Another Word For It Patrick Durusau on Topic Maps and Semantic Diversity

February 3, 2014

FISA Court Subpoena Data Released!

Filed under: Cybersecurity,NSA,Security — Patrick Durusau @ 9:42 pm

FISA Court Subpoena Data (Google) from Ed Chi.

From the post:

Todd Underwood originally shared:

This is huge. Google is finally able to publish information about the number and scope of the FISA (secret intelligence court) subpoenas received. The takeaway: it’s massively fewer subpoenas and accounts involved than many people suspected.

There are caveats. Google is required to delay reporting by six months and required to only report information in bands of 1,000. But it’s massively better than nothing.

The world, but especially US citizens, have a right to know what kind of surveillance their government is authorizing. It has been cool to see companies like Google push for this kind of openness. Reform is a long time coming and this is only the beginning. Baby steps.

The Google post with data: http://googleblog.blogspot.com/2014/02/shedding-some-light-on-foreign.html

It’s a good thing I posted about How to Lie with Statistics today!

The real danger from these numbers was voiced by Todd Underwood, when he said:

The takeaway: it’s massively fewer subpoenas and accounts involved than many people suspected.

That’s the key problem.

They aren’t violating everybody’s rights, just those nasty people hiding behind that tree over there.

How did that poem go?

First they came for the Socialists, and I did not speak out– Because I was not a Socialist.

Then they came for the Trade Unionists, and I did not speak out– Because I was not a Trade Unionist.

Then they came for the Jews, and I did not speak out– Because I was not a Jew.

Then they came for me–and there was no one left to speak for me.

First they came …

Dear America, I Saw You Naked

Filed under: NSA,Security — Patrick Durusau @ 2:35 pm

Dear America, I Saw You Naked: And yes, we were laughing. Confessions of an ex-TSA agent by Jason Edward Harrington.

WARNING: If news about growing security state in the United States depresses you, skip this post and the article.

Just to get you interested:

I hated it from the beginning. It was a job that had me patting down the crotches of children, the elderly and even infants as part of the post-9/11 airport security show. I confiscated jars of homemade apple butter on the pretense that they could pose threats to national security. I was even required to confiscate nail clippers from airline pilots—the implied logic being that pilots could use the nail clippers to hijack the very planes they were flying.

Once, in 2008, I had to confiscate a bottle of alcohol from a group of Marines coming home from Afghanistan. It was celebration champagne intended for one of the men in the group—a young, decorated soldier. He was in a wheelchair, both legs lost to an I.E.D., and it fell to me to tell this kid who would never walk again that his homecoming champagne had to be taken away in the name of national security.
There I was, an aspiring satire writer, earnestly acting on orders straight out of Catch-22.

I quickly discovered I was working for an agency whose morale was among the lowest in the U.S. government. In private, most TSA officers I talked to told me they felt the agency’s day-to-day operations represented an abuse of public trust and funds.
…

I learned new details from Jason’s article but nothing all that surprising.

What troubles me about Jason’s account is that we as travelers have tolerated the abuse he details, despite there being no evidence that the TSA have ever stopped a single terrorist.

That’s right, there has never even been a false claim by the TSA to having caught a terrorist.

Next 9/11, it will have been thirteen (13) years and the TSA has not captured a single terrorist.

Not to mention that as of 2011, there were 25,000 breaches of airport security since 9/11.

True, the TSA captured 1,813 guns at airport checkpoints in 2013. TSA seizes record number of guns in 2013 But since security testers can get past scans and a pat down search, you wonder how many guns make it onto airplanes. Undercover agent with mock bomb breaches airport security: report

The results of “tests” of TSA security are not published. The alleged reason for non-publication of security testing results is to prevent use of that information by potential hijackers. A more obvious reason is to protect the contracts and jobs of those associated with the farce know as “airport security.”

In fact, there is no evidence that the current security procedures would stop hijackers armed the same way as the 9/11 hijackers. I say no evidence, there is no published evidence. With the known failures of the TSA on weapons and explosives, I would venture to say the 9/11 hijackers would have nothing to fear from today’s airport security.

Understanding a security problem is a lot like understanding an information problem. It isn’t sufficient to pick information that is easy to collect (like phone records) and decide that is the solution to your information problem. Yes, the 9/11 hijackers went through airports, all of them, but that doesn’t make an airport the appropriate place for a solution.

The 9/11 Commission said as much when it found:

The final layer, security on board commercial aircraft, was not designed to counter suicide hijackings.The FAA-approved “Common Strategy” had been elaborated over decades of experience with scores of hijackings, beginning in the 1960s. It taught flight crews that the best way to deal with hijackers was to accommodate their demands, get the plane to land safely, and then let law enforcement or the military handle the situation. According to the FAA, the record had shown that the longer a hijacking persisted, the more likely it was to end peacefully.The strategy operated on the fundamental assumption that hijackers issue negotiable demands (most often for asylum or the release of prisoners) and that, as one FAA official put it,“suicide wasn’t in the game plan” of hijackers. FAA training material provided no guidance for flight crews should violence occur.

This prevailing Common Strategy of cooperation and nonconfrontation meant that even a hardened cockpit door would have made little difference in a hijacking.As the chairman of the Security Committee of the Air Line Pilots Association observed when proposals were made in early 2001 to install reinforced cockpit doors in commercial aircraft,“Even if you make a vault out of the door, if they have a noose around my flight attendant’s neck, I’m going to open the door.” Prior to 9/11, FAA regulations mandated that cockpit doors permit ready access into and out of the cockpit in the event of an emergency. Even so, rules implemented in the 1960s required air crews to keep the cockpit door closed and locked in flight.This requirement was not always observed or vigorously enforced. (footnotes omitted) (The 9/11 Commission Report, page 85)

The solution to suicide hijackings is now well known:

Don’t open the cockpit door and/or allow anyone to take control of the airplane.

The 9/11 hijackers exploited flaws in airport security that persist to this day and a known flaw in U.S. hijacking policy.

Now fear of hijacking is being exploited by those who are providing no more security than existed on 9/11, at a much higher cost.

Topic maps can help connect those dots if you are interested in reducing the terrorism ROI from 9/11.

(Terrorism ROI: Security/Terrorism expenditures of the U.S. since 9/11 divided by the estimated $250,000 invested in 9/11 by terrorists)

February 2, 2014

Catalog of the Snowden Revelations

Filed under: Cybersecurity,NSA,Security — Patrick Durusau @ 5:29 pm

Catalog of the Snowden Revelations

From the post:

This page catalogs various revelations by Edward Snowden, regarding the United States’ surveillance activities.

Each disclosure is assigned to one of the following categories: tools and methods, overseas USG locations from which operations are undertaken, foreign officials and systems that NSA has targeted, encryption that NSA has broken, ISPs or platforms that NSA has penetrated or attempted to penetrate, and identities of cooperating companies and governments.

The page will be updated from time to time and is intended as a resource regarding Snowden and the debate over U.S. surveillance. Comments and suggestions thus are welcomed, and should be sent to staff.lawfare@gmail.com.

LawFare has produced this useful, if somewhat high level, catalog of Edward Snowden‘s revelations.

Very useful for other governments when visitors from Washington start the finger waving lecture on political corruption. With a little data mining, they may be able to trace a visitor back to specific incidents.

Now that would make an interesting data set.

Violation of Pakistan’s sovereignty comes to mind. Surely that is a crime under Pakistani law.

Thoughts?

January 17, 2014

Cybersecurity – Know Your Network

Filed under: Cybersecurity,NSA,Security — Patrick Durusau @ 7:02 pm

10 Free Or Low-Cost Network Discovery And Mapping Tools by Ericka Chickowski.

To see the ten (10) tools you have to page through ten (10) screen refreshes of advertising.

I though you might have better ways to spend your time:

  1. Open-AudIT
  2. NetSurveyor
  3. Advanced IP Scanner
  4. Fing
  5. Network Mapping Software
  6. Cheops-ng
  7. Open NMS
  8. NetworkView
  9. Nmap
  10. Angry IP Scanner

Despite the uber-hacker tales about the NSA, the NSA succeeds for the same reason some spammers make $7,000 a day, people are careless.

Using one or more of these tools you can start hardening your network against government intrusion.

Government intrusion isn’t a question of if but of when and for how long?

After you start working on your network, enlist your friends as well. A neighborhood network watch program as it were.

You will run into issues when sharing local network maps with your friends. Most of you will have one or more conflicting local IP addresses inside your routers.

One easy solution is to use topic maps to create unique topics to represent all of the machines individually, even if they share the same local IP address.

That will enable you to query across all the local networks in the data set for similar probes, etc.

The larger your network of friends, the more data you will be gathering on the activities of the shadow government in the U.S.

Post your data publicly so it can be combined with data from other neighborhood network watch groups.

Let’s take back the Internet, one local data pipe at a time.

NSA News!

Filed under: Cybersecurity,NSA,Security — Patrick Durusau @ 5:16 pm

Four Questionable Claims Obama Has Made on NSA Surveillance by Kara Brandeisky of ProPublico.

Kara does a great job pointing out four specific claims made by President Obama that just don’t add up.

Read Kara’s article and then share it. (Results in a small donation for ProPublico.)

My concern isn’t that the President made mis-leading statements. You can turn on CNN any day of the week and hear mis-leading statements from inside the “beltway” as they call it.

I am more concerned that the “merits” of the President’s “reforms” will become serious topics of discussion. That would be an unfortunate distraction from the only remedy that might deter other federal agencies from going completely rogue, closure of the NSA.

When I say closure I mean exactly that. No transfers of files, personnel, physical assets, etc. Lock the doors and just seal it up.

Why? Well, consider that the Director of the NSA, James Clapper, Jr. lied to Congress about surveillance of U.S. citizens and has not been held accountable for those lies.

How would you know if any of the reforms are performed? Ask Clapper?

Reform of the NSA is a farce wrapped in a lie and concealed inside secret budget allocations.

Closing the NSA should be the first step to making the government as transparent as the average U.S. (and non-U.S.) citizen is today.

January 16, 2014

Do NSA’s Bulk Surveillance Programs Stop Terrorists?

Filed under: NSA,Security — Patrick Durusau @ 2:50 pm

Do NSA’s Bulk Surveillance Programs Stop Terrorists? by Peter Bergen, David Sterman, Emily Schneider, Bailey Cahall, New America Foundation.

From the summary of the full report:

However, our review of the government’s claims about the role that NSA “bulk” surveillance of phone and email communications records has had in keeping the United States safe from terrorism shows that these claims are overblown and even misleading. An in-depth analysis of 225 individuals recruited by al-Qaeda or a like-minded group or inspired by al-Qaeda’s ideology, and charged in the United States with an act of terrorism since 9/11, demonstrates that traditional investigative methods, such as the use of informants, tips from local communities, and targeted intelligence operations, provided the initial impetus for investigations in the majority of cases, while the contribution of NSA’s bulk surveillance programs to these cases was minimal. Indeed, the controversial bulk collection of American telephone metadata, which includes the telephone numbers that originate and receive calls, as well as the time and date of those calls but not their content, under Section 215 of the USA PATRIOT Act, appears to have played an identifiable role in initiating, at most, 1.8 percent of these cases. NSA programs involving the surveillance of non-U.S. persons outside of the United States under Section 702 of the FISA Amendments Act played a role in 4.4 percent of the terrorism cases we examined, and NSA surveillance under an unidentified authority played a role in 1.3 percent of the cases we examined.

Looking at the actual cases, it turns out that traditional law enforcement is the most effective means of finding terrorists. By a large margin.

Out of 225 cases (including murders by the U.S. overseas), only 17 of them were initiated by the NSA. Or 7.7%.

Think of it this way, would you prefer your car to start 92 times out of 100 or only 8 times out of 100?

Now add in that you are spending $billions for that 8 times out of 100.

Does that give you a new perspective on funding the NSA?

January 14, 2014

Blocking NSA’s Lawful Interception

Filed under: Cybersecurity,NSA,Security — Patrick Durusau @ 5:05 pm

Researcher describes ease to detect, derail and exploit NSA’s Lawful Interception by Violet Blue.

From the post:

While headlines from European hacking conference 30c3 featured speakers vying for U.S. National Security Agency revelation sensationalism, one notorious hacker delivered an explosive talk that dismantled one thing the NSA, law enforcement, and global intelligence agencies depend on: “Lawful Interception” systems.

And German researcher Felix “FX” Lindner did exactly that, in what was stealthily 30c3’s most controversial bombshell of the conference.

In a talk titled CounterStrike: Lawful Interception, Lindner explained to a standing-room-only theater of 3,000 hackers how easy it is to find out if you’re under legally imposed surveillance, detailing how easily a user can jam the shoddy legacy systems running Lawful Interception (LI).

In explaining how LI works, Lindner revealed the shocking lack of accountability in its implementation and the “perverted incentive situation of all parties involved” that makes it easy to perform interception of communications without any record left behind.
….

When you get past all the hype, “notorious,” “controversial bombshell,” “shocking,” “perverted,” etc. it is a good article and worth reading.

For your reading/viewing pleasure:

CounterStrike: Lawful Interception: Complete slide deck

YouTube: CounterStrike – Lawful Interception [30c3]

When debating NSA disclosures or ineffectual plans to curb the NSA, remember the security community’s “I’ve got a secret” game enabled the NSA and others.

I can’t say that was its intention but it certainly was the result.

January 13, 2014

Embedded System Insurance?

Filed under: NSA,Security — Patrick Durusau @ 11:48 am

Security Risks of Embedded Systems by Bruce Schneier.

From the post:

We’re at a crisis point now with regard to the security of embedded systems, where computing is embedded into the hardware itself — as with the Internet of Things. These embedded computers are riddled with vulnerabilities, and there’s no good way to patch them.

….

If we don’t solve this soon, we’re in for a security disaster as hackers figure out that it’s easier to hack routers than computers. At a recent Def Con, a researcher looked at thirty home routers and broke into half of them — including some of the most popular and common brands.

Bruce does a great job of explaining the embedded systems market and the lack of economic incentives to improve the security of embedded systems.

Where I disagree with Bruce is when he says:

The economic incentives point to large ISPs as the driver for change. Whether they’re to blame or not, the ISPs are the ones who get the service calls for crashes. They often have to send users new hardware because it’s the only way to update a router or modem, and that can easily cost a year’s worth of profit from that customer. This problem is only going to get worse, and more expensive. Paying the cost up front for better embedded systems is much cheaper than paying the costs of the resultant security disasters.

Large ISPs are an easy target but it would federal legislation to impose a uniform responsibility for embedded systems and what liability an ISP would incur for failure to upgrade. That is ignoring international issues with regard to ISPs. Not to mention not all “embedded systems” are routers. Who is responsible for all other “embedded systems?” Sounds like a sticky wicket that will take longer than the WWW has been around to solve.

A non-starter in other words.

We already have mechanisms in place to create the economic incentives Bruce is looking for, it’s called insurance.

If you have purchased anything at Target recently, you have probably been offered “replacement insurance”

Protect every important purchase with a Target Replacement Plan and we’ll help get your covered breakdown resolved. If your product qualifies for replacement, we will issue you a Target Gift Card for the original purchase price. You can then replace your non-working product with a new one—perhaps even the latest version!*

This plan protects your new product against common failures, and protects you from unexpected repair bills. Coverage is for 2 years, starting from the date of purchase, inclusive of the original manufacturer’s warranty.*

What if the sales of embedded systems were accompanied by an offer of embedded system insurance?

That would be insurance that will pay for either replacement or repair in the event of a security flaw in software or hardware of the embedded system. Where would the economic incentives be then?

Insurers will have an incentive to reduce their economic risk so they will be testing products, visiting manufacturers, funding research, etc., so they can make good decisions on their risk for particular products.

At the same time, government and industry, having the most to lose from security breaches, can refuse to buy embedded systems that are not insurable or that are insurable but have a higher premium. That would have the happy consequence of driving questionable manufacturers from the embedded systems marketplace.

The practical advantage to embedded system insurance is it only takes demand for insurable embedded system products to start the process.

Demand will attract insurers into the marketplace, local security policies will drive purchasing insured products, and when breaches are found (there is no magic bullet), customers will no disincentives to upgrading.

It won’t be quite that smooth but it has the advantage of no mandated NSA backdoors in the replacement software/embedded systems.

January 11, 2014

Reality Gap In War on Terrorism

Filed under: NSA,Security — Patrick Durusau @ 9:06 pm

Andy Oram writes in How did we end up with a centralized Internet for the NSA to mine?:

Having lived through the Boston Marathon bombing, I understand what the NSA claims to be fighting, and I am willing to seek some compromise between their needs for spooking and the protections of the Fourth Amendment to the US Constitution.

You may still remember the Boston Marathon bombing, a couple of malcontents who were already known to the authorities so there was no need for NSA action or any compromise on the Fourth Amendment to the US Constitution.

There is no defense to one or two people committing a criminal act.

Consider bank robberies. Guess where they all occur. Did you say at banks?

Despite knowing where banks are located, the FBI reported for 2011, 5,014 bank robberies.

I am sure anyone who was at any of those robberies was terrified. But we don’t get patted down to go into a bank.

Having a crime on TV (like the Boston Marathon bombing) is no reason to start trading constitutional rights for fictional security.

Crimes happen. Comfort the victims, find suspects, if possible within the bounds of the Constitution and roll on.

If we treat terrorist acts as crimes, just garden variety crimes, our recovery from the hysteria over terrorism will have begun.

Why is the NSA grabbing all your private data?

Filed under: Cybersecurity,NSA,Security — Patrick Durusau @ 8:05 pm

Why is the NSA grabbing all your private data? by Daniel Lemire.

From the post:

Snowden revealed to the world that the NSA was systematically spying on all of us. Maybe more critically, we have learned that the NSA is spying on all American citizens. In fact, the NSA is even spying on its own congress. This spying violates the US constitution.

We also know that such spying is ineffective when it comes to stopping terrorists. A cost-benefit analysis shows that the NSA is wasteful.

So why are they doing it?

They are doing it precisely because it is very expensive.
….

To expand Daniel’s point a bit, the war on terrorism isn’t about national security any more than the war on drugs was about reducing drug use.

Both were excuses to spend large amounts of government money with no measurable goals or metrics for success or failure.

Remember the old saying: If you can’t measure it, you can’t manage it.

Spending the funds in secret budget allocations serves to further conceal its lack of value.

But it also points towards a solution to the surveillance/privacy issue.

Congress should pass secret budgets for scientific, medical and humanities research projects that dwarf the war on terror budgets.

Contractors pushing the surveillance agenda will switch over to the larger budgets. Still no measurable results but the projects won’t involve invasion of the privacy of people world wide.

With larger budgets in sight, the supporters of surveillance will move to greener pastures.

January 8, 2014

Our Peeping Tom Government

Filed under: Cybersecurity,Metadata,NSA,Security — Patrick Durusau @ 5:58 pm

immersion screencap

Graphs by MIT Students Show the Enormously Intrusive Nature of Metadata by Kade Crockford.

From the post (as is the image):

You’ve probably heard politicians or pundits say that “metadata doesn’t matter.” They argue that police and intelligence agencies shouldn’t need probable cause warrants to collect information about our communications. Metadata isn’t all that revealing, they say, it’s just numbers.

But the digital metadata trails you leave behind every day say more about you than you can imagine. Now, thanks to two MIT students, you don’t have to imagine—at least with respect to your email.

Deepak Jagdish and Daniel Smilkov’s Immersion program maps your life, using your email account. After you give the researchers access to your email metadata—not the content, just the time and date stamps, and “To” and “Cc” fields—they’ll return to you a series of maps and graphs that will blow your mind. The program will remind you of former loves, illustrate the changing dynamics of your professional and personal networks over time, mark deaths and transitions in your life, and more. You’ll probably learn something new about yourself, if you study it closely enough. (The students say they delete your data on your command.)
…

If you have any interest in privacy at all, you need to read Kade’s post in full and watch video.

Personally I don’t think we can recover our privacy from the government. After all, it is already illegal for the NSA to be spying on U.S. citizens. Their excuse (now and in the future), “it was necessary.”

On the upside, we can and should deprive government toadies and others of privacy in the performance of official government functions. There is no right to privacy in order to loot the U.S. treasury or to use elected/appointed office for political or personal gain.

Keep the locations of nuclear weapons and codes secret. Throw the rest of it wide open.

As the Supreme Court stated in United States v. Nixon

The expectation of a President to the confidentiality of his conversations and correspondence, like the claim of confidentiality of judicial deliberations, for example, has all the values to which we accord deference for the privacy of all citizens and, added to those values, is the necessity for protection of the public interest in candid, objective, and even blunt or harsh opinions in Presidential decision-making. A President and those who assist him must be free to explore alternatives in the process of shaping policies and making decisions and to do so in a way many would be unwilling to express except privately. These are the considerations justifying a presumptive privilege for Presidential communications. (emphasis added)

Since we as citizens have no privacy from the government, it only stands to reason that the government, including the President, has no privacy from citizens.

BTW, as a historical note, there has been no shortage of self-serving advisers for presidents following Nixon and the disclosure of the Watergate tapes.

December 31, 2013

NSA Catalog

Filed under: Cybersecurity,NSA,Security — Patrick Durusau @ 3:34 pm

NSA’s ANT Division Catalog of Exploits for Nearly Every Major Software/Hardware/Firmware

Just in case you missed the news, the NSA has a catalog of hardware and software hacks.

Two points to bear in mind:

First, the catalog dates from 2008, which makes me wonder if it hasn’t been updated or is there a later version of the catalog that will be leaked later?

If shopping fromm a five year old catalog is any indication, small wonder the NSA is collecting lots of information to no avail.

Second, when you get to the catalog pages, note the parts that are blacked out.

Either a copy of the catalog was stolen along with the blackouts already in place or the news agency is censoring the information it distributes.

If it is the latter, I find that real curious.

The U.S. government hides information from us and when the press obtains that information, the press hides information as well.

I suppose I should feel lucky that we get any information at all.

NSA Cloud On The “Open Internet”

Filed under: Cybersecurity,NSA,Security,WWW — Patrick Durusau @ 11:22 am

The FCC defines the “Open Internet” as:

The “Open Internet” is the Internet as we know it. It’s open because it uses free, publicly available standards that anyone can access and build to, and it treats all traffic that flows across the network in roughly the same way. The principle of the Open Internet is sometimes referred to as “net neutrality.” Under this principle, consumers can make their own choices about what applications and services to use and are free to decide what lawful content they want to access, create, or share with others. This openness promotes competition and enables investment and innovation.

The Open Internet also makes it possible for anyone, anywhere to easily launch innovative applications and services, revolutionizing the way people communicate, participate, create, and do business—think of email, blogs, voice and video conferencing, streaming video, and online shopping. Once you’re online, you don’t have to ask permission or pay tolls to broadband providers to reach others on the network. If you develop an innovative new website, you don’t have to get permission to share it with the world.

Pay particular attention to the line:

This openness promotes competition and enables investment and innovation.

The National Security Agency (NSA) and other state-sponsored cyber-criminals are dark clouds on that “openness.”

For years, many of us have seen:

MS error report

But as the Spiegel staff report in: Inside TAO: Documents Reveal Top NSA Hacking Unit

NSA staff capture such reports and mock Microsoft with slides such as:

NSA image

(Both of the images are from the Spiegel story.)

It doesn’t require a lot of imagination to realize that Microsoft will have to rework its error reporting systems to encrypt such reports, resulting in more overhead for users, the Internet and Microsoft.

Other software vendors and services will be following suite, adding more cost and complexity to services on the Internet, rather than making services more innovative and useful.

The NSA and other state-sponsored cyber-criminals are a very dark cloud over the very idea of an “open Internet.”

What investments will be made to spur competition and innovation on the Internet in the future is unknown. What we do know is that left unchecked, the NSA and other state-sponsored cyber-criminals are going to make security, not innovation, the first priority in investment.

State-sponsored cyber-criminals are far more dangerous than state-sponsored terrorists. Terrorists harm a few people today. Cyber-criminals are stealing the future from everyone.

PS: The Spiegel story is in three parts: Part 1: Documents Reveal Top NSA Hacking Unit, Part 2: Targeting Mexico, Part 3: The NSA’s Shadow Network. Highly recommended for your reading.

December 29, 2013

If the NSA can’t connect two dots….

Filed under: Cybersecurity,NSA,Security — Patrick Durusau @ 3:48 pm

Judge on NSA Case Cites 9/11 Report, But It Doesn’t Actually Support His Ruling by Justin Elliott.

From the post:

In a new decision in support of the NSA’s phone metadata surveillance program, U.S. district court Judge William Pauley cites an intelligence failure involving the agency in the lead-up to the 9/11 attacks. But the judge’s cited source, the 9/11 Commission Report, doesn’t actually include the account he gives in the ruling. What’s more, experts say the NSA could have avoided the pre-9/11 failure even without the metadata surveillance program.

We previously explored the key incident in question, involving calls made by hijacker Khalid al-Mihdhar from California to Yemen, in a story we did over the summer, which you can read below.

In his decision, Pauley writes: “The NSA intercepted those calls using overseas signals intelligence capabilities that could not capture al-Mihdhar’s telephone number identifier. Without that identifier, NSA analysts concluded mistakenly that al-Mihdhar was overseas and not in the United States.”

As his source, the judge writes in a footnote, “See generally, The 9/11 Commission Report.” In fact, the 9/11 Commission report does not detail the NSA’s intercepts of calls between al-Mihdhar and Yemen. As the executive director of the commission told us over the summer, “We could not, because the information was so highly classified publicly detail the nature of or limits on NSA monitoring of telephone or email communications.”

To this day, some details related to the incident and the NSA’s eavesdropping have never been aired publicly. And some experts told us that even before 9/11 — and before the creation of the metadata surveillance program — the NSA did have the ability to track the origins of the phone calls, but simply failed to do so.

Prior to 9/11, the NSA had a phone number in Yemen which it was monitoring and could have traced to a location with terrorists in San Diego. Under existing law at the time.

If the NSA can’t connect two dots, Mihdhar to Yemen in 2000, what reason is there to think they can usefully connect hundreds of millions, if not billions of dots?

December 24, 2013

Take The Money And Run (RSA)

Filed under: Encryption,Government,NSA — Patrick Durusau @ 10:32 am

I think David Meyer’s headline captures the essence of the RSA story: Security firm denies knowingly including NSA backdoor — but not taking NSA cash.

RSA posts in its defense:

We made the decision to use Dual EC DRBG as the default in BSAFE toolkits in 2004, in the context of an industry-wide effort to develop newer, stronger methods of encryption. At that time, the NSA had a trusted role in the community-wide effort to strengthen, not weaken, encryption.

…

When concern surfaced around the algorithm in 2007, we continued to rely upon NIST as the arbiter of that discussion.

…

RSA, as a security company, never divulges details of customer engagements, but we also categorically state that we have never entered into any contract or engaged in any project with the intention of weakening RSA’s products, or introducing potential ‘backdoors’ into our products for anyone’s use.

So, if I had given the RSA $10 million on a contract, would that give me “a trusted role in the community-wide effort to strengthen, not weaken, encryption?”

Given the NSA mission to break encryption used by others, it isn’t clear how the NSA could ever have a “trusted role” in public encryption efforts.

To be sure, the NSA also has an interest in robust encryption for the U.S. government, but it has no interest in making those methods publicly available.

Quite the contrary, the only sensible goal of the NSA is to have breakable encryption used by everyone but the NSA and its clients. Yes?

The NSA was pursuing a rational strategy for a government spy agency and RSA was simply naive to believe otherwise.

As usual, cui bono (“to whose benefit?”), is the relevant question.

PS: If you need help asking that question, I was professionally trained in a hermeneutic of suspicion tradition that was centuries old when the feminists “discovered” it.

December 21, 2013

Accumulo Comes to CDH

Filed under: Accumulo,Cloudera,Hadoop,NSA — Patrick Durusau @ 7:11 pm

Accumulo Comes to CDH by by Sean Busbey, Bill Havanki, and Mike Drob.

From the post:

Cloudera is pleased to announce the immediate availability of its first release of Accumulo packaged to run under CDH, our open source distribution of Apache Hadoop and related projects and the foundational infrastructure for Enterprise Data Hubs.

Accumulo is an open source project that provides the ability to store data in massive tables (billions of rows, millions of columns) for fast, random access. Accumulo was created and contributed to the Apache Software Foundation by the National Security Agency (NSA), and it has quickly gained adoption as a Hadoop-based key/value store for applications that require access to sensitive data sets. Cloudera provides enterprise support with the RTD Accumulo add-on subscription for Cloudera Enterprise.

This release provides Accumulo 1.4.3 tested for use under CDH 4.3.0. The release includes a significant number of backports and fixes to allow use with CDH 4’s highly available, production-ready packaging of HDFS. As a part of our commitment to the open source community, these changes have been submitted back upstream.

At least with Accumulo, you know you are getting NSA vetted software.

Can’t say the same thing for RSA software.

Enterprise customers need to demand open source software that reserves commercial distribution rights to its source.

For self-preservation if no other reason.

December 20, 2013

The NSA Knows If You’ve Been Bad Or Good…

Filed under: NSA,Security — Patrick Durusau @ 4:31 pm

NSA and Britain’s GCHQ targeted aid groups and top EU, Israeli and African officials by David Meyer.

From the post:

Another day, another addition to our pool of knowledge regarding U.S. and British surveillance activities. According to the Guardian, Der Spiegel and New York Times, historical targets of the intelligence agencies have included (deep breath): Unicef, Médecins du Monde, the UN development program, the UN food program, the UN Institute for Disarmament Research, Israel’s former prime minister and defense secretary, the head of the Economic Community of West African States (Ecowas), other African leaders and their families, French defense contractor Thales, French oil giant Total, and EU competition chief Joaquin Almunia — although he was in charge of the EU economy at the time. File under “Diplomatic Disasters”.

Perhaps the reason the NSA has gained so little intelligence from its wide spread snooping is that it is looking in the wrong places. Yes?

The UN food program?

What about wealthy Saudis? I understand at least one Saudi was a self-announced terrorist. (Osama bin Laden)

That’s one more than you can say for the UN food program.

The incompetence and waste of the current intelligence efforts are more pressing issues to me than the invasions of privacy.

The intelligence-industrial complex, I2C, is fighting a war against enemies that only it can see, by means only it can know about, for a cost that it can’t disclose and/or justify.

In some ways, the I2C poses a greater danger than the military-industrial complex. At least with the military-industrial compex the drama was being played out to some degree in public. Lots of lies were told privately but there were visible enemies.

With the I2C, anyone, your neighbor, co-worker, brother-in-law, etc., could be the enemy! (It sounds absurd when I say it, but the nodding heads on TV treat the same statement from the President on down as thought its sensible.)

It’s time to end this carnival scare ride called the war on terrorism. The only people making money are the ticket takers and the money being spent is yours.

December 18, 2013

Liberty And Security In A Changing World

Filed under: Cybersecurity,NSA,Security — Patrick Durusau @ 5:16 pm

Liberty And Security In A Changing World: Report and Recommendations of The President’s Review Group on Intelligence and Communications Technologies

At just a shade over 300 pages (303 to be exact), I’m not going to attempt to give you an instance analysis of what took months to write.

My suggestion is that you ignore reports, summaries, analysis of this report until you have read the report for yourself.

As I read the report, I am going to annotate it with comments about where topic maps might or might not be useful.

Along with comments as to why topic maps would be useful.

Looking forward to posting the annotated version and getting your feedback on it.

NSA & Connecting the Dots

Filed under: Cybersecurity,NSA,Privacy — Patrick Durusau @ 4:51 pm

A release of an review panel study of Surveillance U.S.A. (SUSA, aka, U.S. intelligence activities) has been rumored on the Net most of the day.

While we wait for a copy of the alleged study, consider this report by the Guardian:

On Wednesday, NSA director Keith Alexander, the army general who will retire in the spring after leading the agency for eight years, strongly defended the bulk collection of phone data as necessary to detect future domestic terrorist attacks. “There is no other way we know of to connect the dots,” Alexander told the Senate judiciary committee.

Mass telephone data collection because:

There is no other way we know of to connect the dots

If the General wasn’t just playing to the press, that is one key to why U.S. intelligence services are functioning so poorly.

streetlamp

The light is better for connecting telephone dots together.

Connecting other dots, non-telephone dots, the ones that might effectively prevent terrorism, that might be hard.

Or in this case, none of the General’s contract buddies have a clue about connecting non-telephone dots.

Arguments to keep massive telephone surveillance:

  • Telephone dots are easy to connect (even if ineffectual).
  • Usual suspects profit from connecting telephone dots.
  • Usual suspects don’t know how to connect non-telephone dots.

From the General’s perspective, that’s a home run argument.

To me, that’s a three strikes and you are out argument.

There are lots of ways to connect non-telephone dots, effectively and in a timely manner.

It would not be as easy as telephone data but then it would be more effective as well.

You would have to know what sort of non-telephone information the NSA has in order to fashion a connect the non-telephone dot proposal.

Easy information (telephone call records) don’t equal useful information (dot connecting information).

If your cause, organization, agency, department, government, government in waiting, is interested in non-telephone dot connecting advice, you know how to reach me.

PS: BTW, I work on a first come, first served basis.

December 16, 2013

Judge Wacks the NSA

Filed under: NSA,Privacy — Patrick Durusau @ 5:03 pm

Judge calls for phone data to be destroyed, says NSA program too broad by Jeff John Roberts.

From the post:

In a major rebuke to the National Security Agency’s mass collection of telephone data, a federal judge ruled that the agency’s surveillance program likely violates the Constitution and also granted two Verizon subscribers’ request for an order to destroy so-called meta-data.

On Monday in Washington,D.C., U.S. District Judge Richard Leon issued a ruling that “bars the Government from collecting … any telephony data” associated with the Verizon account of two citizens who filed the lawsuit, and “requires the Government to destroy any such metadata in its possession that was collected through the bulk collection program.”

….

The judge also rejected the argument that the existence of a secret NSA court, known as the FISA court, precluded him from reviewing the surveillance program for constitutional questions.

“While Congress has great latitude to create statutory scheme like FISA, it may not hang a cloak of secrecy over the Constitution,” he wrote as part of the 68 page ruling.

See the decision at: Klayman NSA Decision and more at: Politico.

Good news but note the judge only ordered the destruction of records for two subscribers. And even that is stayed on appeal. Like they would really destroy the data anyway. How would you know?

Take this as a temporary victory.

Celebrate, yes, but regroup tomorrow to continue the fight.

December 8, 2013

Mapping the open web using GeoJSON

Filed under: Geo Analytics,Geographic Data,Geographic Information Retrieval,JSON,NSA — Patrick Durusau @ 5:59 pm

Mapping the open web using GeoJSON by Sean Gillies.

From the post:

GeoJSON is an open format for encoding information about geographic features using JSON. It has much in common with older GIS formats, but also a few new twists: GeoJSON is a text format, has a flexible schema, and is specified in a single HTML page. The specification is informed by standards such as OGC Simple Features and Web Feature Service and streamlines them to suit the way web developers actually build software today.

Promoted by GitHub and used in the Twitter API, GeoJSON has become a big deal in the open web. We are huge fans of the little format that could. GeoJSON suits the web and suits us very well; it plays a major part in our libraries, services, and products.

A short but useful review of why GeoJSON is important to MapBox and why it should be important to you.

A must read if you are interested in geo-locating data of interest to your users to maps.

Sean mentions that Github promotes GeoJSON but I’m curious if the NSA uses/promotes it as well? 😉

December 5, 2013

On Self-Licking Ice Cream Cones

Filed under: Funding,NSA,Project Management,Security — Patrick Durusau @ 3:47 pm

On Self-Licking Ice Cream Cones by Peter Worden. 1992

Ben Brody in The definitive glossary of modern US military slang quotes the following definition for a Self-Licking Ice Cream Cone:

A military doctrine or political process that appears to exist in order to justify its own existence, often producing irrelevant indicators of its own success. For example, continually releasing figures on the amount of Taliban weapons seized, as if there were a finite supply of such weapons. While seizing the weapons, soldiers raid Afghan villages, enraging the residents and legitimizing the Taliban’s cause.

Wikipedia at (Self-licking ice cream cone) reports the phrase was first used by Pete Worden in “On Self-Licking Ice Cream Cones” in 1992 to describe the NASA bureaucracy.

The keywords for the document are: Ice Cream Cones; Pork; NASA; Mafia; Congress.

Birds of a feather I would say.

Worden isolates several problems:

Problems, National, The Budget Process

…
This unfortunate train of events has resulted in a NASA which, more than any other agency, believes it works only for the appropriations committees. The senior staff of those committees, who have little interest in science or space, effectively run NASA. NASA senior offiicials’ noses are usually found at waist level near those committee staffers.
…

Problems, Closer to Home, NASA

“The Self-Licking Ice Cream Cone”

Since NASA effectively works for the most porkish part of Congress, it is not surprising that their programs are designed to maximize and perpetuate jobs programs in key Congressional districts. The Space Shuttle-Space Station is an outrageous example. Almost two-thirds of NASA’s budget is tied up in this self-licking program. The Shuttle is an unbelievably costly was to get to space at $1 billion a pop. The Space Station is a silly design. Yet, this Station is designed so it can only be built by the Shuttle and the Shuttle is the only way to construct the Station….

“Inmates Running the Asylum”

NASA’s vaulted “peer review” process is not a positive factor, but an example of the “pork” mentality within the scientific community. It results in needlessly complex programs whose primary objective is not putting instruments in orbit, but maximizing the number of constituencies and investigators, thereby maximizing the political invulnerability of the program….

“Mafia Tactics”

…The EOS is a case in point. About a year ago, encouraged by criticism from some quarters of Congress and in the press, some scientists and satellite contractors began proposing small, cheap, near-term alternatives to the EOS “battlestars.” Senior NASA officials conducted, with impunity, an unbelievable campaign of threats against these critics. Members of the White House advisory committees were told they would not get NASA funding if they continued to probe the program….

“Shoot the Sick Horses, and their Trainers”

It is outrageous that the Hubble disaster resulted in no repercussions. All we hear is that some un-named technician, no longer working for the contractor, made a mistake in the early 1980s. Even in the Defense Department, current officials would lost their jobs over allowing such an untested and expensive system to be launched.

Compare Worden’s complaints to the security apparatus represented by the NSA and its kin.

Have you heard of any repercussions for any of the security failures and/or outrages?

Is there any doubt that the security apparatus exists solely to perpetuate the security apparatus?

By definition the NSA is a Self-Licking Ice Cream Cone.

Time to find a trash can.

EOS: Earth Observing System

Hubble: The Hubble Space Telescope Optical Systems Failure Report (pdf) Long before all the dazzling images from Hubble, it was virtually orbiting space junk for several years.

Latest NSA Fire Storm

Filed under: Cybersecurity,NSA,Security — Patrick Durusau @ 10:18 am

Among the many places you can read about the latest Edward Snowden disclosures, NSA tracking cellphone locations worldwide, Snowden documents show by Barton Gellman and Ashkan Soltani, Washington Post, December 4, 2013, reads in part:

The National Security Agency is gathering nearly 5 billion records a day on the whereabouts of cellphones around the world, according to top-secret documents and interviews with U.S. intelligence officials, enabling the agency to track the movements of individuals — and map their relationships — in ways that would have been previously unimaginable.

The records feed a vast database that stores information about the locations of at least hundreds of millions of devices, according to the officials and the documents, which were provided by former NSA contractor Edward Snowden. New projects created to analyze that data have provided the intelligence community with what amounts to a mass surveillance tool.

And among the many denunciations of NSA activities, the American Library Association:

Nation’s Libraries Warn of NSA’s ‘Ravenous Hunger’ for Data

“We don’t want [library patrons] being surveilled because that will inhibit learning, and reading, and creativity,” said Alan Inouye of the American Library Association

– Andrea Germanos, staff writer

A quick search on Twitter quickly led to several hundred tweets with updates in the double digits every 30 seconds or so.

The general tenor being surprise (which I don’t understand) and outrage (that I do understand).

What is missing from the discussion is what to do to correct the situation?

Quite recently we all learned that MinuteMan missiles had their launch codes set to 00000000, despite direct presidential orders to the contrary.

I take that as evidence, along with the history of the NSA, that passing laws to regulate an agency that is without effective supervision is an exercise in futility.

Any assurance from the NSA that they are obeying U.S. laws is incapable of public verification and therefore should be presumed to be false.

The only effective means to limit NSA activities is to limit the NSA.

Let me repeat that: The only effective means to limit NSA activities is to limit the NSA.

We only have the NSA’s word that it has played an important role in protecting the U.S. from terrorists.

How can we test that tale?

My suggestion is that we defund the NSA for a period of not less than five years. No transfer of data, equipment or personnel. None.

If during the next five years, if U.S. based terrorism increases and proponents have a plausible plan for a new NSA, then we can re-consider it.

If there is, as is likely, no increase in U.S. based terrorism, we can avoid the expense of a rogue agency with its own agenda.

PS: I would not worry about the fates of NSA staff/contractors. There are a number of high tech surveillance opportunities in People’s Republic of China. Plus they have a form of government more suited to current NSA staff.

November 19, 2013

Known NSA Collaborators

Filed under: Cybersecurity,NSA,Security — Patrick Durusau @ 6:45 pm

Here’s what we know about European collaboration with the NSA by David Meyer.

Norway is the latest named collaborator with the NSA.

David summarizes surveillance details (so far), including known collaborators of the NSA:

Puzzling that for all the huffing and puffing about sovereignty in public from these collaborators, in private they can’t wait to abase themselves before the United States.

Not that sovereign nations need always disagree but this sort of toadyism endangers citizens of the United States as well as citizens of other countries around the world.

Toadyism isn’t an effective means of provoking rational discussion and debate among nations.

What’s missing from David’s post are the individual names from the NSA, U.S. government, and its collaborators, who should be held accountable by their respective legal systems.

Creating topic maps of surveillance activities will of necessity be a diverse projects. Different laws, information sources, etc.

Should common questions come up about creating and/or merging such topic maps, I will contribute answers whenever possible on this blog. And solicit input from any readers of this blog who care to contribute their insights.

Should you require more regular involvement on my part, you know where to find me for further discussions.

My public PGP key.

November 13, 2013

How Did Snowden Do It?

Filed under: Cybersecurity,NSA,Security — Patrick Durusau @ 4:40 pm

How Did Snowden Do It? by Kelly Jackson Higgins.

From the post:

The full story of just how the now-infamous systems administrator Edward Snowden was able to grab highly classified documents from the world’s most secretive spy agency and expose its controversial spying practices may never be public, but some clues have emerged that provide a clearer picture of how the most epic insider leak in history may have transpired.

Snowden, the former Booz Allen contractor working as a low-level systems admin for the NSA at its Hawaii post, reportedly coerced several of his colleagues to provide him with their credentials, according to a report by Reuters late last week. He may have convinced up to 25 staffers at the NSA regional operations center there to hand over their usernames and passwords under the pretext that he needed them for his job, according to the report.

Did you notice the shifting description of Snowden’s actions in the second paragraph?

At first Snowden “coerced several of his colleagues.” Then Snowden “convinced up to 25 staffers.” If you jump to the Reuters story, Snowden “persuaded other NSA workers to give up passwords….”

Persuasion is a long way from coercion, at least as I understand those terms.

Unfortunately, Congress is considering a variety of technical fixes to what is ultimately a user problem.

The user problem? Sharing of admin logins and passwords.

Sharing among privileged and admin account holders is fairly commonplace. More than half of organizations surveyed earlier this year by CyberArk said their “approved” users share their admin and privileged account passwords.

Snowden’s social-engineering of his colleagues to get their credentials played off of an environment of trust. “Employees want to please their co-workers, so if he said, ‘hey, I need your help because I’ve gotta get something done’ … there a trust that can be taken advantage of,” says John Worrall, chief marketing officer at CyberArk.

“What’s troubling is there are a couple of basic tenets of security that you never want to screw around with, [including] you never share your credentials,” Worrall says. “The whole access control model is based on identity and then the access model is useless and it blows up.”

None of the remedies being discussed/funded by Congress address that fundamental breakdown in security.

I’m sure it would be harder right now to obtain a login/password at the NSA but give it six (or fewer) months.

A better solution than the “throw money at our contractor friends” used by Congress is to have regular internal security testing.

Offer a bounty to staff who get other staff to share their login/password.

What happens to those who share logins/passwords should depend on their level of access and potential for harm.

November 1, 2013

NSA FILES: DECODED

Filed under: NSA — Patrick Durusau @ 6:31 pm

NSA FILES: DECODED What the revelations mean for you.

From the story:

When Edward Snowden met journalists in his cramped room n Hong Kong’s Mira hotel in June, his mission was ambitious. Amid the clutter of laundry, meal trays and his four laptops, he wanted to start a debate about mass surveillance.

He succeeded beyond anything the journalists or Snowden himself ever imagined. His disclosures about the NSA resonated with Americans from day one. But they also exploded round the world.

For some, like Congresswoman Zoe Lofgren, it is a vitally important issue, one of the biggest of our time: nothing less than the defence of democracy in the digital age.
…

And it just keeps getting better the further you read in the story.

If you have trouble remembering all the various outrages of the NSA as they dribbled out over the past several months, this is a great summary of the leaks and the debates surrounding them.

Do keep in mind that surveillance has not slowed one bit nor is there any reason to think the NSA will obey any future restrictions.

October 24, 2013

Are all the “Facts” in a Topic Map True? [Reporting on the NSA]

Filed under: News,NSA,Security,TMDM,Topic Maps — Patrick Durusau @ 12:53 pm

Topic maps are not constrained to report “true facts.”

The Topic Maps Data Model (TMDM, 5.3.1 Subjects and topics) states:

A subject can be anything whatsoever, regardless of whether it exists or has any other specific characteristics, about which anything whatsoever may be asserted by any means whatsoever. In particular, it is anything about which the creator of a topic map chooses to discourse. (emphasis in the original)

Which is fortunate for topic map authors who are tracking the false claims that NSA surveillance has prevented 54 terrorist attacks.

Claim on “Attacks Thwarted” by NSA Spreads Despite Lack of Evidence by Justin Elliott and Theodoric Meyer, reports:

Earlier this month, Sen. Patrick Leahy, D-Vt., pressed Alexander on the issue at a Senate Judiciary Committee hearing.

“Would you agree that the 54 cases that keep getting cited by the administration were not all plots, and of the 54, only 13 had some nexus to the U.S.?” Leahy said at the hearing. “Would you agree with that, yes or no?”

“Yes,” Alexander replied, without elaborating.

…

“We’ve heard over and over again the assertion that 54 terrorist plots were thwarted” by the two programs, Leahy told Alexander at the Judiciary Committee hearing this month. “That’s plainly wrong, but we still get it in letters to members of Congress, we get it in statements. These weren’t all plots and they weren’t all thwarted. The American people are getting left with the inaccurate impression of the effectiveness of NSA programs.”

To track the spread of false facts, see the excellent visualization in How the NSA’s Claim on Thwarted Terrorist Plots Has Spread by By Sisi Wei, Theodoric Meyer and Justin Elliott.

With a topic map you could connect the spreaders of those lies with other lies they have spread on the same subject, other lies they have spread and their relationships to others who spread lies.

The NSA may be accidentally tracking terrorists every now and again.

What do you say to tracking the polluters of public policy discussions?

October 20, 2013

In re EPIC – NSA Telephone Records Surveillance

Filed under: Cybersecurity,NSA,Security — Patrick Durusau @ 3:56 pm

In re EPIC – NSA Telephone Records Surveillance

From the webpage:

“It is simply not possible that every phone record in the possession of a telecommunications firm could be relevant to an authorized investigation. Such an interpretation of Section 1861 would render meaningless the qualifying phrases contained in the provision and eviscerate the purpose of the Act.” – EPIC Mandamus Petition

…

Factual Background

The Verizon Order

On June 5, 2013, a secret Foreign Intelligence Surveillance Court (“FISC”) order allowing the Federal Bureau of Investigation (“FBI”) and the National Security Agency (“NSA”) to obtain vast amounts of telephone call data of Verizon customers was made public. The order, issued April 25, 2013, does not link this data collection to any specific target or investigation, but instead grants sweeping authority compelling Verizon to produce to the NSA “all call detail records or ‘telephony metadata’ created by Verizon for communications (i) between the United States and abroad; or (ii) wholly within the United States, including local telephone calls.” As a result, the NSA collected the telephone records of millions of Verizon customers, including those who only make calls to other U.S. numbers. Senator Diane Feinstein, Chairwoman of the Senate Intelligence Committee, has confirmed that this FISC Order is part of an ongoing electronic communications surveillance program that has been reauthorized since 2007. EPIC is a Verizon customer, and has been for the entire period the FISC Order has been in effect. Because the FISC Order compels disclosure of “all call detail records,” EPIC’s telephone metadata are subject to the order and have been disclosed to the NSA.

The Electronic Privacy Information Center (EPIC) is seeking to have the U.S. Supreme Court vacate the Verizon order. In legal terms, the Supreme Court is being asked to issue a writ of mandamus, that is an order to the FISC court to vacate its Verizon order and one assumes to no violate U.S. law in the future.

The EPIC effort is one step in a long march to recover the republic.

For topic mapping the loss of rights in the U.S. since 9/11, this site makes a very good starting point.

October 11, 2013

Security Patch Bounties!

Filed under: Cybersecurity,NSA,Programming,Security,Software — Patrick Durusau @ 6:17 pm

Google Offers New Bounty Program For Securing Open-Source Software by Kelly Jackson Higgins.

From the post:

First there was the bug bounty, and now there’s the patch bounty: Google has launched a new program that pays researchers for security fixes to open-source software.

The new experimental program offers rewards from $500 to $3,133.70 for coming up with security improvements to key open-source software projects. It is geared to complement Google’s bug bounty program for Google Web applications and Chrome.

Google’s program initially will encompass network services OpenSSH, BIND, ISC DHCP; image parsers libjpeg, libjpeg-turbo, libpng, giflib; Chromium and Blink in Chrome; libraries for OpenSSh and zlib; and Linux kernel components, including KVM. Google plans to next include Web servers Apache httpd, lighttpd, ngix; SMTP services Sendmail, Postfix, Exim; and GCC, binutils, and llvm; and OpenVPN.

Industry concerns over security flaws in open-source code have escalated as more applications rely on these components. Michal Zalewski of the Google Security Team says the search engine giant initially considered a bug bounty program for open-source software, but decided to provide financial incentives for better locking down open-source code.

“We all benefit from the amazing volunteer work done by the open-source community. That’s why we keep asking ourselves how to take the model pioneered with our Vulnerability Reward Program — and employ it to improve the security of key third-party software critical to the health of the entire Internet,” Zalewski said in a blog post. “We thought about simply kicking off an OSS bug-hunting program, but this approach can easily backfire. In addition to valid reports, bug bounties invite a significant volume of spurious traffic — enough to completely overwhelm a small community of volunteers. On top of this, fixing a problem often requires more effort than finding it.”

So Google went with offering money for improving the security of open-source software “that goes beyond merely fixing a known security bug,” he blogged. “Whether you want to switch to a more secure allocator, to add privilege separation, to clean up a bunch of sketchy calls to strcat(), or even just to enable ASLR – we want to help.”

The official rules include this statement:

Reactive patches that merely address a single, previously discovered vulnerability will typically not be eligible for rewards.

I read that to mean that hardening the security of the covered projects may qualify for an award (must be accepted by the project first).

I wonder if Google will consider a bonus if the patch repairs an NSA induced security weakness?

October 7, 2013

The NSA As Auto-Immune Disease

Filed under: Cybersecurity,NSA,Security — Patrick Durusau @ 6:47 pm

Time to tame the NSA behemoth trampling our rights by Yochai Benkler.

From the post:

The spate of new NSA disclosures substantially raises the stakes of this debate. We now know that the intelligence establishment systematically undermines oversight by lying to both Congress and the courts. We know that the NSA infiltrates internet standard-setting processes to security protocols that make surveillance harder. We know that the NSA uses persuasion, subterfuge, and legal coercion to distort software and hardware product design by commercial companies.

We have learned that in pursuit of its bureaucratic mission to obtain signals intelligence in a pervasively networked world, the NSA has mounted a systematic campaign against the foundations of American power: constitutional checks and balances, technological leadership, and market entrepreneurship. The NSA scandal is no longer about privacy, or a particular violation of constitutional or legislative obligations. The American body politic is suffering a severe case of auto-immune disease: our defense system is attacking other critical systems of our body.

The NSA and its fellows are dismantling the U.S. Constitution and American culture in the name of saving us all.

While I doubt the honesty of the contractors and sycophants attached to the intelligence community by its money teat, I am sure there are many government staffers who are completely sincere in their fear of terrorism. Even though it is quite unreasonable.

Gun numbers are always soft but consider:

In 2010, guns took the lives of 31,076 Americans in homicides, suicides and unintentional shootings. This is the equivalent of more than 85 deaths each day and more than three deaths each hour. (Law Center to Prevent Gun Violence)

That’s the equivalent of 10 World Trade Tower bombings every year in terms of casualties. Every year. 9/11 x 10 from gun violence.

But it’s true, we were attacked. And our immune system responded completely disproportionately to the attack. We destabilized two countries, lost more in casualties than in the original attack, repealed most of our bill of rights, etc.

Now more than twelve (12) years later our intelligence services are still jumping at shadows and pressing for more security measures and less rights.

No one can prove that terrorists aren’t “out there,” but their remarkable lack of success is some indication that it isn’t a serious problem.

Consider the recent mall attack in Kenya.

First, can you find Kenya on a map? Anywhere close to the United States? I didn’t think so.

Second, and the casualties? More than sixty (60) dead? That less than four days of gun deaths in the United States.

I’m sorry the people in Kenya are dead but I am also sorry about the ongoing gun casualties in the United States.

If and when terrorism becomes a serious problem, then we can look for solutions.

Looking for solutions to fantasy attackers is a sure recipe for national bankruptcy and ruin.

« Newer Posts — Older Posts »

Powered by WordPress