data for their own ends and to our detriment.

And political goals aren't objectively good justifications for invading people's financial privacy. The National Taxpayers Union Foundation's Andrew Moylan and Andrew Wilford warned in Reason that ProPublica's use of the data was "deceptive and sure to lead to ill-advised policy making." Under the most charitable interpretation, that indicates a tendentious misuse of sensitive private information.

Not that the tax authorities necessarily care. History suggests that IRS leaks carry minimal consequences for the agency.

"The Treasury Inspector General for Tax Administration (TIGTA) previously issued an audit report in September 2006 on the IRS's Office of Privacy and found that the IRS was not complying with legislative privacy requirements," TIGTA reported in 2013. "Despite its commitment toward privacy and improvements from our prior review, the IRS continues to face challenges in meeting legislative privacy requirements."

And here we are in 2022 with, apparently, still a good deal of room for improvement after decades of abuses of privacy by tax collectors and wrist-slaps by their watchdogs. Almost a year after the initial ProPublica story, and after Treasury Secretary Janet Yellen promised "to get to the bottom of this criminal activity," the federal government still claims to have no idea who leaked the data. "There have been no arrests nor any official hints about how the wall of secrecy around tax records was broken; it is unknown whether the IRS has found or closed any security gaps," reports the Wall Street Journal.

Many of us complain about the bite the government takes out of our paychecks. Even more pernicious, though, is that the information tax collectors force us to surrender is likely to be turned against us by politicians, government agents, and activists who see the details of our finances as tools with which to achieve their goals. The IRS isn't just a powerful federal agency, it's a weapon against the public.

See the original post:
One Year Later, No One Has Been Punished for the IRS Leak of Billionaires' Tax Data - Reason

MongoDB debuts new encryption tool and analytics features at MongoDB World – SiliconANGLE News

MongoDB Inc. today introduced new features that will enable enterprises to query their data without decrypting it and carry out large-scale analytics projects more easily.

The features were announced at the companys annual MongoDB World conference.

Publicly traded MongoDB provides an open-source NoSQL database that is widely used among developers. The database has been downloaded more than 265 million times, while developers at north of 35,000 organizations use it to power applications.

Some of the product updates that MongoDB announced today are rolling out for its namesake open-source database. Other features will become available as part of MongoDB Atlas, a managed cloud version of the database. Atlas removes the need for customers to manage infrastructure and automates a number of other administrative tasks.

Our vision is to offer a developer data platform that provides a modern and elegant developer experience, enables broad support for a wide variety of use cases, and delivers the performance and scale needed to address the most demanding requirements, said MongoDB Chief Executive Officer Dev Ittycheria.

Companies keep the business information in their databases encrypted most of the time to ensure that hackers cant read records in case they gain network access. However, records have to be decrypted when theyre queried by an application or a user. MongoDB is rolling out a new release of its open-source database, MongoDB 6.0, that it says makes it possible to query data without decrypting it.

MongoDB 6.0s Queryable Encryption feature, as its known, doesnt require specialized cryptography know-how to use. Queryable Encryption keeps records encrypted while theyre in a servers memory. Information also remains encrypted while it travels through the servers central processing unit, according to MongoDB.

Cybersecurity researchers have long sought to develop a way of processing data without having to decrypt it. Some of the technologies that have been created to facilitate encrypted processing, such as fully homomorphic encryption, are impractical to use because they significantly slow down queries. MongoDB says Queryable Encryption facilitates speedy queries and doesnt impact application performance.

Another set of features introduced by MongoDB today focuses on helping companies carry out large-scale data analytics initiatives more easily. Some of the capabilities are rolling out for the MongoDB database, while others are part of the Atlas managed database service.

MongoDB 6.0 introduces a feature called Column Store Indexes that will speed up common analytical queries. The feature speeds up queries by creating an index, a collection of data shortcuts that makes it possible to find specific records in a database faster. Reducing the amount of time that it takes to find records enables the database to return results quicker.

For administrators, MongoDB is adding a feature that makes it easier to manage the hardware resources assigned to a MongoDB deployment. According to the company, the feature will help administrators avoid provisioning too little or too much infrastructure for a MongoDB deployment that is used to support analytics workloads.

Atlas, the managed version of MongoDB, is also receiving improved support for analytics workloads. A tool called Atlas Data Lake will provide managed cloud object storage to facilitate analytical queries. For business analysts, MongoDB is rolling out Atlas SQL Interface, a capability that makes it possible to query data using SQL syntax.

MongoDBs revenuegrew 57% year-over-year, to $285.4 million, during the quarter ended April 30. As part of its revenue growth strategy, MongoDB has been adding support for more enterprise use cases, which helps expand its addressable market and unlock new sales opportunities.

MongoDB 6.0 adds improved support for use cases that involve time series data. Thats the term for data used to describe a trend, such as how a servers performance changes over the course of a week. Time series data is used for tracking the health of technology infrastructure, monitoring shifts in product demand and a range of other use cases that MongoDB can now support more effectively.

Website development is another use case on which MongoDB is increasing its focus. The company is upgrading its managed Atlas database service by adding an integration with Vercel, a popular website development tool. MongoDB says that the integration will save time for joint customers by automating certain manual configuration tasks.

For developers using Atlas to power mobile apps, MongoDB is adding the ability to sync data to and from the popular Realm mobile database. Meanwhile, companies that rely on Atlas to power the search features of their applications and websites are also receiving new features. The company is making it easier to let users filter search results by category, a feature that usually requires significant amounts of custom code to implement.

Some MongoDB customers run multiple deployments of its database to support their applications. As part of the product updates announced today, the company is adding a set of features to simplify such customers information technology operations.

Cluster-to-Cluster Synchronization is a new tool that can automatically sync records between MongoDB databases to ensure they all have the latest version of a dataset. The tool can sync records across Atlas deployments, as well as MongoDB databases running in the cloud and on-premises.

Another new addition to the companys feature set is Data Federation. Available as part of Atlas, the capability makes it possible to centrally run a query across multiple MongoDB deployments. Data Federation could simplify large-scale analytics projects that draw on information from multiple databases.

Read more here:
MongoDB debuts new encryption tool and analytics features at MongoDB World - SiliconANGLE News

WinMagic Enters the Passwordless Authentication Market with MagicEndpoint – GlobeNewswire

MISSISSAUGA, Ontario, June 08, 2022 (GLOBE NEWSWIRE) -- WinMagic, is proud to announce that MagicEndpoint, its passwordless authentication and encryption solution is now available. With MagicEndpoint, WinMagic enters the passwordless landscape in a unique position, offering independent, yet complimentary, authentication and encryption solutions that protect both data and user. MagicEndpoint ensures that CISOs and other technology and IT security leaders, can easily implement passwordless authentication, addressing their cyber security needs, while eliminating password friction and reducing password management costs. MagicEndpoint addresses a growing industry need for precise, strong user authentication while still protecting the data security within devices, servers, and networks.

The breakthrough behind MagicEndpoint's passwordless technology means a client only has to authenticate to the endpoint to verify they are in possession of the device, and the endpoint can do the remote authentication on behalf of the users, with no user action required. MagicEndpoint does not require phones or external tokens. Smarter, faster passwordless authentication means no more obtaining codes from mobile devices, or accepting insecure push notifications, or re-setting multiple passwords. The result? Happy end-users and even happier CIOs and CISOs, who can be confident their employees and data are protected, while reducing and eventually eliminating the need for password support.

A Media Snippet accompanying this announcement is available by clicking on the image or link below:

Thi Nguyen-Huu, President and CEO of WinMagic, noted that this latest development is a proud addition to WinMagics existing award-winning suite of encryption products, and a game changer for cyber-protection. Creating a techno-logically correct solution is amazing. Nguyen-Huu added, While initially trying to use various authentication devices to give users the choice for different scenarios, we realized that the capable endpoint can perform high assurance secure remote authentication, magnitudes stronger than the user ever could. Capable of verifying user identity, even user intention, MagicEndpoint delivers not only passwordless, but also user-action-less remote authentications, undoubtedly the best user experience while eliminating any possible user error or phishable action. No user action, in turn, allows MagicEndpoint to perform continuous verification of user and device - an impossible task for any human, fulfilling the Zero Trust aspired principle of Always Verify!

In a newly published 451 Research Market Insight Report, Principal Security Research Analyst Garrett Bekker remarked on the product development, saying, It is logical for an endpoint-focused encryption vendor to leverage that expertise with an endpoint-focused authentication offering. One of MagicEndpoints main value propositions is the ability to offer no user interaction (for Windows devices), which in turn allows for continuous verification of the endpoint client and is a step toward delivering a zero-trust architecture along with the ability to establish device trust by combining user authentication with device health checks.

MagicEndpoint passwordless authentication is based on the principle that the endpoint can perform public key-based authentication that no other device or bad actor can duplicate. By leveraging this inherent capability within endpoint devices, the attack surface is significantly reduced.

About WinMagicWinMagic is a leading developer of cybersecurity solutions that, over the course of 20 years, has raised the bar for endpoint encryption. As a result of extensive experience with securing the endpoint and a commitment to continuous innovation, WinMagic is trusted by over 2500 businesses and government agencies around the world and has over 3 million active licenses globally. WinMagics authentication and encryption suite of products protects data within any laptop, physical or virtualized data center, on-premises or in the cloud. The companys solutions are platform-independent, able to secure data on devices using Windows, Linux and Mac systems.WinMagic has earned wide recognition for protecting against threats and data loss, while helping businesses meet privacy and regulatory compliance requirements. WinMagic delivers a secure, seamless authentication and encryption experience and offers solutions that free customers to think, share and achieve their goals, knowing employees and data are protected. For more information, visit ww.winmagic.com.

For more information:Nadine BrownDirector of Marketing and CommunicationsNadine.brown@winmagic.com

Go here to read the rest:
WinMagic Enters the Passwordless Authentication Market with MagicEndpoint - GlobeNewswire

Perfect Forward Secrecy explained: everything you need to know – TechRadar

You're probably already familiar with the concept of encryption. Messaging apps, VPN services and most websites constantly scramble your data in transit so that just you and the receiver can access that information - whether it's a message, call or webpage.

However, for encryption to be effective, these private keys must remain secret at all times. Otherwise, if cybercriminals get hold of them, they will be able to access or modify your data in transit.

That's where Perfect Forward Secrecy (PFS) comes into play: to minimize the risk in the rare situation that your encryption keys do get compromised. This technology is a way to fortify encryption, and prevent hackers from accessing your whole stack of data.

Secure messaging apps like Signal and many of the best VPN providers have implemented PFS technology in their software to ensure their users stay safe, even in a worst-case scenario.

Here, we'll explain everything you need to know about Perfect Forward Secrecy: how it works, its pros and cons, and on which occasions it is implemented.

Perfect Forward Secrecy minimizes the risk posed to your personal information in the event of an encryption key breach by regularly changing your keys. The amount of time between changes varies by implementation - some are hourly, and others change every time you access a new message or load a new page.

This means that if malicious actors manage to intercept one of these keys, they will be able to access just a small portion of the information you shared online.

These keys are randomly generated so that, even in case they get intercepted, hackers won't be able to use them to get hold of your past nor your future data.

In the case of VPN traffic, these sets of keys are regenerated for each session. Some providers like ExpressVPN use new keys every time your device switches network, after a connection is terminated, as well as every 15 minutes to better protect longer sessions.

So, PFS generates new sets of keys to minimize the users' risk, but how exactly does this process work?

The infrastructure of apps, services and websites supporting Perfect Forward Secrecy relies on the Diffie-Hellman key exchange (DH) (opens in new tab) to generate ephemeral keys without sharing them over the internet. Using prime numbers and complex mathematical formulas, DH allows two parties without prior knowledge of each other to establish a shared secret key over an insecure connection channel.

In simple terms, as soon as these decryption keys have been used, they disappear. And the process is repeated for each data exchange happening between the two parties - whether that's you and your mate chatting via Telegram Secret Chats, or your device and the web server rerouting you on a chosen site.

All this makes it quite difficult for hackers to get hold of your data in transit and, in the virtually impossible case that they manage to do so, only the information you shared via that single key will be revealed.

Perfect Forward Secrecy has several advantages compared with traditional encryption systems. That's not to say that normal encryption isn't secure, but adding an extra layer of protection makes your crypto-lock way more difficult to crack.

First of all, with endlessly changing encryption keys, your past activities will be protected from any intruders in case future sessions get compromised.

Your overall data security will improve as, even if a leak does happen, third parties will manage to see only a tiny portion of your encrypted data.

On top of that, hackers would probably be less inclined to target PFS-based services. That's mainly because it wouldn't be worth the effort to access only a very limited stack of data.

As every time a double encryption occurs - similarly to NordVPN's Double VPN - your connection might slow down. That's because the system requires more processing power. However, if your device is powerful enough you are unlikely to even realize it.

From a developing perspective, PFS is harder to troubleshoot as its infrastructure is more complex.

Plus, although all modern browsers support Perfect Forward Secrecy on HTTPS-encrypted sites, there are still some web servers that unfortunately do not.

It is also worth noting that, even though both the popular OpenVPN and WireGuard protocols support PFS technology, even the most secure VPN services usually do not enable this by default.

With cyber attacks continuing to grow everywhere around the world, Perfect Forward Secrecy is becoming increasingly popular for protecting modern communications.

In 2011, Google started integrating PFS in its TLS infrastructure to secure all its services - from Gmail and Google Docs to encrypted search. Two years later, Twitter did the same.

Now, almost every website implements Perfect Forward Secrecy technology. As Atlas VPN reported, SSL Labs found out that only a tiny 0,9% of sites do not support PFS at all (opens in new tab).

Many of the most private VPN services have implemented this secure technology, too. These include ExpressVPN, Proton VPN, NordVPN and Private Internet Access (PIA).

Compare today's best overall VPNs

See the original post:
Perfect Forward Secrecy explained: everything you need to know - TechRadar

Securities Litigation Partner James (Josh) Wilson Encourages Investors Who Suffered Losses Exceeding $100,000 In Arqit To Contact Him Directly To…

NEW YORK, NY / ACCESSWIRE / June 9, 2022 / Faruqi & Faruqi, LLP, a leading national securities law firm, is investigating potential claims against Arqit Quantum Inc. f/k/a Centricus Acquisition Corp. ("Arqit" or the "Company") (NASDAQ:ARQQ,ARQQW,CENH,CENHU,CENHW) and reminds investors of the July 5, 2022 deadline to seek the role of lead plaintiff in a federal securities class action that has been filed against the Company.

If you (i) suffered losses exceeding $100,000 investing in Arqit stock or options between September 7, 2021 and April 18, 2022, and/or (ii) were a holder of Centricus securities as of the record date for the special meeting of shareholders held on August 31, 2021 to consider approval of the merger between Arqit and Centricus (the "Merger") and would like to discuss your legal rights, call Faruqi & Faruqi partner Josh Wilson directly at 877-247-4292 or 212-983-9330 (Ext. 1310). You may also click here for additional information: http://www.faruqilaw.com/ARQQ.

Faruqi & Faruqi, LLP, Thursday, June 9, 2022, Press release picture

There is no cost or obligation to you.

Faruqi & Faruqi, LLP, Thursday, June 9, 2022, Press release picture

Faruqi & Faruqi is a leading minority and Woman-owned national securities law firm with offices in New York, Pennsylvania, California and Georgia.

As detailed below, the lawsuit focuses on whether the Company and its executives violated federal securities laws by making false and/or misleading statements and/or failing to disclose that: (1) Arqit's proposed encryption technology would require widespread adoption of new protocols and standards of for telecommunications; (2) British cybersecurity officials questioned the viability of Arqit's proposed encryption technology in a meeting in 2020; (3) the British government was not an Arqit customer but, rather, providing grants to Arqit; (4) Arqit had little more than an early-stage prototype of its encryption system at the time of the Merger; and (5) as a result, Defendants' statements about its business, operations, and prospects, were materially false and misleading and/or lacked a reasonable basis at all relevant times.

Story continues

On April 18, 2022, The Wall Street Journal (the "WSJ") published an article titled, "British Encryption Startup Arqit Overstates Its Prospects, Former Staff and Others Say." The WSJ article stated, in relevant part:

When the company secured its Nasdaq listing last autumn, its revenue consisted of a handful of government grants and small research contracts, and its signature product was an early-stage prototype unable to encrypt anything in practical use, according to [former employees and other people familiar with the company]. The encryption technology the company hinges on-a system to protect against next-generation quantum computers-might never apply beyond niche uses, numerous people inside and outside the company warned, unless there were a major overhaul of internet protocols.

British cybersecurity officials questioned the viability of Arqit's proposed approach to encryption technology in a high-level evaluation they privately shared with the company in the summer of 2020, according to people familiar with the matter.

The U.S. National Security Agency and the NCSC published separate assessments in recent years warning against using satellite-based encryption systems like those Arqit is proposing to integrate into its current product in the next few years. The NSA said its warning was unrelated to any specific vendor, a spokesperson said.

The encryption system-with or without its satellite components-depends on the broad adoption of new protocols and standards for telecommunications, cloud computing and internet services that currently aren't widely supported, people familiar with the matter said.

Steve Weis, a San Francisco-based cryptographer and entrepreneur, said that what Arqit was proposing-relying in part on transmitting quantum information from satellites-is a well-known 1980s-era technology with limited real-world application. "There have been many proofs of concept and companies trying to sell products," he said. "The issue is that there is no practical-use case."

Key to the company's pitch was its claim that it had a large stream of future revenue locked in as the product was live and already selling well. "Customers are using the Arqit products today-and they are universally finding it to be an important part of their technology future," Mr. Williams said in an August investor presentation shortly before the merger closed. He added, "The Quantum Cloud product is live for service and we already have $130 million in signed committed revenue contracts."

"These are contracts where the revenues will definitely be delivered," the CEO said.

The people familiar with the matter said that the bulk of the company's committed revenue isn't from selling its product and that at its public launch, the company had little more than an early-stage prototype of its encryption system. Several clients the company lists-including a number of British government agencies-are simply giving Arqit research grants, nonbinding memorandums of understanding or research agreements that come with no funding, not contracts for its encryption product, they said.

No commercial customer was using Arqit's encryption system with live data when it made its market debut in September, the people said, and the system couldn't meaningfully use any of the common internet protocols required to do nearly anything online. They said it has signed two master distribution agreements with BT Group [] PLC and Sumitomo Corp. [] for the still-unrealized satellite component of its technology that are cancelable under certain conditions.

On this news, Arqit share price fell $2.57 per share, or 17%, to close at $12.49 per share on April 18, 2022, damaging investors.

The court-appointed lead plaintiff is the investor with the largest financial interest in the relief sought by the class who is adequate and typical of class members who directs and oversees the litigation on behalf of the putative class. Any member of the putative class may move the Court to serve as lead plaintiff through counsel of their choice, or may choose to do nothing and remain an absent class member. Your ability to share in any recovery is not affected by the decision to serve as a lead plaintiff or not.

Faruqi & Faruqi, LLP also encourages anyone with information regarding Arqit's conduct to contact the firm, including whistleblowers, former employees, shareholders and others.

Attorney Advertising. The law firm responsible for this advertisement is Faruqi & Faruqi, LLP (www.faruqilaw.com). Prior results do not guarantee or predict a similar outcome with respect to any future matter. We welcome the opportunity to discuss your particular case. All communications will be treated in a confidential manner.

SOURCE: Faruqi & Faruqi, LLP

View source version on accesswire.com: https://www.accesswire.com/704577/Securities-Litigation-Partner-James-Josh-Wilson-Encourages-Investors-Who-Suffered-Losses-Exceeding-100000-In-Arqit-To-Contact-Him-Directly-To-Discuss-Their-Options

Follow this link:
Securities Litigation Partner James (Josh) Wilson Encourages Investors Who Suffered Losses Exceeding $100,000 In Arqit To Contact Him Directly To...

Mandiant: Cyberextortion schemes increasing pressure to pay – TechTarget

SAN FRANCISCO -- Enterprises are facing multilayered cyberextortion campaigns that combine data theft, public shaming and system encryption, which are increasing the pressure on victims to pay ransoms.

During an RSA Conference 2022 session Wednesday, David Wong, vice president at Mandiant, and Nick Bennett, vice president of professional services at Mandiant, provided case studies and anecdotal data that compared the outcomes of two clients that each suffered a ransomware attack and various cyberextortion attempts. While one client was more prepared to deal with a successful attack than the other, the examples highlighted an increasing persistence from attackers that pays off if the victim is ill-equipped.

Bennett highlighted some of the newer cyberextortion tactics that ransomware gangs and cybercriminals are using to pressure victims to pay. Encrypting data and demanding payments for decryption keys is only one of the tactics used by threat actors, he said.

"We see them reaching out directly to the victim's customers and antagonizing those customers," Bennett said. "We see them reaching out to the media to get more heat on the victim. We see them sometimes even reaching out to regulators that have jurisdiction over the victims."

The first case study involved a company that had relative success, despite it being the client's first incident response situation, because of some key factors in place. The client had implemented multifactor authentication across all remote access technologies, kept aggregated logs, understood its Active Directory environment, was ready to issue public statements and had a clear plan of whom to contact during all attack stages.

Bennett said that enabled Mandiant to react more swiftly and effectively in its incident response investigation.

"The client's team was confident, they were motivated, and importantly, they were authorized by leadership to make decisions and execute," Bennett said during the session.

On the other hand, the second client did not have confidence in bringing its environment back online, Bennett noted. The company was also worried about encryption starting again and feared public leaking of its data. Overall, the client just wanted to get the attacker to back down. Subsequently, Bennett said, it ended up paying a hefty ransom in the million-dollar range.

Wong also provided an example of an incident response case where the company had a policy against paying. While he said Mandiant agrees with that approach, sometimes they start ransom negotiations with the threat actor to stall and gain additional information on the attack, with no intention of paying. However, this company refused to engage in negotiations at all.

In return, the threat actor got nervous and followed through with posting the company's data on a public leak site, Wong said. That alerted the victim's customers, which caused further problems.

"The attacker started DDoS campaigns, they started calling customers because of that multifaceted extortion ransomware attack where they keep trying to put pressure on you, and you don't have much time to respond because you didn't prepare, and now you've got customers calling you," Wong said. "You need to think about those types of strategies, and it's not anything the IT can do -- it's your lawyers, communication teams and the business folks."

Another factor that is contributing to paying ransoms is cyber insurance, both from a company standpoint as well as incentives for attackers. Wong said that although it's an unpopular opinion, sometimes if companies are insured for ransomware coverage, they will pay because it has little effect on their bottom line.

Payal Chakravarty, head of product at cyber insurance company Coalition, echoed that sentiment in an interview with SearchSecurity. Some companies have become confident that if something happens, they will be covered.

"A few customers say, 'Why are you bothering to alert me, you've got me covered,' or 'I have insurance, so why are you telling me to fix things?'" Chakravarty said. "Additionally, if attackers know you're insured, they'll attack you because there's a higher chance of paying it."

Mandiant also addressed a problem stemming from alerts. In both incident response scenarios detailed during the presentation, Bennett said, the victims were equipped with endpoint security tools that identified credential harvesting and issued an alert. However, the human expertise was lacking.

Bennett said there's often failure in the analyst being able to see the alert, understand the full context and piece it together as part of a more significant event.

Chakravarty has observed similar problems with responses to alerts. In some cases, they are ignored, she said. Other times, there are too many people to loop in, or the person who received the alerts no longer works for that company.

"Recently we started tracking preventability, and almost 50% to 60% of ransomware cases are preventable if they had responded [to alerts]," Chakravarty said.

When Mandiant clients do pay, Wong said, nearly 100% do not attempt to recover the funds, even when law enforcement offers to do so. Several reasons contribute to that decision, including cyber insurance and potential attack reciprocation.

"You just suffered a ransomware attack and made that difficult decision to pay, and once you do, you don't really want to open that can of worms," Wong said during the session. "I do want to give law enforcement credit -- for a lot of crimes, you can follow the money and tackle the problem. But with ransomware today, if the victims aren't really trying to recover those funds, it will make it a lot harder for law enforcement, and we're going to have to tackle this in a different way."

See more here:
Mandiant: Cyberextortion schemes increasing pressure to pay - TechTarget

Using the random motion of electrons to improve cybersecurity – Help Net Security

In October 2017, Yahoo! disclosed a data breach that had leaked sensitive information of over 3 billion user accounts, exposing them to identity theft. The company had to force all affected users to change passwords and re-encrypt their credentials. In recent years, there have been several instances of such security breaches that have left users vulnerable.

Almost everything we do on the internet is encrypted for security. The strength of this encryption depends on the quality of random number generation, says Nithin Abraham, a PhD student at the Department of Electrical Communication Engineering (ECE), Indian Institute of Science (IISc). Abraham is a part of a team led by Kausik Majumdar, Associate Professor at ECE, which has developed a true random number generator (TRNG), which can improve data encryption and provide better security for sensitive digital data such as credit card details, passwords and other personal information. The study describing this device has been published in the journal ACS Nano.

Encrypted information can be decoded only by authorised users who have access to a cryptographic key. But the key needs to be unpredictable and, therefore, randomly generated to resist hacking. Cryptographic keys are typically generated in computers using pseudorandom number generators (PRNGs), which rely on mathematical formulae or pre-programmed tables to produce numbers that appear random but are not. In contrast, a TRNG extracts random numbers from inherently random physical processes, making it more secure.

In IIScs TRNG device, random numbers are generated using the random motion of electrons. It consists of an artificial electron trap constructed by stacking atomically-thin layers of materials like black phosphorus and graphene. The current measured from the device increases when an electron is trapped, and decreases when it is released. Since electrons move in and out of the trap in a random manner, the measured current also changes randomly. The timing of this change determines the generated random number. You cannot predict exactly at what time the electron is going to enter the trap. So, there is an inherent randomness that is embedded in this process, explains Majumdar.

The performance of the device on the standard tests for cryptographic applications designed by the US National Institute of Standards and Technology (NIST) has exceeded Majumdars own expectations. When the idea first struck me, I knew it would be a good random number generator, but I didnt expect it to have a record-high min-entropy, he says.

Min-entropy is a parameter used to measure the performance of TRNGs. Its value ranges from 0 (completely predictable) to 1 (completely random). The device from Majumdars lab showed a record-high min-entropy of 0.98, a significant improvement over previously reported values, which were around 0.89. Ours is by far the highest reported min-entropy among TRNGs, says Abraham.

The teams electronic TRNG is also more compact than its clunkier counterparts that are based on optical phenomena, says Abraham. Since our device is purely electronic, millions of such devices can be created on a single chip, adds Majumdar. He and his group plan to improve the device by making it faster and developing a new fabrication process that would enable the mass production of these chips.

Continue reading here:
Using the random motion of electrons to improve cybersecurity - Help Net Security

The race toward a new computing technology is heating up and Asia is jumping on the trend – CNBC

A quantum computer in a vibration-free building. Quantum computing will ultimately speed up the computational power that drives many industries and could affect everything from drug discovery to how data is secured.

Oliver Berg | Picture Alliance | Getty Images

Quantum computing was already gathering pace in Japan and elsewhere in Asia when the University of Tokyo and IBM launched their new quantum computer last year.

The computer was the second such system built outside the United States by IBM the latest in a string of key moves in quantum research.

The university and IBM have led the Quantum Innovation Initiative Consortium alongside heavyweights of Japanese industry like Toyota and Sony all with a view to nailing the quantum question.

Quantum computing refers to the use of quantum mechanics to run calculations. Quantum computing can run multiple processes at once by using quantum bits, unlike binary bits which power traditional computing.

The new technology will ultimately speed up the computational power that drives many industries and could affect everything from drug discovery to how data is secured. Several countries are racing to get quantum computers fully operational.

Christopher Savoie, CEO of quantum computing firm Zapata, who spent much of his career in Japan, said technological development has been very U.S.-centric. But now, Asian nations don't want to be left behind on quantum computing, he added.

"Nation states like India, Japan and China are very much interested in not being the only folks without a capability there. They don't want to see the kind of hegemony that's arisen where the large cloud aggregators by and large are only US companies," Savoie said, referring to the likes of Amazon Web Services and Microsoft Azure.

China, for example, has committed a great deal of brainpower to the quantum race. Researchers have touted breakthroughs and debates are simmering over whether China has surpassed the U.S. on some fronts.

India, for its part, announced plans earlier this year to invest $1 billion in a five-year plan to develop a quantum computer in the country.

James Sanders, an analyst at S&P Global Market Intelligence, told CNBC that governments around the world have been taking more interest in quantum computing in recent years.

In March, Sanders published a report that found governments have pledged around $4.2 billion to support quantum research. Some notable examples include South Korea's $40 million investment in the field and Singapore's Ministry of Education's funding of a research center, The Center for Quantum Technologies.

All of these efforts have a long lens on the future. And for some, the benefits of quantum can seem nebulous.

According to Sanders, the benefits of quantum computing aren't going to be immediately evident for everyday consumers.

What is likely to happen is that quantum computers will wind up utilized in designing products that consumers eventually buy.

James Sanders

analyst, S&P Global Market Intelligence

"On a bad day, I'm talking people down from the idea of quantum cell phones. That's not realistic, that's not going to be a thing," he said.

"What is likely to happen is that quantum computers will wind up utilized in designing products that consumers eventually buy."

There are two major areas where quantum's breakthrough will be felt industry and defense.

A staff member of tech company Q.ant puts a chip for quantum computing in a test station in Stuttgart, Germany, on Sept. 14, 2021. It's expected that the power of quantum computing will be able to decrypt RSA encryption, one of the most common encryption methods for securing data.

Thomas Kienzle | Afp | Getty Images

"Areas where you have HPC [high-performance computing] are areas where we will be seeing quantum computers having an impact. It's things like material simulation, aerodynamic simulation, these kinds of things, very high, difficult computational problems, and then machine learning artificial intelligence," Savoie said.

In pharmaceuticals, traditional systems for calculating the behavior of drug molecules can be time-consuming. The speed of quantum computing could rapidly increase these processes around drug discovery and, ultimately, the timeline for drugs coming to market.

On the flip side, quantum could present security challenges. As computing power advances, so too does the risk to existing security methods.

"The longer-term [motivation] but the one that that everyone recognizes as an existential threat, both offensively and defensively, is the cryptography area. RSA will be eventually compromised by this," Savoie added.

RSA refers to one of the most common encryption methods for securing data, developed in 1977, that could be upended by quantum's speed. It is named after its inventors Ron Rivest, Adi Shamir and Leonard Adleman.

You're seeing a lot of interest from governments and communities that don't want to be the last people on the block to have that technology because [other nations] will be able to decrypt our messages.

Christopher Savoie

CEO of Zapata

"You're seeing a lot of interest from governments and communities that don't want to be the last people on the block to have that technology because [other nations] will be able to decrypt our messages," Savoie said.

Magda Lilia Chelly, chief information security officer at Singaporean cybersecurity firm Responsible Cyber, told CNBC that there needs to be a twin track of encryption and quantum research and development so that security isn't outpaced.

"Some experts believe that quantum computers will eventually be able to break all forms of encryption, while others believe that new and more sophisticated forms of encryption will be developed that cannot be broken by quantum computers," Chelly said.

A quantum processor on a prototype of a quantum computer. There needs to be a twin track of encryption and quantum research and development so that security isn't outpaced, said Magda Lilia Chelly, chief information security officer at Singaporean cybersecurity firm Responsible Cyber.

Julian Stratenschulte/dpa | Picture Alliance | Getty Images

"In particular, [researchers] have been looking at ways to use quantum computers to factor large numbers quickly. This is important because many of the modern encryption schemes used today rely on the fact that it is very difficult to factor large numbers," she added.

If successful, this would make it possible to break most current encryption schemes, making it possible to unlock messages that are encrypted.

Sanders said the development and eventual commercialization of quantum computing will not be a straight line.

Issues like the threat to encryption can garner attention from governments, but research and breakthroughs, as well as mainstream interest, can be "stop-start," he said.

Progress can also be affected by fluctuating interest of private investors as quantum computing won't deliver a quick return on investment.

"There are a lot of situations in this industry where you might have a lead for a week and then another company will come out with another type of the advancement and then everything will go quiet for a little bit."

Another looming challenge for quantum research is finding the right talent with specific skills for this research.

"Quantum scientists that can do quantum computing don't grow on trees," Savoie said, adding that cross-border collaboration is necessary in the face of competing government interests.

"Talent is global. People don't get to choose what country they're born in or what nationality they have."

Visit link:
The race toward a new computing technology is heating up and Asia is jumping on the trend - CNBC

What is the Orca PT-1 computer and how does quantum computing work? – The National

Britain's Ministry of Defence said on Thursday it will work with UK tech firm Orca Computing to investigate the scope to apply quantum technology in defence.

Here, The National explains what quantum computing is and why the UK MoD has agreed to work with Orca.

The pioneer of quantum computing was Paul Benioff of Argonne National Labs, who in 1984 theorised the possibility of designing a computer based exclusively on quantum theory.

In the most simple of terms, quantum computing is extremely high-performance computing so high performing it has the potential revolutionise global industry.

Normal computers process data in bits which have a binary value of zero or one. Quantum computers, by contrast, can process digits simultaneously using a two-state unit called a qubit.

This means that quantum computers have far greater processing power than their regular counterparts.

This extra processing power comes at a heady cost. Quantum computing firm SEECQ says "a single qubit costs around $10,000 and needs to be supported by a host of microwave controller electronics, coaxial cabling and other materials that require large controlled rooms in order to function".

It estimates that in terms of pure hardware, "a useful quantum computer costs tens of billions of dollars to build".

Orca Computing is a 2-year-old UK company that is seeking to scale and integrate quantum computers with real-world technology.

This is a challenge, as qubits must be kept at extremely old temperatures or they will become unstable.

However, Orca says it has found an alternative to conventional quantum computing whereby its software allows small-scale photonic processors to use single units of light to power the process at room temperature.

Investors have been persuaded by Orca's Series A funding round, raising $15 million and attracting investment from the likes of Octopus Ventures, Oxford Science Enterprises, Quantonation and Verve Ventures.

The UK's MoD is also seemingly persuaded by Orca's proposition, having agreed to work in concert with the firm to develop future data-processing capabilities, using Orca's small PT-1 quantum computer.

"Our partnership with MoD gives us the type of hands-on, close interaction, working with real hardware which will help us to jointly discover new applications of this revolutionary new technology," said Richard Murray, chief executive of Orca Computing.

Stephen Till, of the MoD's science and technology lab, said access to the PT-1 would accelerate his ministry's understanding of the technology.

"We expect the Orca system to provide significantly improved latency the speed at which we can read and write to the quantum computer," he said.

Updated: June 09, 2022, 4:04 PM

Read this article:
What is the Orca PT-1 computer and how does quantum computing work? - The National

What’s So Great About Quantum Computing? A Q&A with NIST Theorist Alexey Gorshkov – HPCwire

The following is a Q&A originally published on Taking Measure, the official blog of the National Institute of Standards and Technology (NIST). Photo credit: NIST.

As the rise of quantum computers becomes the subject of more and more news articles especially those that prophesy these devices ability to crack the encryption that protects secure messages, such as our bank transfers its illuminating to speak with one of the quantum experts who is actually developing the ideas behind these as-yet-unrealized machines. Whereas ordinary computers work with bits of data that can be either 0 or 1, quantum computers work with bits called qubits that can be 0 and 1 simultaneously, enabling them to perform certain functions exponentially faster, such as trying out the different keys that can break encryption.

Simple quantum computers already exist, but it has been extremely challenging to build powerful versions of them. Thats because the quantum world is so delicate; the tiniest disturbances from the outside world, such as stray electrical signals, can cause a quantum computer to crash before it can carry out useful calculations.

National Institute of Standards and Technology (NIST) public affairs specialist Chad Boutin interviewed Alexey Gorshkov, a NIST theorist at NIST/University of MarylandsJoint Center for Quantum Information and Computer Science(QuICS) andJoint Quantum Institute, who works at the intersection of physics and computer science research. His efforts are helping in the design of quantum computers, revealing what capabilities they might possess, and showing why we all should be excited about their creation.

We all hear about quantum computers and how many research groups around the world are trying to help build them. What has your theoretical work helped clarify about what they can do and how?

I work on ideas for quantum computer hardware. Quantum computers will be different from the classical computers we all know, and they will use memory units called qubits. One thing I do is propose ideas for various qubit systems made up of different materials, such as neutral atoms. I also talk about how to make logic gates, and how to connect qubits into a big computer.

Another thing my group does is propose quantum algorithms: software that one can potentially run on a quantum computer. We also study large quantum systems and figure out which ones have promise for doing useful computations faster than is possible with classical computers. So, our work covers a lot of ground, but theres a lot to do. You have this big, complicated beast in front of you and youre trying to chip away at it with whatever tools you have.

You focus on quantum systems. What are they?

I usually start by saying, at very small scales the world obeys quantum mechanics. People know about atoms and electrons, which are small quantum systems. Compared to the big objects we know, they are peculiar because they can be in two seemingly incompatible states at once, such as particles being in two places at the same time. The way these systems work is weird at first, but you get to know them.

Large systems, made up of a bunch of atoms, are different from individual particles. Those weird quantum effects we want to harness are hard to maintain in bigger systems. Lets say you have one atom thats working as a quantum memory bit. A small disturbance like a nearby magnetic field has a chance of causing the atom to lose its information. But if you have 500 atoms working together, that disturbance is 500 times as likely to cause a problem. Thats why classical physics worked well enough for so many years: Because classical effects overwhelm weird quantum effects so easily, usually classical physics is enough for us to understand the big objects we know from our everyday life.

What were doing is trying to understand and build large quantum systems that stay quantum something we specialists call coherent even when they are large. We want to combine lots of ingredients, say 300 qubits, and yet ensure that the environment doesnt mess up the quantum effects we want to harness. Large coherent systems that are not killed by the environment are hard to create or even simulate on a classical computer, but coherence is also what will make the large systems powerful as quantum computers.

What is compelling about a large quantum system?

One of the first motivations for trying to understand large quantum systems is potential technological applications. So far quantum computers havent done anything useful, but people think they will very soon and its very interesting. A quantum internet would be a secure internet, and it also would allow you to connect many quantum computers to make them more powerful. Im fascinated by these possibilities.

Its also fascinating because of fundamental physics. You try to understand why this system does some funny stuff. I think a lot of scientists just enjoy doing that.

Why are you personally so interested in quantum research?

I got my first exposure to it after my junior year in college. I quickly found it has a great mix of math, physics, computer science and interactions with experimentalists. The intersection of all these fields is why its so much fun. I like seeing the connections. You end up pulling an idea from one field and applying it to another and it becomes this beautiful thing.

Lots of people worry that a quantum computer will be able to break all our encryption, revealing all our digitized secrets. What are some less worrying things they might be able to do that excite you?

Before I get into what excites me, let me say first that its important to remember that not all of our encryption will break. Some encryption protocols are based on math problems that will be vulnerable to a quantum computer, but other protocols arent. NISTs post-quantum cryptography project is working on encryption algorithms that could foil a quantum computer.

As for what excites me, lots does! But here are a couple of examples.

One thing we can do is simulation. We might be able to simulate really complicated things in chemistry, materials science and nuclear physics. If you have a big complex chemical reaction and you want to figure out how its taking place, you have to be able to simulate a big molecule that has lots of electrons in a cloud around it. Its a mess, and its hard to study. A quantum computer can in principle answer these questions. So maybe you could use it to find a new drug.

Another possibility is finding better solutions to what are called classical optimization problems, which give classical computers a lot of trouble. An example is, What are more efficient ways to direct shipments in a complex supply chain network? Its not clear whether quantum computers will be able to answer this question any better than classical computers, but theres hope.

A follow-up to the previous question: If quantum computers arent actually built yet, how do we know anything about their abilities?

We know or think we know the microscopic quantum theory that qubits rely on, so if you put these qubits together, we can describe their capabilities mathematically, and that would tell us what quantum computers might be able to do. Its a combination of math, physics and computer science. You just use the equations and go to town.

There are skeptics who say that there might be effects we dont know about yet that would destroy the ability of large systems to remain coherent. Its unlikely that these skeptics are right, but the way to disprove them is to run experiments on larger and larger quantum systems.

Are you chasing a particular research goal? Any dreams youd like to realize someday, and why?

The main motivation is a quantum computer that does something useful. Were living in an exciting time. But another motivation is just having fun. As a kid in eighth grade, I would try to solve math problems for fun. I just couldnt stop working on them. And as you have fun, you discover things. The types of problems we are solving now are just as fun and exciting to me.

Lastly, why NIST? Why is working at a measurement lab on this research so important?

Quantum is at the heart of NIST, and its people are why. We have top experimentalists here including multipleNobel laureates. NIST gives us the resources to do great science. And its good to work for a public institution, where you can serve society.

In many ways, quantum computing came out of NIST and measurement: It came out of trying to build better clocks.Dave Winelands work with ions is important here.Jun Yes work with neutral atoms is too. Their work led to the development of amazing control over ions and neutral atoms, and this is very important for quantum computing.

Measurement is at the heart of quantum computing. An exciting open question that lots of people are working on is how to measure the quantum advantage, as we call it. Suppose someone says, Here is a quantum computer, but just how big is its advantage over a classical computer? Were proposing how to measure that.

Read more:
What's So Great About Quantum Computing? A Q&A with NIST Theorist Alexey Gorshkov - HPCwire