Category Archives: NSA

Representatives from the National Sheep Associations (NSA) Wales/Cymru region are urging Secretary of State for the Environment, Food and Rural Affairs, George Eustice to provide an assurance of future financial support following this weeks spending review.

The three devolved governments of Wales, Scotland and Northern Ireland wrote jointly to the Defra Secretary urging him to provide assurances that the budget for agriculture would be maintained.

NSA Wales/Cymru chair Kate Hovers said:

NSA Cymru understands Westminster are claiming the devolved nations will have this money from the EU but it is previously allocated money and not for future farm payment schemes.

As an industry, we are constantly told to be resilient and plan for the future but when we have no control over the price of our end product and then suddenly see a reduction in promised funds, this makes it very difficult to see a way forward.

The spending review appears to show a 95 million blackhole for Welsh farmers, just as the Brexit transition period nears its end.

Hovers continued:

This is a bitter pill to swallow as we have been consistently told that funding for Welsh farming would be maintained and protected following our departure from the EU.

The joint Welsh food industry letter sent last week to Prime Minister Boris Johnson highlighted the need to ensure a UK-EU trade deal is in place and to urgently address major non-tariff barriers.

NSA Wales/Cymru development officer Helen Roberts commented:

We can ill afford to lose this funding especially as we are weeks away from potential significant disruption to our markets for agricultural produce, alongside the upheaval that the Covid-19 pandemic has caused to the UK food supply chain.

NSA Cymru sees this cut in the budget as an act of bad faith to the farmers who have kept producing food and feeding the nation throughout the pandemic, she concluded.

RELATED STORIES

Originally posted here:
Reduction in future funding for farmers 'a bitter pill to swallow' - NSA Wales - Agriland.co.uk

When Edward Snowden leaked classified information about U.S. government mass surveillance seven years ago, the former National Security Agency contractor sparked intense debate about and reform of many surveillance policies. Those conversations around reforming government surveillance practices have been especially important for journalists. As the Reporters Committee haspreviously argued, national security surveillance can chill or compromise newsgathering.

Current discussions about proposed legislation that would prevent companies from using the strongest forms of encryption, such as theEARN IT Act, have resurfaced many concerns about government surveillance. But learning how NSA policies have changed is almost as hard as it was before Snowdens revelations, lawmakers are finding.

The NSA is resisting congressional efforts, led by Sen. Ron Wyden (D-Ore.), to improve transparency around its policies regarding the introduction of back doors into commercial products. In response to these inquiries, NSA official Anne Neubergertold Reuters, We dont share specific processes and procedures. But the broad strokes of post-Snowden policies on other issues have been released, including the White House-initiatedVulnerability Equities Process, which governs the process by which government agencies decide whether to reveal or keep for national security surveillance purposes vulnerabilities in information systems and technologies.

Reuters reports that three former senior intelligence agency officials have said that the new NSA backdoor process requires them to weigh the potential fallout and to arrange for some kind of warning to the company if the back door is discovered by adversarial actors.

Backdoor access to devices matters to journalists who rely on commercial products to communicate with sources domestically and overseas especially when these back doors are in commercial encryption products that journalists use to offer sources greater protection. Documents released by Snowden revealed that the NSA worked with the Commerce Department to get a certain encryption standard accepted as the global default in part becausethe agency knew how to break itand access encrypted data.

In a highly publicized incident, Juniper Networks, a network management company, discovered that an outside actor had changed the encryption key to the NSA-designed algorithm its products incorporated. In July, Sens. Wyden, Mike Lee (R-Utah) and Cory Booker (D-N.J.), along with 13 House members, sent aletterto Juniper Networks, asking the company to reveal the results of its internal investigation. The companys response has not yet been made public.

Like what youve read?Sign up to get the full This Week in Technology + Press Freedom newsletter delivered straight to your inbox!

The Technology and Press Freedom Project at the Reporters Committee for Freedom of the Press uses integrated advocacy combining the law, policy analysis, and public education to defend and promote press rights on issues at the intersection of technology and press freedom, such as reporter-source confidentiality protections, electronic surveillance law and policy, and content regulation online and in other media. TPFP is directed by Reporters Committee attorney Gabe Rottman. He works with Stanton Foundation National Security/Free Press Legal Fellow Grayson Clary and Technology and Press Freedom Project Legal Fellow Mailyn Fidler.

The rest is here:
Seven years on, congressional oversight of NSA policies is still a slog - Reporters Committee for Freedom of the Press

Netball South Africa (NSA) president Cecilia Molokwane seemed unfazed on Monday about the legal threat sent to her federation by trade union Solidarity over the sports race regulations.

Molokwane said the governing netball federation would not respond to trade union Solidaritys legal letter until their council met to discuss the issue.

On 6 November, Solidaritys Hennie Bierman addressed a letter to Molokwane saying NSAs race regulations were "irrational".

This came after the Mpumalanga Sunbirds were disqualified for failing to adhere to the regulations during their clash with the Kingdom Queens, in the Telkom Netball Leagues Division 2 final last month.

READ | 'No quotas in netball,' says Molokwane

"[We are] of the view that the rules are irrational, damaging to the sport of Netball, and most importantly, to the players, coaching and management staff," Bierman wrote.

"The TNL tournament rules are on its own ambiguous in that no rational benchmark is set to determine the target system."

Molokwane, however, said they had procedures to follow before they could engage Solidarity on their threat.

"You can take us to court and do whatever but at the end of the day we will still have to go to the very same council and say, Solidarity is taking us to court, what do we do?" she said.

"We cannot spend money on legal matters. We will only answer that letter only when weve gone to council.

"We are not going to jump because of them. We have procedures to follow. We have a constitution to follow and it should be a council resolution like many other legal things we have to deal with.

"We are not going to do anything and we havent even responded. We will take the letter to council and go through our procedures, as we did with the AfriForum issue."

Molokwane said she was concerned that people outside netball were trying to influence the sport in a negative way and that it was up to their own council to decide whether their system was fit or not for the sport.

"My concern is that there are people outside of netball thinking they can come into netball and threaten us, giving us legal letters and whatever," said Molokwane.

"The council of Netball South Africa will decide whether the rules suit them or not. At the end of the day, they are the people that play netball.

"They are the people with the players and they will decide what is best for the players in the country."

READ | Proteas air Black Lives Matter grievances

Molokwane added that NSA, which was under a barrage of criticism during the height of the Black Lives Matter conversation in South African sport, her federation was working hard to ensure redress.

However, she suspected foul elements were trying to destabilise the organisation ahead of the 2023 Netball World Cup in Cape Town.

"We are still trying to fix the wrongs and injustices of the past and we cant do that in a day," Molokwane said.

"People are expecting so many miracles from us, the executive, and I dont know why. Theres only seven of us but we are working and we do netball because of the passion and love we have for it.

"People are trying to destabilise us. Is it not a plan to make sure we dont host the World Cup?"

See the original post:
NSA president Cecilia Molokwane unfazed by Solidaritys legal threat over race regulations - News24

Last year, Michael Mitchell and Jack Doyle staged a season-long battle for top jockey honors on the National Steeplechase Association circuit. They were due to settle the matter at the season-ending event at the Steeplechase of Charleston.

But at the final fence of the final race before Charleston, Doyle suffered a season-ending injury during a fall, a fractured jaw that required his mouth to be wired shut.

Mitchell, an Englishman who has ridden all over the world, faced a decision. He could come to the Steeplechase of Charleston and attempt to break a tie with Doyle atop the NSA jockey standings. Or he could stay away and share the title with Irish rider Doyle.

He chose the sporting gesture.

Going down to Charleston, I was putting myself into a position where I was taking away from someone else," Mitchell told This is Racing. "Ive won. Jacks won. The only other outcome would be winning a race and taking that title away from Jack. Thats what hit me."

It was the opportunity to take it away from someone else. I know how hard Ive worked to try to get that title. The amount you stress over rides, the amount you stress over your weight, you put everything in for that season. For it to come to the last meeting and have someone take it away from you, when you have it, thats tough. Thats what clinched the decision for me.

This year, the NSA jockey title again comes down to the Steeplechase of Charleston, set for Sunday at Stono Ferry Racetrack in Hollywood.

Mitchell has 11 wins in a season cut short by the COVID-19 pandemic, one victory ahead of Gerard Galligan, another Irish rider. Both are entered on mounts in Sunday's five races at Steeplechase of Charleston.

Like many jockeys, Mitchell is all too familiar with the dangers of his sport. He fell at the Queen's Cup in Charlotte in 2016, taking a kick to the head that resulted in a severe concussion, a broken cheekbone and fractured jaw. The jump-racing industry rallied to his aide through the American Steeplechase Injured Jockeys Fund.

Its part and parcel of a career, Mitchell told The Hunt Magazine. You just carry on.

The NSA's trainer of the year title already has been clinched by Hall of Famer Jonathan Sheppard, who has 16 wins this year.

The Steeplechase of Charleston is the final event on the NSA 2020 calendar, but is just the second of the year to allow spectators due to the pandemic. All of the NSA's spring events were canceled, including races in Aiken and Camden. Racing resumed with some spectator-less events in Virginia, and spectators were allowed last week in Pine Mountain, Ga.

The Charleston event, produced by The Post and Courier's parent company, applied to the S.C. Department of Commerce for an event exception, which was granted. Ticket sales have been limited to 50 percent of the 60-acre facilitys total capacity.

Among the safety guidelines in place for the event:

Each dedicated tailgate space will accommodate a group of up to five guests. Each party is encouraged to stay with their own party.

Ticketholders planning to join a tailgate group (but arriving separately) must use a ride-share service to the Stono Ferry track, as no guest parking will be available on site. All ticketholders will be part of a tailgate arrangement; the 2020 Steeplechase cannot accommodate single-ticket holders unattached to a tailgate party.

Guests will pack their own food and beverages to be enjoyed on race day; special catering services are available for hire for individuals or groups purchasing hospitality tents.

A wide-open vendor village will offer shopping and entertainment in a 100-percent touchless environment.

The event will feature double the number of sanitation stations and restroom facilities available last year, each of which will be cleaned regularly.

Masks will be required of all individuals any time they leave their dedicated space.

Reach Jeff Hartsell at 843-937-5596. Follow on Twitter @Jeff_fromthePC

View post:
Steeplechase of Charleston will decide jockey of the year title - Charleston Post Courier

Currently, a divergence is observed between the aggregate of gross state domestic products (GSDPs) and the gross domestic product (GDP) of India. Though a thorough exercise is required to find out the reason, this difference has public policy implications for the country.

The divergence between the recorded output of Indias constituent states put together and the national output, which is taken to signify the size of the economy, gives rise to doubt if the GDP numbers put out by the Central Statistics Office (CSO) accurately capture the countrys economic growth. This divergence, if found true, could complicate assessments of the outcomes of various policy measures.

In 2019-20, as per available official data, Indias 20 states and Union territories (UTs) combined recorded growth of 6.9%, compared to national-level GDP growth of 4.2%. There have been reasonable differences between the two numbers in the past, and after the introduction the 2012 series of the National Accounts Statistics (NAS), this difference averaged 0.3 percentage points over fiscal years 2012-13 through 2018-19. The added-up GSDP growth of states/UTs has been consistently higher than that of national GDP during the last five years. But the growth difference of 2.7 percentage points in 2019-20 is not only abnormally high, it also suggests that the deceleration of growth at the sub-national level was not as sharp as the national number may suggest.

In India, states release only annual data of their GSDP and not quarterly data. Also, they do not provide GSDP figures with a break-down of consumption and investment. However, in their annual GSDP sectoral estimates, not only do they follow the same methodology of data compilation used by the National Statistical Agency (NSA), but the data is also discussed and vetted by the NSA. The comparable estimates of GSDP for 2015-16 to 2017-18 that the NSA prepared for the Finance Commission indicate that states estimates were quite consistent with these; specifically for 21 states, the ratio of one to the other varied between 0.99 and 1.01. Even the average annual growth at current prices of the NSAs comparable GSDP for 2015-16 to 2017-18 at 12% was a just a shade lower than 12.4% for the aggregated GSDP as compiled by the states themselves. This suggests that state estimates did not suffer from any methodological or estimation flaws. Further, the aggregated GSDP of states/UTs was also aligned with national GDP in 2011-12, the first year of the new NAS series, with the ratio of aggregated GSDP of sub-national constituents being 1.012. Aggregated GSDP growth after that was expected to show a similar growth trajectory. The gap of 2019-20, however, raises a question: Is there an emerging disconnect?

Before we look at the implications and ways of resolving it, it is important to look at two issues. The ministry of company affairs MCA-21 data for corporate output across all sectors and the data on railways, financial institutions, public administration and defence is allocated by the NSA to various states. Their respective directorates of economics and statistics incorporate that data in their overall compilation of GSDP. Each states share differs, and tends to exceed 60% of total GSDP for most. Hence, differences in GSDP growth can be inferred to arise from only that part of GSDP which is solely in the states domain. Often, discrepancies in GDP estimates (including sharp revisions) get attributed to the informal sector. The overall share in GDP of households and non-profit institutions serving households, which is the informal sector, has been around 45%, and this is almost equally distributed across agriculture, industry and services. Though there are differences in growth across those three broad sectors, industrial growth is significantly more robust from a data perspective.

Some questions arise in this regard. Has the issue of a sharp, persistent and secular deceleration of GDP growth been overplayed? The average annual growth of GSDP of Indias 20 major states/UTs during 2012-13 to 2018-19 was 7.15%. This measure of growth in 2019-20 at 6.89% was only a shade lower than 6.97% achieved in 2018-19, and showed a marginal deceleration from the trend medium-term growth. Seven of these states (six of them major), namely Tamil Nadu, Haryana, West Bengal, Sikkim, Bihar, Madhya Pradesh and Andhra Pradesh recorded higher growth in 2019-20 than the previous year. Could it be that Indian states are making a more accurate assessment of the growth situation on the ground? After all, considerable changes have taken place in the composition of the economy over the last five years, especially in the informal sector.

The methodology of the survey used by states to gather data has the approval of the National Sample Survey Organization (NSSO). The NSSO, however, lacks the expert capacity to supervise these surveys, and this makes data robustness hard to ensure. Should this bottleneck not be eased for us to obtain clarity?

If the states GSDP reflects the situation correctly, has Indias unorganized sector bounced back faster after demonetization (in 2016) and introduction of the goods and services tax (in 2017) than anecdotal data suggests? And if this is so, will it not be prudent to ensure that the sector gets access to capital as part of the countrys stimulus strategy? And finally, will the 15th Finance Commission use GSDP or CSO data in deciding on its devolution of resources to states?

R. Gopalan and Manak C. Singhi are respectively, former secretary in the department of economic affairs, ministry of finance, and former senior adviser at ministry of finance, Government of India.

Subscribe to Mint Newsletters

* Enter a valid email

* Thank you for subscribing to our newsletter.

Link:
An odd divergence between India and its constituents - Mint

The Central Bank of Nigeria (CBN) and the Nigeria Deposit Insurance Corporation (NDIC) have been empowered to set up a Banking Sector Resolution Fund to ensure the safety of depositors funds and operate as a bridge bank to strengthen struggling banks back to health.

The CBN is expected to inject the sum of N10 billion ($26 million) or any amount that will be determined by its board into the fund every year.

According to a report from Thisday, this disclosure is contained in the Banks and Other Financial Institutions Act (BOFIA) 2020 which was just signed by President Muhammadu Buhari.

Section 74 of the BOFIA states that without prejudice to the provisions of the Asset Management Corporation of Nigeria (AMCON) Act, the Resolution Fund shall be domiciled with the central bank, and into which shall be paid all contributions and agreed levies.

According to the Act, the CBN Governor, Mr. Godwin Emefiele, with the approval of the board of the bank, is to determine the date of commencement of the fund.

This new arrangement is, however, separate to that of AMCON which was established to buy bad debts following the banking crisis that happened in 2009.

In the new act, each bank is expected to make annual contributions that are equivalent to 10 basis points of their total assets or a percentage that the CBN will still have to finalize.

The new regulation states, This will be based on the financial institutions total assets as at the date of their audited financial statements for the immediately preceding financial year published pursuant to this Act, and which shall be payable on the commencement date, and on or before the 30th day of April in each subsequent calendar year following the commencement date.

The funds are expected to be used to offset operating costs of a bridge bank, to pay the costs of transferring the whole or any part of the business of a bank, specialized bank, or other financial institution pursuant to a resolution measure.

The new act also states, The Resolution Fund shall not be subject to tax and accordingly, all monies accruing to, payments made from, and instruments and transactions relating to the Resolution Fund shall be exempt from all forms of taxes, levies, duties, charges, or imposition howsoever described.

Any annual levy paid by a bank, specialized bank or other financial institution in pursuance of this Act, shall be deductible for the purposes of the companies income tax of the paying bank, specialized bank or other financial institution under the Companies Income Tax Act.

A bank, specialized bank or other financial institution that is in default of payment of the levy imposed under this Act or any part thereof, shall be prohibited from paying dividends or other purpose of the Resolution Fund, it added.

This new regulation is expected to act as a relief to some smaller or medium-sized banks who sometimes struggle during the global financial crisis like the one that happened in 2016 or the one that hit that Nigerian financial system in 2009, which led to the collapse of some financial institutions.

Nairametrics had reported that President Muhammadu Buhari, some days ago assented to the Banks and Other Financial Institutions Act (BOFIA) 2020, with several new provisions to enhance the effectiveness of the countrys financial system.

It also strengthens the regulatory and supervisory framework for the financial industry and provides additional tools for managing failing financial institutions and systemic distress to preserve financial stability.

Read more:
Terrorism: Nigeria and USA committed to defeating ISIS, Boko Haram and others - NSA - Nairametrics

Senator Ron Wyden asked, and the NSA didnt answer:

The NSA has long sought agreements with technology companies under which they would build special access for the spy agency into their products, according to disclosures by former NSA contractor Edward Snowden and reporting by Reuters and others.

These so-called back doors enable the NSA and other agencies to scan large amounts of traffic without a warrant. Agency advocates say the practice has eased collection of vital intelligence in other countries, including interception of terrorist communications.

The agency developed new rules for such practices after the Snowden leaks in order to reduce the chances of exposure and compromise, three former intelligence officials told Reuters. But aides to Senator Ron Wyden, a leading Democrat on the Senate Intelligence Committee, say the NSA has stonewalled on providing even the gist of the new guidelines.

The agency declined to say how it had updated its policies on obtaining special access to commercial products. NSA officials said the agency has been rebuilding trust with the private sector through such measures as offering warnings about software flaws.

At NSA, its common practice to constantly assess processes to identify and determine best practices, said Anne Neuberger, who heads NSAs year-old Cybersecurity Directorate. We dont share specific processes and procedures.

Three former senior intelligence agency figures told Reuters that the NSA now requires that before a back door is sought, the agency must weigh the potential fallout and arrange for some kind of warning if the back door gets discovered and manipulated by adversaries.

The article goes on to talk about Juniper Networks equipment, which had the NSA-created DUAL_EC PRNG backdoor in its products. That backdoor was taken advantage of by an unnamed foreign adversary.

Juniper Networks got into hot water over Dual EC two years later. At the end of 2015, the maker of internet switches disclosed that it had detected malicious code in some firewall products. Researchers later determined that hackers had turned the firewalls into their own spy tool here by altering Junipers version of Dual EC.

Juniper said little about the incident. But the company acknowledged to security researcher Andy Isaacson in 2016 that it had installed Dual EC as part of a customer requirement, according to a previously undisclosed contemporaneous message seen by Reuters. Isaacson and other researchers believe that customer was a U.S. government agency, since only the U.S. is known to have insisted on Dual EC elsewhere.

Juniper has never identified the customer, and declined to comment for this story.

Likewise, the company never identified the hackers. But two people familiar with the case told Reuters that investigators concluded the Chinese government was behind it. They declined to detail the evidence they used.

Okay, lots of unsubstantiated claims and innuendo here. And Neuberger is right; the NSA shouldnt share specific processes and procedures. But as long as this is a democratic country, the NSA has an obligation to disclose its general processes and procedures so we all know what theyre doing in our name. And if its still putting surveillance ahead of security.

Recent Articles By Author

*** This is a Security Bloggers Network syndicated blog from Schneier on Security authored by Bruce Schneier. Read the original post at: https://www.schneier.com/blog/archives/2020/10/the-nsa-is-refusing-to-disclose-its-policy-on-backdooring-commercial-products.html

Read the original post:
The NSA is Refusing to Disclose its Policy on Backdooring Commercial Products - Security Boulevard

from the build-them-or-we'll-just-build-our-own dept

It's been more than a half-decade since it made headlines, but the NSA's hardware manipulation programs never went away. These programs -- exposed by the Snowden leaks -- involved the NSA compromising network hardware, either through interception of physical shipments or by the injection of malicious code.

One major manufacturer -- Cisco -- was righteously angered when leaked documents showed some of its hardware being "interdicted" by NSA personnel. It went directly to Congress to complain. The complaint changed nothing. (Cisco, however, changed its shipping processes.) But even though the furor has died down, these programs continue pretty much unhindered by Congressional oversight or public outcry.

One legislator hasn't forgotten about the NSA's hardware-focused efforts. Senator Ron Wyden is still demanding the NSA answer questions about these programs and give him details about "backdoors" in private companies' computer equipment. The DOJ and FBI may be making a lot of noise about encryption backdoor mandates, but one federal agency is doing something about it. And it has been for years.

Not only has the NSA installed its own backdoors in intercepted devices, it has been working with tech companies to develop special access options in networking equipment. This allows the agency to more easily slurp up communications and internet traffic in bulk. Senator Wyden wants answers.

The agency developed new rules for such practices after the Snowden leaks in order to reduce the chances of exposure and compromise, three former intelligence officials told Reuters. But aides to Senator Ron Wyden, a leading Democrat on the Senate Intelligence Committee, say the NSA has stonewalled on providing even the gist of the new guidelines.

Secret encryption back doors are a threat to national security and the safety of our families its only a matter of time before foreign hackers or criminals exploit them in ways that undermine American national security, Wyden told Reuters. The government shouldnt have any role in planting secret back doors in encryption technology used by Americans.

No one knows what's in the guidelines and whether they forbid the NSA from backdooring hardware or software sold to US buyers. All the NSA is willing to say is it's trying to patch things up with domestic tech vendors by, um, giving them more stuff to patch up.

The agency declined to say how it had updated its policies on obtaining special access to commercial products. NSA officials said the agency has been rebuilding trust with the private sector through such measures as offering warnings about software flaws.

This is a welcome change after years of exploit hoarding. But there's no reason to believe the NSA isn't holding useful flaws back until they've outlived their exploitability. As for the built-in backdoors, the NSA refuses to provide any details. It won't even answer to its oversight. And if it won't do that, it really needs to stop saying things about "robust oversight" every time more surveillance abuses by the agency are exposed.

There's more to this than potential domestic surveillance. Any flaw deliberately introduced in hardware and software can be exploited by anyone who discovers it, not just the agency that requested it. The threat isn't theoretical. It's already happened. In 2015, it was discovered that malicious hackers had exploited what appeared to be a built-in flaw to intercept and decrypt VPN traffic running through Juniper routers. This appeared to be a byproduct of the NSA's "Tailored Access Operations." While Juniper has never acknowledged building a backdoor for the NSA, the circumstantial evidence points in No Such Agency's direction.

[Juniper] acknowledged to security researcher Andy Isaacson in 2016 that it had installed Dual EC [Dual Elliptic Curve] as part of a customer requirement, according to a previously undisclosed contemporaneous message seen by Reuters. Isaacson and other researchers believe that customer was a U.S. government agency, since only the U.S. is known to have insisted on Dual EC elsewhere.

This is the danger of relying on deliberately introduced flaws to gather intelligence or obtain evidence. Broken is broken and broken tools are toys for malicious individuals, which includes state-sponsored hackers deployed by this nation's enemies. It's kind of shitty to claim you're in the national security business when you're out there asking companies to add more attack vectors to their products.

Thank you for reading this Techdirt post. With so many things competing for everyones attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.

Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites especially a site like ours that is unwilling to pull punches in its reporting and analysis.

While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise and every little bit helps. Thank you.

The Techdirt Team

Filed Under: 4th amendment, backdoors, nsa, ron wyden, surveillanceCompanies: cisco, juniper

More:
Senator Wyden Wants To Know If The NSA Is Still Demanding Tech Companies Build Backdoors Into Their Products - Techdirt

The National Security Agency (NSA) issued a cybersecurity advisory warning that Chinese state-sponsored actors have increased their attacks on American companies, including those that work closely with the U.S. government. The NSA warned that one of the great threats to the U.S. National Security Systems (NSS), the U.S. Defense Industrial Base (DIB), and even the Department of Defense (DoD) information networks remains hackers in China who work at the behest of Beijing.

The same process for planning the exploitation of a computer network that is used by sophisticated cyber criminals for profit is being used by Chinese-sanctioned hackers. The same types of efforts are employed, and this often involves identifying a target, gathering technical information, identifying any vulnerabilities, developing or even re-using an exploit to access those vulnerabilities, and then launching the attack.

This warning highlights the trend of nation-state actors expanding their focus, from the .gov and .mil domains to prioritizing the exploitation of companies in the defense industrial base or with any connection to U.S. government data, said John Dermody, counsel in the Washington, D.C., office of international law firm OMelveny & Myers and member of the firms Data Security & Privacy Group, in an email to ClearanceJobs.

Hackers can now choose from a menu of readily-deployable malware, already-developed access to victims, network exploitation services, and post-breach monetization services, added Dermody. This has resulted in entrepreneurial cyber-actors going out and developing access to a broad scope of companies and offering to sell it to the highest bidder, whether that be cyber criminals or nation states.

Along with its warning, the NSA published an in-depth report that detailed the top 25 vulnerabilities that are currently being scanned, targeted, and exploited. All of these bugs are actually well known, and they all have patches. However, because of the continued targeting of these exploits, the NSA has called greater attention and highlighted the need to address these vulnerabilities as soon as possible.

The NSA advisory identified 25 known vulnerabilities that state or state-sponsored attackers from China are known to actively use, or have scanned for, explained cybersecurity expert Saryj Nayya, CEO of Gurucul. Its important to realize that this list is only the ones they know of. These attackers have considerable resources that they can, and do, dedicate to finding and developing attacks against a broad range of systems. They have exploited vulnerabilities in network equipment, servers, and mobile devices, and will continue to do so.

While many of the vulnerabilities have been known to cybersecurity professionals, this is the first time that the NSA the nations premier electronic intelligence agency has specifically described them as prime targets for Chinese state-sponsored attacks.

State sponsored attackers are nothing new, Nayya told ClearanceJobs. Governments have always employed researchers to find vulnerabilities and developed attacks that exploit them to further their own agendas. Given the current geopolitical situation, it is no surprise we are hearing more about attacks originating from China.

However, state and state-sponsored threat actors will remain a serious challenge for civilian targets.

The attackers are effectively immune from prosecution and, as civilians, the victims cant return fire even when they know who is attacking them, warned Nayya. We have to rely on our own defenses to mitigate these attacks, and hope the government agencies responsible for protecting our vital infrastructure will extend that protection to other areas under threat.

The NSA noted that most of the vulnerabilities that it listed could be exploited to gain initial access to a victim network by utilizing products that provide either remote access or are for external web services, and these products should be patched accordingly. The NSA also offered tips to mitigate from such attacks:

Cybersecurity due diligence should remain a priority, and this should include regular backups, watching for social engineering, and keeping devices at all levels patched and up to date.

Our best defense is to deploy best-in-breed security solutions, including behavioral analytics that can adapt to new threats, and to follow industry best practices across the board, said Nayya. Patch management, user education, etc.

A full list of the threats is available on the NSA Cybersecurity Advisory.

Originally posted here:
Per NSA, DoD Networks in the Crosshairs of Chinese State-Sponsored Hackers - ClearanceJobs

John Judkins Contributing columnist

Your federal government is spying on you. Every post on Facebook. Every text message. Every email. Every website visited. You have essentially no privacy online.

In 2006, a consumer advocacy group obtained previously sealed sworn statements from a former AT&T technician Mark Klein, who testified that AT&T installed a fiberoptic splitter at one of its facilities in San Francisco. This splitter makes copies of all emails, web searches, and other internet traffic to and from AT&T customers and sends copies of all of the data to a room operated by the National Security Agency (NSA). This room has a dedicated line transmitting data out of AT&Ts facility to the NSAs own servers. Later testimony revealed that this splitter was one of dozens of devices installed at many different facilities owned by AT&T.

The Washington Post and several other media outlets have run various stories about the NSA spying on our own citizens from time to time. Through the work of these journalists, it has been revealed that the NSA has utilized provisions located in Section 215 of the Patriot Act to collect metadata of phone traffic from virtually every American. Additionally, we have learned that the NSA spent over 1.5 billion dollars to build a massive data collection center in Utah five times the size of the U.S. Capitol Building complete with its own power plant. An article by Forbes estimated the power requirements of the spying facility at approximately 65 megawatts costing about $40 million per year to generate. Further, it was estimated that the facility used 1.7 million gallons of water per day to cool the massive computers used to conduct surveillance on all Americans.

Nearly all public officials swear an oath to uphold the Constitution, and any reasonable interpretation of the Constitution would hold the NSAs domestic spying as unconstitutional. I do not believe that there is any valid interpretation of the Fourth Amendment that permits the government to collect and store U.S. citizens online communications. Yet still, the NSA continues to do this without any suspicion of wrongdoing by citizens, and without any court or congressional oversight. This kind of surveillance of citizens begs to be abused in the long run. It does not matter if we trust the individuals in office at a particular moment. Allowing the government to collect our data without reason or cause is absurd and unconscionable.

Now it appears that this domestic spying program may devastate our international trade with Europe. Under European Union law, citizens of the EU have a fundamental right to privacy, with most online activities protected by something called the General Data Protection Regulation. A German privacy activist named Max Schrems has undertaken a series of lawsuits beginning in 2013 to challenge the adequacy of U.S. law to protect EU privacy rights. Recently, an EU court agreed with Mr. Schrems holding that the U.S. governments ability to collect data on EU residents without proper procedural protections makes it impossible for U.S. firms to be generally capable of complying with EU law.

In July the Office of Information and Data Protection Commissioner ruled that European countries cannot use contracts to work around data privacy laws, and essentially all data transfer to the United States is now illegal. This ruling has been stayed pending further appeal, but unless a compromise can be reached, nearly all internet traffic with Europe could be halted.

The costs of this trade disruption will be enormous. According to the U.S. Chamber of Commerce, Transatlantic trade generates upward of $5.6 trillion, of which at least $333 billion was related to digitally-enabled services. The truth is that likely far more of that overall commerce is facilitated in some way by cross-border data transfers.

All of these concerns could be obviated if Congress were to apply ordinary due process requirements to our nations surveillance programs. There is no reason for our government to spy on all Americans at all times. The NSA domestic spying of internet activity violates our constitution, and it appears to violate European law, too. It might just crash our economy if something isnt done soon.

John Judkins is a Greenfield attorney.

John Judkins Contributing columnist

See the original post:
Big Brother is spying on you - Hillsboro Times Gazette