Diplomat to be new head of GCHQ

April 16, 2014 Leave a comment
Robert Hannigan -- new head of GCHQ

Robert Hannigan — new head of GCHQ

The new head of GCHQ is neither a spy by trade nor a hard-hitting political bully — he is a diplomat. Robert Hannigan, selected to replace Sir Iain Lobban, as head of Britain’s spy agency GCHQ comes out of the Foreign Office and is a former adviser to Tony Blair in Northern Ireland.

Ex-colleagues say choice of Foreign Office diplomat as GCHQ chief suggests government is leaving door open to reform
Robert Hannigan: GCHQ director who can balance secrecy and accountability — Guardian

The implication is clear: maybe, just maybe, Cameron has realised the severity of not just public concern and distrust over GCHQ, but the dismay of our European political allies. It will take some serious diplomacy to soothe some very ruffled feathers. It already seems likely the Britain will be excluded from the EU’s Schengen-routing and Schengen-cloud (see here for details); and that would put the country at a severe trade disadvantage in our most important export market.

The Guardian goes on to give an example of Hannigan’s diplomacy:

Hannigan rose from being the head of communications in the Northern Ireland Office to running its political affairs department. At one particularly critical moment in the peace talks in 2007, Hannigan helped overcome an impasse between Sinn Féin’s Gerry Adams and the DUP’s Ian Paisley. The latter wanted an adversarial arrangement with the parties glaring at each other across a table; Adams wanted them sitting side by side, as partners. Hannigan suggested a diamond-shaped table as a compromise.

The best of all possible worlds will be that Hannigan’s brief is to open up GCHQ to some form of public transparency. The greater likelihood, however, is that his brief is to pull the diplomatic wool over everyone’s eyes to allow GCHQ to continue as is.


Categories: All, Politics, Security Issues

Google amends its Terms of Service

April 16, 2014 Leave a comment

google logoWith most privacy laws you can pretty much do what you want provided you are up front about it. The key is the ‘informed consent’ of the user.

Google has been getting grief from legislators who claim that the complexity of its privacy policies make it impossible for users to be informed, and difficult for them to opt out if they do not consent.

One continuing argument is over Google’s scanning of email content in order to provide targeted advertising to Gmail users. The nub of the argument is that claimants say they have not given consent to this scanning while Google’s response is that consent is implied by use.

Now Google has made its practices explicit with a Monday addition to its terms of service. It has added a new paragraph:

Our automated systems analyze your content (including emails) to provide you personally relevant product features, such as customized search results, tailored advertising, and spam and malware detection. This analysis occurs as the content is sent, received, and when it is stored.
Google Terms of Service

I think Google was correct in reality if not legality when it claimed that consent was implicit in use — most if not all users are perfectly aware that email content is scanned electronically. The new paragraph makes this explicit: informed consent is now given by use of Google services.

What I still find interesting is that this consent is said to apply to received emails. If a non-Google user sends me a message, how is that user giving consent for the message to be scanned by Google? Is it realistic for non-Gmail users to read Google’s terms of service before emailing a Google user?

I don’t believe it is. So who owns the content: the sender or receiver? Copyright would suggest it is the sender — in which case this amendment to the terms of service will go some way, but not all the way, towards solving Google’s privacy issues.

Categories: All, Security Issues

Having sex online can seriously damage your economic health

April 15, 2014 Leave a comment

Get Safe Online is warning young males about the webcam scam sex blackmail. It seems to be targeting youngsters in Avon and Somerset because when I asked about other cases I was told, “The City of London police haven’t been able to provide any further stats, as this is a relatively new type of fraud.”

Strange, because it certainly isn’t new and is unlikely to be limited to Avon and Somerset.

Avon and Somerset Constabulary has dealt with several cases where, following connecting via social networking sites, victims (usually young males) are lured into taking off their clothes in front of their webcam – and sometimes performing sexual acts – which is videoed by the fraudster. The victims are then threatened with blackmail to avoid the video being published online and shared with their contacts. Investigations have revealed that most of these cases stem from abroad, making them difficult to trace.

That’s the scam in a nutshell. But it’s certainly not new – and you can get a more complete description from a report in the BBC from September 2012.

She said she was French, living in Lyon, but was on holiday in Ivory Coast. We then chatted for a bit on MSN and I could see a video of her. She was a very beautiful French-looking girl, very pretty.

She was dressed to begin with and asked whether I would be interested in going further. I asked what that meant and she said she wanted to see my body… everything.
Blackmail fraudsters target webcam daters

This particular case seems to have been in France, but adds another potentially more worrying aspect. The subsequent video was published with a caption saying the victim performed a sex act in front of a young girl – and that unless he pays €500 to take it down, the world would soon know he is a paedophile.

“At the moment we are persuaded that there are several blackmail attempts committed every day,” says Vincent Lemoine, a specialist in cybercrime in the Gendarmerie’s criminal investigations unit.

So it’s not new and already widespread. Perhaps it’s just newly migrated to the UK because, let’s face it, we Brits have a reputation for not even shaking hands without a formal introduction. But it is a problem and it’s very likely to be an increasing problem. I just wish that Get Safe Online would get real with the young of today. Its language simply doesn’t resonate.

“It’s terrible that fraudsters are targeting innocent people in such a personal way,” said Tony Neate, Chief Executive of Get Safe Online. The language is so British and understated. Terrible? Devastating and possibly life threatening (“His blackmailers were relentless and he could see no end to his ordeal. A week after the first demand, he killed himself.” BBC report) might be more accurate.

I also have some concerns over whether Get Safe Online actually understands young culture. The purpose of the warning is admirable – but the advice given somewhat misses the mark. “Be wary about who you invite or accept invitations from on social networking sites. Don’t accept friendship requests from complete strangers. You wouldn’t do this in real life!”

That’s the problem. That’s exactly what people actually do in real life. We dress up, go out on the town, hook up with a complete stranger and have sex. It’s called a one-night-stand and it’s what weekends were invented for. And all friends were strangers before they became friends, so saying don’t make friends with strangers is a bit silly.

So I would say to Get Safe Online, if you want to seriously warn the youngsters of today, Get Safe should first get real.

If you want more advice on the threat from Get Safe, there’s an outline on their site:

Get Safe warning

I think the illustration is meant to show a worried young man who is being blackmailed – but it could just be someone giving head to a stranger he just met on Facebook.

Categories: All, Security Issues

New Android flaw could send you to a phishing site

April 14, 2014 Leave a comment

Last week news of the Heartbleed bug broke. Initial concern concentrated on the big service providers and whether they were bleeding their users’ credentials, but attention soon turned to client devices, and in particular Android. Google said only one version of Android was vulnerable (4.11 Jelly Bean); but it’s the one that is used on more than one-third of all Android devices.

The problem is, Android simply won’t be patched as fast as the big providers. Google itself is good at patching; but Android is fragmented across multiple manufacturers who are themselves responsible for patching their users – and historically, they are not so good. It prompted ZDNet to write yesterday,

The Heartbleed scenario does raise the question of the speed of patching and upgrading on Android. Take for instance, the example of the Samsung Galaxy S4, released this time last year, it has taken nine months from the July 2013 release of Jelly Bean 4.3 for devices on Australia’s Vodafone network to receive the update, it took a week for Nexus devices to receive the update.
Heartboned: Why Google needs to reclaim Android updates

Today we get further evidence of the need for Google to take control of Android updating – information from FireEye on a new and very dangerous Android flaw. In a nutshell, a malicious app can manipulate other icons.

FireEye mobile security researchers have discovered a new Android security issue: a malicious app with normal protection level permissions can probe icons on Android home screen and modify them to point to phishing websites or the malicious app itself without notifying the user. Google has acknowledged this issue and released the patch to its OEM partners.
Occupy Your Icons Silently on Android

The danger, however, is this can be done without any warning. Android only notifies users when an app requires ‘dangerous’ permissions. This flaw, however, makes use of normal permissions; and Android does not warn on normal permissions. The effect is that an apparently benign app can have dangerous consequences.

FireEye's POC test app does not display any warning to the user

FireEye’s POC test app does not display any warning to the user

As a proof of concept attack scenario, a malicious app with these two permissions can query/insert/alter the system icon settings and modify legitimate icons of some security-sensitive apps, such as banking apps, to a phishing website. We tested and confirmed this attack on a Nexus 7 device with Android 4.4.2. (Note: The testing website was brought down quickly and nobody else ever connected to it.) Google Play doesn’t prevent this app from being published and there’s no warning when a user downloads and installs it. (Note: We have removed the app from Google Play quickly and nobody else downloaded this app.)

Google has already released a patch for Android, and Nexus users will soon be safe. But others? “Many android vendors were slow to adopt security upgrades. We urge these vendors to patch vulnerabilities more quickly to protect their users,” urges FireEye.

Categories: All, Security Issues

Is it safe to carry on using Dropbox with Condoleezza Rice on the Board?

April 14, 2014 Leave a comment
Drew Houston, Dropbox (Wikipedia)

Drew Houston, Dropbox (Wikipedia)

No. How could you even ask? Leopards do not change their spots except on the road to Damascus; and Rice was too involved in the road to Baghdad with warrantless wiretapping along the route.

And what is Drew Houston, founder and CEO of Dropbox even thinking? On 9 April he blogged:

Finally, we’re proud to welcome Dr. Condoleezza Rice to our Board of Directors. When looking to grow our board, we sought out a leader who could help us expand our global footprint. Dr. Rice has had an illustrious career as Provost of Stanford University, board member of companies like Hewlett Packard and Charles Schwab, and former United States Secretary of State. We’re honored to be adding someone as brilliant and accomplished as Dr. Rice to our team.
Growing our leadership team

Condoleezza Rice, 2005 (Wikipedia)

Condoleezza Rice, 2005 (Wikipedia)

It is true that Rice has had an illustrious career. However, some of the bits not mentioned by Houston include being a board member of Chevron (one of the top six ‘supermajor’ oil companies) before becoming Bush’s National Security Advisor (the two positions actually overlapped for one month). As National Security Advisor she understood the need for the petrodollar invasion of Iraq and was a strong supporter of the 2003 invasion.

On Iraq’s weapons of mass destruction, the primary and false premise that justified the war, she said, “The problem here is that there will always be some uncertainty about how quickly he can acquire nuclear weapons. But we don’t want the smoking gun to be a mushroom cloud.” As Ming Campbell said of Tony Blair, you are either incompetent or lying.

There’s more. Rice was a strong supporter of the NSA’s warrantless wiretapping program; and it is claimed she personally authorised eavesdropping on UN officials. The Guardian reported on a leaked memo in 2003 instructing the NSA to increase surveillance “‘particularly directed at… UN Security Council Members (minus US and GBR, of course)’ to provide up-to-the-minute intelligence for Bush officials on the voting intentions of UN members regarding the issue of Iraq.”

The existence of the surveillance operation, understood to have been requested by President Bush’s National Security Adviser, Condoleezza Rice, is deeply embarrassing to the Americans in the middle of their efforts to win over the undecided delegations.
Revealed: US dirty tricks to win vote on Iraq war

Now, seriously, do we want a supporter of warrantless surveillance to be on the Board of a company that holds some of our most precious documents, photos and thoughts?

Categories: All, Politics, Security Issues

How much will the Senate report on CIA torture reveal about British involvement?

April 13, 2014 Leave a comment

As the world waits to see how much of the Senate report on CIA torture is left unredacted in its imminent release, the British government and some of its former members must be worrying about what will be revealed of their own involvement.

Cameron can claim it all happened before his time; but he can hardly claim he didn’t learn of it since. All the current evidence seems to suggest that the Labour movers and shakers, including Blair and then foreign secretary Jack Straw knew and hushed up British involvement.

Just over a week ago, the Telegraph reported:

“The politicians took a very active interest indeed. They wanted to know everything. The Americans passed over the legal opinions saying that this was now ‘legal’, and our politicians were aware of what was going on at the highest possible level.

“The politicians knew in detail about everything – the torture and the rendition. They could have said [to MI6] ‘stop it, do not get involved’, but at no time did they,” said the source, who has direct and detailed knowledge of the transatlantic relations during that period.
The Telegraph: Tony Blair ‘knew all about CIA secret kidnap programme’

Britain, of course, has its own torture investigation in progress. When Gaddafi was overthrown, the victors found documents

>that appeared to show that Sir Mark Allen, the former head of counter-terrorism at MI6, and other agents had been complicit in the rendition of Abdel Hakim Belhadj, who was captured by the CIA with his pregnant wife and sent back to Libya.
The Independent: Tony Blair ‘knew everything about CIA interrogation programme’

The Metropolitan police are investigating whether any MI6 officers should be prosecuted for involvement with torture.

At issue now is whether Diego Garcia, a British island leased to the Americans, was a CIA ‘black prison’. If so, it could not have been used as such without British approval.


Diego Garcia

Diego Garcia: a hell made from paradise by Anglo-American imperialism


On 9 April, Al Jazeera America reported,

The Senate report, according to Al Jazeera’s sources, says that the CIA detained some high-value suspects on Diego Garcia, an Indian Ocean island controlled by the United Kingdom and leased to the United States. The classified CIA documents say the black site arrangement at Diego Garcia was made with the “full cooperation” of the British government. That would confirm long-standing claims by human rights investigators and journalists, whose allegations — based on flight logs and unnamed government sources — have routinely been denied by the CIA.

It is possible that when the report is finally released, British approval will have been redacted. This would explain why Cameron remains silent. It is unlikely that he does not know what is included in the report. If British involvement is made clear, he probably believes that he can lay all blame at the feet of the previous Labour government. But either way, Britain and America are guilty of appalling behaviour both to and with the island of Diego Garcia:

Island of Shame is the first major book to reveal the shocking truth of how the United States conspired with Britain to forcibly expel Diego Garcia’s indigenous people–the Chagossians–and deport them to slums in Mauritius and the Seychelles, where most live in dire poverty to this day. Drawing on interviews with Washington insiders, military strategists, and exiled islanders, as well as hundreds of declassified documents, David Vine exposes the secret history of Diego Garcia. He chronicles the Chagossians’ dramatic, unfolding story as they struggle to survive in exile and fight to return to their homeland. Tracing U.S. foreign policy from the Cold War to the war on terror, Vine shows how the United States has forged a new and pervasive kind of empire that is quietly dominating the planet with hundreds of overseas military bases.
Island of Shame: The Secret History of the U.S. Military Base on Diego Garcia


Categories: All, Politics

Andrew Weev Auernheimer freed on an important technicality

April 13, 2014 Leave a comment

Just over one year ago, Andrew (Weev) Auernheimer was sentenced to 41 months in prison for downloading data that AT&T had left exposed on the internet. That data was the email addresses of more than 100,000 early iPad adopters; and was a major embarrassment for AT&T.

Perhaps because of the importance of AT&T to law enforcement; perhaps because of the celebrities and government officials included in the early adopters; the government prosecuted Weev under the Computer Fraud and Abuse Act.

The important point to remember is that Weev performed no hack, subverted no security defences — he merely downloaded (effectively by asking the site to give him…) the email addresses of AT&T customers. The implication of the government action against him is that any site could declare any data ‘prohibited’ after its download, and allow the government to prosecute anyone who had downloaded it.

It would also mean that much genuine and valuable security research — such as testing a website to see if it is vulnerable to the Heartbleed bug — and even the compilation of web search databases such as Google and Bing would be illegal.

Weev appealed his sentence, and one year and a bit later, on 10 April 2014, Third Circuit judges vacated the conviction.

weev free

The satisfactory outcome is that Weev has been freed from another government CFAA overreach. The unsatisfactory outcome is the cop-out manner in which it was done by the court.

The appeal was effectively over the misuse of the CFAA, and the location of the trial in New Jersey. Location is an important concept in US computer law. If the conviction had been allowed to stand, prosecutors would be able to cherry-pick from different state laws (as indeed they seem to have done with Weev) in order to maximise the penalty. But the law says that there must be a geographical connection between the crime and the prosecution.

In this instance Auernheimer was in Arkansas, his accomplice was in California, AT&T was in Texas with the server in Georgia — and Gawker (which published some of the email addresses downloaded by Weev) was in New York. But the government prosecuted him in New Jersey where state laws allowed a longer sentence.

Few people believe that Weev’s conviction and sentence was anything other than a miscarriage of justice. This view could have been upheld by the appeal court either on the misuse of the CFAA or the venue of the trial. It chose the latter because this meant it did not need to consider the former. The great news is that the conviction has been vacated; the disappointing news is that the CFAA itself has not been challenged and future overreach remains a distinct possibility.


Get every new post delivered to your Inbox.

Join 127 other followers