J. G. Sandom ~ Author

404 — Officials: Body found in water off Providence, RI, park is that of missing Brown Univ. student ~ Welcome to the world of e-lynching

I was greatly troubled by most of the quick-let's-get-it-out-there-even-if-it's-wrong coverage of the Boston Marathon bombings by the mainstream media, and highly offended by the way in which it was "covered" on the Net (blogosphere, twittersphere, reddit, etc.). Now that the body of 22-year-old Brown University student Sunil Tripathi, who went missing after the Boston Marathon bombings, and who was wrongly accused by the noösphere . . . I mean blogosphere/twittersphere . . . has been found, I am absolutely appaled. Let's call a spade a spade. This was nothing short of an e-lynching. Bad enough that the Boston police had to tell folks not to tweet about their locations during the manhunt (really, people, have you no sense at all!), but to see this boy found dead — either from suicide or murder (I doubt it was accidental) — just makes my blood boil. SHAME ON YOU IF YOU POSTED PICTURES OF ALLEGED SUSPECTS DURING THE MANHUNT. Sunil's blood is on your hands. When will we learn that having brown skin is not a crime!

See this story from the AP which appeared in The Washington Post.

 

Officials: Body found in water off Providence, RI, park is that of missing Brown Univ. student

RIP Sunil

PROVIDENCE, R.I. — A body pulled from waters off a Providence park was that of a 22-year-old Brown University student missing since last month, the Rhode Island medical examiner’s office said Thursday.

Sunil Tripathi was identified through a forensic dental exam, but a cause of death has not been determined, said Dara Chadwick, a spokeswoman for the state health department.

The announcement put an end to the mystery of Tripathi’s disappearance, which became doubly painful for his family when amateur online sleuths wrongly identified him as a possible suspect in the Boston Marathon bombings.

Tripathi’s family, of Bryn Mawr, Pa., said it was overcome with grief but grateful for the outpouring of support relatives got over the last month.

“As we carry indescribable grief, we also feel incredible gratitude,” the Tripathi family said in a statement on a Facebook page set up to help find Tripathi, who went by Sunny. “To each one of you — from our hometown to many distant lands — we extend our thanks for the words of encouragement, for your thoughts, for your hands, for your prayers, and for the love you have so generously shared.”

Tripathi’s body was found Tuesday by members of the Brown crew team off of India Point Park and was brought to shore by its coach, Providence Police Cmdr. Thomas Oates said. He said the body had been in the water for “some time.”

Tripathi’s family had been searching for him since mid-March with help from the FBI and fellow Brown students. His sister, Sangeeta, said he left his phone, wallet and other belongings in his apartment near campus and simply disappeared. He was on leave from the Ivy League school, where he was studying philosophy, and had been going through a difficult time, she said.

Last week, speculation swirled on Twitter and the website Reddit that Tripathi was the second of two suspects in the Boston Marathon bombings because some thought he resembled one of the people in photos released by the FBI. That person turned out to be 19-year-old Dzhokhar Tsarnaev, authorities said.

Reddit later apologized to Tripathi’s family for fueling “online witch hunts and dangerous speculation which spiraled into very negative consequences for innocent parties.”

Tripathi’s family responded to the speculation in a Facebook post that read: “A tremendous and painful amount of attention has been cast on our beloved Sunil Tripathi in the past 12 hours. We have known unequivocally all along that neither individual suspected as responsible for the Boston Marathon bombings was Sunil.”

The family said in its statement Thursday that the last month “has changed our lives forever, and we hope it will change yours too.”

The family went on: “Take care of one another. Be gentle, be compassionate. Be open to letting someone in when it is you who is faltering. Lend your hand. We need it. The world needs it.”

Brown President Christina H. Paxson sent a message to the campus community Thursday, saying Tripathi — the brother of two Brown graduates— would be remembered for his “gentle demeanor and generous spirit.” She described him as an accomplished saxophonist and a “serious, thoughtful, intellectually curious student and a brilliant writer.”

404 — North Korea Threatens to Close Factories It Runs With South

And now, it appears, the South Koreans have struck back at the North using their own cyber warriors. Unfortunately, since the North Koreans have so little to take down, it's a rather lame reprisal. Here is a good story from The New York Times.

The American military carries out a rare long-range mission over the Korean Peninsula, sending two nuclear-capable B-2 stealth bombers on a practice sortie over South Korea, underscoring Washington’s commitment to defend its ally amid rising tensions with North Korea.

North Korea Threatens to Close Factories It Runs With South

By CHOE SANG-HUN and GERRY MULLANY

SEOUL, South Korea - North Korea, reiterating that it considered the Korean Peninsula back in "a state of war," threatened Saturday to shut down a factory complex it jointly operates with South Korea and that stands as the last significant symbol of cooperation.

The industrial park, the eight-year-old Kaesong complex in the North Korean border town of the same name, is a crucial source of badly needed cash for the heavily sanctioned North. It funnels more than $92 million a year in wages for 53,400 North Koreans employed there, and its operation has survived despite years of military tensions. The latest threat to close down Kaesong came amid a torrent of bellicose statements by the North in recent days, widely seen as a strategy to increase pressure on South Korea and the United States to soften their policies on the North.

Although South Korean officials reasserted that they were ready to retaliate if the North committed any military provocations, they said they saw no imminent sign of any such attacks. On Saturday, cross-border traffic operated as normal, allowing hundreds of South Koreans to travel to and from Kaesong.

Over 300 South Koreans remained in the complex, where 123 South Korean textile and other labor-intensive factories employ the North Korean workers, at an average monthly wage of $144.

The fate of Kaesong is seen as a crucial test of how far North Korea is willing to take its recent threats against the South. Its continued operation was often seen as a sign that Pyongyang's verbal militancy was not necessarily matched by its actions.

"The South Korean puppet forces are left with no face to make complaint even though we ban the South side's personnel's entry into the zone and close it," North Korea said Saturday in a statement carried by its official Korean Central News Agency. It said its dignity was insulted by South Korean news media reports that suggested the North kept the complex open to obtain hard currency.

In another development, some of the North's main government-run Web sites were disabled on Saturday in what news media reports said were cyberattacks.

The disabled sites included those of Naenara, the government's official Web portal; Air Koryo, the state-run airline; and Voice of Korea, Pyongyang's international broadcast outlet.

North Korea Tech, a Web site that monitors Internet activities on the Korean Peninsula, said the problems appeared "to be part of a loosely coordinated effort by hackers to target North Korean sites." By late Saturday afternoon, North Korean officials had not confirmed any attacks on government-run Web sites.

The problems come as some analysts suspect that cyberattacks have become an increasingly frequent weapon in the intensified sparring between the Koreas, although each side denies hacking the other.

South Korean officials suspect that North Korea was behind cyberattacks on March 20 against three banks and the country's two largest broadcasters. The attacks came five days after North Korea blamed the South and the United States for cyberattacks that temporarily shut down some of its official Web sites, and warned of "consequences."

North Korea has been angry ever since South Korea and the United States started a joint military exercise in early March. Its bellicosity further escalated when the United Nations imposed more sanctions against it after its Feb. 12 nuclear test.

The North has since declared an "all-out action" against Washington and Seoul and said that the armistice that stopped the Korean War in 1953, as well as all nonaggression agreements with the South, was nullified.

Last week, it cut the last remaining military hot lines with Seoul. Its leader, Kim Jong-un, ordered all his missile units to be on standby and if provoked, attack the United States and South Korea with nuclear-tipped long-range missiles, although most analysts doubt the North has them.

A statement by South Korea's military said that although the North Korean threats were not new, they "are unacceptable and harm the peace and stability of the Korean Peninsula."

Choe Sang-hun reported from Seoul, and Gerry Mullany from Hong Kong.

404 — Devices Like Cable Boxes Figured in Internet Attack

This fine piece by one of my favorite reporters on the subject tackles the proliferation of IP-enabled devices out there that are badly configured and, therefore, grist for the hacker's mill. Don't let your tech become the unwitting pawn of a botnet or zero day malware attack. Make sure you're not helping others take down the Net.

Check out this piece by Nicole Perlroth of The New York Times.

Paul Vixie of Internet Software Consortium is studying how online attacks work.

Devices Like Cable Boxes Figured in Internet Attack

By NICOLE PERLROTH

SAN FRANCISCO - In the aftermath this week of one of the most powerful attacks on the Internet, finger-pointing quickly ensued.

The organization most suspected, victims said, was Stophaus, an elusive group of disgruntled European Internet users, although Sven Olaf Kamphuis, its spokesman, denied he was responsible for the attacks. At the same time, he shifted blame to Russian Internet service providers, which he said were retaliating against Spamhaus, a European anti-spam group, for blacklisting them.

But the real enablers of the attack were the operators of more than 27 million computers around the globe who left their equipment wide open to a motivated attacker. Those enablers are not just companies, but regular people with home cable boxes.

"There is a big possibility that you are part of the problem without even knowing it," said Paul Vixie, chairman of the Internet Software Consortium, a nonprofit company responsible for the software used by many of the servers that power the Internet.

The servers the attackers used - what the Internet community calls open recursive servers or, more commonly, open resolvers - are simply home Internet devices, corporate servers, or virtual machines in the cloud that have been sloppily configured to accept messages from any device around the globe.

Open resolvers have been set up in such a way that they are not unlike the naïve users of public Wi-Fi who forget to turn off their file-sharing settings, so that any hacker on the Internet can creep inside the computer. It's similar to PC users who do not realize that by not updating their software, they let their computers get infected with malware and used as a zombie in a cyberattack.

The difference is that if you think of a computer as a digital weapon, then an open resolver is a machine gun. Attackers can use open resolvers to amplify the strength of a cyberattack by a factor of 100.

In this week's attack on Spamhaus and the company hired to fight it, CloudFlare, attackers made use of more than 100,000 open resolvers to inflict an attack that reached 300 billion bits per second, the largest such attack ever reported. When they could not take down those targets, they aimed and fired open resolvers at the world's major Internet exchanges, first London, then Amsterdam, Frankfurt and then Hong Kong.

"At some point, we thought, 'They are going to hit everything at once, and that's when this gets real,' " said Matthew Prince, the chief executive of CloudFlare. "That's the nightmare scenario that hasn't happened - yet."

"We've now seen an attack that begins to illustrate the full extent of the problem," Mr. Prince wrote in a blog post.

Closing an open resolver, unfortunately, is not as simple as flipping a switch or downloading some software. Finding out if your home cable box is an open resolver, for instance, requires you to call your cable company and tell them that you do not want to be running an open resolver - a tough request when most of the world's population does not even know what an open resolver is.

Recent efforts have been made to increase awareness of the issue. Computer security experts have recently started "naming and shaming" the operators of open resolvers. The DNS Measurement Factory, one such group, published a survey of top offenders by network, and more recently the Open Resolver Project published a full list of the 27 million open servers online.

The campaign is making slow progress; thousands dropped off those lists in the last few months.

But Dr. Vixie calls the open resolvers just the low-hanging fruit. Even if they were all fixed tomorrow, there are other types of servers that could just as easily be used to amplify an attack, a fact that hackers are eager to point out.

"The guys doing the attack indeed use open resolvers, but those are not needed for this type of attack," Mr. Kamphuis said in an online interview with The New York Times earlier this week.

Indeed, there are other servers that amplify attacks - including machines called Simple Network Management Protocol (SNMP) servers - albeit by a significantly smaller magnitude. Dr. Vixie and others have been working on what is called response rate limiting technology, a potential solution to the amplification problem. That technology helps servers decipher between unusual requests and normal traffic, but engineers still need to fine-tune it in such a way that it can be used without slowing Internet speeds.

Even if they can pull it off, that still leaves the other half of the problem. To accomplish this week's attacks, the attackers sent messages forged to look as if they came from their victims, so that when the open resolvers responded, they responded to Spamhaus, CloudFlare and their Internet providers with large blocks of traffic.

That digital forging is easy to pull off. But, there too, Internet security specialists have long had a solution. For more than a decade, Dr. Vixie and others have encouraged companies to use what is called Source Address Validation, a technology that filters forged traffic from legitimate traffic. The problem is that the technology is not yet pervasive.

The reason, Dr. Vixie said, was "simple economics." What incentive do companies have to pay for the cost of adopting the technology and training their engineers to use it when their competitors don't? The victims of the attacks are usually not those companies, so they bear the expense and reap no direct benefit.

Dan Kaminsky, a prominent computer security researcher, said, "The problem is that it's hard to get someone to care."

This week's attack, which had halted on Tuesday, resumed Thursday morning.

But there is a silver lining. "I've been waiting for this attack for a long time," Dr. Vixie said, "so that we could tell the earth's population to do something about it."

404 — Pyongyang Blusters, and U.S. Worries About Quieter Risks

I found this piece from The New York Times about North Korea interesting, especially this section: 

"In fact, it is the abilities that Mr. Kim is not showing off that have the Obama administration most worried. The cyberattacks on South Korea’s banking system and television broadcasters two weeks ago were surprisingly successful, as was the torpedo attack three years ago this week on the Cheonan, a naval corvette, that killed 46 South Korean sailors. The North has never acknowledged involvement in either — though the South believes it was responsible for both and so do American experts . . . The cyberattacks and torpedo attack have something in common: Unlike the missile attacks and beach landings that Mr. Kim seems to be suggesting are imminent, they are hard to trace to North Korea, at least immediately. As a result, they are hard to retaliate against, and in fact the South never struck back militarily for the sinking of the Cheonan, even after a commission of inquiry, with experts from outside South Korea, concluded it was the work of a submarine-launched torpedo."

University students marched through Kim Il Sung Square in downtown Pyongyang, North Korea, on Friday.

Pyongyang Blusters, and U.S. Worries About Quieter Risks

By CHOE SANG-HUN and DAVID E. SANGER

SEOUL, South Korea — This week, North Korea’s young leader, Kim Jung-un, ordered his underlings to prepare for a missile attack on the United States. He appeared at a command center in front of a wall map with the bold, unlikely title, “Plans to Attack the Mainland U.S.” Earlier in the month, his generals boasted of developing a “Korean-style” nuclear warhead that could be fitted atop a long-range missile.

But the missile systems that figure in Mr. Kim’s blitz of threats and orders do not yet have the range to approach American shores. There is no evidence his nuclear weapons can be shrunk to fit atop a missile. And a prominent photograph showing Mr. Kim’s military making a Normandy-style beach landing appears to have been manufactured, raising questions about whether his forces could possibly repeat the feat his grandfather pulled off in 1950, ordering a ground attack to open the Korean War.

On top of all that, most countries on the verge of a major military assault do not broadcast their battle plans to the world.

“You would expect such a military order to be issued in secret,” said Kim Min-seok, spokesman of the South Korean Defense Ministry. “We believe that by revealing it to the media and publicizing it to the world, North Korea is playing psychology.”

In fact, it is the abilities that Mr. Kim is not showing off that have the Obama administration most worried. The cyberattacks on South Korea’s banking system and television broadcasters two weeks ago were surprisingly successful, as was the torpedo attack three years ago this week on the Cheonan, a naval corvette, that killed 46 South Korean sailors. The North has never acknowledged involvement in either — though the South believes it was responsible for both and so do American experts.

“We’re convinced this is about Kim solidifying his place with his own people and his own military, who still don’t know him,” one senior administration official said Friday. He added, “We’re worried about what he’s going to do next, but we’re not worried about what he seems to be threatening to do next.”

The cyberattacks and torpedo attack have something in common: Unlike the missile attacks and beach landings that Mr. Kim seems to be suggesting are imminent, they are hard to trace to North Korea, at least immediately. As a result, they are hard to retaliate against, and in fact the South never struck back militarily for the sinking of the Cheonan, even after a commission of inquiry, with experts from outside South Korea, concluded it was the work of a submarine-launched torpedo.

To North Korea experts in Washington and Seoul, there is something familiar in the country’s threats to “keep the White House in the cross hairs of our long-range missiles.” Such threat of armed brinkmanship — the catchphrase in the 1990s was that Seoul would become a “sea of fire,” a term recently revived by North Korea’s news agencies — has in the past drawn its adversaries to the bargaining table with economic concessions. But at the same time, the tensions with the outside world provide the government with opportunities to elevate its leader’s status among his people — which might be more important to a young, untested leader than it was to his father and grandfather.

According to the view that North Korea’s propaganda machine pounds into its citizens’ minds, the North is a tiny nation besieged by hostile outside forces, one that survived despite decades of sanctions and can finally stand up to both its longtime Chinese ally and American enemy — all thanks to the strong “military-first” leadership of the Kim family and the country’s nuclear arsenal.

In such a setting, Mr. Kim’s trip to a border island on a wooden boat — it almost seemed designed to create a “Washington crossing the Delaware” motif — is proof of his “daring and pluck,” as the country’s main party newspaper, Rodong, explained. Rodong also declared about North Korea’s nuclear weapons: “Let the American imperialists and their followers know! We are not a pushover like Iraq or Libya.” The first, famously, had no nuclear weapons; the second gave up its nascent nuclear program in late 2003, a move North Korea describes as Col. Muammar el-Qaddafi’s greatest mistake.

In the propaganda world that the three generations of the Kim dynasty has created, Mr. Kim is “a great iron-willed general admired by all of his people, including real generals who have actually served in the military,” said Lee Sung-yoon, North Korea specialist at the Fletcher School of Law and Diplomacy at Tufts University. “For the Kim III, fantasy is reality.”

Keeping the fantasy up has required a lot of work in the past month, with many visits to military units on both of the country’s coasts, and a lot of conferences at midnight with generals.

Yet in each of these scenes, North Korea’s propagandists sometimes made Mr. Kim look as much a clumsy actor as a new leader of one of the world’s most belligerent governments.

For one, North Korean state-run media on March 12 released a photo showing Mr. Kim arriving at an island within the gun range of South Korean marines and quoted him as threatening to “cut the windpipes of the enemies.” But it strained credibility that he traveled to a region he called a powder keg on a small unarmed wooden boat, as shown in the photo.

On Tuesday, North Korea released a photo showing Mr. Kim watching hovercrafts storm a snow-covered beach in eastern North Korea. But it did not take long for journalists and analysts to conclude that the picture was clumsily doctored to add more amphibious landing vehicles and make the drill look far more imposing than it really was.

Then on Friday, photos released by the North’s state media, which also showed signs of digital manipulation, featured Mr. Kim huddling with his top generals during a midnight meeting to approve “plans to strike the mainland U.S.” A military chart behind them showed a series of lines shooting out of North Korea and hitting major cities in the United States, including those on the East Coast. Even if the North Koreans had such missiles — most analysts doubt it does — would they really intend to launch them at the United States in what would be a suicidal action for the Pyongyang government?

“We’re all trying to put him on the couch,” said Jonathan D. Pollack, a North Korea expert at the Brookings Institution. “A year ago the U.S. and the Chinese saw at least the possibility that you could do business with him. But he has steadily reverted to form,” adopting the approach of his father and grandfather in using the perception of an external threat to solidify support at home.

On Saturday those threats were South Korea and “the Americans and their puppets,” a statement from the North said. The two Koreas “were back to a state of war,” it said, and the North’s foes “should know that everything is different under our peerless general and dear Marshal Kim Jong-un.” While many fear that Mr. Kim’s rhetoric is building up toward some action, Mr. Pollack held out the hope that the threats could abate as United States and South Korean military exercises, which infuriate the North, wind up at the end of April.

 

Choe Sang-Hun reported from Seoul, South Korea, and David E. Sanger from Washington.

 

404 — Cyberattacks Seem Meant to Destroy, Not Just Disrupt

An attack againt American Express this past Thursday is thought to be the work of Iran's Izz ad-Din al-Qassam Cyber Fighters. "The attacks have changed from espionage to destruction," said Alan Paller, director of research at the SANS Institute, a cybersecurity training organization. "Nations are actively testing how far they can go before we will respond."

Well, how far can they go? Check out this interesting article from The New York Times. We are engaged in a cold cyber war with Iran. And their programmers are getting better and better every day. "Instead of using individual personal computers to fire Web traffic at each bank, they infected powerful, commercial data centers with sophisticated malware and directed them to simultaneously fire at each bank, giving them the horsepower to inflict a huge attack."

 

Cyberattacks Seem Meant to Destroy, Not Just Disrupt

Officials at a South Korean security agency study an attack that disabled 32,000 computers.

By NICOLE PERLROTH and DAVID E. SANGER

American Express customers trying to gain access to their online accounts Thursday were met with blank screens or an ominous ancient type face. The company confirmed that its Web site had come under attack.

The assault, which took American Express offline for two hours, was the latest in an intensifying campaign of unusually powerful attacks on American financial institutions that began last September and have taken dozens of them offline intermittently, costing millions of dollars.

JPMorgan Chase was taken offline by a similar attack this month. And last week, a separate, aggressive attack incapacitated 32,000 computers at South Korea's banks and television networks.

The culprits of these attacks, officials and experts say, appear intent on disabling financial transactions and operations.

Corporate leaders have long feared online attacks aimed at financial fraud or economic espionage, but now a new threat has taken hold: attackers, possibly with state backing, who seem bent on destruction.

"The attacks have changed from espionage to destruction," said Alan Paller, director of research at the SANS Institute, a cybersecurity training organization. "Nations are actively testing how far they can go before we will respond."

Security experts who studied the attacks said that it was part of the same campaign that took down the Web sites of JPMorgan Chase, Wells Fargo, Bank of America and others over the last six months. A group that calls itself the Izz ad-Din al-Qassam Cyber Fighters has claimed responsibility for those attacks.

The group says it is retaliating for an anti-Islamic video posted on YouTube last fall. But American intelligence officials and industry investigators say they believe the group is a convenient cover for Iran. Just how tight the connection is - or whether the group is acting on direct orders from the Iranian government - is unclear. Government officials and bank executives have failed to produce a smoking gun.

North Korea is considered the most likely source of the attacks on South Korea, though investigators are struggling to follow the digital trail, a process that could take months. The North Korean government of Kim Jong-un has openly declared that it is seeking online targets in its neighbor to the south to exact economic damage.

Representatives of American Express confirmed that the company was under attack Thursday, but said that there was no evidence that customer data had been compromised. A representative of the Federal Bureau of Investigation did not respond to a request for comment on the American Express attack.

Spokesmen for JPMorgan Chase said they would not talk about the recent attack there, its origins or its consequences. JPMorgan has openly acknowledged previous denial of service attacks. But the size and severity of the most recent one apparently led it to reconsider.

The Obama administration has publicly urged companies to be more transparent about attacks, but often security experts and lawyers give the opposite advice.

The largest contingent of instigators of attacks in the private sector, government officials and researchers say, remains Chinese hackers intent on stealing corporate secrets.

The American and South Korean attacks underscore a growing fear that the two countries most worrisome to banks, oil producers and governments may be Iran and North Korea, not because of their skill but because of their brazenness. Neither country is considered a superstar in this area. The appeal of digital weapons is similar to that of nuclear capability: it is a way for an outgunned, outfinanced nation to even the playing field. "These countries are pursuing cyberweapons the same way they are pursuing nuclear weapons," said James A. Lewis, a computer security expert at the Center for Strategic and International Studies in Washington. "It's primitive; it's not top of the line, but it's good enough and they are committed to getting it."

American officials are currently weighing their response options, but the issues involved are complex. At a meeting of banking executives, regulators and representatives from the departments of Homeland Security and Treasury last December, some pressed the United States to hit back at the hackers, while others argued that doing so would only lead to more aggressive attacks, according to two people who attended the meeting.

The difficulty of deterring such attacks was also the focus of a White House meeting this month with Mr. Obama and business leaders, including the chief executives Jamie Dimon of JPMorgan Chase; Brian T. Moynihan of Bank of America; Rex W. Tillerson of Exxon Mobil; Randall L. Stephenson of AT&T and others.

Mr. Obama's goal was to erode the business community's intense opposition to federal legislation that would give the government oversight of how companies protect "critical infrastructure," like banking systems and energy and cellphone networks. That opposition killed a bill last year, prompting Mr. Obama to sign an executive order promoting increased information-sharing with businesses.

"But I think we heard a new tone at this latest meeting," an Obama aide said later. "Six months of unrelenting attacks have changed some views."

Mr. Lewis, the computer security expert, agreed. "The Iranian attacks have tilted private sector opinion," he said. "Hence the muted reaction to the executive order versus squeals of outrage. Companies are much more concerned about this and much more willing to see a government role."

Neither Iran nor North Korea has shown anywhere near the subtlety and technique in online offensive skills that the United States and Israel demonstrated with Olympic Games, the ostensible effort to disable Iran's nuclear enrichment plants with an online weapon that destabilized hundreds of centrifuges, destroying many of them. But after descriptions of that operation became public in the summer of 2010, Iran announced the creation of its own Cyber Corps.

North Korea has had hackers for years, some of whom are believed to be operating from, or through, China. Neither North Korea nor Iran is as focused on stealing data as they are determined to destroy it, experts contend.

When hackers believed by American intelligence officials to be Iranians hit the world's largest oil producer, Saudi Aramco, last year, they did not just erase data on 30,000 Aramco computers; they replaced the data with an image of a burning American flag. In the assault on South Korea last week, some affected computers displayed an ominous image of skulls.

"This attack is as much a cyber-rampage as it is a cyberattack," Rob Rachwald, a research director at FireEye, a computer security firm, said of the South Korea attacks.

In the past, such assaults typically occurred through a denial-of-service attack, in which hackers flood their target with Web traffic from networks of infected computers until it is overwhelmed and shuts down. One such case was a 2007 Russian attack on Estonia that affected its banks, the Parliament, ministries, newspapers and broadcasters.

With their campaign against American financial institutions, the hackers suspected of being Iranian have taken that kind of attack to the next level. Instead of using individual personal computers to fire Web traffic at each bank, they infected powerful, commercial data centers with sophisticated malware and directed them to simultaneously fire at each bank, giving them the horsepower to inflict a huge attack.

As a result, the hackers were able to take down the consumer banking sites of American Express, JPMorgan Chase, Bank of America, Wells Fargo and other banks with exponentially more traffic than hit Estonia in 2007.

In the attack on Saudi Aramco last year, the culprits did not mount that type of assault. Instead, they created malware designed for the greatest impact, coded to spread to as many computers as possible.

Likewise, the attacks last week on South Korean banks and broadcasters were far more sophisticated than coordinated denial-of-service attacks in 2009 that briefly took down the Web sites of South Korea's president and its Defense Ministry. Such attacks were annoyances; they largely did not affect operations.

This time around in South Korea, however, the attackers engineered malware that could evade popular South Korean antivirus products, spread it to as many computer systems as possible, and inserted a "time bomb" to take out all the systems at once for greatest impact.

The biggest concern, Mr. Lewis said: "We don't know how they make decisions. When you add erratic decision making, then you really have something to worry about."

404 — South Korea says it was mistaken when it linked cyber-attacks to China

Oops. We thought it was in China, but now we see it's just another Korean IP address. What we mean is . . . and other bogus apologies. This from The Guardian.

 

South Korea says it was mistaken when it linked cyber-attacks to China

Internet security officials still believe attack that hit tens of thousands of computers at six companies was organised abroad

Members of the Korea Internet Security Agency at a briefing room in Seoul.

South Korean investigators say they were wrong when they identified a Chinese internet address as the origin of a cyber-attack that paralysed tens of thousands of computers at six South Korean companies this week. They still believe, however, that the attack originated from abroad.

Seoul's Korea Communications Commission said on Friday that an internet protocol address linked to Wednesday's attack actually belonged to a computer at one of the South Korean companies that was hit.

Commission officials say the IP address was used only for the company's internal network and was identical to a public Chinese address.

Investigators say an analysis of malware and servers indicates that the attack was likely to have been orchestrated from abroad. They did not elaborate.

Experts in Seoul suspect Pyongyang of orchestrating the attack. The investigation is likely to take weeks.

404 — Luring Young Web Warriors Is a U.S. Priority. It’s Also a Game . . . until someone gets hurt.

Another interesting and pleasantly surprising story by Nicole Perlroth of The New York Times. A fascinating portrait of how this nation is trying to shore up its cyber defenses.

If only H2o2 had been focused on helping the US instead of doing what he did on behalf of his foreign masters, he would still be alive . . . in my new novel, 404.

 

Luring Young Web Warriors Is a U.S. Priority. It’s Also a Game.

By NICOLE PERLROTH

Virginia high school students competed in a digital defense simulation at the Virginia Governor’s Cup Cyber Challenge at George Mason University.

WASHINGTON — In the eighth grade, Arlan Jaska figured out how to write a simple script that could switch his keyboard’s Caps Lock key on and off 6,000 times a minute. When friends weren’t looking, he slipped his program onto their computers. It was all fun and games until the program spread to his middle school.

“They called my parents and told my dad I was hacking their computers,” Mr. Jaska, 17 years old, recalled. He was grounded and got detention. And he is just the type the Department of Homeland Security is looking for.

The secretary of that agency, Janet Napolitano, knows she has a problem that will only worsen. Foreign hackers have been attacking her agency’s computer systems. They have also been busy trying to siphon the nation’s wealth and steal valuable trade secrets. And they have begun probing the nation’s infrastructure — the power grid, and water and transportation systems.

So she needs her own hackers — 600, the agency estimates. But potential recruits with the right skills have too often been heading for business, and those who do choose government work often go to the National Security Agency, where they work on offensive digital strategies. At Homeland Security, the emphasis is on keeping hackers out, or playing defense.

“We have to show them how cool and exciting this is,” said Ed Skoudis, one of the nation’s top computer security trainers. “And we have to show them that applying these skills to the public sector is important.”

One answer? Start young, and make it a game, even a contest.

This month, Mr. Jaska and his classmate Collin Berman took top spots at the Virginia Governor’s Cup Cyber Challenge, a veritable smackdown of hacking for high school students that was the brainchild of Alan Paller, a security expert, and others in the field.

With military exercises like NetWars, the competition had more the feel of a video game. Mr. Paller helped create the competition, the first in a series, to help Homeland Security, and likens the agency’s need for hackers to the shortage of fighter pilots during World War II.

The job calls for a certain maverick attitude. “I like to break things,” Mr. Berman, 18, said. “I always want to know, ‘How can I change this so it does something else?’ ”

It’s a far different pursuit — and a higher-minded one, enlightened hackers will say — than simply defacing Web sites.

“You want people who ask: How do things work? But the very best ones turn it around,” said Mr. Paller, director of research at the SANS Institute, a computer security training organization.

It’s no coincidence that the idea of using competitions came, in part, from China, where the People’s Liberation Army runs challenges every spring to identify its next generation of digital warriors.

Tan Dailin, a graduate student, won several of the events in 2005. Soon afterward he put his skills to work and was caught breaking into the Pentagon’s network and sending reams of documents back to servers in China.

“We have no program like that in the United States — nothing,” Mr. Paller said. “No one is even teaching this in schools. If we don’t solve this problem, we’re in trouble.”

At Northern Virginia’s acclaimed Thomas Jefferson High School for Science and Technology, which both Mr. Jaska and Mr. Berman attend, there are five computer science teachers, but none focused on security.

When eight students expressed interest in starting a security club, they had to persuade a Raytheon employee to meet with them once a week. (One idea for a name, the Hacking Club, didn’t last.

“We don’t want people who are going to go around defacing sites,” Mr. Berman said. They recently rebranded from the Cybersecurity Club to the Computer Security Club. The group dropped the “Cyber” because “it sounds like you’re trying to be cool but you’re not,” clarified Mr. Jaska.)

Mr. Jaska and Mr. Berman heard about the Virginia competition through their school. To qualify, they had to identify bad passwords and clean up security settings — a long way from a Caps Lock program.

Some 700 students from 110 Virginia high schools applied, but only 40, including Mr. Jaska and Mr. Berman, made the cut.

So, three weeks ago, the pair traveled to the Governor’s Cup Cyber Challenge at George Mason University.

There, they found something they rarely encounter in high school — a thriving community of like-minded teenagers, the best and brightest of a highly specialized task.

“For some of the kids, who tended to be a little bit loners, this was the first time they had a peer group,” Mr. Paller said. “They were having excited conversations about arcane technical issues — something they never get to do — and their parents exalted in it.”

The students faced the same five-level test that the military uses to test its own security experts. They earned points for cracking passwords, flagging vulnerabilities and breaking into a Web site administrator’s account where, had they changed any settings or defaced a site, they would have been eliminated. Their scores were displayed in real time on a leader board.

After several hours, the winners were announced. A third of the students had made it to Level 3 — a level that Rear Adm. Gib Godwin, chairman of the Governor’s Cup, said typically requires someone with seven to 10 years of experience to achieve. Mr. Jaska won, earning a $5,000 scholarship. Mr. Berman won $1,500 for third place.

The idea for such competitions is nothing new. For years, a hacking conference called DefCon has hosted games like Capture the Flag in which teams earn points for hacking into each other’s computers. The Air Force started a Cyber Patriot competition in which hackers defend against a “Red Team” trying to steal data. And the Defense Department has its own Digital Forensics Challenge. But none of these was meant for high school students.

“The goal is to create a continuum, similar to the way kids go to junior high, high school, college and get their Ph.D.,” Admiral Godwin said. “We want to create the same flow for kids in the cyber domain.”

This summer, Mr. Jaska is hoping to be an intern at Northrop Grumman. Mr. Berman is considering an internship at Homeland Security. But Ms. Napolitano still has some convincing to do.

But asked about their dream job, both said they wanted to work in the private sector. “The problem with going into the government is you’re going to make a lot less,” said Mr. Berman.

“Everything’s slower, there’s budget cuts and bureaucracy everywhere and you can’t talk about what you do,” Mr. Jaska added. “It just doesn’t seem like as much fun.”

404 — Big Data Is Opening Doors, but Maybe Too Many

It is imperative that we all pay attention to this issue . . . before our privacy is totally gone. Check out this story from The New York Times.

Corporate executives and privacy experts agree that the best way forward combines new rules and technology tools. But some privacy professionals say the approach in the recent forum report puts way too much faith in the tools and too little emphasis on strong rules, particularly in moving away from curbs on data collection.

Big Data Is Opening Doors, but Maybe Too Many

By STEVE LOHR

IN the 1960s, mainframe computers posed a significant technological challenge to common notions of privacy. That’s when the federal government started putting tax returns into those giant machines, and consumer credit bureaus began building databases containing the personal financial information of millions of Americans. Many people feared that the new computerized databanks would be put in the service of an intrusive corporate or government Big Brother.

“It really freaked people out,” says Daniel J. Weitzner, a former senior Internet policy official in the Obama administration. “The people who cared about privacy were every bit as worried as we are now.”

Along with fueling privacy concerns, of course, the mainframes helped prompt the growth and innovation that we have come to associate with the computer age. Today, many experts predict that the next wave will be driven by technologies that fly under the banner of Big Data — data including Web pages, browsing habits, sensor signals, smartphone location trails and genomic information, combined with clever software to make sense of it all.

Proponents of this new technology say it is allowing us to see and measure things as never before — much as the microscope allowed scientists to examine the mysteries of life at the cellular level. Big Data, they say, will open the door to making smarter decisions in every field from business and biology to public health and energy conservation.

“This data is a new asset,” says Alex Pentland, a computational social scientist and director of the Human Dynamics Lab at the M.I.T. “You want it to be liquid and to be used.”

But the latest leaps in data collection are raising new concern about infringements on privacy — an issue so crucial that it could trump all others and upset the Big Data bandwagon. Dr. Pentland is a champion of the Big Data vision and believes the future will be a data-driven society. Yet the surveillance possibilities of the technology, he acknowledges, could leave George Orwell in the dust.

The World Economic Forum published a report late last month that offered one path — one that leans heavily on technology to protect privacy. The report grew out of a series of workshops on privacy held over the last year, sponsored by the forum and attended by government officials and privacy advocates, as well as business executives. The corporate members, more than others, shaped the final document.

The report, “Unlocking the Value of Personal Data: From Collection to Usage,” recommends a major shift in the focus of regulation toward restricting the use of data. Curbs on the use of personal data, combined with new technological options, can give individuals control of their own information, according to the report, while permitting important data assets to flow relatively freely.

“There’s no bad data, only bad uses of data,” says Craig Mundie, a senior adviser at Microsoft, who worked on the position paper.

The report contains echoes of earlier times. The Fair Credit Reporting Act, passed in 1970, was the main response to the mainframe privacy challenge. The law permitted the collection of personal financial information by the credit bureaus, but restricted its use mainly to three areas: credit, insurance and employment.

The forum report suggests a future in which all collected data would be tagged with software code that included an individual’s preferences for how his or her data is used. All uses of data would have to be registered, and there would be penalties for violators. For example, one violation might be a smartphone application that stored more data than is necessary for a registered service like a smartphone game or a restaurant finder.

The corporate members of the forum say they recognize the need to address privacy concerns if useful data is going to keep flowing. George C. Halvorson, chief executive of Kaiser Permanente, the large health care provider, extols the benefits of its growing database on nine million patients, tracking treatments and outcomes to improve care, especially in managing costly chronic and debilitating conditions like heart disease, diabetes and depression. New smartphone applications, he says, promise further gains — for example, a person with a history of depression whose movement patterns slowed sharply would get a check-in call.

“We’re on the cusp of a golden age of medical science and care delivery,” Mr. Halvorson says. “But a privacy backlash could cripple progress.”

Corporate executives and privacy experts agree that the best way forward combines new rules and technology tools. But some privacy professionals say the approach in the recent forum report puts way too much faith in the tools and too little emphasis on strong rules, particularly in moving away from curbs on data collection.

“We do need use restrictions, but there is a real problem with getting rid of data collection restrictions,” says David C. Vladeck, a professor of law at Georgetown University. “And that’s where they are headed.”

“I don’t buy the argument that all data is innocuous until it’s used improperly,” adds Mr. Vladeck, former director of the Bureau of Consumer Protection at the Federal Trade Commission.

HE offers this example: Imagine spending a few hours looking online for information on deep fat fryers. You could be looking for a gift for a friend or researching a report for cooking school. But to a data miner, tracking your click stream, this hunt could be read as a telltale signal of an unhealthy habit — a data-based prediction that could make its way to a health insurer or potential employer.

Dr. Pentland, an academic adviser to the World Economic Forum’s initiatives on Big Data and personal data, agrees that limitations on data collection still make sense, as long as they are flexible and not a “sledgehammer that risks damaging the public good.”

He is leading a group at the M.I.T. Media Lab that is at the forefront of a number of personal data and privacy programs and real-world experiments. He espouses what he calls “a new deal on data” with three basic tenets: you have the right to possess your data, to control how it is used, and to destroy or distribute it as you see fit.

Personal data, Dr. Pentland says, is like modern money — digital packets that move around the planet, traveling rapidly but needing to be controlled. “You give it to a bank, but there’s only so many things the bank can do with it,” he says.

His M.I.T. group is developing tools for controlling, storing and auditing flows of personal data. Its data store is an open-source version, called openPDS. In theory, this kind of technology would undermine the role of data brokers and, perhaps, mitigate privacy risks. In the search for a deep fat fryer, for example, an audit trail should detect unauthorized use.

Dr. Pentland’s group is also collaborating with law experts, like Scott L. David of the University of Washington, to develop innovative contract rules for handling and exchanging data that insures privacy and security and minimizes risk.

The M.I.T. team is also working on living lab projects. One that began recently is in the region around Trento, Italy, in cooperation with Telecom Italia and Telefónica, the Spanish mobile carrier. About 100 young families with young children are participating. The goal is to study how much and what kind of information they share on smartphones with one another, and with social and medical services — and their privacy concerns.

“Like anything new,” Dr. Pentland says, “people make up just-so stories about Big Data, privacy and data sharing,” often based on their existing beliefs and personal bias. “We’re trying to test and learn,” he says.

404 — Computer Networks in South Korea Are Paralyzed in Cyberattacks

Yet another solid story from The New York Times by Choe Sang-Hun (with contributions from Nicole Perlroth, one of my favorite reporters on this topic, and David E. Sanger, another fine journalist). Now it appears the malware that struck South Korea on Wednesday has a name: DarkSeoul! (Fantasitc moniker!)

What these reporters don't tell you is that North Korea has been operating out of bases in China for years since the Internet connections in the Hermit Kingdom are so few and so easily identified. Indeed, according to Richard A. Clarke — who served as Bill Clinton's National Coordinator for Security, Infrastructure Protection, and Counterterrorism, and who is the co-author of the seminal work Cyber War — while North Korea hasn't invested much in their own IP infrastructure, they have invested heavily in taking down the infrastructure of other nations.

Based on the analyses of Clarke and other experts in the field, I would say the likeliest candidate responsible for Wednesday's attack of South Korea's infrastructure is probably the Korean People's Army (KPA) Unit 121, by far that nation's largest and, according to one former hacker who defected in 2004, best trained North Korean cyberwarfare unit. It specializes in disabling South Korea's military command, control, and — most notably — communications networks. They are probably working out of the Shanhai Hotel in Dandong, China (right across the river from North Korea), or in Sunyang, where North Korean agents have rented out several floors of the Myohyang Hotel. All told, North Korea has anywhere from 600 to 1,000 cyberwarfare agents acting in cells throughout the People's Republic of China. 

 

Computer Networks in South Korea Are Paralyzed in Cyberattacks

By CHOE SANG-HUN

SEOUL, South Korea — Computer networks running three major South Korean banks and the country’s two largest broadcasters were paralyzed Wednesday in attacks that some experts suspected originated in North Korea, which has consistently threatened to cripple its far richer neighbor.

The attacks, which left many South Koreans unable to withdraw money from A.T.M.’s and news broadcasting crews staring at blank computer screens, came as the North’s official Korean Central News Agency quoted the country’s leader, Kim Jong-un, as threatening to destroy government installations in the South, along with American bases in the Pacific.

Though American officials dismissed those threats, they also noted that the broadcasters hit by the virus had been cited by the North before as potential targets.

The Korea Communications Commission said Thursday that the disruption originated at an Internet provider address in China but that it was still not known who was responsible.

Many analysts in Seoul suspect that North Korean hackers honed their skills in China and were operating there. At a hacking conference here last year, Michael Sutton, the head of threat research at Zscaler, a security company, said a handful of hackers from China “were clearly very skilled, knowledgeable and were in touch with their counterparts and familiar with the scene in North Korea.”

But there has never been any evidence to back up some analysts’ speculation that they were collaborating with their Chinese counterparts. “I’ve never seen any real evidence that points to any exchanges between China and North Korea, ” said Adam Segal, a senior fellow who specializes in China and cyberconflict at the Council on Foreign Relations.

Depositors trying to use Shinhan Bank A.T.M.’s on Wednesday in Seoul, South Korea, while the bank’s networks were down. [NOTE: This same photo was used by the BBC yesterday in their coverage of this story. You'd think The New York Times could find something original. Hmmm. Shame on you, photo editor! ED]

The malware is called “DarkSeoul” in the computer world and was first identified about a year ago. It is intended to evade some of South Korea’s most popular antivirus products and to render computers unusable. In Wednesday’s strikes, the attackers made no effort to disguise the malware, leading some to question whether it came from a state sponsor — which tend to be more stealthy — or whether officials or hackers in North Korea were sending a specific, clear message: that they can reach into Seoul’s economic heart without blowing up South Korean warships or shelling South Korean islands.

North Korea was accused of using both those techniques in attacks over the past three years.

The cyberattacks Wednesday come just days after North Korea blamed South Korea and the United States for attacks on some of its Web sites. The North’s official Korean Central News Agency said last week that North Korea “will never remain a passive onlooker to the enemies’ cyberattacks that have reached a very grave phase as part of their moves to stifle it.”

The South Korean government cautioned that it was still too early to point the finger for Wednesday’s problems at the North, which has been threatening “pre-emptive nuclear attacks” and other, unspecified actions against its southern neighbor for conducting the military exercises with the United States this month and for supporting new American-led United Nations sanctions against the North.

“We cannot rule out the possibility of North Korean involvement, but we don’t want to jump to a conclusion,” said Kim Min-seok, a spokesman for the Defense Ministry.

The military raised its alert against cyberattacks, he added, and the Korea Communications Commission asked government agencies and businesses to triple the number of monitors for possible hacking attacks. South Korea’s new president, Park Geun-hye, instructed a civilian-government task force to investigate the disruptions.

It could take months to determine the true source of the attacks, and sometimes investigators never come to a firm conclusion. In 2009, a similar campaign of coordinated cyberattacks over the Fourth of July holiday hit 27 American and South Korean Web sites, including South Korea’s presidential palace, called the Blue House; its Defense Ministry; and Web sites belonging to the United States Treasury Department, the Secret Service and the Federal Trade Commission.

But those were all “distributed denial of service” attacks in which attackers flood the sites with traffic until they fall offline. While many suspected North Korea, a clear link to the country was never established.

South Korea’s two leading television stations, the publicly financed Korean Broadcasting System and MBC, maintained normal broadcasts but said their computers were frozen. The cable channel YTN reported a similar problem. The KBS Web site was shut down.

Shinhan Bank, the country’s fourth-largest lender, reported that its Internet banking servers had been temporarily blocked. Technicians restored operations, the government’s Financial Services Commission said in a statement.

Two other banks, NongHyup and Jeju, reported that operations at some of their branches had been paralyzed after computers were infected with viruses and their files erased, the commission said. After two hours, the banks’ operations returned to normal, they said. A fourth bank, Woori, reported a hacking attack, but said it had suffered no damage.

The Web site of the Washington-based Committee for Human Rights in North Korea was hacked by an entity calling itself “Hitman 007-Kingdom of Morocco,” which stole the committee’s publications and other documents, said its executive director, Greg Scarlatoiu.

He said he did not know whether the attack was linked to the disruptions in South Korea, but noted that it came a day before the United Nations Human Rights Council was to vote on the resolution calling for the establishment of an independent investigation of North Korean human rights abuses, including its running of prison gulags. The committee has been an active supporter of such an inquiry.

“This type of mishap is not to be unexpected, given the nature of our work,” Mr. Scarlatoiu said.

In testimony to Congress last year, Gen. James D. Thurman, the American commander in South Korea, described what he called North Korea’s “growing cyberwarfare capability.”

“North Korea employs sophisticated computer hackers trained to launch cyberinfiltration and cyberattacks” against South Korea and the United States, General Thurman said. “Such attacks are ideal for North Korea,” he added, “providing the regime a means to attack” South Korean and American businesses “without attribution.”

But security researchers and foreign policy experts say that North Korea faces significant hurdles. “They simply don’t have access to the same technology due to sanctions,” said Mr. Sutton, of Zscaler. “And a large portion of their population does not have ready access to the Internet, so they don’t have that natural pool of talent to recruit from.”

Lee Seong-won, an official at the communications commission, told reporters on Wednesday that the malicious code, once activated, disrupted the booting of computers. “It will take time for us to find out the identity and motive of those who were behind this attack,” he said.

The government investigators were also checking whether the images of skulls that reportedly popped up on some computer screens had anything to do with the virus attack.

In recent years, North Korea has vowed to attack South Korean television stations and newspapers for carrying articles critical of its government, even citing the map coordinates of their headquarters.

Nicole Perlroth contributed reporting from San Francisco, and David E. Sanger from Washington.

404 — South Korea network attack 'a computer virus'

What I find most interesting about this article from the BBC is that it claims recent attacks on South Korean infrastructure to be the result of a virus vs. a Distributed Denial of Service (DDoS) attack. For my non-techie readers, a DDoS attack happens when systems — like a bank's computers — go down as a result of too many server requests. This is usually accomplished by hackers hijacking thousands, or tens of thousands of computers without their owners knowing it, and these computers are programmed to "hit" target servers all at the same time, in essence overwhelming the servers. In this case, though, it was a virus that caused South Korea's problems. This represents a quantum leap in sophistication compared to, say, the recent attacks on American banks by Iran which were simple DDoS attacks. Then again, the North Korean cyber forces are much more sophisticated than their Iranian counterparts . . . although, given their alliance, I'm sure the North Koreans will soon be bringing the Iranians up to speed.

South Korea network attack 'a computer virus'

Services at two banks were hit by the incident, which began at around 14:00 local time

Disruption that paralysed the computer networks of broadcasters and banks in South Korea appears to have been caused by a virus, an official close to the investigation has told the BBC.

The official said it was believed a "malicious" code was to blame for the system failure.

He said investigators were trying to identify and analyse the virus.

Last week, North Korea accused the US and its allies of attacks on its internet servers.

In the latest incident, two South Korean banks, Shinhan Bank and Nonghyup, and three TV stations KBS, MBS and YTN, all reported that their networks had suddenly shut down on Wednesday afternoon.

The BBC's Lucy Williamson in Seoul says that, for one of the world's most networked populations, South Korea has had more than its share of cyber attacks.

North Korea has been blamed for several breaches over the past few years, she says.

Initially, South Korea's Communications Commission suspected a cyber-attack. However, the BBC was later told that experts had concluded it was not a denial-of-service attack, of the kind South Korea has experienced in the past.

'Skulls' on screens

Staff at the three broadcasters said their computers crashed and could not be restarted, with screens simply displaying an error message, although they have continued to make television broadcasts, our correspondent said.

There were also reports of skulls popping up on some computer screens, which could indicate that hackers had installed malicious code in the networks, the Korean Internet Security Agency said.

Some services at Shinhan bank, including internet banking and ATM machines, were also affected, although operations now appear to have been restored.

In the immediate aftermath of the incident, South Korean internet service provider LG Uplus said it believed its network had been hacked, Reuters news agency reported.

An official from the presidential office told Yonhap news agency it was not yet known whether North Korea was involved.

"We do not rule out the possibility of North Korea being involved, but it's premature to say so," Defence Ministry spokesman Kim Min-seok said.

Surveillance upgrade

No government-related computer networks had been affected, an official from the National Computing and Information Agency (NCIA) told the agency.

The military has upgraded its information surveillance status by one level, Yonhap said.

North Korea is believed to have been behind two major cyber attacks on the South, in 2009 and 2011, that targeted government agencies and financial firms.

Nonghyup bank was one of the victims of the 2011 attack, which left its customers unable to access or transfer their cash for three days.

North Korea has stepped up rhetoric in recent days in response to fresh UN sanctions over its nuclear test in February and joint annual military drills between the US and South Korea, which it bitterly opposes.

On 15 March, North Korea's KCNA news agency accused the US and its allies of "intensive and persistent" hacking attacks on its networks.

Official sites such as KCNA, Air Koryo and Rodong Sinmun, the party newspaper, were reportedly inaccessible for short periods.

404 — South Korea Banks and Broadcasters Hit by Possible Cyberattack

This most recent attack of South Korea's banking and communications infrastructure is yet another warning to the US and our allies about the need to shore up our cyber defenses. I am highly skeptical about reports that the alleged temporary shut-down of websites in Pyongyang last week was the result of South Korean or American cyberattacks. Frankly, we and our allies have little to gain from attacking a country which has very limited IP infrastructure, especially when we know that Pyongyang has invested heavily in its cyberforces and we — both South Korea and the US — are so much more vulnerable to attack.

As Mossad agent Ben Seiden says in my forthcoming novel 404, "The worst part about it is that while they (the North Koreans) train them (their cyber soldiers) to become experts at disrupting South Korean and American systems, we have no way to fight back.  They barely have an Internet infrastructure in North Korea.  Unlike us, they have nothing to take down.”

Check out this story from The New York Times.

North Korean leader Kim Jong Un

South Korea Banks and Broadcasters Hit by Possible Cyberattack

By CHOE SANG-HUN

SEOUL, South Korea — South Korea said Wednesday that it was investigating the possibility of a North Korean cyberattack after the computer networks of three broadcasters and three banks were paralyzed.

The government and military raised their vigilance against more possible disruptions. But they cautioned that it was still too early to point the finger at Pyongyang, which has been threatening ‘'pre-emptive nuclear attacks'’ and other, unspecified actions against its southern neighbor for conducting military exercises with the United States this month and for supporting new American-led United Nations sanctions against the North.

South Korea’s two leading television stations, KBS and MBC, maintained normal broadcasts but said their computers were frozen. The cable channel YTN reported a similar problem. The KBS Web site was shut down.

Shinhan Bank, the country’s fourth-largest lender, reported that its Internet banking servers had been blocked temporarily. Technicians restored operations, the government’s Financial Services Commission said in a statement.

Two other banks, NongHyup and Jeju, reported that operations at some of their branches had been paralyzed after computers were ‘'affected with virus and their files erased,'’ the commission said. After two hours, the banks’ operations returned to normal, they said. A fourth bank, Woori, reported a hacking attack, but said it had suffered no damage.

South Korea’s government, military and nuclear power plants reported no disruptions. But scenes of customers complaining at bank windows about their inability to use A.T.M.'s and live national broadcasts with experts who raised the possibility of North Korean cyberattacks reflected a simmering anxiety over North Korea, which recently declared that the 1953 armistice that halted the Korean War was not valid.

After an initial investigation, government experts found that a virus had penetrated the networks of the agencies, Lee Seong-won, an official at the Korea Communications Commission, said during a media briefing. Once activated, the malicious code disrupted the booting of computers.

“It will take time for us to find out the identity and motive of those who were behind this attack,” Mr. Lee said. The government investigators were also checking whether skulls that reportedly popped up on some computer screens had anything to do with the virus attack.

Kim Min-seok, a spokesman of the Defense Ministry, said, ‘'We cannot rule out the possibility of North Korean involvement, but we don’t want to jump to a conclusion.”

The military raised its alert against cyberattacks by one level, Mr. Kim said. The Korea Communications Commission also upgraded the country’s defense against cyberattacks, asking government agencies and businesses to triple the number of monitors for possible hacking attacks. President Park Geun-hye instructed a civilian-government task force to investigate the disruptions.

The simultaneous shutdowns came five days after North Korea blamed South Korea and the United States for cyberattacks that temporarily shut down Web sites in Pyongyang last week. In recent years, North Korea had also vowed to attack South Korean television stations and newspapers for carrying articles critical of its government, even citing the map coordinates of their headquarters.

North Korea said it suspected that South Korea and the United States had hacked its Web sites as part of the joint military exercises they have been conducting since early this month. North Korea ‘'will never remain a passive onlooker to the enemies’ cyberattacks that have reached a very grave phase as part of their moves to stifle it,'’ the North’s official Korean Central News Agency said Friday.

Concerns have been rising in South Korea over North Korean hackers who the South Korean authorities have said were trained to disrupt South Korea, one of the world’s most wired societies, where government operations and daily life depend greatly on its broadband Internet.

Even before the disruptions Wednesday, government officials and private analysts warned of possible hacking attempts from North Korea. Tensions remained high on the peninsula after the North conducted a nuclear test on Feb. 12 and the United Nations Security Council responded by imposing more sanctions.

North Korean hackers were suspected when the Web sites of government agencies and businesses were shut down in the past few years. In May, South Korea accused the North of jamming signals, forcing hundreds of commercial flights to switch off their global positioning systems.

Experts said it could take months to determine what happened. In January, after a six-month investigation, the South Korean police said North Korea had been behind a hacking attack that disrupted the computer network of the mass-circulation daily JoongAng Ilbo.

 

404 — Cyberattacks a Topic in Obama Call With New Chinese President

Not much of a story here, Nicole, but this was interesting:  “In any discussion with China, the U.S. needs to have three agenda items: One, cybersecurity; two, cybersecurity; and three, cybersecurity,” Mike Rogers, the Republican chairman of the House Intelligence Committee, said in an interview." Does this mean that when the President introduces new anti-hacking legislation (which he is going to do soon) to bolster the nation's cybersecurity, the Republicans won't carry water for the Chamber of Commerce and shoot it down — as Senator John McCain of Arizona did last year!

By NICOLE PERLROTH

Cyberthreats featured prominently in President Obama’s congratulatory call to the new Chinese president, Xi Jinping, on Thursday.

The president used the occasion to discuss the loss of United States intellectual property from cyberattacks. The mere mention of cyberthreats is a step forward for an administration that has been reluctant to confront Beijing on Chinese military attacks even as billions of dollars’ worth of trade secrets have been stolen.

But a spate of recent headlines about Chinese cyberattacks on The New York Times, The Washington Post, The Wall Street Journal and others have thrust the issue on the diplomatic stage.  A report by Mandiant, a computer security firm, tying hundreds of attacks back to one Chinese military unit, made the issue even harder to ignore.

Mr. Obama has been increasingly vocal about cyberthreats, but has not gone as far as to call out China by name. In his State of the Union address, he was careful to omit China when he said “we know foreign countries and companies swipe our corporate secrets.” And when the Obama administration sent the nation’s Internet providers a confidential list of Internet addresses tied to a hacking group that had stolen terabytes of data from American corporations, it failed to mention that every single address could be traced to the Chinese military cybercommand.

But privately, administration officials have said they plan to tell China’s new leaders that the volume and sophistication of Chinese cyberattacks have become so intense that they threaten the relationship between Washington and Beijing.

“In any discussion with China, the U.S. needs to have three agenda items: One, cybersecurity; two, cybersecurity; and three, cybersecurity,” Mike Rogers, the Republican chairman of the House Intelligence Committee, said in an interview.

China has long denied that it is responsible for cyberattacks on American companies and has said that it too is a victim of such attacks. And in discussions with American officials, Chinese representatives often refuse to discuss economic espionage.

“They say that the topic of economic espionage is ‘embarrassing’ for them,” said James A. Lewis, a cybersecurity expert at the Center for Strategic and International Studies, who has participated in such discussions. “They say, in the U.S. cyberwarriors are treated as heroes but those who participate in economic espionage are treated like criminals. In China, the line is not so clear.”

404 — Domestic Drones Stir Imaginations, and Concerns

Thank you, Senator Patrick Leahy of Vermont for, once again, being there to protect our privacy . . . this time about drones! Drones play an important role in my new novel, The Plague (or 404; you decide!).

As if I needed any more reasons to love the Green Mountain State — where I usually spend at least 2 weeks every summer, flyfishing and taking in the beauty . . . oh, yeah, and writing!

I loved the last two paragraphs of this piece from The New York Times. Priceless.

Domestic Drones Stir Imaginations, and Concerns

Andrew Regenhard and Meagan Kaiser, students at the University of North Dakota, with an unmanned plane and remote control.

By MATTHEW L. WALD

GRAND FORKS, N.D. - On the pilot's computer screen, planted at ground level a few yards from the airport runway here, the data streaming across the display tracked an airplane at 1,300 feet above a small city on the coast, making perfect circles at 150 miles per hour.

To the pilot's right, a sensor operator was aiming a camera on the plane to pan, tilt and zoom in a search among the houses on the ground for people who had been reported missing.

On his screen, cartoonlike human figures appeared in a gathering around a camp fire between the houses.

"There they are," Andrew Regenhard, the pilot and a student, said in a flat tone that seemed out of place with a successful rescue mission.

In fact, no one was missing; the entire exercise used imaginary props and locales. Mr. Regenhard was taking part in a training session at the University of North Dakota. The first to offer a degree program in unmanned aviation, the university is one of many academic settings, along with companies and individuals, preparing for a brave new world in which cheap remote-controlled airplanes will be ubiquitous in civilian air space, searching for everything from the most wanted of criminal suspects to a swarm of grasshoppers devouring a crop.

"The sky's going to be dark with these things," said Chris Anderson, the former editor of Wired, who started the hobbyist Web site DIY Drones and now runs a company, 3D Robotics, that sells unmanned aerial vehicles and equipment. He says it is selling about as many drones every calendar quarter - about 7,500 - as the United States military flies in total.

The burst of activity in remotely operated planes stems from the confluence of two factors: electronics and communications gear has become dirt cheap, enabling the conversion of hobbyist radio-controlled planes into sophisticated platforms for surveillance, and the Federal Aviation Administration has been ordered by Congress to work out a way to integrate these aircraft into the national airspace by 2015.

The rapidly expanding market has not gone unnoticed by lawmakers and privacy watchdogs. On Wednesday, the Senate Judiciary Committee will hold a hearing on the privacy implications of drones like the ones being developed at Grand Forks.

Senator Patrick Leahy, the Vermont Democrat who is chairman of the committee, said this year: "This fast-emerging technology is cheap and could pose a significant threat to the privacy and civil liberties of millions of Americans. It is another example of a fast-changing policy area on which we need to focus to make sure that modern technology is not used to erode Americans' right to privacy."

Some fans of the technology wince at the word "drone," which implies that there is no pilot. And they have grown resentful about the alarms raised over privacy issues, noting that a few city and state governments have begun banning drones even where they do not yet operate.

Tom K. Kenville, chairman of the North Dakota chapter of the trade association, Unmanned Applications Institute, International, said such bans would discourage technological progress. "I don't think we had rules for the road before we had roads," he said.

Back in the university lab, Rico Becker, a software developer with Corsair Engineering, which had written a program for the students, emphasized that the "missing persons" exercise was just one of many hypothetical missions that students would fly, and was purely theoretical. "We're not training pilots to spot people camping in their backyards," he said.

Aside from the missing persons mission, experts here outline a number of uses for the planes: "precision agriculture," with tiny planes inspecting crops several times a week for the first sign of blight or insect invasion; safety missions by semiautonomous flying machines that could cruise the two-mile length of a freight train and examine the air brakes on each car, far faster than a person could, and be available for accident assessment in case of derailment; inspection operations of pipelines or power lines, a job that is notoriously dangerous for helicopters, and scouting out fires or car crashes.

Volunteer fire departments in places like Grand Forks, Mr. Kenville said, would provide a clear market. An unmanned vehicle, he said, was "going to beat all the cars there," to determine the scope of a problem.

"If it's a chemical fire, it will tell us to stay away, or it's just some hay bales, drive slower," he said.

Remote control equipment might even displace some human pilots, in the cockpits of cargo planes.

"This is money," said Matthew L. Opsahl, in another part of the University of North Dakota simulation lab, at a work station where an operator could coordinate the activities of several remotely operated planes. One person could handle six cargo planes at a time, he said, or direct ground-based crews of several remotely operated planes that were scanning a large-scale event, like a spreading forest fire. The operator could compare the aerial images with those from Google maps, identifying street names and addresses to forward to a 911 call center.

Mr. Opsahl, a former pilot on a regional jet, is now an instructor in the North Dakota program, where Mr. Regenhard, 21, a junior from Prescott, Wis., has a double major in commercial aviation and in unmanned aerial systems. Mr. Regenhard is also building a six-rotor helicopter that will beam pictures back to the ground, one that might inspect rooftop air-conditioners or offer a bird's-eye view of a crime scene.

Equipped with a GPS sensor and a $220 autopilot, it can be programmed to fly to a sequence of coordinates, at various altitudes, much the way an airliner can. Or it can simply broadcast its position to a distant ground station, where an operator can use a computer keyboard and mouse, or a joystick, to direct it.

The unresolved question is how to avoid midair collisions, because the operator on the ground cannot see other traffic in the air. The F.A.A. plans to have a system ready by 2015 called "sense and avoid" in which each plane in the sky, manned or unmanned, uses GPS equipment to locate itself, and sends that information to a computer on the ground that draws a map showing all targets. The computer then rebroadcasts that map to every pilot in the air - or at a computer workstation on the ground, as the case may be.

The progress of electronics seems relentless. Mr. Anderson, of 3D Robotics, said that all the components in a drone - a fast processor, a good battery, a GPS receiver and microelectromechancial sensors - were present in an iPhone.

The rapid progress has driven a burst of commercial activity, along with a lot of anxiety. Mr. Regenhard was teamed up one recent afternoon with Mr. Becker, whose company had written a program that simulated a Cessna 182, a single-engine plane familiar to generations of student pilots, and was integrated with a variety of computer-drawn landscapes, some real, some artificial.

Among the software tricks, the terrain map on Mr. Regenhard's screen showed a moving red cone, like a searchlight, that was sometimes broad and sometimes a pinpoint, indicating the field of view through the camera controlled by Mr. Becker, giving the pilot a good idea of what the sensor operator was looking at, and thus how to direct the plane.

As demonstrated here, the technology seems whiz-bang but unthreatening. The unmanned aerial systems include a ground station, usually a laptop with some communications gear attached, and some of the flying vehicles weigh only a few pounds. Even many of the larger ones will fit into molded cases that go comfortably into the trunk of a car. Some take off when the operator throws them, like a javelin or a football; some of the larger ones are intended to be launched from a catapult that could sit in the bed of a pickup truck.

The field is embryonic. "We're in the Wilbur Wright years of the U.A.S. industry," said Bruce Gjovig, director of the Center for Innovation, a business incubator, at the University of North Dakota.

Benjamin M. Trapnell, an associate professor and a mainstay of the unmanned aircraft systems program here, one of only three nationwide to offer a bachelor's in the field, said the trick was not just in learning to fly such vehicles, but also in designing them, including the cameras or other sensors they could carry, and the ground stations from which they can be controlled.

The technology seems so flexible and promising that even some companies involved in conventional aviation are interested. For example, at Applebee Aviation, which flies 11 helicopters out of Banks, Ore., mostly to spray crops, Warren Howe, the sales manager, said a remotely piloted vehicle might never replace a conventional one for that purpose. In a drone, he said, "you're limited to looking with a camera; you wouldn't be able to see necessarily the wind changes that control drift, or a spotted owl or something, or beehives in a neighboring yard."

"You may not see that kid coming down the street to take a look because he thinks a helicopter is really cool," Mr. Howe said.

But at the same time, he said, his light helicopters cost $1,100 an hour to charter, and a lot of survey work could be done with a drone instead, mapping out what a manned helicopter would be needed for.

Mr. Anderson, in contrast, said that later this year, his company would introduce a helicopter for agricultural surveillance that would sell for less than $1,000. "That's not per hour, that's for the helicopter," he said.

404 — Is All The Talk About Cyberwarfare Just Hype?

I found this piece from NPR interesting. It contends that some feel the current hoopla about cyberattacks is over-blown — intentionally — in essence because, "we (the US) needed to hype the threat to get the country to move, on the theory that democracies don't do anything until they've had a disaster." Well, cyber expert James Lewis of the Center for Strategic and International Studies may be right about that one. Sometimes it does take a lot to move us. And, while it is highly unlikely that we'll see a major cyberattack (as in cyberwarfare) from Russia or China, one can't say the same thing about the Iranians. They've already hacked Saudi's Aramco, plus a host of US banks. And they are learning fast. And then, of course, there are those pesky North Koreans. For more on that, check out my new novel, The Plague (or 404; you decide!), when it comes out.

Director of National Intelligence James Clapper says the danger of a devastating cyberattack is the No. 1 threat facing the U.S. He made the assessment Tuesday on Capitol Hill before the Senate Intelligence Committee hearing on worldwide threats.

Is All The Talk About Cyberwarfare Just Hype?

U.S. government pronouncements about the danger of a major cyberattack can be confusing. The director of national intelligence, James Clapper, and the head of the U.S. military's Cyber Command, Army Gen. Keith Alexander, delivered mixed messages this week while testifying on Capitol Hill.

Clapper told the Senate Intelligence Committee that the prospect of a computer attack on the nation's critical infrastructure is now the top security threat facing the country, surpassing terrorism.

"It's hard to overestimate its significance," Clapper said.

In a separate appearance before the Senate Armed Services Committee, Alexander issued a similar warning.

"All our systems today — our power systems, our water systems, our governments, our industry — depend on computers, depend on computerized switches, depend on these networks," Alexander said. "All are at risk. If an adversary were to get in, they could essentially destroy those components."

Asked by Republican Sen. Lindsey Graham whether such an intrusion would cause as much or more damage than the attacks of Sept. 11, 2001, Alexander answered, "That's correct. I think it would."

The Clapper and Alexander testimonies, however, were worded carefully. Clapper, in an assessment representing the views of the entire U.S. intelligence community, characterized the chance of a major cyberattack against U.S. infrastructure in the next two years as "remote."

"The level of technical expertise and operational sophistication required for such an attack will be out of reach for most actors during this time frame," the assessment stated. "Advanced cyber actors — such as Russia and China — are unlikely to launch such a devastating attack against the United States outside of a military conflict or crisis that they believe threatens their vital interests."

Alexander was similarly reassuring in his written testimony.

"We feel confident that foreign leaders believe that a devastating attack on the critical infrastructure and population of the United States by cyber means would be correctly traced back to its source and elicit a prompt and proportionate response," Alexander said. "We [therefore] have some confidence in our ability to deter major state-on-state attacks in cyberspace."

So what about a cyber-9/11, or a "cyber-Pearl Harbor," the scenario envisioned in an October 2012 speech by then-U.S. Defense Secretary Leon Panetta? Is the scare talk just hype?

Cyber expert James Lewis of the Center for Strategic and International Studies says he put that question recently to what he calls "one of the leading hypers" of the cyberthreat.

"I said, 'Oh, come on, you know it's not going to be Pearl Harbor,' " Lewis says. "And he said, 'Yeah.' But he wants people to pay attention. And nobody is doing anything."

Cybersecurity experts in both industry and government say the country is unprepared to deal with computer threats.

"So there are some folks out there who have believed we needed to hype the threat to get the country to move, on the theory that democracies don't do anything until they've had a disaster," Lewis notes. "He's probably right, but I think it has been overhyped."

The immediate security problem is cybercrime and cyberespionage, not cyberwar. President Obama's national security adviser, Tom Donilon, this week accused computer hackers from China of stealing confidential business information and technology.

"Increasingly, U.S. businesses are speaking out about their serious concerns about sophisticated, targeted theft through cyber-intrusions emanating from China on a very large scale," Donilon said.

Industry and government leaders say the everyday theft of trade secrets is undermining the U.S. economy. Beyond that is the danger that some country, in the future, might be tempted to launch a major cyberattack that could knock out portions of the U.S. power grid or paralyze the financial system. It is unlikely now, but some up-and-coming cyber powers are a cause for concern. Among them is Iran, suspected of carrying out a recent attack against the state oil company in Saudi Arabia.

"One thing most of us didn't expect was the Iranians [going] from zero to 60 in about eight months," Lewis notes. "China, Russia, these are responsible countries. They're not going to start a war. How comfortable do you feel saying that about the Iranian Revolutionary Guard?"

At this point, even the leaders of Iran may see little reason to spark a major cyber-confrontation with the United States. Their calculation, however, could change at some point, considering the current hostility between the two countries.

404 — Obama Discusses Computer Security With Corporate Chiefs

What I find incredible is how this issue has become so politicized. It's hard to believe that a Democratic President should be so much more strident about our national security than, say, Republican Senator John McCain of Arizona, who was the one who spearheaded the defeat of Obama's "tough" anti-hacking legislation last year on behalf of the Chamber of Commerce. McCain is all for villifying the President re Libya and Ambassador Stevens under the guise of national security, but he buckles under Chamber of Commerce pressure. Check out this story from The New York Times.

Obama Discusses Computer Security With Corporate Chiefs

By MICHAEL D. SHEAR and NICOLE PERLROTH

WASHINGTON – President Obama met with an invited group of 13 chief executives at the White House on Wednesday to discuss growing concerns about cybersecurity and enlist them to get behind his proposed legislation to combat the threat of computer warfare and corporate espionage.

Among those present were Rex W. Tillerson of Exxon Mobil, Randall L. Stephenson of AT&T, Wesley G. Bush of Northrop Grumman, Brian T. Moynihan of Bank of America, and Jamie Dimon of JPMorgan Chase, which had been attacked by foreign hackers as recently as Tuesday.

White House officials said the meeting in the White House Situation Room was intended as a “two way” information exchange. Aides said Mr. Obama wanted to hear directly from industry leaders about how vulnerable their companies were to computer attacks. The president also wanted to discuss efforts the government was taking to address threats.

“He has seen as various corporations and business leaders have gone public with their concerns about cybersecurity and the effects of breaches of cybersecurity on their operations,” said Jay Carney, the White House press secretary.

In recent weeks, Apple, Twitter, Facebook, The Washington Post, The Wall Street Journal and The New York Times have all stepped forward to say that their computer systems had been attacked. And since September, online banking sites of several American banks have been intermittently pulled offline by attacks that officials say originated in Iran.

But the president is also looking to drum up public support as he makes a renewed push for legislation that would give the administration new technological tools and broader authority in the battle against computer attacks by foreign governments. The president’s previous bill was killed by a Republican filibuster last year after intensive lobbying by the United States Chamber of Commerce and other business groups, which argued that the legislation would prove onerous.

“He also wants to convey to them how seriously he takes this issue and what he believes the right steps are moving forward,” Mr. Carney said. “And he certainly hopes that out of this meeting and the many others he has on this topic, that we will build the kind of consensus necessary to compel Congress to take appropriate action.”

The meeting Wednesday, which also included chief executives from American Electric Power, Xerox, Marathon Oil, Honeywell, United Parcel Service, ITT Exelis, Siemens and Frontier Communications, was just the latest step in the administration’s campaign to persuade Congress to pass a computer security bill.

In recent months, several senior administration officials — including Janet Napolitano, the secretary of homeland security; Robert S. Mueller III, the director of the Federal Bureau of Investigation; and Gen. Martin E. Dempsey, the chairman of the Joint Chiefs of Staff — have provided closed-door briefings to members of Congress about the threat.

As a stopgap measure, the president signed an executive order last month that promotes increased the sharing of information between the government and private companies.

The president has also been making his case directly to the public in speeches and media appearances in recent months. In his State of the Union speech, Mr. Obama spent more time on the topic of computer attacks than he did on North Korea and Iran combined.

In an interview on ABC News broadcast on Wednesday, Mr. Obama was careful to avoid saying that the United States is engaged in a computer war with China. He said officials need to “be careful with war analogies” in discussions about the topics.

But the president said that billions of dollars are lost when industrial secrets were stolen online. And he said that some of the attacks on the nation’s private and public computer networks were sponsored by foreign governments.

“Our companies are put into competitive disadvantage. You know, there are disruptions to our systems that, you know, involve everything from our financial systems to some of our infrastructure,” Mr. Obama said. “And this is why I’ve taken some very aggressive executive actions. But we need Congress to act.”

He said that the government was limited in what it could do to confront China and other sponsors of computer attacks. And he said the government needed the authority to require that critical infrastructure in the country is hardened against such attacks.

“There are ways that we can harden our critical infrastructure, our financial sector,” Mr. Obama said. “And the only thing that’s holding us back from doing that right now is we haven’t gotten the legislative authority out of Congress. They need to get this done.”

404 — Security Leader Says U.S. Would Retaliate Against Cyberattacks

For the first time ever, General Alexander (who runs Cyber Command) admits he's creating teams to ATTACK our enemies, rather than simply for defensive purposes. Anyone who thinks that these teams are new is frighteningly naive. We have had "offensive" teams for some time now. Who do you think built Stuxnet (in tandem with our Israeli friends)? Check out this New York Times article whose title should have read:  "For the first time, US admits to building offensive cyber teams."

Security Leader Says U.S. Would Retaliate Against Cyberattacks

By MARK MAZZETTI and DAVID E. SANGER

WASHINGTON - The chief of the military's newly created Cyber Command told Congress on Tuesday that he is establishing 13 teams of programmers and computer experts who could carry out offensive cyberattacks on foreign nations if the United States were hit with a major attack on its own networks, the first time the Obama administration has publicly admitted to developing such weapons for use in wartime.

"I would like to be clear that this team, this defend-the-nation team, is not a defensive team," Gen. Keith Alexander, who runs both the National Security Agency and the new Cyber Command, told the House Armed Services Committee. "This is an offensive team that the Defense Department would use to defend the nation if it were attacked in cyberspace. Thirteen of the teams that we're creating are for that mission alone."

General Alexander's testimony came on the same day the nation's top intelligence official, James R. Clapper Jr., warned Congress that a major cyberattack on the United States could cripple the country's infrastructure and economy, and suggested that such attacks now pose the most dangerous immediate threat to the United States, even more pressing than an attack by global terrorist networks.

On Monday, Thomas E. Donilon, the national security adviser, demanded that Chinese authorities investigate such attacks and enter talks about new rules governing behavior in cyberspace.

General Alexander has been a major architect of the American strategy on this issue, but until Tuesday he almost always talked about it in defensive terms. He has usually deflected questions about America's offensive capability, and turned them into discussions of how to defend against mounting computer espionage from China and Russia, and the possibility of crippling attacks on utilities, cellphone networks and other infrastructure. He was also a crucial player in the one major computer attack the United States is known to have sponsored in recent years, aimed at Iran's nuclear enrichment plants. He did not discuss that highly classified operation during his open testimony.

Mr. Clapper, the director of national intelligence, told the Senate Intelligence Committee that American spy agencies saw only a "remote chance" in the next two years of a major computer attack on the United States, which he defined as an operation that "would result in long-term, wide-scale disruption of services, such as a regional power outage."

Mr. Clapper appeared with the heads of several other intelligence agencies, including Lt. Gen. Michael T. Flynn of the Defense Intelligence Agency, the F.B.I. director Robert S. Mueller III, and the C.I.A. director John O. Brennan, to present their annual assessment of the threats facing the nation. It was the first time that Mr. Clapper listed cyberattacks first in his presentation to Congress, and the rare occasion since the Sept. 11, 2001, attacks that intelligence officials did not list international terrorism first in the catalog of dangers facing the United States.

"In some cases," Mr. Clapper said in his testimony, "the world is applying digital technologies faster than our ability to understand the security implications and mitigate potential risks." He said it was unlikely that Russia and China would launch "devastating" cyberattacks against the United States in the near future, but he said foreign spy services had already hacked the computer networks of government agencies, businesses and private companies.

Two specific attacks Mr. Clapper listed, an August 2012 attack against the Saudi oil company Aramco and attacks on American banks and stock exchanges last year, are believed by American intelligence officials to have been the work of Iran.

General Alexander picked up on the same themes in his testimony, saying that he was adding 40 cyber teams, 13 focused on offense and 27 on training and surveillance. When pressed, he said that the best defense hinged on being able to monitor incoming traffic to the United States through private "Internet service providers," which could alert the government, in the milliseconds that electronic messages move, about potentially dangerous attacks. Such surveillance is bound to raise more debate with privacy advocates, who fear government monitoring of the origin and the addressing data on most e-mail messages and other computer exchanges.

Traditional threats occupied much of Mr. Clapper's testimony. American intelligence officials are giving new emphasis to the danger posed by North Korea's nuclear weapons and missile programs, which are said for the first time to "pose a serious threat to the United States" as well as to its East Asian neighbors. North Korea, which recently made a series of belligerent statements after its third nuclear test, has displayed an intercontinental missile that can be moved by road and in December launched a satellite atop a Taepodong-2 launch vehicle, Mr. Clapper's prepared statement noted.

"The rhetoric, while it is propaganda laced, is also an indicator of their attitude and perhaps their intent," Mr. Clapper said during one exchange with a lawmaker, adding that he was concerned that North Korea "could initiate a provocative action against the South."

In his discussion of terrorism, Mr. Clapper noted that while Al Qaeda's core in Pakistan "is probably unable to carry out complex, large-scale attacks in the West," spinoffs still posed a threat. Listed first is the affiliate in Yemen, Al Qaeda in the Arabian Peninsula, which Mr. Clapper said had retained its goal of attacks on United States soil, but he also noted militant groups in six other countries that still threaten local violence.

Mr. Clapper began his remarks by criticizing policy makers for the current budget impasse, saying that the budget cuts known as sequestration will force American spy agencies to make sharp reductions in classified programs and to furlough employees. The classified intelligence budget has ballooned over the past decade, and Mr. Clapper compared the current round of cuts to the period during the 1990s when the end of the cold war led to drastic reductions in the C.I.A.'s budget.

"Unlike more directly observable sequestration impacts, like shorter hours at public parks or longer security lines at airports, the degradation of intelligence will be insidious," Mr. Clapper said. "It will be gradual and almost invisible unless and until, of course, we have an intelligence failure."

The threat hearing is the only scheduled occasion each year when the spy chiefs present open testimony to Congress about the dangers facing the United States, and Mr. Clapper did not hide the fact that he is opposed to the annual ritual. President Obama devoted part of his State of the Union address to a pledge of greater transparency with the Congress and the American public, but Mr. Clapper, a 71-year-old retired Air Force general, made it clear that he saw few benefits of more public disclosure.

"An open hearing on intelligence matters is something of a contradiction in terms," he said.

Scott Shane contributed reporting.

404 — U.S. Demands China Block Cyberattacks and Agree to Rules . . . or else!

President Obama’s national security adviser, Tom Donilon, is the first senior White House official to publicly confront China over cyberespionage, and comes two days after China's foreign minister, Yang Jiechi, rejected a growing body of evidence that his country’s military was involved in cyberattacks on American corporations and some government agencies.

History in the making. Are we at odds with the Chinese? Or, is there another entity at work here? Read The Plague (404) to find out. And check out this story from The New York Times.

 

U.S. Demands China Block Cyberattacks and Agree to Rules

By MARK LANDLER and DAVID E. SANGER

WASHINGTON — The White House demanded Monday that the Chinese government stop the widespread theft of data from American computer networks and agree to “acceptable norms of behavior in cyberspace.”

The demand, made in a speech by President Obama’s national security adviser, Tom Donilon, was the first public confrontation with China over cyberespionage and came two days after its foreign minister, Yang Jiechi, rejected a growing body of evidence that his country’s military was involved in cyberattacks on American corporations and some government agencies.

The White House, Mr. Donilon said, is seeking three things from Beijing: public recognition of the urgency of the problem; a commitment to crack down on hackers in China; and an agreement to take part in a dialogue to establish global standards.

“Increasingly, U.S. businesses are speaking out about their serious concerns about sophisticated, targeted theft of confidential business information and proprietary technologies through cyberintrusions emanating from China on an unprecedented scale,” Mr. Donilon said in a wide-ranging address to the Asia Society in New York.

“The international community,” he added, “cannot tolerate such activity from any country.”

In Beijing, a spokeswoman for the Chinese Foreign Ministry, Hua Chunying, did not directly say whether the government is willing to negotiate over the proposals spelled out by Mr. Donilon. But at a daily news briefing Tuesday she repeated the government’s position that it opposes Internet attacks and wants “constructive dialogue” with the United States and other countries about cybersecurity issues.

Until now, the White House has steered clear of mentioning China by name when discussing cybercrime, though Mr. Obama and other officials have raised it privately with Chinese counterparts. In his State of the Union address, he said, “We know foreign countries and companies swipe our corporate secrets.”

But as evidence has emerged suggesting the People’s Liberation Army is linked to hacking, the China connection has become harder for the administration not to confront head-on. The New York Times three weeks ago published evidence tying one of the most active of the Chinese groups to a neighborhood in Shanghai that is headquarters to a major cyberunit of the People’s Liberation Army. That account, based in large part on unclassified work done by Mandiant, a security firm, echoed the findings of intelligence agencies that have been tracking the Chinese attackers.

American officials say raising the issue with the Chinese is a delicate balancing act at a time when the United States is seeking China’s cooperation in containing North Korea’s nuclear and missile programs, and joining in sanctions on Iran. Yet they have been expressing their concerns about cyberattacks with Chinese officials for years. Starting in 2010, they invited P.L.A. officials to discuss the issue — a process that has only just started — and last November, Mr. Obama broached the subject at a summit meeting with Prime Minister Wen Jiabao, a senior administration official said.

Since then, the official said, there has been a “perfect storm” of media coverage and protests from the corporate world. Still, he said, Mr. Donilon chose not to mention the P.L.A. in his speech because he did not want to engage in finger-pointing.

“What we are hoping to do,” another senior official said, “is force the Chinese civilian leadership to realize that the P.L.A. is interfering with their foreign policy.”

The Chinese have insisted that they are the victims of cyberattacks, not the perpetrators. On Saturday, the Chinese foreign minister, Yang Jiechi, issued his own call for “rules and cooperation” on cybersecurity and said reports of Chinese military involvement in cyberattacks were “built on shaky ground.”

“Anyone who tries to fabricate or piece together a sensational story to serve a political motive will not be able to blacken the name of others nor whitewash themselves,” Mr. Yang told reporters at the National People’s Congress, which was preparing to ratify the ascension ofXi Jinpingto the Chinese presidency.

Mr. Donilon said the threats to cybersecurity had moved to the forefront of American concerns with China, noting that he was not “talking about ordinary cybercrime or hacking.”

That distinction, a senior administration official said, was meant to separate the theft of intellectual property by Chinese state entities from small-scale hacking by individuals, or the use of cyberweapons by a state to protect its national security. But the distinction between cyberattacks aimed at intellectual property theft and those aimed at disabling a military threat is largely made by Western officials devising legal arguments, not one the Chinese have embraced.

Even as he emphasized the need for international rules to guide cyberactivity, Mr. Donilon made no reference to the billions of dollars the American military and intelligence agencies are spending to develop an arsenal of offensive cyberweapons — to be used against military targets, officials insist, not economic ones. The most famous of these operations was the covert cyberattack mounted by the United States and Israel to disable the centrifuges that Iran uses to enrich uranium at its site in Natanz.

Mr. Donilon sketched out a vigorous agenda in Asia, insisting the United States would keep pursuing its “strategic pivot” toward the region, despite cuts in military spending. He announced that the Treasury Department would impose sanctions on a North Korean bank specializing in foreign-exchange transactions — ratcheting up the pressure on the North Korean government on the day that Pyongyang announced it would no longer abide by the 1953 armistice that halted the Korean War.

With fears about North Korea’s increased nuclear and missile capabilities causing considerable anxiety in Seoul and Tokyo, Mr. Donilon restated a “declaratory policy” that was first formulated by President George W. Bush after the North’s first nuclear test, in 2006. He warned that the United States would reserve the option to retaliate against the North, not just if it used nuclear weapons but if it allowed the “transfer of nuclear weapons or nuclear materials to other states or nonstate entities.”

That formulation did not appear to cover, however, the transfer of technology to build nuclear facilities, as North Korea did in Syria. That reactor was destroyed by Israel in 2007.

“It’s understandable that the people of South Korea would be concerned about the threat they face from the North,” Mr. Donilon said, apparently alluding to talk in the South of building the country’s own nuclear arsenal, a move the United States halted decades ago. Mr. Donilon added that the United States had assets in place “to insure that South Korea’s defense is provided for.”

Chris Buckley contributed reporting from Hong Kong.

404 — The Drone Question Obama Hasn't Answered

I have to say that I found this OP-ED Piece in The New York Times to be mostly hysterical nonsense, jinned up to play upon people's fears. We have a lot to be concerned about, but our own President targeting US citizens on American soil is not one of them . . . or is it?

Check out THE PLAGUE (404), now being edited and coming our soon.

OP-ED CONTRIBUTOR - THE NEW YORK TIMES

The Drone Question Obama Hasn't Answered

By RYAN GOODMAN

THE Senate confirmed John O. Brennan as director of the Central Intelligence Agency on Thursday after a nearly 13-hour filibuster by the libertarian senator Rand Paul, who before the vote received a somewhat odd letter from the attorney general.

"It has come to my attention that you have now asked an additional question: 'Does the President have the authority to use a weaponized drone to kill an American not engaged in combat on American soil?' " the attorney general, Eric H. Holder Jr., wrote to Mr. Paul. "The answer to that question is no."

The senator, whose filibuster had become a social-media sensation, elating Tea Party members, human-rights groups and pacifists alike, said he was "quite happy with the answer." But Mr. Holder's letter raises more questions than it answers - and, indeed, more important and more serious questions than the senator posed.

What, exactly, does the Obama administration mean by "engaged in combat"? The extraordinary secrecy of this White House makes the answer difficult to know. We have some clues, and they are troubling.

If you put together the pieces of publicly available information, it seems that the Obama administration, like the Bush administration before it, has acted with an overly broad definition of what it means to be engaged in combat. Back in 2004, the Pentagon released a list of the types of people it was holding at Guantánamo Bay as "enemy combatants" - a list that included people who were "involved in terrorist financing."

One could argue that that definition applied solely to prolonged detention, not to targeting for a drone strike. But who's to say if the administration believes in such a distinction?

American generals in Afghanistan said the laws of war "have been interpreted to allow" American forces to include "drug traffickers with proven links to the insurgency on a kill list," according to a report released in 2009 by the Senate Foreign Relations Committee, then led by John Kerry, now the secretary of state.

The report went on to say that there were about 50 major traffickers "who contribute funds to the insurgency on the target list." The Pentagon later said that it was "important to clarify that we are targeting terrorists with links to the drug trade, rather than targeting drug traffickers with links to terrorism."

That statement, however, was not very clarifying, and did not seem to appease NATO allies who raised serious legal concerns about the American targeting program. The explanation soon gave way to more clues, and this time it was not simply a question of who had been placed on a list.

In a 2010 Fox News interview, under pressure to explain whether the Obama administration was any closer to capturing or killing Osama bin Laden, Mr. Kerry's predecessor, Hillary Rodham Clinton, said that "we have gotten closer because we have been able to kill a number of their trainers, their operational people, their financiers." That revelation - killing financiers - appears not to have been noticed very widely.

As I have written, sweeping financiers into the group of people who can be killed in armed conflict stretches the laws of war beyond recognition. But this is not the only stretch the Obama administration seems to have made. The administration still hasn't disavowed its stance, disclosed last May in a New York Times article, that military-age males killed in a strike zone are counted as combatants absent explicit posthumous evidence proving otherwise.

Mr. Holder's one-word answer - "no" - is not a step toward the greater transparency that President Obama pledged when he came into office, but has not delivered, in the realm of national security.

By declining to specify what it means to be "engaged in combat," the letter does not foreclose the possible scenario - however hypothetical - of a military drone strike, against a United States citizen, on American soil. It also raises anew questions about the standards the administration has used in deciding to use drone strikes to kill Americans suspected of terrorist involvement overseas - notably Anwar al-Awlaki, the American-born cleric who was killed in a drone strike in Yemen in 2011.

Is there any reason to believe that military drones will soon be hovering over Manhattan, aiming to kill Americans believed to be involved in terrorist financing? No.

But is it well past time for the United States government to specify, precisely, its views on whom it thinks it can kill in the struggle against Al Qaeda and other terrorist forces? The answer is yes.

The Obama administration's continued refusal to do so should alarm any American concerned about the constitutional right of our citizens - no matter what evil they may or may not be engaged in - to due process under the law. For those Americans, Mr. Holder's seemingly simple but maddeningly vague letter offers no reassurance.

Ryan Goodman is a professor of law and co-chairman of the Center for Human Rights and Global Justice at New York University.

404 — Visions of Drones Swarming U.S. Skies Hit Bipartisan Nerve

According to this piece in The New York Times, Benjamin Wittes, a national security scholar at the Brookings Institution who has written extensively about drones, said he thought Mr. Paul's marathon was a "dumb publicity stunt." But he said it had touched a national nerve because the technology, with its myriad implications, had already deeply penetrated the culture.

Is this why a drone strike against an American right here in the United States plays such a key role in my forthcoming novel, The Plague (404)?

 

Senator Rand Paul at the Capitol on Thursday, 12 hours after ending his marathon filibuster on drone policy.

Visions of Drones Swarming U.S. Skies Hit Bipartisan Nerve

By SCOTT SHANE and MICHAEL D. SHEAR

WASHINGTON - The debate goes to the heart of a deeply rooted American suspicion about the government, the military and the surveillance state: the specter of drones streaking through the skies above American cities and towns, controlled by faceless bureaucrats and equipped to spy or kill.

That Big Brother imagery - conjured up by Senator Rand Paul of Kentucky during a more than 12-hour filibuster this week - has animated a surprisingly diverse swath of political interests that includes mainstream civil liberties groups, Republican and Democratic lawmakers, conservative research groups, liberal activists and right-wing conspiracy theorists.

They agree on little else. But Mr. Paul's soliloquy has tapped into a common anxiety on the left and the right about the dangers of unchecked government. And it has exposed fears about ultra-advanced technologies that are fueled by the increasingly fine line between science fiction and real life.

Drones have become the subject of urgent policy debates in Washington as lawmakers from both parties wrangle with President Obama over their use to prosecute the fight against terrorism from the skies above countries like Pakistan and Yemen.

But they are also a part of the popular culture - toys sold by Amazon; central plot points in "Homeland" and a dozen other television shows and movies; the subject of endless macabre humor, notably by The Onion; and even the subject of poetry. ("Ode to the MQ-9 Reaper," a serious work by the Brooklyn poet Joe Pan that was just published in the journal Epiphany, describes the drone as "ultra-cool & promo slick, a predatory dart" that is "as self-aware as silverware.")

Benjamin Wittes, a national security scholar at the Brookings Institution who has written extensively about drones, said he thought Mr. Paul's marathon was a "dumb publicity stunt." But he said it had touched a national nerve because the technology, with its myriad implications, had already deeply penetrated the culture.

"Over the last year or so, this thing that was the province of a small number of technologists and national security people has exploded into the larger public consciousness," Mr. Wittes said.

On the right, Mr. Paul has become an overnight hero since his filibuster. Self-proclaimed defenders of the Constitution have shouted their approval on Twitter, using the hashtag #StandWithRand and declaring him to be a welcomed member of their less-is-better-government club.

"The day that Rand Paul ignited Liberty's Torch inside the beltway!" one Tea Party activist wrote on Twitter. "May it never be extinguished!"

But even as the right swooned, the left did, too. Senator Ron Wyden of Oregon - the only Democrat to join Mr. Paul's filibuster - said the unexpected array of political forces was just the beginning, especially as Congress and the public face the new technologies of 21st-century warfare.

"I believe there is a new political movement emerging in this country that's shaking free of party moorings," Mr. Wyden said. "Americans want a better balance between protecting our security and protecting our liberty."

P. W. Singer, whose 2009 book "Wired for War: The Robotics Revolution and Conflict in the 21st Century" anticipated the broad impact of drones, said he believed they had shaken up politics because they were "a revolutionary technology, like the steam engine or the computer."

"The discussion doesn't fall along the usual partisan lines," he said. The dozen states that have passed laws restricting drones do not fall into conventional red-blue divisions, nor do the score of states competing to be the site of the Federal Aviation Administration's test sites for drones.

The serious issues raised by the government's lethal drones seem inextricably mixed with the ubiquitous appearance of the technology in art, commerce and satire.

A four-minute video by the Air Force Research Laboratory on "micro aerial vehicles" shows a futuristic bee-size drone flying in an open window and taking out an enemy sniper with a miniature explosive payload. Since it was posted in 2009, it has been viewed hundreds of thousands of times and reposted all over the Web.

When Amazon advertised a six-inch model of the Predator, made by Maisto, in its toy section, people wrote politically charged mock reviews that became Internet hits: "This goes well," one reviewer wrote, "with the Maisto Extraordinary Rendition playset, by the way - which gives you all the tools you need to kidnap the family pet and take him for interrogation at a neighbor's house, where the rules of the Geneva Convention may not apply. Loads of fun!"

Senator John McCain, Republican of Arizona, was not laughing Thursday when he took to the Senate floor to chastise Mr. Paul and defend the use of drones. In an interview with The Huffington Post, Mr. McCain dismissed Mr. Paul and the other critics of drones as "the wacko birds on right and left that get the media megaphone."

But the issue is larger than Mr. Paul, whose ambitions may include a run for the presidency in 2016. For many, Mr. Paul gave voice to the dangers they whisper about to anyone who will listen: that the government is too powerful to be left unchecked.

"It's not merely the black helicopter crowd of the folks on the far right," said Mark Potok, a senior fellow at the Southern Poverty Law Center, which tracks extremist groups. "What Rand Paul had to say about drones absolutely fired up conspiracy theorists on the left as well as the right."

Human Rights Watch plans to join other groups next month in starting an effort called the Campaign to Stop Killer Robots. The technology, fully autonomous weapons that are still at the drawing-board stage, would find and fire at their programmed targets without requiring a human being to pull the trigger.

Some national security experts find the campaign overwrought, but Mary Wareham, the advocacy director for the arms division of Human Rights Watch, noted that the Defense Department in November issued a policy directive on autonomous weapons that recognized the challenges they pose.

At the same time, there are people like Everett Wilkinson, a Tea Party organizer and self-proclaimed conspiracy theorist in Florida, who is hailing Mr. Paul as a "rock star for the Constitution." On Mr. Wilkinson's Web site, Liberty.com, he warns that the United States government is building "internment camps" for political dissidents. He is wary of what comes next.

"First they said we are just going to use drones to observe stuff, and then they put Hellfire missiles on them," Mr. Wilkinson said. "How soon are we going to have drones overhead with Tasers on them?"

In Washington, Code Pink, a leftist group of antiwar activists, showed up with flowers and chocolates at Mr. Paul's Senate offices on Thursday to thank him for standing up against abuses of power. Known around Capitol Hill mainly for disrupting Congressional hearings, the group had found a new champion.

"People say: 'Oh, my God, Code Pink is praising Rand Paul. Hell has frozen over!' " said Medea Benjamin, a co-founder of the group. "But we were glued to C-Span to the bitter end of the filibuster. We were amazed to see the education of the public that was taking place, and that has never occurred before."

404 — A Senator's Stand on Drones Scrambles Partisan Lines

While I don't find myself in accord with Senator Rand Paul very often, I consider his concern about this Administration's drone program to be refreshingly passionate, as reported by The New York Times. These days, to get any politician to do anything that might mark him or her as soft on terrorism is usually enough to muzzle them completely. But not Paul:  Love him or hate him, he certainly calls it as he sees it. Of course, it's the corporate behemoth we should be concerned about, the one that has the rights of a person today, thanks to Chief Justice Stevens and Citizens United.

Senator John McCain, right, on Thursday with Senator Rand Paul, whom he had accused of "disservice" with his drone criticism.

A Senator's Stand on Drones Scrambles Partisan Lines

By RICHARD W. STEVENSON and ASHLEY PARKER

WASHINGTON - Senator Rand Paul's intention was to highlight his misgivings about how drones are used. He ended up enmeshing his fellow Republicans in a broader debate over national security that scrambled the politics of left and right.

After invoking and being embraced by civil-liberties-minded liberals during a 13-hour filibuster starting Wednesday on the Senate floor, Mr. Paul, of Kentucky, was showered with praise on Thursday by both the Tea Party movement and the provocateurs of the peace group Code Pink. Senator Mitch McConnell of Kentucky, the Republican minority leader, praised Mr. Paul's conviction.

Mr. Paul, a libertarian in the mold of his father, former Representative Ron Paul, pointedly questioned whether the government had the authority to kill an American citizen in the United States with a drone strike - an effort that generated a tremendous following on social media.

But he was assailed by two of his party's most prominent national security hawks, Senators John McCain of Arizona and Lindsey Graham of South Carolina. They took to the floor on Thursday to defend President Obama's aggressive use of drones against Al Qaeda and its affiliates and to suggest that Mr. Paul and his backers had engaged in scaremongering.

"We've done, I think, a disservice to a lot of Americans by making them think that somehow they're in danger from their government," Mr. McCain said. "They're not. But we are in danger from a dedicated, longstanding, easily replaceable-leadership enemy that is hellbent on our destruction." [No, Senator McCain, we're in danger because of Chamber of Commerce toadies like you who prevented the President last year from enacting measures that would have made it more difficult for cyber terrorists to cripple or destroy vital American infrastructure like power plants and gas lines! ED]

Mr. Paul won particular support from two other Tea Party-backed Republicans, Senators Ted Cruz of Texas and Mike Lee of Utah. The three spelled one another during the filibuster on Wednesday afternoon and evening, drawing in part from a huge positive response on Twitter to their efforts.

But with Tea Party supporters having demonstrated the ability to mount primary challenges to incumbents they consider insufficiently conservative, an array of other Republican senators showed up on the Senate floor late Wednesday night to support Mr. Paul's filibuster.

They included Mr. McConnell, who has been moving vigorously to shut down chatter about a potential primary challenge to his re-election campaign next year, and Senator Marco Rubio, who has drawn some Tea Party criticism for his openness to an immigration overhaul that would give illegal immigrants a chance at gaining citizenship.

As Republicans went at one another and White House officials watched in amusement, the administration directly answered the question at the heart of Mr. Paul's filibuster. No, Attorney General Eric H. Holder Jr. said in a letter Thursday to Mr. Paul, the president does not have the authority to use a drone to kill a United States citizen on American soil who is not engaged in combat.

Mr. Holder did not say how the president would determine who is an enemy combatant. And he did not back off his statement on Wednesday that the president has the authority to pursue military action inside the United States in extraordinary circumstances, an assertion that helped set off Mr. Paul's filibuster.

Late Thursday afternoon, the Senate went on to address what Mr. Paul had been seeking to delay with his filibuster, the confirmation of John O. Brennan as director of the Central Intelligence Agency. After Democrats threatened to keep in the Senate in session through the weekend to deal with the confirmation, Republicans allowed a quick vote and Mr. Brennan was approved, 63 to 34.

Among those voting in favor of Mr. Brennan was Mr. Graham, who had earlier indicated that he might vote no but said Thursday that he would support the nomination to send a signal that he backs the drone program.

By the time the Senate adjourned for the weekend, a Republican Party that had long assailed Mr. Obama as a leader who would turn a war on terrorism into a police action with Miranda rights for suspects had shown itself to be sharply divided over whether the president had instead grabbed too much power and was risking violating the Constitution in his efforts to keep the nation safe.

"The question of whether the United States government can kill a U.S. citizen on U.S. soil when that individual does not pose an imminent threat of death or grievous bodily harm is a fundamental issue of liberty," Mr. Cruz said. "It is an issue of enforcing the explicit language of our Constitution."

While the events of the day brought into sharp relief the strains within the various components of the conservative movement, they also highlighted bipartisan unease in Congress over Mr. Obama's policy of keeping information about the drone program tightly held.  

In particular, the events suggested that both ends of the ideological spectrum were intent on drawing the administration into a more public discussion of its legal rationale for its use of drones - including in one case to kill an American citizen, Anwar al-Awlaki, the radical cleric and Qaeda planner, in Yemen - and questions about due process for terrorism suspects targeted by the United States.

Among the no votes on the Brennan nomination was Senator Patrick J. Leahy, Democrat of Vermont and chairman of the Judiciary Committee. He has been pressing the White House to release memos to the committee setting out the administration's legal rationale for drone strikes against American citizens, but so far the White House has provided the memos only to the Intelligence Committee.

"There is a prospect for a libertarian-right, progressive-left coalition on transparency issues," said Robert M. Chesney, a law professor at the University of Texas.

Best known in foreign policy circles until now for being on the losing end of 90-to-1 Senate vote last year on Iran policy, Mr. Paul emerged as a voice of populists on the right who are concerned about what they see as an unchecked national security state that too often becomes overinvolved in the rest of the world.

While he has sought to distance himself somewhat from the explicitly isolationist and antiwar stances of his father, Mr. Paul still reflects deep suspicion among libertarians and Tea Party supporters about global entanglements. He has expressed skepticism about foreign aid and the need for overseas military bases, opposes American involvement in Syria and has sought more restrictions on the powers of presidents to wage war.

"There's a healthy debate in the Republican caucus," Mr. Paul said when asked about divisions in the party and criticism by Mr. McCain and Mr. Graham. "People are starting to understand that that just by calling someone an enemy combatant doesn't make them an enemy combatant. Someone has to assess their guilt or innocence, and it's a pretty important question."

404 — As Hacking Against U.S. Rises, Experts Try to Pin Down Motive

Sometimes when you get hit in the face, it's hard to know why. If it's in the street, chances are it's for money, or because you shot off your big mouth once again. Wrong place, wrong time. But, if it's down a dark corridor, it might be something altogether different.

US security experts try and figure out why foreign governments are hacking us. From puppies to Saudi Aramco, this article from The New York Times goes far afield yet always asking the same old question, "How come?"

In my view, most of the system-hijacking code has been placed in our systems already, our "critical infrastructure" — like time bombs, waiting for Iran and China to get pissed off enough to do something devastating.

As Hacking Against U.S. Rises, Experts Try to Pin Down Motive

By NICOLE PERLROTH, DAVID E. SANGER and MICHAEL S. SCHMIDT

SAN FRANCISCO — When Telvent, a company that monitors more than half the oil and gas pipelines in North America, discovered last September that the Chinese had hacked into its computer systems, it immediately shut down remote access to its clients’ systems.

Company officials and American intelligence agencies then grappled with a fundamental question: Why had the Chinese done it?

Was the People’s Liberation Army, which is suspected of being behind the hacking group, trying to plant bugs into the system so they could cut off energy supplies and shut down the power grid if the United States and China ever confronted each other in the Pacific? Or were the Chinese hackers just trolling for industrial secrets, trying to rip off the technology and pass it along to China’s own energy companies?

“We are still trying to figure it out,” a senior American intelligence official said last week. “They could have been doing both.”

Telvent, which also watches utilities and water treatment plants, ultimately managed to keep the hackers from breaking into its clients’ computers.

At a moment when corporate America is caught between what it sees as two different nightmares — preventing a crippling attack that brings down America’s most critical systems, and preventing Congress from mandating that the private sector spend billions of dollars protecting against that risk — the Telvent experience resonates as a study in ambiguity.

To some it is prime evidence of the threat that President Obama highlighted in his State of the Union address, when he warned that “our enemies are also seeking the ability to sabotage our power grid, our financial institutions, our air traffic control systems,” perhaps causing mass casualties. Mr. Obama called anew for legislation to protect critical infrastructure, which was killed last year by a Republican filibuster after intensive lobbying by the Chamber of Commerce and other business groups.

But the security breach of Telvent, which the Chinese government has denied, also raises questions of whether those fears — the subject of weekly research group reports, testimony and Congressional studies — may be somewhat overblown, or whether the precise nature of the threat has been misunderstood.

American intelligence officials believe that the greater danger to the nation’s infrastructure may not even be China, but Iran, because of its avowal to retaliate for the Stuxnet virus created by the United States and Israel and unleashed on one of its nuclear sites. But for now, these officials say, that threat is limited by gaps in Iranian technical skills.

There is no doubt that attacks of all kinds are on the rise. The Department of Homeland Security has been responding to intrusions on oil pipelines and electric power organizations at “an alarming rate,” according to an agency report last December. Some 198 attacks on the nation’s critical infrastructure systems were reported to the agency last year, a 52 percent increase from the number of attacks in 2011.

Researchers at McAfee, a security firm, discovered in 2011 that five multinational oil and gas companies had been attacked by Chinese hackers. The researchers suspected that the Chinese hacking campaign, which they called Night Dragon, had affected more than a dozen companies in the energy industry. More recently, the Department of Energy confirmed in January that its network had been infiltrated, though it has said little about what damage, if any, was done.

But security researchers say that the majority of those attacks were as ambiguous as the Telvent case. They appeared to be more about cyberespionage, intended to bolster the Chinese economy. If the goal was to blow up a pipeline or take down the United States power grid, the attacks would likely have been of a different nature.

In a recent report, Critical Intelligence, an Idaho Falls security company, said that several cyberattacks by “Chinese adversaries” against North American energy firms seemed intended to steal fracking technologies, reflecting fears by the Chinese government that the shale energy revolution will tip the global energy balance back in America’s favor. “These facts are likely a significant motivation behind the wave of sophisticated attacks affecting firms that operate innatural gas, as well as industries that rely on natural gas as an input, including petrochemicals and steelmaking,” the Critical Intelligence report said, adding that the attack on Telvent, and “numerous” North American pipeline operators may be related.

American intelligence experts believe that the primary reason China is deterred from conducting an attack on infrastructure in the United States is the simple economic fact that anything that hurts America’s financial markets or transportation systems would also have consequences for its own economy. It could interrupt exports to Walmart and threaten the value of China’s investments in the United States — which now include a new, big investment in oil and gas.

Iran, however, may be a different threat. While acknowledging that “China is stealing our intellectual property at a rate that qualifies as an epidemic,” Representative Mike Rogers, the Michigan Republican who chairs the House Intelligence Committee, added a caveat in an interview on Friday. “China is a rational actor,” he said. “Iran is not a rational actor.”

A new National Intelligence Estimate — a classified document that has not yet been published within the government, but copies of which are circulating for final comments — identifies Iran as one of the other actors besides China who would benefit from the ability to shut down parts of the American economy. Unlike the Chinese, the Iranians have no investments in the United States. As a senior American military official put it, “There’s nothing but upside for them to go after American infrastructure.”

While the skills of Iran’s newly created “cybercorps” are in doubt, Iranian hackers gained some respect in the technology community when they brought down 30,000 computers belonging to Saudi Aramco, the world’s largest oil producer, last August, replacing their contents with an image of a burning American flag.

The attack did not affect production facilities or refineries, but it made its point.

“The main target in this attack was to stop the flow of oil and gas to local and international markets and thank God they were not able to achieve their goals,” Abdullah al-Saadan, Aramco’s vice president for corporate planning, told Al Ekhbariya television.

President Obama has been vague about how the United States would respond to such an attack. No one in the administration argues that the United States should respond with cyber- or physical retaliation for the theft of secrets. Attorney General Eric H. Holder Jr. has made clear that would be dealt with in criminal courts, though the prosecutions of cybertheft by foreign sources have been few.

But the question of whether the president could, or should, order military retaliation for major attacks that threaten the American public is a roiling debate.

“Some have called for authorizing the military to defend private corporate networks and critical infrastructure sectors, like gas pipelines and water systems,” Candace Yu, who studies the issue for the Truman National Security Project, wrote recently. “This is unrealistic. The military has neither the specialized expertise nor the capacity to do this; it needs to address only the most urgent threats.”

But the administration has failed to convince Congress that the first line of defense to avert catastrophic cyberattack is to require private industry — which controls the cellphone networks and financial and power systems that are the primary target of infrastructure attacks — that it must build robust defenses.

A bill containing such requirements was defeated last year amid intense lobbying from the United States Chamber of Commerce and others, which argued that the costs would be prohibitive. Leading members of Congress say they expect the issue will come up again in the next few months.

“We are in a race against time,” Michael Chertoff, the former secretary of homeland security, said last week. “Most of the infrastructure is in private hands. The government is not going to be able to manage this like the air traffic control system. We’re going to have to enlist a large number of independent actors.”

The administration’s cybersecurity legislation last year failed despite closed-door simulations for lawmakers about what a catastrophic attack would look like.

During one such simulation that the Department of Homeland Security allowed a New York Times reporter to view at a department facility in Virginia, a woman played the role of an “evil hacker” who successfully broke into a power plant’s network. To get in, the hacker used a method called “spearphishing,” in which she sent a message to a power plant employee that induced the employee to click on a link to see pictures of “cute puppies.”

When the employee clicked on the link, it surreptitiously allowed the hacker to gain access to the employee’s computer, enabling her to easily turn the switches to the plant’s breakers on and off.

Although the officials providing the briefing acknowledged that the simulation was a bit simplistic, their message was clear: with so many vulnerable critical infrastructure systems across the country, such an attack could easily occur, with huge consequences. No one rules out that scenario — whatever the current motivations and abilities of countries like China and Iran.

“There are 12 countries developing offensive cyberweapons; Iran is one of them,” James Lewis, a former government official and cybersecurity expert at the Center for Strategic and International Studies in Washington, said at a security conference in San Francisco. Those countries have a long way to go, he said, but added: “Like nuclear weapons, eventually they’ll get there.”

Nicole Perlroth and Michael S. Schmidt reported from San Francisco, and David E. Sanger from Washington.

THE PLAGUE — Justices Turn Back Challenge to Broader U.S. Eavesdropping . . . once again eroding the Bill of Rights

The issues recently debated by the Supreme Court in this landmark decision are at the core of my new novel The Plague (404). In our post-9/11 world, how do we, as a nation, strike a balance between freedom/privacy and security?

“Because the covenant forming the commonwealth results from subjects giving to the sovereign the right to act for them, the sovereign cannot possibly breach the covenant,” said Thomas Hobbes in his Leviathan. Further, “The sovereign exists because the majority has consented to his rule; the minority have agreed to abide by this arrangement and must then assent to the sovereign's actions. (And, finally,) every subject is author of the acts of the sovereign: hence the sovereign cannot injure any of his subjects and cannot be accused of injustice.”

We get the government we deserve. As James Bamford has so elegantly described in both The Shadow Factory and The Puzzle Palace, our constitutionally protected rights of freedom and privacy have not only eroded since 9/11, but they are basically illusory today. Any American who is deemed to be a threat to this government (and I include the current Administration here, and not just the Bush Administration) can be spied upon without recourse or even knowledge of intrusion . . . all in the name of national security. So, I ask you, what distinguishes us from other tyrannies around the world? Even our vaunted fourth estate, the last watchdog, is under attack by new digital economic forces and crowd-sourcing of the news.

Ben Franklin said, “They who can give up essential liberty to obtain a little temporary safety, deserve neither liberty nor safety.” We would do well to heed Stephane Hessel (on the eve of his death) who urged us all to understand this is a Time for Outrage . . . not silence. 

Assocaite Supreme Court Justice Samuel "Not true" Alito, Jr. was nominated by President G.W. Bush, and has served on the court since January 31, 2006.

Justices Turn Back Challenge to Broader U.S. Eavesdropping

By ADAM LIPTAK

WASHINGTON — The Supreme Court on Tuesday turned back a challenge to a federal law that broadened the government’s power to eavesdrop on international phone calls and e-mails.

The decision, by a 5-to-4 vote that divided along ideological lines, probably means the Supreme Court will never rule on the constitutionality of that 2008 law.

More broadly, the ruling illustrated how hard it is to mount court challenges to a wide array of antiterrorism measures, including renditions of terrorism suspects to foreign countries and targeted killings using drones, in light of the combination of government secrecy and judicial doctrines limiting access to the courts.

“Absent a radical sea change from the courts, or more likely intervention from the Congress, the coffin is slamming shut on the ability of private citizens and civil liberties groups to challenge government counterterrorism policies, with the possible exception of Guantánamo,” said Stephen I. Vladeck, a law professor at American University.

Writing for the majority, Justice Samuel A. Alito Jr. said that the journalists, lawyers and human rights advocates who challenged the constitutionality of the law could not show they had been harmed by it and so lacked standing to sue. The plaintiffs’ fear that they would be subject to surveillance in the future was too speculative to establish standing, he wrote.

Justice Alito also rejected arguments based on the steps the plaintiffs had taken to escape surveillance, including traveling to meet sources and clients in person rather than talking to them over the phone or sending e-mails. “They cannot manufacture standing by incurring costs in anticipation of nonimminent harms,” he wrote of the plaintiffs.

It is of no moment, Justice Alito wrote, that only the government knows for sure whether the plaintiffs’ communications have been intercepted. It is the plaintiffs’ burden, he wrote, to prove they have standing “by pointing to specific facts, not the government’s burden to disprove standing by revealing details of its surveillance priorities.”

In dissent, Justice Stephen G. Breyer wrote that the harm claimed by the plaintiffs was not speculative. “Indeed,” he wrote, “it is as likely to take place as are most future events that common-sense inference and ordinary knowledge of human nature tell us will happen.”

Under the system of warrantless surveillance that was put in place by the Bush administration shortly after the terrorist attacks of Sept. 11, 2001, aspects of which remain secret, the National Security Agency was authorized to monitor Americans’ international phone calls and e-mails without a warrant.

After The New York Times disclosed the program in 2005 and questions were raised about its constitutionality, Congress in 2008 amended the Foreign Intelligence Surveillance Act, granting broad power to the executive branch to conduct surveillance aimed at persons overseas without an individual warrant.

The Obama administration defended the law in court, and a Justice Department spokesman said the government was “obviously pleased with the ruling.”

The decision, Clapper v. Amnesty International, No. 11-1025, arose from a challenge to the 2008 law by Amnesty International, the American Civil Liberties Union and other groups and individuals, including journalists and lawyers who represent prisoners held at Guantánamo Bay, Cuba. The plaintiffs said the law violated their rights under the Fourth Amendment, which bars unreasonable searches, by allowing the government to intercept their international telephone calls and e-mails.

Justice Alito said the program was subject to significant safeguards, including supervision by the Foreign Intelligence Surveillance Court, which meets in secret, and restrictions on what may be done with “nonpublic information about unconsenting U.S. persons.” Chief Justice John G. Roberts Jr. and Justices Antonin Scalia, Anthony M. Kennedy and Clarence Thomas joined the majority opinion, and Justices Ruth Bader Ginsburg, Sonia Sotomayor and Elena Kagan joined the dissent.

Jameel Jaffer, a lawyer with the A.C.L.U., said the decision “insulates the statute from meaningful judicial review and leaves Americans’ privacy rights to the mercy of the political branches.”

Justice Alito wrote that the prospect that no court may ever review the surveillance program was irrelevant to analyzing whether the plaintiffs had standing. But he added that the secret court does supervise the surveillance program.

It is also at least theoretically possible, he added, that the government will try to use information gathered from the program in an ordinary criminal prosecution and thus perhaps allow an argument “for a claim of standing on the part of the attorney” for the defendant.

Mr. Jaffer said the situations were far-fetched.

“Justice Alito’s opinion for the court seems to be based on the theory that the secret court may one day, in some as-yet unimagined case, subject the law to constitutional review, but that day may never come,” Mr. Jaffer said. In many national security cases, he added, the government has prevailed at the outset by citing lack of standing, the state secrets doctrine or officials’ immunity from suit.

“More than a decade after 9/11,” he said, “we still have no judicial ruling on the lawfulness of torture, of extraordinary rendition, of targeted killings or of the warrantless wiretapping program. These programs were all contested in the public sphere, but they have not been contested in the courts.”

James Risen and Charlie Savage contributed reporting.

THE PLAGUE — A New Cold War, in Cyberspace, Tests U.S. Ties to China

It is gratifying to see this country finally waking up to what has been a constant barrage of cyber-attacks from nation states like China, Russia and Iran. Yes, we are at war, and have been for years.

So far, it is true, the attacks have resulted mostly in the loss of intellectual property; they steal data, sometimes very private data — from manufacturing secrets (including from major defense contractors), to the names of Chinese dissidents (news sources stolen from The New York Times), to the formulae of drugs and soft drinks! But let us be clear: They also have the capacity to do major harm to the systems they penetrate, and, just because they haven't destroyed anything so far (such as vital infrastructure, including gas pipelines, FAA systems and nuclear power plant systems), it doesn't mean they can't or won't in the future.

Many of this country's vital infrastructure systems are currently riddled with code that can be activated remotely to cause major damage. The good news is that China recognizes that to do real damage (vs. just stealing our intellectual property), to go beyond the current "rules of engagement" would probably precipitate a significant counter-attack by the U.S. and, perhaps, lead to a real shooting war.

Check out this article from The New York Times, and also this video interview with Kevin Mandia, of Mandiant, the private cyber-security firm that busted APT1 (Advanced Persistent Threat #1), also known as 61398, the cyber unit of China's People's Liberation Army (PLA) out of Shanghai responsible for many attacks over the past few years.

A building that houses a Chinese military unit on the outskirts of Shanghai, believed to be the source of hacking attacks.

A New Cold War, in Cyberspace, Tests U.S. Ties to China

By DAVID E. SANGER

WASHINGTON — When the Obama administration circulated to the nation’s Internet providers last week a lengthy confidential list of computer addresses linked to a hacking group that has stolen terabytes of data from American corporations, it left out one crucial fact: that nearly every one of the digital addresses could be traced to the neighborhood in Shanghai that is headquarters to the Chinese military’s cybercommand.

That deliberate omission underscored the heightened sensitivities inside the Obama administration over just how directly to confront China’s untested new leadership over the hacking issue, as the administration escalates demands that China halt the state-sponsored attacks that Beijing insists it is not mounting.

The issue illustrates how different the worsening cyber-cold war between the world’s two largest economies is from the more familiar superpower conflicts of past decades — in some ways less dangerous, in others more complex and pernicious.

Administration officials say they are now more willing than before to call out the Chinese directly — as Attorney General Eric H. Holder Jr. did last week in announcing a new strategy to combat theft of intellectual property. But President Obama avoided mentioning China by name — or Russia or Iran, the other two countries the president worries most about — when he declared in his State of the Union address that “we know foreign countries and companies swipe our corporate secrets.” He added: “Now our enemies are also seeking the ability to sabotage our power grid, our financial institutions and our air traffic control systems.”

Defining “enemies” in this case is not always an easy task. China is not an outright foe of the United States, the way the Soviet Union once was; rather, China is both an economic competitor and a crucial supplier and customer. The two countries traded $425 billion in goods last year, and China remains, despite many diplomatic tensions, a critical financier of American debt. As Hillary Rodham Clinton put it to Australia’s prime minister in 2009 on her way to visit China for the first time as secretary of state, “How do you deal toughly with your banker?”

In the case of the evidence that the People’s Liberation Army is probably the force behind “Comment Crew,” the biggest of roughly 20 hacking groups that American intelligence agencies follow, the answer is that the United States is being highly circumspect. Administration officials were perfectly happy to have Mandiant, a private security firm, issue the report tracing the cyberattacks to the door of China’s cybercommand; American officials said privately that they had no problems with Mandiant’s conclusions, but they did not want to say so on the record.

That explains why China went unmentioned as the location of the suspect servers in the warning to Internet providers. “We were told that directly embarrassing the Chinese would backfire,” one intelligence official said. “It would only make them more defensive, and more nationalistic.”

That view is beginning to change, though. On the ABC News program “This Week” on Sunday, Representative Mike Rogers, Republican of Michigan and chairman of the House Intelligence Committee, was asked whether he believed that the Chinese military and civilian government were behind the economic espionage. “Beyond a shadow of a doubt,” he replied.

In the next few months, American officials say, there will be many private warnings delivered by Washington to Chinese leaders, including Xi Jinping, who will soon assume China’s presidency. Both Tom Donilon, the national security adviser, and Mrs. Clinton’s successor, John Kerry, have trips to China in the offing. Those private conversations are expected to make a case that the sheer size and sophistication of the attacks over the past few years threaten to erode support for China among the country’s biggest allies in Washington, the American business community.

“America’s biggest global firms have been ballast in the relationship” with China, said Kurt M. Campbell, who recently resigned as assistant secretary of state for East Asia to start a consulting firm, the Asia Group, to manage the prickly commercial relationships. “And now they are the ones telling the Chinese that these pernicious attacks are undermining what has been built up over decades.”

It is too early to tell whether that appeal to China’s self-interest is getting through. Similar arguments have been tried before, yet when one of China’s most senior military leaders visited the Joint Chiefs of Staff at the Pentagon in May 2011, he said he didn’t know much about cyberweapons — and said the P.L.A. does not use them. In that regard, he sounded a bit like the Obama administration, which has never discussed America’s own cyberarsenal.

Yet the P.LA.’s attacks are largely at commercial targets. It has an interest in trade secrets like aerospace designs and wind-energy product schematics: the army is deeply invested in Chinese industry and is always seeking a competitive advantage. And so far the attacks have been cost-free.

American officials say that must change. But the prescriptions for what to do vary greatly — from calm negotiation to economic sanctions and talk of counterattacks led by the American military’s Cyber Command, the unit that was deeply involved in the American and Israeli cyberattacks on Iran’s nuclear enrichment plants.

“The problem so far is that we have rhetoric and we have Cyber Command, and not much in between,” said Chris Johnson, a 20-year veteran of the C.I.A. team that analyzed the Chinese leadership. “That’s what makes this so difficult. It’s easy for the Chinese to deny it’s happening, to say it’s someone else, and no one wants the U.S. government launching counterattacks.”

That marks another major difference from the dynamic of the American-Soviet nuclear rivalry. In cold war days, deterrence was straightforward: any attack would result in a devastating counterattack, at a human cost so horrific that neither side pulled the trigger, even during close calls like the Cuban missile crisis.

But cyberattacks are another matter. The vast majority have taken the form of criminal theft, not destruction. It often takes weeks or months to pin down where an attack originated, because attacks are generally routed through computer servers elsewhere to obscure their source. A series of attacks on The New York Times that originated in China, for example, was mounted through the computer systems of unwitting American universities. That is why David Rothkopf, the author of books about the National Security Council, wrote last week that this was a “cool war,” not only because of the remote nature of the attacks but because “it can be conducted indefinitely — permanently, even — without triggering a shooting war. At least, that is the theory.”

Administration officials like Robert Hormats, the under secretary of state for business and economic affairs, say the key to success in combating cyberattacks is to emphasize to the Chinese authorities that the attacks will harm their hopes for economic growth. “We have to make it clear,” Mr. Hormats said, “that the Chinese are not going to get what they desire,” which he said was “investment from the cream of our technology companies, unless they quickly get this problem under control.”

But Mr. Rogers of the Intelligence Committee argues for a more confrontational approach, including “indicting bad actors” and denying visas to anyone believed to be involved in cyberattacks, as well as their families.

The coming debate is over whether the government should get into the business of retaliation. Already, Washington is awash in conferences that talk about “escalation dominance” and “extended deterrence,” all terminology drawn from the cold war.

Some of the talk is overheated, fueled by a growing cybersecurity industry and the development of offensive cyberweapons, even though the American government has never acknowledged using them, even in the Stuxnet attacks on Iran. But there is a serious, behind-the-scenes discussion about what kind of attack on American infrastructure — something the Chinese hacking groups have not seriously attempted — could provoke a president to order a counterattack.

THE PLAGUE — Some Victims of Online Hacking Edge Into the Light . . . despite Senator John McCain's weakness on cyber-terrorism

What I find most disturbing is that Senator John McCain of Arizona, Obama's rival the last time around, is the guy who carried water for the US Chamber of Commerce when this corporate lobbying group fought measures in Congress last year to bolster online security.

"Last week, President Obama signed an executive order that encouraged increased information-sharing about online threats between the government and private companies. But compliance with the order is voluntary, a weakened alternative to an online security bill that stalled in Congress last year after the Chamber of Commerce, a lobbying group that itself was hacked, led an effort to block it, saying that the regulations would be too burdensome." That's right:  Senator McCaine claims the administration is soft on terrorism (e.g. the Benghazi attack on Ambassador Stevens), and yet he's the guy who stopped the US from protecting itself from the real threat to this country. What a stooge.

 

Some Victims of Online Hacking Edge Into the Light

Alan Paller of the SANS Institute said recently hacked companies were seeking safety in numbers.

By NICOLE PERLROTH

Hackers have hit thousands of American corporations in the last few years, but few companies ever publicly admit it. Most treat online attacks as a dirty secret best kept from customers, shareholders and competitors, lest the disclosure sink their stock price and tarnish them as hapless.

Rarely have companies broken that silence, usually when the attack is reported by someone else. But in the last few weeks more companies have stepped forward. Twitter, Facebook and Apple have all announced that they were attacked by sophisticated cybercriminals. The New York Times revealed its experience with hackers in a front-page article last month.

The admissions reflect the new way some companies are calculating the risks and benefits of going public. While companies once feared shareholder lawsuits and the ire of the Chinese government, some can't help noticing that those that make the disclosures are lauded, as Google was, for their bravery. Some fear the embarrassment of being unable to fend off hackers who may still be in high school.

But as hacking revelations become more common, the threat of looking foolish fades and more companies are seizing the opportunity to take the leap in a crowd.

"There is a 'hide in the noise' effect right now," said Alan Paller, director of research at the SANS Institute, a nonprofit security research and education organization. "This is a particularly good time to get out the fact that you got hacked, because if you are one of many, it discounts the starkness of the announcement."

In 2010, when Google alerted some users of Gmail - political activists, mostly - that it appeared Chinese hackers were trying to read their mail, such disclosures were a rarity. In its announcement, Google said that it was one of many - two dozen - companies that had been targeted by the same group. Google said it was making the announcement, in part, to encourage other companies to open up about the problem.

But of that group, only Intel and Adobe Systems reluctantly stepped forward, and neither provided much detail.

Twitter admitted that it had been hacked this month. Facebook and Apple followed suit two weeks later. Within hours after The Times published its account, The Wall Street Journal chimed in with a report that it, too, had been attacked by what it believed to be Chinese hackers. The Washington Post followed.

Not everyone took advantage of the cover. Bloomberg, for example, has repeatedly denied that its systems were also breached by Chinese hackers, despite several sources that confirmed that its computers were infected with malware.

Computer security experts estimate that more than a thousand companies have been attacked recently. In 2011, security researchers at McAfee unearthed a vast online espionage campaign, called Operation Shady Rat, that found more than 70 organizations had been hit over a five-year period, many in the United States.

"I am convinced that every company in every conceivable industry with significant size and valuable intellectual property and trade secrets has been compromised (or will be shortly) with the great majority of the victims rarely discovering the intrusion or its impact," Dmitri Alperovitch, then McAfee's vice president for threat research, wrote in his findings.

"In fact," said Mr. Alperovitch, now the chief technology officer at Crowdstrike, a security start-up, "I divide the entire set of Fortune Global 2000 firms into two categories: those that know they've been compromised and those that don't yet know."

Of that group, there are still few admissions. A majority of companies that have at one time or another been the subject of news reports of online attacks refuse to confirm them. The list includes the International Olympic Committee, Exxon Mobil, Baker Hughes, Royal Dutch Shell, BP, ConocoPhillips, Chesapeake Energy, the British energy giant BG Group, the steel maker ArcelorMittal and Coca-Cola.

Like Google, some companies have stepped forward in the interest of increasing awareness and improving security within their respective industries, often to little avail. In 2009, Heartland Payment Systems, a major payment processing company, took the unusual step of disclosing a major data breach on its systems that potentially exposed millions of credit and debit card customers to fraud. It did so against the advice of its lawyers.

"Until then, most people tried to sweep breaches under the rug," said Steve Elefant, then Heartland's chief information officer. "We wanted to make sure that it didn't happen to us again and didn't want to sit back while the bad guys tried to pick us off one by one."

Heartland helped set up the Payments Processors Information Sharing Council to share information about security threats and breaches within the industry. Again, the company's lawyers thought it was a bad idea. "But we felt it was important."

The effort did not stop its other members from sweeping their own breaches under the rug. Last year, Global Payments, a major payment processor, did not disclose that it had been the victim of two major breaches that potentially affected millions of accounts, until the attacks were reported by a well-known security blogger. Even then, it did not offer details that other companies could use to fortify their systems. Last week, President Obama signed an executive order that encouraged increased information-sharing about online threats between the government and private companies. But compliance with the order is voluntary, a weakened alternative to an online security bill that stalled in Congress last year after the Chamber of Commerce, a lobbying group that itself was hacked, led an effort to block it, saying that the regulations would be too burdensome.

In Washington on Wednesday, several senior administration officials presented a new strategy for protecting American intellectual property by urging firms to step forward when attacked.

"There has been a reluctance by companies to come forward because of the concern about the impact on their shareholders or others," said Lanny A. Breuer, the assistant attorney general in charge of the criminal division of the Justice Department.

In October 2011, the Securities and Exchange Commission issued a new guidance that specifically outlined how publicly traded companies should disclose online attacks, but few disclosures have come because of it.

"Quite frankly, since then, there hasn't been an abundance of reporting on cyberevents despite the fact that they are clearly happening," said Jacob Olcott, a specialist in online risks who managed a Senate investigation into the disclosure practices.

The best hope, Mr. Olcott said, is that as investors start paying more attention to the threats, they will demand that companies disclose them. "I wouldn't hold my breath," Mr. Elefant said. "There are an awful lot of lawyers out there trying to keep companies from exposing that these breaches are happening. And they are happening."

David E. Sanger contributed reporting from Washington.

 

THE PLAGUE — How Could The U.S. Respond To Chinese Hacking?

Yes, even probing is out of bounds, PLA!

Another fine piece from NPR on Unit 61398, responsible for hundreds of attacks on US websites, including systems that control our vital infrastructure.

 

How Could The U.S. Respond To Chinese Hacking?

by SCOTT NEUMAN

A Chinese soldier stands guard Tuesday in front of the Shanghai building that houses military Unit 61398. A U.S. cybersecurity company says the unit is behind nearly 150 computer attacks on U.S. and other Western companies and organizations in recent years. China denies the allegation.

If the Chinese military is regularly hacking into the computers of U.S. organizations, as an American security firm says, it raises all sorts of questions about how the U.S. should respond.

Is this a job for the military or the intelligence agencies? What role should diplomats and trade officials be playing?

The report issued this week by the IT security consultancy Mandiant says it has traced the hacking activity to the People's Liberation Army's Unit 61398, which has "systematically stolen hundreds of terabytes of data from at least 141 organizations."

As NPR's Frank Langfitt reported, Unit 61398 is headquartered in a nondescript neighborhood in Shanghai's sprawling Pudong district.

The Chinese government has strongly denied the report, but in the U.S., there's been a widespread belief for years that the Chinese have been deeply involved in computer hacking.

Speaking to The Associated Press, Shawn Henry, who now heads security firm CrowdStrike, used a military analogy to describe the current situation.

"If the Chinese government flew planes into our airspace, our planes would escort them away," he said. "If it happened two, three or four times, the president would be on the phone and there would be threats of retaliation."

Mounting Evidence

Martin Libicki, a researcher at the RAND Corp., says while there's still no smoking gun, Beijing's denials have reached the level of "implausible deniability." Even so, he says the hacking can be viewed as essentially an illegal technology transfer.

"How damaging that is to the United States depends on how much the problem is costing us," he says. "It's a policy decision on where you draw the line and why you want to draw the line," Libicki says.

It's difficult to estimate the cost to the U.S. Broad figures have been tossed around, ranging from as much as a trillion dollars, which would be "huge," Libicki says, to maybe a billion dollars, which would put it "very low on the list of issues between the United States and China."

 

 

The allegation that the Chinese military may be playing a key role is a vestige of China's evolving economic system in which the government still has a central role promoting industry, he says.

"It may also be that a lot of the same techniques that it takes to steal secrets from Coca-Cola are the same techniques it takes to steal secrets from Lockheed," says Libicki. "And Lockheed, of course, builds military equipment, the nature of which is probably of keen interest to the Chinese."

A Well-Organized Operation

Richard Bejtlich, chief security officer at Mandiant, says the evidence in its report leaves little question about who is behind the spying.

"It's clear that this is not just a few people working in some basement, some patriotic hackers," he says. "This is a military operation with defined goals, with schedules, with tasking. This is a whole new level of activity."

Bejtlich says the U.S. government is "well aware" of the activity, but partly because of concerns about exposing intelligence resources and other secrecy concerns, has been reluctant to talk about it.

Christopher Johnson, who holds the Freeman chair in China studies at the Center for Strategic and International Studies, says that while the Mandiant report may spur the Obama administration to action, the White House has been heading in that direction for some time.

"It's becoming so pervasive that there's a sense that it's time to do something about it," he says. "One way or another, this [Mandiant report] puts tremendous salience on the issue and pressure on the U.S. government to do something about it."

President And Pentagon Address Concerns

Mandiant's Bejtlich says at least some of the information China has garnered through its cybersleuthing program has military utility, and the report comes less than a month after the Pentagon announced it would dramatically expand its Cyber Command to defend against attacks and, if necessary, wage offensive operations.

And last week, the president issued an executive order to improve cybersecurity for critical infrastructure. He also even mentioned cybersecurity concerns in his State of the Union address last week.

Media reports in this country have linked the U.S. government to at least one high-profile cyberattack, the 2010 Stuxnet computer virus that hit networks associated with Iran's nuclear facilities.

So far, there's no evidence that China has done more than snoop, Bejtlich says. But he says it appears to be in a position to do much more.

"By virtue of having access they could just as easily delete information," he says. "So this is an espionage problem now, but if they so decided to hold our assets at risk, they could choose to start destroying data, as we saw in Saudi Aramco last year.

Some analysts say there is a key difference between the Cold War cloak-and-dagger between Washington and Moscow, and the current situation with Chinese spying.

"In the Cold War, the United States had a distinct advantage in the Soviet Union doing worse, and they had a distinct advantage in the United States doing worse," Libicki says. "This is not true with the U.S. and China — we both have an interest in each other's economy doing better."

Although the U.S. has offensive cyberwarfare capabilities, Libicki doesn't see the Pentagon and the U.S. intelligence community engaging in economic espionage on behalf of U.S. companies.

"If, for instance, we were able to take in information on Chery automobiles, a Chinese car company, who do we give it to? It turns out that to give it to GM and not Ford would not only look bad, but would probably set us up for lawsuits," he says.

And, as Johnson of the Center for Strategic and International Studies points out, there is an implied red line between economic espionage against U.S. companies and a cyberattack aimed at larger economic interests.

"In areas like key infrastructure, such as pipelines and power grids, I think even probing is out of bounds," he says. "That's a message that we have been sending and presumably will continue to be sending to the Chinese and other governments."

THE PLAGUE — Apple Computers Hit by Sophisticated Cyberattack

Is anyone still using the Java browser plug-in? Really! If you haven't disabled it yet, here's how.

To unplug Java:

• In Firefox, select "Tools" from the main menu, then "Add-ons," then click the "Disable" button next to any Java plug-ins.
• In Safari, click "Safari" in the main menu bar, then "Preferences," then select the "Security" tab and uncheck the button next to "Enable Java."
• In Chrome, type or copy "Chrome://Plugins" into your browser's address bar, then click the "Disable" button below any Java plug-ins.
• In Internet Explorer, follow these instructions for disabling Java in all browsers via the Control Panel. There is no way to completely disable Java specifically in IE. What's up with that Microsoft?

This story from the New York Times documents how Apple, Facebook and Twitter have all been hacked due to yet another Java zero-day vulnerability.

 

Apple Computers Hit by Sophisticated Cyberattack

By NICOLE PERLROTH

Cyberattacks, apparently, happen in threes.

After Facebook and Twitter announced that they were breached by sophisticated hackers in recent weeks, Apple said it had been attacked, too, in a rare admission for the technology giant.

In a statement to reporters Tuesday, Apple said some of its computers were infected with the same malware that hit Twitter and Facebook. Like Facebook, Apple confirmed that its employees’ computers were infected with malware when they visited a Web site for software developers. Neither company has named the Web site. But according to a person with knowledge of Facebook’s investigation, the compromised site, iPhonedevsdk, an online forum for software developers, is still infected. (In other words, unless you want to be owned by hackers, do not visit the site.)

“We identified a small number of systems within Apple that were infected and isolated them from our network,” Apple said in a statement. “There is no evidence that any data left Apple. We are working closely with law enforcement to find the source of the malware.”

Twitter said attackers may have briefly gained access to data for 250,000 user accounts and that it reset passwords for and alerted users whose data may have been vulnerable. Facebook said that no user data was taken in its attack. Both companies said that they were also working with law enforcement to trace the source of the attacks, which they described only as “sophisticated.”

In all three cases, the attackers exploited a well-known security hole in Oracle’s Java software. Java, a widely used programming language, is installed on more than three billion devices. It has long been hounded by security problems.

Last month, after a French security researcher and blogger named Kafeine exposed a serious vulnerability in the software, the Department of Homeland Security issued a rare alert that warned users to disable Java on their computers. The vulnerability was particularly disconcerting because it let attackers download a malicious program onto its victims’ machines without any prompting. Users did not even have to click on a malicious link, they only had to visit an infected site for their computers to get infected.

After Oracle initially patched the security hole in January, the Department of Homeland Security said that the fix was not sufficient and recommended that, unless it was “absolutely necessary” to use Java, users should disable it on their computers completely. Oracle did not issue another fix until Feb. 1.

Apple said on Tuesday that it was releasing an updated Java malware removal tool that will check Macs for malware and remove it if found.

But security researchers say the Java exploit only gave hackers a foothold into these companies’ systems, and that the companies should be more forthcoming with what the attackers did once inside.

“Why is nobody asking what the payload is?” Sean Sullivan, a security adviser at the Finnish antivirus company F-Secure tweeted. “The Java exploit only opened the door. What walked in?”

@nickbilton Facebook developers use MACS. Why is nobody asking what the payload is? The Java exploit only opened the door. What walked in?

— Sean Sullivan (@5ean5ullivan) February 15, 2013

 

Social networks are a prime target for hackers, who look to use people’s personal data and particularly their social connections in what are known as “spearphishing” attacks. In this type of attack, a victim is sent an e-mail, ostensibly from someone they know on Facebook or other social networking site, containing a malicious link or attachment. Once the link is clicked or attachment opened, attackers take control of a user’s computer. If the infected computer is inside a company’s system, the attackers are able to gain a foothold. In many cases, they then extract passwords and gain access to sensitive data.

In an article published Monday evening, The New York Times reported that one group of Chinese cyberattackers, which has been tied to a specific military unit of China’s People’s Liberation Army, leveraged the social connections of its targets to send malicious e-mails that eventually allowed them to compromise thousands of organizations, ranging from Coca-Cola to the International Olympic Committee.

Hackers have been attacking organizations inside the United States at an alarming rate. The number of attacks reported by government agencies last year topped 48,500 — a ninefold jump from the 5,500 attacks reported in 2006, according to the Government Accountability Office.

 

 

THE PLAGUE - Chinese Army Unit Is Seen as Tied to Hacking Against U.S.

I almost fell off my chair when I read this article from The New York Times. It's life immitating art, as this is exactly what happens in my new novel, The Plague. Great reporting, and great detective work by Mandiant. Good on you!

 

This 12-story building on the outskirts of Shanghai is the headquarters of Unit 61398 of the People’s Liberation Army. China’s defense ministry has denied that it is responsible for initiating digital attacks.

Chinese Army Unit Is Seen as Tied to Hacking Against U.S.

By DAVID E. SANGER, DAVID BARBOZA and NICOLE PERLROTH

On the outskirts of Shanghai, in a run-down neighborhood dominated by a 12-story white office tower, sits a People’s Liberation Army base for China’s growing corps of cyberwarriors.

The building off Datong Road, surrounded by restaurants, massage parlors and a wine importer, is the headquarters of P.L.A. Unit 61398. A growing body of digital forensic evidence — confirmed by American intelligence officials who say they have tapped into the activity of the army unit for years — leaves little doubt that an overwhelming percentage of the attacks on American corporations, organizations and government agencies originate in and around the white tower.

An unusually detailed 60-page study, to be released Tuesday by Mandiant, an American computer security firm, tracks for the first time individual members of the most sophisticated of the Chinese hacking groups — known to many of its victims in the United States as “Comment Crew” or “Shanghai Group” — to the doorstep of the military unit’s headquarters. The firm was not able to place the hackers inside the 12-story building, but makes a case there is no other plausible explanation for why so many attacks come out of one comparatively small area.

“Either they are coming from inside Unit 61398,” said Kevin Mandia, the founder and chief executive of Mandiant, in an interview last week, “or the people who run the most-controlled, most-monitored Internet networks in the world are clueless about thousands of people generating attacks from this one neighborhood.”

Other security firms that have tracked “Comment Crew” say they also believe the group is state-sponsored, and a recent classified National Intelligence Estimate, issued as a consensus document for all 16 of the United States intelligence agencies, makes a strong case that many of these hacking groups are either run by army officers or are contractors working for commands like Unit 61398, according to officials with knowledge of its classified content.

Mandiant provided an advance copy of its report to The New York Times, saying it hoped to “bring visibility to the issues addressed in the report.” Times reporters then tested the conclusions with other experts, both inside and outside government, who have examined links between the hacking groups and the army (Mandiant was hired by The New York Times Company to investigate a sophisticated Chinese-origin attack on its news operations, but concluded it was not the work of Comment Crew, but another Chinese group. The firm is not currently working for the Times Company but it is in discussions about a business relationship.)

While Comment Crew has drained terabytes of data from companies like Coca-Cola, increasingly its focus is on companies involved in the critical infrastructure of the United States — its electrical power grid, gas lines and waterworks. According to the security researchers, one target was a company with remote access to more than 60 percent of oil and gas pipelines in North America. The unit was also among those that attacked the computer security firm RSA, whose computer codes protect confidential corporate and government databases.

Contacted Monday, officials at the Chinese embassy in Washington again insisted that their government does not engage in computer hacking, and that such activity is illegal. They describe China itself as a victim of computer hacking, and point out, accurately, that there are many hacking groups inside the United States. But in recent years the Chinese attacks have grown significantly, security researchers say. Mandiant has detected more than 140 Comment Crew intrusions since 2006. American intelligence agencies and private security firms that track many of the 20 or so other Chinese groups every day say those groups appear to be contractors with links to the unit.

And the Chinese Ministry of Foreign Affairs said Tuesday that the allegations were ‘‘unprofessional.’’

‘‘Making unfounded accusations based on preliminary results is both irresponsible and unprofessional, and is not helpful for the resolution of the relevant problem,’’ said Hong Lei, a ministry spokesman. ‘‘China resolutely opposes hacking actions and has established relevant  laws and regulations and taken strict law enforcement measures to defend against online hacking activities.’’  ["Pants on fire!" ed.]

While the unit’s existence and operations are considered a Chinese state secret, Representative Mike Rogers of Michigan, the Republican chairman of the House Intelligence Committee, said in an interview that the Mandiant report was “completely consistent with the type of activity the Intelligence Committee has been seeing for some time.”

The White House said it was “aware” of the Mandiant report, and Tommy Vietor, the spokesman for the National Security Council, said, “We have repeatedly raised our concerns at the highest levels about cybertheft with senior Chinese officials, including in the military, and we will continue to do so.”

The United States government is planning to begin a more aggressive defense against Chinese hacking groups, starting on Tuesday. Under a directive signed by President Obama last week, the government plans to share with American Internet providers information it has gathered about the unique digital signatures of the largest of the groups, including Comment Crew and others emanating from near where Unit 61398 is based.

But the government warnings will not explicitly link those groups, or the giant computer servers they use, to the Chinese army. The question of whether to publicly name the unit and accuse it of widespread theft is the subject of ongoing debate.

“There are huge diplomatic sensitivities here,” said one intelligence official, with frustration in his voice.

But Obama administration officials say they are planning to tell China’s new leaders in coming weeks that the volume and sophistication of the attacks have become so intense that they threaten the fundamental relationship between Washington and Beijing.

The United States government also has cyberwarriors. Working with Israel, the United States has used malicious software called Stuxnet to disrupt Iran’s uranium enrichment program. But government officials insist they operate under strict, if classified, rules that bar using offensive weapons for nonmilitary purposes or stealing corporate data.

The United States finds itself in something of an asymmetrical digital war with China. “In the cold war, we were focused every day on the nuclear command centers around Moscow,” one senior defense official said recently. “Today, it’s fair to say that we worry as much about the computer servers in Shanghai.”  ["For a fascinating look at China's asymmetrical war strategy, check out Unrestricted Warfare - China's Master Plan To Destroy America by Col Qiao Liang and Col. Wang Xiangsui of the PLA, published by Pan American Publishing Company back in 2002!" ed.]

A new study by Mandiant, an American computer security firm, identified more than 140 organizations that have been compromised over the past six years by a single hacking group, called “Comment Crew’' or “Shanghai Group.’' Mandiant has assembled a circumstantial case that links Comment Crew to Unit 61398 of the People’s Liberation Army.

A Shadowy Unit

Unit 61398 — formally, the 2nd Bureau of the People’s Liberation Army’s General Staff Department’s 3rd Department — exists almost nowhere in official Chinese military descriptions. Yet intelligence analysts who have studied the group say it is the central element of Chinese computer espionage. The unit was described in 2011 as the “premier entity targeting the United States and Canada, most likely focusing on political, economic, and military-related intelligence” by the Project 2049 Institute, a nongovernmental organization in Virginia that studies security and policy issues in Asia.

While the Obama administration has never publicly discussed the Chinese unit’s activities, a secret State Department cable written the day before Barack Obama was elected president in November 2008 described at length American concerns about the group’s attacks on government sites. (At the time American intelligence agencies called the unit “Byzantine Candor,” a code word dropped after the cable was published by WikiLeaks.)

The Defense Department and the State Department were particular targets, the cable said, describing how the group’s intruders send e-mails, called “spearphishing” attacks, that placed malware on target computers once the recipient clicked on them. From there, they were inside the systems.

American officials say that a combination of diplomatic concerns and the desire to follow the unit’s activities have kept the government from going public. But Mandiant’s report is forcing the issue into public view.

For more than six years, Mandiant tracked the actions of Comment Crew, so named for the attackers’ penchant for embedding hidden code or comments into Web pages. Based on the digital crumbs the group left behind — its attackers have been known to use the same malware, Web domains, Internet protocol addresses, hacking tools and techniques across attacks — Mandiant followed 141 attacks by the group, which it called “A.P.T. 1” for Advanced Persistent Threat 1.

“But those are only the ones we could easily identify,” said Mr. Mandia. Other security experts estimate that the group is responsible for thousands of attacks.

As Mandiant mapped the Internet protocol addresses and other bits of digital evidence, it all led back to the edges of Pudong district of Shanghai, right around the Unit 61398 headquarters. The group’s report, along with 3,000 addresses and other indicators that can be used to identify the source of attacks, concludes “the totality of the evidence” leads to the conclusion that “A.P.T. 1 is Unit 61398.”

Mandiant discovered that two sets of I.P. addresses used in the attacks were registered in the same neighborhood as Unit 61398’s building.

“It’s where more than 90 percent of the attacks we followed come from,” said Mr. Mandia.

The only other possibility, the report concludes with a touch of sarcasm, is that “a secret, resourced organization full of mainland Chinese speakers with direct access to Shanghai-based telecommunications infrastructure is engaged in a multiyear enterprise-scale computer espionage campaign right outside of Unit 61398’s gates.” ["FOFLMHO!" ed.]

The most fascinating elements of the Mandiant report follow the keystroke-by-keystroke actions of several of the hackers who the firm believes work for the P.L.A. Mandiant tracked their activities from inside the computer systems of American companies they were invading. The companies had given Mandiant investigators full access to rid them of the Chinese spies.

One of the most visible hackers it followed is UglyGorilla, who first appeared on a Chinese military forum in January 2004, asking whether China has a “similar force” to the “cyber army” being set up by the American military.

By 2007 UglyGorilla was turning out a suite of malware with what the report called a “clearly identifiable signature.” Another hacker, called “DOTA” by Mandiant, created e-mail accounts that were used to plant malware. That hacker was tracked frequently using a password that appeared to be based on his military unit’s designation. DOTA and UglyGorilla both used the same I.P. addresses linked back to Unit 61398’s neighborhood.

Mandiant discovered several cases in which attackers logged into their Facebook and Twitter accounts to get around China’s firewall that blocks ordinary citizen’s access, making it easier to track down their real identities.

Mandiant also discovered an internal China Telecom memo discussing the state-owned telecom company’s decision to install high-speed fiber-optic lines for Unit 61398’s headquarters.

China’s defense ministry has denied that it is responsible for initiating attacks. “It is unprofessional and groundless to accuse the Chinese military of launching cyberattacks without any conclusive evidence,” it said last month, one of the statements that prompted Mandiant to make public its evidence.  ["OMG!  No evidence!"  ed.]

Escalating Attacks

Mandiant believes Unit 61398 conducted sporadic attacks on American corporate and government computer networks; the earliest it found was in 2006. Two years ago the numbers spiked. Mandiant discovered some of the intrusions were long-running. On average the group would stay inside a network, stealing data and passwords, for a year; in one case it had access for four years and 10 months.

Mandiant has watched the group as it has stolen technology blueprints, manufacturing processes, clinical trial results, pricing documents, negotiation strategies and other proprietary information from more than 100 of its clients, mostly in the United States. Mandiant identified attacks on 20 industries, from military contractors to chemical plants, mining companies and satellite and telecommunications corporations.

Mandiant’s report does not name the victims, who usually insist on anonymity. A 2009 attack on Coca-Cola coincided with the beverage giant’s failed attempt to acquire the China Huiyuan Juice Group for $2.4 billion, according to people with knowledge of the results of the company’s investigation.

As Coca-Cola executives were negotiating what would have been the largest foreign purchase of a Chinese company, Comment Crew was busy rummaging through their computers in an apparent effort to learn more about Coca-Cola’s negotiation strategy.

The attack on Coca-Cola began, like hundreds before it, with a seemingly innocuous e-mail to an executive that was, in fact, a spearphishing attack. When the executive clicked on a malicious link in the e-mail, it gave the attackers a foothold inside Coca-Cola’s network. From inside, they sent confidential company files through a maze of computers back to Shanghai, on a weekly basis, unnoticed.

Two years later, Comment Crew was one of at least three Chinese-based groups to mount a similar attack on RSA, the computer security company owned by EMC, a large technology company. It is best known for its SecurID token, carried by employees at United States intelligence agencies, military contractors and many major companies. (The New York Times also uses the firm’s tokens to allow access to its e-mail and production systems remotely.) RSA has offered to replace SecurID tokens for customers and said it had added new layers of security to its products.

As in the Coca-Cola case, the attack began with a targeted, cleverly fashioned poisoned e-mail to an RSA employee. Two months later, hackers breached Lockheed Martin, the nation’s largest defense contractor, partly by using the information they gleaned from the RSA attack.

Mandiant is not the only private firm tracking Comment Crew. In 2011, Joe Stewart, a Dell SecureWorks researcher, was analyzing malware used in the RSA attack when he discovered that the attackers had used a hacker tool to mask their true location.

When he reverse-engineered the tool, he found that the vast majority of stolen data had been transferred to the same range of I.P. addresses that Mandiant later identified in Shanghai.

Dell SecureWorks says it believed Comment Crew includes the same group of attackers behind Operation Shady RAT, an extensive computer espionage campaign uncovered in 2011 in which more than 70 organizations over a five-year period, including the United Nations, government agencies in the United States, Canada, South Korea, Taiwan and Vietnam were targeted.

Infrastructure at Risk

What most worries American investigators is that the latest set of attacks believed coming from Unit 61398 focus not just on stealing information, but obtaining the ability to manipulate American critical infrastructure: the power grids and other utilities.

Staff at Digital Bond, a small security firm that specializes in those industrial-control computers, said that last June Comment Crew unsuccessfully attacked it. A part-time employee at Digital Bond received an e-mail that appeared to come from his boss, Dale Peterson. The e-mail, in perfect English, discussed security weaknesses in critical infrastructure systems, and asked the employee to click a link to a document for more information. Mr. Peterson caught the e-mail and shared it with other researchers, who found the link contained a remote-access tool that would have given the attackers control over the employee’s computer and potentially given them a front-row seat to confidential information about Digital Bond’s clients, which include a major water project, a power plant and a mining company.

Jaime Blasco, a security researcher at AlienVault, analyzed the computer servers used in the attack, which led him to other victims, including the Chertoff Group. That firm, headed by the former secretary of the Department of Homeland Security, Michael Chertoff, has run simulations of an extensive digital attack on the United States. Other attacks were made on a contractor for the National Geospatial-Intelligence Agency, and the National Electrical Manufacturers Association, a lobbying group that represents companies that make components for power grids. Those organizations confirmed they were attacked but have said they prevented attackers from gaining access to their network.

Mr. Blasco said that, based on the forensics, all the victims had been hit by Comment Crew. But the most troubling attack to date, security experts say, was a successful invasion of the Canadian arm of Telvent. The company, now owned by Schneider Electric, designs software that gives oil and gas pipeline companies and power grid operators remote access to valves, switches and security systems.

Telvent keeps detailed blueprints on more than half of all the oil and gas pipelines in North and South America, and has access to their systems. In September, Telvent Canada told customers that attackers had broken into its systems and taken project files. That access was immediately cut, so that the intruders could not take command of the systems.

Martin Hanna, a Schneider Electric spokesman, did not return requests for comment, but security researchers who studied the malware used in the attack, including Mr. Stewart at Dell SecureWorks and Mr. Blasco at AlienVault, confirmed that the perpetrators were the Comment Crew.

“This is terrifying because — forget about the country — if someone hired me and told me they wanted to have the offensive capability to take out as many critical systems as possible, I would be going after the vendors and do things like what happened to Telvent,“ Mr. Peterson of Digital Bond said. “It’s the holy grail.”

Mr. Obama alluded to this concern in the State of the Union speech, without mentioning China or any other nation. “We know foreign countries and companies swipe our corporate secrets,” he said. “Now our enemies are also seeking the ability to sabotage our power grid, our financial institutions, our air-traffic control systems. We cannot look back years from now and wonder why we did nothing.”

Mr. Obama faces a vexing choice: In a sprawling, vital relationship with China, is it worth a major confrontation between the world’s largest and second largest economy over computer hacking?

A few years ago, administration officials say, the theft of intellectual property was an annoyance, resulting in the loss of billions of dollars of revenue. But clearly something has changed. The mounting evidence of state sponsorship, the increasing boldness of Unit 61398, and the growing threat to American infrastructure are leading officials to conclude that a far stronger response is necessary.

“Right now there is no incentive for the Chinese to stop doing this,” said Mr. Rogers, the House intelligence chairman. “If we don’t create a high price, it’s only going to keep accelerating.”

THE PLAGUE — FAA moves closer to widespread US drone flights with plan for 6 test sites across the country

Here's another piece, this time from the Washington Post, about our wonderful FAA initiating 6 drone tests across the country. Look up . . . Big Brother is watching you! I sure hope these UAVs have good lenses so they can catch my middle finger waving back.

 

FAA moves closer to widespread US drone flights with plan for 6 test sites across the country

Lance Bertolino, Vanguard Defense Industries/Associated Press - This September 2011 photo provided by Vanguard Defense Industries, shows a ShadowHawk drone with Montgomery County, Texas, SWAT team members. In a major step toward opening U.S. skies to thousands of unmanned drones, federal officials Thursday, Feb. 14, 2013, solicited proposals to create six drone test sites around the country. The FAA has granted several hundred permits to universities, police departments and other government agencies to use small, low-flying drones. For example, the sheriff’s department in Montgomery County, Texas, has a 50-pound ShadowHawk helicopter drone intended to supplement its SWAT team.

WASHINGTON — A future in which unmanned drones are as common in U.S. skies as helicopters and airliners has moved a step closer to reality with a government request for proposals to create six drone test sites around the country.

The Federal Aviation Administration made the request Thursday, kicking off what is anticipated to be an intense competition between states hoping to win one of the sites.

The FAA also posted online a draft plan for protecting people’s privacy from the eyes in the sky. The plan would require each test site to follow federal and state laws and make a privacy policy publicly available.

Privacy advocates worry that a proliferation of drones will lead to a “surveillance society” in which the movements of Americans are routinely monitored, tracked, recorded and scrutinized by the authorities.

The military has come to rely heavily on drones overseas. Now there is tremendous demand to use drones in the U.S. for all kinds of tasks that are too dirty, dull or dangerous for manned aircraft. Drones, which range from the size of a hummingbird to the high-flying Global Hawks that weigh about 15,000 pounds without fuel, also are often cheaper than manned aircraft. The biggest market is expected to be state and local police departments.

Industry experts predict the takeoff of a multibillion-dollar market for civilian drones as soon as the FAA completes regulations to make sure they don’t pose a safety hazard to other aircraft.

Potential civilian users are as varied as the drones themselves. Power companies want them to monitor transmission lines. Farmers want to fly them over fields to detect which crops need water. Ranchers want them to count cows. Film companies want to use drones to help make movies. Journalists are exploring drones’ newsgathering potential.

The FAA plans to begin integrating drones starting with small aircraft weighing less than about 55 pounds. The agency forecasts an estimated 10,000 civilian drones will be in use in the U.S. within five years.

The FAA is required by a law enacted a year ago to develop sites where civilian and military drones can be tested in preparation for integration into U.S. airspace that’s currently limited to manned aircraft.

The law also requires that the FAA allow drones wide access to U.S. airspace by 2015, but the agency is behind schedule on that.

The test sites are planned to evaluate what requirements are needed to ensure the drones don’t collide with planes or endanger people or property on the ground. Remotely controlled drones don’t have a pilot who can see other aircraft the way an onboard plane or helicopter pilot can.

There’s also concern that links between drones and their on-the-ground operators can be broken or hacked, causing the operator to lose control of the aircraft.

“This research will give us valuable information about how best to ensure the safe introduction of this advanced technology into our nation’s skies,” Transportation Secretary Ray LaHood said in a statement.

The test sites are also expected to boost the local economy of the communities where they are located.

Customs and Border Patrol uses drones along the U.S.-Mexico border. And the FAA has granted several hundred permits to universities, police departments and other government agencies to use small, low-flying drones. For example, the sheriff’s department in Montgomery County, Texas, has a 50-pound ShadowHawk helicopter drone intended to supplement its SWAT team.

The sheriff’s department hasn’t armed its drone, although the ShadowHawk can be equipped with a 40 mm grenade launcher and a 12-guage shotgun. The prospect of armed drones patrolling U.S. skies has alarmed some lawmakers and their constituents. More than a dozen bills have been introduced in Congress and state legislatures to curb drone use and protect privacy.

President Barack Obama was asked Thursday about concerns that the administration believes it’s legal to strike American citizens abroad with drones and whether that’s allowed against citizens in the U.S.

“There’s never been a drone used on an American citizen on American soil,” the president said, speaking during an online chat sponsored by Google in which he was promoting his policy initiatives.

“We respect and have a whole bunch of safeguards in terms of how we conduct counterterrorism operations outside of the United States. The rules outside of the United States are going to be different than the rules inside the United States, in part because our capacity, for example, to capture terrorists in the United States are very different than in the foothills or mountains of Afghanistan or Pakistan.”

He said he would work with Congress to make sure the American public understands “what the constraints are, what the legal parameters are, and that’s something that I take very seriously.”

Earlier this week, an FAA official told a meeting of potential test site bidders that aviation regulations prohibit dropping anything from an aircraft, which could be interpreted to bar arming civilian drones, according to an industry official present at the meeting who requested anonymity because he wasn’t authorized to speak publicly.

THE PLAGUE — Drones Across US Skies Closer to Reality ~ FAA solicits plans for 6 domestic drone test sites

I found this piece from progressive website Common Cause absolutely fascinating — and really, really scary. It appears the FAA is soliciting plans for 6 domestic drone tests. Big brother will soon be watching you . . . from the sky.

 

Drones Across US Skies Closer to Reality

FAA solicits plans for 6 domestic drone test sites

- Andrea Germanos, staff writer

A day when thousands of drones are flying across U.S. skies is not that far away.  In a step to bring this closer to reality, the Federal Aviation Administration (FAA) announced on Thursday it was soliciting proposals for six drone research and test sites around the country.

Transportation secretary Ray LaHood said, “This research will give us valuable information about how best to ensure the safe introduction of this advanced technology into our nation’s skies.”

Michael Toscano, president and CEO of the Association for Unmanned Vehicle Systems International, said in a statement that the FAA's announcement was "an important milestone on the path toward unlocking the potential of unmanned aircraft." Toscano lamented that the number of test sites had been limited to six, saying, "states across the country have been eager" to be a designated test site.

The FAA predicts 10,000 domestic drones in use by 2018, the Associated Press reports.  ["Holy crap!" ed.]

In National Geographic, science writer John Horgan notes how drone makers are trying to push drones into the civilian landscape:

So far only a dozen police departments, including ones in Miami and Seattle, have applied to the FAA for permits to fly drones. But drone advocates—who generally prefer the term UAV, for unmanned aerial vehicle—say all 18,000 law enforcement agencies in the U.S. are potential customers. They hope UAVs will soon become essential too for agriculture (checking and spraying crops, finding lost cattle), journalism (scoping out public events or celebrity backyards), weather forecasting, traffic control. “The sky’s the limit, pun intended,” says Bill Borgia, an engineer at Lockheed Martin. “Once we get UAVs in the hands of potential users, they’ll think of lots of cool applications.” [...]

If the FAA relaxes its rules, says Mark Brown, the civilian market for drones—and especially small, low-cost, tactical drones—could soon dwarf military sales, which in 2011 totaled more than three billion dollars. Brown, a former astronaut who is now an aerospace consultant in Dayton, Ohio, helps bring drone manufacturers and potential customers together. The success of military UAVs, he contends, has created “an appetite for more, more, more!”

The FAA announcement comes a day after legislation was introduced by Rep. Zoe Lofgren (D-Calif.) and Rep. Ted Poe (R-Texas) to limit the use of domestic drones, and, The Hillreports, the legislation "would require warrants for drone use in criminal cases, with the exception of emergency situations like fires or drought monitoring."

"It doesn't take a constitutional law professor to see why legislation is needed to protect the rights of the American people," Rep. Ted Poe (R-Texas), the bill's co-sponsor, in a speech on the floor of the House this week. 

"The right of a reasonable expectation of privacy is a constitutional right. Any form of snooping or spying, surveillance or eavesdropping goes against the rights that are outlined in the Constitution." 

Dragonfly X-6 drone shown by the Seattle Police Department (Photo: William Carleton)

Poe and Lofgren's legislation was praised by the ACLU.

"Unmanned drones must not become a perpetual presence in our lives, hovering over us, following us and recording our every move," Chris Calabrese, legislative counsel for the ACLU, said in a statement. "Strict rules should govern the use of drones by the government. By requiring that law enforcement secure judicial approval before using drones, this legislation achieves the right balance for the use of these eyes in the sky."

The FAA is soliciting public comment on its program's privacy approach. Information on where to send the input is found in this document (pdf).

THE PLAGUE — Here's Why Obama Won't Say Whether He Can Kill You With a Drone: Because He Probably Can . . . but he probably won't!

Here's an interesting piece from Mother Jones — the guys who broke the story about Mitt Romney's 47% comment — about why President Obama won't speak definitively when asked if he thinks he has the authority to kill Americans here in the US using drones. I find this discussion fascinating, considering my new novel, The Plague (or will it be 404 or Zero Day ?), features a drone strike on an American — in Massachusetts! Of course, in my book, it's not the DOD or the President behind the attack. It's . . . OOOPS. Almost told you!

Here's Why Obama Won't Say Whether He Can Kill You With a Drone: Because He Probably Can

But he probably won't.

By Adam Serwer 

During a Google+ "Fireside Hangout" Thursday evening [1], President Barack Obama was asked if he believed he has the authority to authorize a drone strike against an American citizen on US soil.

He didn't exactly answer the question.

The Council on Foreign Relations' Micah Zenko transcribed the whole exchange [2]. Lee Doren, a conservative activist, asked the question; here's Obama's answer:

First of all, I think, there’s never been a drone used on an American citizen on American soil. And, you know, we respect and have a whole bunch of safeguards in terms of how we conduct counterterrorism operations outside the United States. The rules outside the United States are going to be different then the rules inside the United States. In part because our capacity to, for example, to capture a terrorist inside the United States are very different then in the foothills or mountains of Afghanistan or Pakistan.

But what I think is absolutely true is that it is not sufficient for citizens to just take my word for it that we are doing the right thing. I am the head of the executive branch. And what we've done so far is to try to work with Congress on oversight issues. But part of what I am going to have to work with congress on is to make sure that whatever it is we’re providing congress, that we have mechanisms to also make sure that the public understands what’s going on, what the constraints are, what the legal parameters are. And that is something that I take very seriously. I am not someone who believes that the president has the authority to do whatever he wants, or whatever she wants, whenever they want, just under the guise of counterterrorism. There have to be legal checks and balances on it.

Doren isn't the only one who wants an answer to this question. Senator Rand Paul (R-Ky.) has placed a hold on [3] John Brennan, Obama's nominee for CIA director, "until [Brennan] answers the question of whether or not the President can kill American citizens through the drone strike program on U.S. soil." Senator Dianne Feinstein (D-Calif.) posed that exact question to Brennan in a written questionnaire, but his answer was as opaque as Obama's [4]. "This Administration has not carried out drone strikes inside the United States and has no intention of doing so," Brennan wrote. 

So why didn't Obama just say, "no, the president cannot deploy drone strikes against US citizens on American soil"? Because the answer is probably "yes." That may not be as apocalyptically sinister as it sounds.

"Certainly, we routinely 'targeted' U.S. citizens during the Civil War," says Steve Vladeck, a law professor at American University's Washington College of Law. "Even if the targeting was with imprecise 19th-century artillery as opposed to 21st-century [unmanned arial vehicles]." If he had the technology, President Abraham Lincoln would most likely have been within his authority to send a drone to vaporize Confederate General Robert E. Lee. [5]

Drone strikes in the modern context, however, aren't being used against uniformed commanders of a traditional military force. Instead, we're talking about strikes that target individuals suspected of being part of terrorist organizations where "membership" is an inherently more nebulous concept. 

There are two government agencies known to conduct drone strikes, the CIA and the Department of Defense. CIA involvement in a domestic drone strike is probably off-limits, says Paul Pillar, a former CIA official who is now a professor at Georgetown University. The idea is really far-fetched anyway, Pillar argues. "I expect that if the CIA were to do anything like that within the U.S. it probably would violate some of the legal restrictions that are placed on all of the agency's activities as far as inside-U.S. operations are concerned," Pillar wrote in an email to Mother Jones. "Nothing like this is ever going to arise as far as drone strikes are concerned, so I don't see it as a live issue."

Since the CIA is probably out, that leaves the military. Congress has long held that the president has the authority to use the military domestically in some circumstances. The Posse Comitatus Act [6], passed after Reconstruction to limit the use of military force on US soil, states that the military can be used to enforce the law "in cases and under circumstances expressly authorized by the Constitution or Act of Congress." The last time this happened was 1992 when, citing the Insurrection Act [7], President George H.W. Bush called out the National Guard [8] to suppress the Los Angeles riots in the aftermath of the Rodney King verdict.

According to US law, Congress can authorize the use of the military inside the US. The question is whether the Authorization for Use of Military Force, which Congress passed in the aftermath of the 9/11 attacks, counts as "express authorization" to carry out a targeted killing on US soil. The Obama administration stated in its white paper explaining its legal authority to kill US citizens abroad [9] that capturing a suspected terrorist should be "infeasible" before a strike is authorized. But "the government's going to have a devil of a time proving that capture is infeasible for any individual found within the territorial United States," Vladeck says. And there's no reason to believe that local or state authorities, or if necessary the FBI, wouldn't be left to handle a situation involving suspected terrorists. (Local police dropped a bomb[10] during an armed standoff with the radical group MOVE in Philadelphia in 1985, proving that civilian authorities can be just as lethal as the military.)

The law says military force can sometimes be used against people on American soil, such as if it were needed to fight an armed domestic insurgency. But we still don't know how broad the Obama administration thinks that authority is. Less than a week before President George W. Bush left office, the Justice Department withdrew a series of memos written by torture memo author John Yoo that envisioned near-dictatorial authority [11] for the president, including the authority to deploy military force against terrorism suspects inside the US. Yoo had basically given Bush the executive branch equivalent of the Konami Code [12]. 

The Bush Justice Department argued that Yoo's theories should no longer "be treated as authoritative for any purpose." The question is whether the Obama administration has envisioned similar authority for itself. The answer to that question lies in the classified documents explaining the Obama administration's legal rationale for the targeted killing program—documents that the Obama administration has so far refused to fully disclose to Congress [9], let alone release to the public.

---

Links:

[1] http://www.youtube.com/watch?v=kp_zigxMS-Y&feature=youtu.be&t=43m45s
[2] http://blogs.cfr.org/zenko/2013/02/15/obama-discusses-targeted-killing-of-u-s-citizens-during-google-hangout/
[3] http://www.paul.senate.gov/?p=press_release&id=708
[4] http://intelligence.senate.gov/130207/posthearing.pdf
[5] http://washingtonexaminer.com/mark-tapscott-would-lincoln-have-droned-robert-e.-lee/article/2520893
[6] http://www.law.cornell.edu/uscode/text/18/1385
[7] http://www.law.cornell.edu/uscode/text/10/332
[8] http://www.nytimes.com/1992/05/03/us/riots-in-los-angeles-general-and-troops-have-domestic-mission.html
[9] http://www.motherjones.com/mojo/2013/02/obama-targeted-killing-white-paper-drone-strikes
[10] http://www.cbsnews.com/2100-201_162-6472296.html
[11] http://www.nytimes.com/2009/03/03/us/politics/03legal.html
[12] http://en.wikipedia.org/wiki/Konami_Code

 

THE PLAGUE - Victims Of Cyberattacks Get Proactive Against Intruders

This last piece in Tom Gjelten's NPR series on cybersecurity delves into offensive measures we in the US can take against the Chinese, Iranians, North Koreans, Russians and a host of other black hat states. Tom's comments about "honeypots" are interesting. But quoting Greg Hoglund is a bit problematic as his company, HBGary, has itself been cracked on more than one occassion.  [Plus, if Hoglund is unhappy with Obama's new directive to give private firms more info on cyberattacks because he believes the President doesn't go far enough, go and bitch at Senator McCain; he's the one responsible for watering it down.]

While this story showcases private enterprises that are crying out for government intervention (ironically), let no one be fooled into thinking that our government's offensive capabilities are lacking; they aren't. Compared to most nation states, we're doing okay.

On the other hand, the private sector must wake up to this threat and provide not only meaningful defensive strategies, but offensive ones too. Indeed, many are . . . although this piece fails to document their feelings. Then again, in Tom's defense, given the precarious legal nature of such offensive measures, who's going to talk to you about that?

Some companies, frustrated with intrusions into their networks by cyberattackers, are now trying to turn the tables in the ongoing and complicated cyberwar.

U.S. companies that have their networks routinely penetrated and their trade secrets stolen cannot be surprised by a new National Intelligence Estimate on the cyber-espionage threat. The classified NIE, the first-ever focusing on cybersecurity, concludes that the U.S. is the target of a major espionage campaign, with China the leading culprit.

Private firms and government agencies have struggled with cyberattacks from China and other countries for years. Many are angry about the constant intrusions into their networks, and in frustration some want to turn the tables on their attackers.

"There is no way that we are going to win the cybersecurity effort on defense," says Steven Chabinsky, formerly the FBI's top cyber-attorney. "We have to go on the offensive."

After leaving the FBI, Chabinsky took a position as chief risk officer at CrowdStrike, a firm set up to serve companies ready to take the cybersecurity fight to their adversaries.

"You can never win a fight, whether in a boxing match or a war, by only taking defensive actions," says Dmitri Alperovitch, CrowdStrike's co-founder. "If you're just standing up taking blows, the adversary will ultimately hit you hard enough that you fall to the ground and lose the match. You need to hit back."

A Tepid Response

Other cybersecurity experts agree that companies have been too slow to confront the people attacking their computer networks.

"What we need to do is get rid of the attackers and take away their tools and learn where their hideouts are and flush them out," says Greg Hoglund, co-founder of HBGary, another firm known for its aggressive approach to cybersecurity, until it was acquired by another company.

At times, such firms seem to be advocating vigilante justice. It is normally not up to private individuals or firms to "get rid" of bad guys or "flush them out" from their hideouts. That's the responsibility of law enforcement. But frustrated cybersecurity experts such as Hoglund and Alperovitch complain that the government does little more than warn U.S. companies about the cyberthreats they face.

"It's [like] the government sees a missile heading for your company's headquarters, and the government just yells, 'Incoming!' " Alperovitch says. "It's doing nothing to prevent it, nothing to stop it [and] nothing to retaliate against the adversary."

Alperovitch says this is how private firms feel under current circumstances.

"Until that changes," he says, "the private sector is going to take actions into their own hands, and the government shouldn't be surprised about that."

Potential For Mistakes

U.S. officials say they understand the frustration of private companies that face a constant barrage of cyberattacks. President Obama signed an executive order on Tuesday that sets out procedures by which the government and the private sector can collaborate in confronting cyberthreats.

A turn toward more aggressive actions against cyberattackers, however, could be risky. Because the source of a cyberattack is often hard to identify, counterattacking is not always well-advised.

"I will guarantee you there will be lots of mistakes made," said Rep. Mike Rogers of Michigan, chairman of the House Permanent Select Committee on Intelligence, speaking at a recent cybersecurity conference at George Washington University. "I worry about the private sector engaging in offensive [activities] ... because a lot of things are going to go wrong."

Companies that want to go on the offense against their cyber-adversaries need to consider the legal risks such actions would involve.

"I have only found one or two lawyers ... who have said, 'Let's consider pursuing some kind of offensive response,' " says Richard Bejtlich, chief security officer at Mandiant, a cyber-consultancy. "The corporate legal structure is very conservative when it comes to what we can allow someone to do."

Alperovitch of CrowdStrike insists there are safe and lawful ways a company can go after an intruder — and come out ahead.

"If they're going after [your] negotiation strategy for a business deal you're involved in, one thing you can do is craft a fake negotiation document and feed that to them," Alperovitch says. "[If] you feed them a different strategy, you're going to cause them to act in a certain way that's actually gong to benefit you."

New Territory

Security experts call this a "honeypot" approach. The idea is to plant a document in your network that an adversary will find irresistible. In one clever version, the document includes code so that when the intruder opens it, it turns the camera on in his computer, takes his picture, and sends it back so you can report him to the authorities.

Hoglund, from the firm previously known as HBGary, says he has reviewed such techniques with lawyers.

"It was pretty clear that putting a booby-trapped document in your own document is 100 percent legal," Hoglund says. "If the bad guy comes and steals it out of your network and opens it in his computer, that's his problem."

There is nevertheless a vigorous debate over the legal issues in offensive cyber-operations by private companies. If you are mugged, you can defend yourself, but you cannot track the mugger down a day later and shoot him. Nor can you break into his house and get your wallet back. Similar constraints govern in the cyberworld.

"This is completely new territory," Hoglund acknowledges, "so a lot of thinking needs to occur around this. Something will change. It will take its time, but we will see something come out, [pertaining to] self-defense as well as what kind of policies will be changed to make it so the attackers will suffer."

Hoglund and other advocates of a harder line against cyberattackers are unlikely to be satisfied by Obama's executive order. The order requires federal agencies to alert private companies to cyberthreats, but it maintains a focus on defense. Companies with critical infrastructure assets such as power plants are asked to follow security standards worked out jointly by government and industry.

THE PLAGUE — Obama Order Gives Firms Cyberthreat Information . . . but not as much as he should!

I found this piece from The New York Times interesting. What's most distressing is that Senator McCain — who was so eager to get to the truth about security in Libya — is the one responsible for filibustering a stronger version of this order last August (See copy in bold, below).

Sure, Senator McCain:  Talk big about security when you want to blame Hillary Clinton for the death of Ambassador Stevens in Benghazi (even though Republicans cut embassy defense budgets), but when it comes to real protection of our infrastructure, it's suddenly bad business.  Shortsighted nonsense.

 

Obama Order Gives Firms Cyberthreat Information

By MICHAEL S. SCHMIDT and NICOLE PERLROTH

WASHINGTON — President Obama signed an executive order on Tuesday that promotes increased information sharing about cyberthreats between the government and private companies that oversee the country’s critical infrastructure, offering a weakened alternative to legislation the administration had hoped Congress would pass last year.

An agent at work last month at the National Cybersecurity and Communications Integration Center in Arlington, Va. The center is an arm of the Homeland Security Department.

The order will allow companies that oversee infrastructure like dams, electrical grids and financial institutions to join an experimental program that has provided government contractors with real-time reports about cyberthreats.

It will also put together recommendations that companies should follow to prevent attacks, and it will more clearly define the responsibilities for different parts of the government that play a role in cybersecurity.

“Now our enemies are also seeking the ability to sabotage our power grid, our financial institutions, and our air traffic control systems,” Mr. Obama said in his State of the Union address. “We cannot look back years from now and wonder why we did nothing in the face of real threats to our security and our economy.”

But the measures considered most important by cybersecurity experts — like minimum requirements for how crucial infrastructure should be protected — were not included in the order because they require Congressional approval. They say the equipment used by companies overseeing the nation’s critical infrastructure is notoriously outdated and insecure because it was not built with the potential for a serious cyberattack in mind.

“The executive order is about information sharing — it does not even begin to address the real problem, which is that these systems are completely insecure,” said Dale Peterson, the founder of Digital Bond, a security firm that focuses on infrastructure.

He added: “I’m amazed that 11 ½ years after 9/11, the government hasn’t even had the courage to say, ‘You need to replace this insecure equipment.’ If you get on these systems, they have no security and you can do whatever you want.”

One of the administration’s top national security priorities last year was to get Congress to pass legislation giving the Department of Homeland Security power to enforce minimum standards for the security standards of equipment running critical infrastructure.

As part of the administration’s efforts to persuade members of Congress about the severity of the problem, several senior administration officials — including Janet Napolitano, the secretary of homeland security; Robert S. Mueller III, the director of the Federal Bureau of Investigation; and Gen. Martin E. Dempsey, the chairman of the Joint Chiefs of Staff — provided closed-door briefings to members of Congress on the threat.

But Senate Republicans, led by John McCain of Arizona, argued that the minimum standards were too burdensome for businesses, and by late July had managed to change the legislation to make them optional. In early August, the bill essentially died when it was blocked by a Republican filibuster. Senior administration officials have said they will attempt to get Congress to pass similar cybersecurity legislation this year.

Hackers are increasingly exploiting the lack of security to gain access to the nation’s most critical infrastructure.

According to a December report by the Department of Homeland Security, the agency has been responding to intrusions into oil pipelines and electric power organizations “at an alarming rate.” Some 198 attacks on the nation’s critical infrastructure systems were reported to the agency last year, a 52 percent increase from the number of reported attacks in 2012.

Several were successful. According to an earlier Department of Homeland Security report, hackers breached the computer systems of several natural gas pipelines last year and stole data that “could facilitate remote unauthorized operations.”

Michael S. Schmidt reported from Washington, and Nicole Perlroth from San Francisco.

THE PLAGUE — In Cyberwar, Software Flaws Are A Hot Commodity . . . and INTENTIONALLY engineered by DOD/NSA working with software cos.

In the second of his three-part series, Tom Gjelten of NPR takes a further look at cyberwarfare and the folks who trade in cyber weaponry. While this piece is better than the first in the series (i.e. less flawed), I found this section surprisingly naive:

"We actually had a standing order after that," Bejtlich says, "that said, if you find something, you don't tell the vendor, you tell the offensive side, and they'll decide what to do about it." 

Really! I am afraid that DOD is not just sitting around hoping to catch vulnerabilities that they can then exploit in offensive operations. I know for a fact that our military is actively working with software companies to CREATE such vulnerabilities (though I can't reveal how I know). Why is anyone surprised? Under G.W. Bush (and continuing with President Obama) DOD and other governmental agencies (i.e. NSA) have worked with the telephonies to hack into private conversations even though this activity was illegal at the time.

An analyst looks at code in the malware lab of a cybersecurity defense lab at the Idaho National Laboratory in Idaho Falls, Idaho, Sept. 29, 2011.

There have been security flaws in software as long as there has been software, but they have become even more critically important in the context of cyberweapons development.

In the past, security researchers who stumbled on a software flaw would typically report the flaw to the manufacturer of the software, so it could be fixed. That changed, however, when cyberweapon designers started looking at these flaws as vulnerabilities that could serve as a back door into a computer network. Most prized of all were "zero day vulnerabilities" — flaws whose existence was previously unknown.

Richard Bejtlich was a cyber specialist for the U.S. Air Force in the 1990s, a time when the U.S. military was going on the offense in the cyberwar. He remembers the day he realized how important a software vulnerability can be to a cyberweapons designer.

"Myself and a couple other guys, we found a zero day vulnerability in Cisco routing equipment," Bejtlich recalls. "And we looked at it, and we said, 'Did we really find this? Can we really get into these Cisco routers?' "

They could, and so Bejtlich and his colleagues reported it to Cisco. The company thanked him and said it would be fixed. Days later, he was talking to some friends who worked on the offensive side of the unit, and they had quite a different reaction to them reporting the bug to Cisco.

"They said, 'You did what? Why didn't you tell us? We could have used this to get into all these various hard targets,' " he says.

To Bejtlich, a software flaw was simply a mistake to be corrected. To a cyberweapons designer, however, it was a potential back door into the computer network he wanted to attack.

"We actually had a standing order after that," Bejtlich says, "that said, if you find something, you don't tell the vendor, you tell the offensive side, and they'll decide what to do about it."

Potential Dangers

A potential loser here, at least in the short run, is the consumer who may be stuck with a flawed piece of software because the government doesn't want anyone to know about the flaw, seeing it as something that could be exploited for the deployment of a cyberweapon.

ACLU technologist Christopher Soghoian, who is something of a privacy activist, says this is something people should know about.

"I don't think your average small business, medium-sized business or Fortune 500 company realizes what's going on here," Soghoian says. "I don't think they realize that their government knows about flaws that could be fixed, and is sitting on them and exploiting them against other people rather than having them fixed."

A good example would be the Stuxnet worm, used by the U.S. and Israel to attack computers controlling nuclear operations in Iran. The designers of Stuxnet took advantage of a software bug in the Microsoft Windows operating system, without alerting Microsoft to the flaw.

The demand for software vulnerabilities has grown to such an extent that the researchers who discover them no longer need to settle for a software vendor sending them a thank-you note, or even a small cash reward. In the context of escalating interest in cyberwar, there is now a growing global demand for the software vulnerabilities — the back doors — that allow an attacker to get inside his enemy's computer network.

"For every researcher who's doing the right thing [by alerting the vendor] and getting the modest gift," Soghoian says, "there are plenty of researchers who are selling these things for what they deem to be the true market value.

"And the true market value is whatever governments and their middlemen are willing to pay."

'It's Just Business'

Former Airman Bejtlich, now the chief security officer at Mandiant, a cybersecurity firm, is not in the business of selling vulnerabilities to the highest bidder, but he knows other cyber people who are.

"There seems to have been an explosion of interest in the last maybe two years," Bejtlich says, "where the hot thing to do is to found a company with five of your buddies who are all really good at finding vulnerabilities and just start making money."

Given that this interest is spurred by the development of secret cyberweapons research, the vulnerability market by necessity operates mostly in the shadows. When the vulnerability traders make a public appearance, it's usually at a conference where hackers and other cyber researchers gather to discuss their latest work.

A vulnerability seller named Donato Ferrante showed up recently at the "Suits and Spooks" conference in Arlington, Va. In an interview with NPR, Ferrante said he advertises his vulnerabilities through an email list. His clients see what vulnerabilities he has found in which products, but Donato gives only the barest of information about the flaws.

"If the customer wants [to] use the vulnerability, the customer needs to buy the vulnerability," Ferrante said. "This is just a sort of portfolio; then the customer needs to buy the details."

Ferrante's company, ReVuln, is the seller. For them, "it's business," he says.

An Unregulated Market

In the U.S., the National Security Agency and other branches of the U.S. military, law enforcement and intelligence agencies are among the biggest buyers of vulnerabilities. But there are other buyers, including any party with an interest in being able to penetrate an adversary's computer network.

Besides the U.S., other governments are also developing cyberweapons. Some private companies may have an interest in penetrating a rival company's network. For that matter, criminal organizations might be interested in purchasing vulnerabilities, or even groups plotting a cyberterrorist attack.

Not surprisingly, vulnerability sellers don't want to say much about their business. Asked where he is based, Ferrante simply says, "Europe," though in a subsequent email he clarifies that he operates out of Malta. He is not eager to describe the world in which he works.

"I don't see bad guys or good guys," Ferrante says. "It's just business."

After all, Ferrante says, ReVuln is only selling information. "The way the information is used is up to the customer; it's not up to us."

There is no regulation of the vulnerability market in the U.S. There is a law prohibiting the export of software that provides penetration capabilities that would enable the users to attack, deny, disrupt or otherwise impair the use of computer infrastructure or networks. But there is no mandatory reporting of vulnerability sales.

If the sellers are not aware of the use to which their vulnerabilities will be put, they may not be prosecutable.

"I am shocked that this has not been regulated," Bejtlich says. "It would be so easy for a legislator to say, 'We're going to do arms control. We're going to keep this out of the hands of the bad guys. You're going to need a license to have these tools.'

"Who's going to stand up and say, 'No, you have to have cyberweapons!' I mean, if you wanted to look for an easy way to have legislators appear to be doing something, this would be it," he says.

The vulnerability trade is just one example of many that indicates how developments in cyberwarfare, and the development of cyberweaponry, are proceeding so quickly that the thinking about how to manage this new domain of warfare is not keeping pace.

 

 

 

THE PLAGUE — Pentagon Goes On The Offensive Against Cyberattacks . . . and has been for years, NPR!

In the first of a three-part series, Tom Gjelten of NPR takes a look at cyberwarfare. While I applaud NPR's (better late than never) interest in this topic, I was taken aback by this paragraph:

The advantages of using cyberweapons are clear. They are more precise than bombs or missiles, and because they damage data rather than physical installations, they are far less likely to hurt innocent civilians...

This is shockingly wrong, as Stuxnet proved. Cyberweapons are not more precise than bombs or missiles, nor are they less likely to hurt innocent civilains.

Stuxnet escaped the Iranian nuclear facility at Natanz when a scientist brought it home on a laptop and then linked to the Net. Since then, as a result of the virus' escape, it has done untold damage beyond Iran, most of which we are only now beginning to understand and appreciate.

And to say cyberwarfare won't hurt innocent civilians belies the very intent of this software — namely the destruction of our physical infrastructure and financial systems. I would say that cracking (hacking) nuclear power and other utilities, railroad systems, locks and dams, air traffic control systems, financial systems, etc. would clearly hurt innocent civilians. Sure, DOD is a target too. But the majority of these attacks are not targeted at our military. Indeed, I would say that "innocent" civilians are the PRIMARY targets.

With the Pentagon now officially recognizing cyberspace as a domain of warfare, U.S. military commanders are emphasizing their readiness to defend the nation against cyberthreats from abroad. What they do not say is that they are equally prepared to launch their own cyberattacks against U.S. adversaries.

The importance of plans for offensive cyberwar operations is obscured by the reluctance of the government to acknowledge them. When the Pentagon announced its "Strategy for Operating in Cyberspace" in July 2011, for example, it appeared the military was focused only on protecting its own computer networks, not on attacking anyone else's.

"The thrust of the strategy is defensive," declared William Lynn, the deputy secretary of defense at the time. Neither he nor other Pentagon officials had one word to say about possible offensive cyberattacks. The Pentagon would not favor the use of cyberspace "for hostile purposes," according to the strategy. "Establishing robust cyberdefenses no more militarizes cyberspace," Lynn said, "than having a navy militarizes the ocean."

Those assurances are deceptive. Behind the scenes, U.S. commanders are committing vast resources and large numbers of military personnel to planning offensive cyberattacks and, in at least some cases, actually carrying them out. But the secrecy surrounding offensive cyberwar planning means there has been almost no public discussion or debate over the legal, ethical and practical issues raised by waging war in cyberspace.

Offensive cyberattacks carried out by the United States could set precedents other countries would follow. The rules of engagement for cyberwar are not yet clearly defined. And the lack of regulation concerning the development of cyberweapons could lead to a proliferation of lethal attack tools — and even to the possibility that such weapons could fall into the hands of unfriendly states, criminal organizations and even terrorist groups.

In some cases, offensive cyberattacks are being conducted within the parameters of conventional military operations. In Afghanistan, soldiers and Marines depend heavily on video and data links when they go into combat. As part of the process of "prepping the battlefield," commanders may want to launch pre-emptive attacks on the adversary's cybercapabilities in order to make sure their data networks do not get interrupted.

Marine Lt. Gen. Richard Mills, in a rare acknowledgment that the military engages in offensive cyber operations, discussed just such a situation during a military conference in August 2012.

"I can tell you that as a commander in Afghanistan in the year 2010, I was able to use my cyber operations against my adversary with great impact," Mills declared. "I was able to get inside his nets, infect his command and control, and in fact defend myself against his almost constant incursions to get inside my wire."

Another reference to the military's use of cyberattacks as part of a traditional combat operation came in 2009, during a presentation at the Brookings Institution by Air Force Gen. Norton Schwartz. Now retired, Schwartz at the time was serving as Air Force chief of staff. He told his audience that his airmen were prepared to carry out cyberattacks on another country's radar and missile installations before launching airstrikes against that country.

"Traditionally, we take down integrated air defenses via kinetic [physical] means," Schwartz said. "But if it were possible to interrupt radar systems or surface-to-air missile systems via cyber, that would be another very powerful tool in our tool kit." Schwartz hinted that the Air Force already had that capability, and in the nearly four years since he gave that speech, such a capability has certainly matured.

Cyberattacks, however, are also being used independently of traditional or kinetic operations, according to Jason Healey, a former Air Force officer who now directs the Cyber Statecraft Initiative at the Atlantic Council.

"It might happen that we will use them as an adjunct to kinetic," Healey says, "but it's quite clear that we're using [cyber] quite a bit more freely."

The best example of an offensive cyberattack independent of a kinetic operation would be Stuxnet, the cyberweapon secretly used to damage nuclear installations in Iran. A U.S. official has privately confirmed to NPR what the New York Times reported last summer — that the United States had a role in developing Stuxnet.

Because the operation has been shrouded in secrecy, however, there has been no public discussion about the pros and cons of using a cyberweapon in the way Stuxnet was used.

Among the top concerns is that other countries, seeing Stuxnet apparently used by the United States and Israel, might conclude that they would also be justified in carrying out a cyberattack. The British author Misha Glenny, writing in the Financial Times, argued that the deployment of Stuxnet may be seen "as a starting gun; countries around the world can now argue that it is legitimate to use malware pre-emptively against their enemies."

Another concern is that the malicious software code in Stuxnet, instructing computers to order Iranian centrifuges to spin out of control, could be modified and used against U.S. infrastructure assets.

"Now that technology is out there," cautions Michigan Rep. Mike Rogers, the Republican chairman of the House Permanent Select Committee on Intelligence. "People are taking a look at it. We are just a few lines of code away from someone else getting closer to a very sophisticated piece of malware that they either wittingly or unwittingly unleash across the world [and cause] huge, huge damage."

The absence of debate over the pros and cons of using cyberweapons is in sharp contrast to the discussion of nuclear weapons. The United States has adopted a "declaratory policy" regarding why it has nuclear weapons and when it would be justified to use them. There is nothing comparable for the cyberweapon arsenal.

Rep. Rogers says such gaps in military doctrine and strategy indicate that developments on the cyberwar front are getting ahead of U.S. thinking about cyberwar.

"The capabilities, I think, are keeping pace with technology," Rogers said in an interview with NPR. "It's the policy that I worry about. We have not fully rounded out what our [cyber] policies are."

The advantages of using cyberweapons are clear. They are more precise than bombs or missiles, and because they damage data rather than physical installations, they are far less likely to hurt innocent civilians. But they are new weapons, and critics say their use should be given careful consideration.

"If we are allowing ourselves to go on the offense without thinking about it, we're likely to militarize cyberspace," says the Atlantic Council's Jason Healey. "We will end up with a cyberspace where everyone is attacking everyone else. I don't believe we need to go on the offense just yet. The downside is higher than the government acknowledges."

White House officials are sensitive to the charge that they should promote more public debate surrounding cybercapabilities. "We understand that there is a view that more discussion is needed about how the United States operates in cyberspace," says National Security Council spokeswoman Caitlin Hayden. "That's why we've published numerous strategies, testified before Congress dozens of times, and [it is why] senior officials ... have given speeches and spoken at conferences and other public events."

THE GOD MACHINE - Knights Of Malta Celebrates 900th Anniversary At Vatican . . . and then the Pope resigns!

Great piece by one of the best reporters -- and sexiest voices, even after quitting smoking -- on the radio today, Sylvia Poggioli. The Knights of Malta are 900 years old!

 

Knights Of Malta Celebrates 900th Anniversary At Vatican

by SYLVIA POGGIOLI

Knights of the Order of Malta walk in procession toward St. Peter's Basilica to mark the 900th anniversary of the Order of the Knights of Malta, on Saturday at the Vatican.

Pilgrims and tourists visiting the Vatican received a special treat Saturday, when some 4,000 members of the Knights of Malta marched in procession to the tomb of St. Peter.

The last of the great chivalrous orders is celebrating the 900^th anniversary of its official recognition by Pope Paschal II. On Saturday, the Knights attended Mass in St. Peter's Basilica and received an audience with Pope Benedict XVI.

The Knights of Malta is also known as the Sovereign Military Order of St. John of Jerusalem, of Rhodes and of Malta.

The order's mission is humility and charity; its 13,500 members — Knights and Dames — trace their origins to warrior friars.

The order started in the 11th century, with the creation of an infirmary in Jerusalem that cared for people making pilgrimages to the Holy Land during the Crusades.

Like the Knights Templars, the Knights of Malta used religious intensity and military force to defend Christendom from the advance of Islam.

When Jerusalem was conquered by Muslims, the order made its base first on Cyprus, then Rhodes, and then Malta. It finally made its home in Rome after Napoleon expelled the order from Malta in 1798.

The order is sovereign. It prints its own stamps, coins, license plates and passports, but it has no territory. Today, it has become an international humanitarian organization with nearly 100,000 doctors, nurses and volunteers worldwide.

Based in Rome, the order is now focusing on its home continent, opening shelters and soup kitchens in Europe, where the number of jobless and homeless is growing in the worst recession since World War II.

Syria is also a priority for the order, which has stepped up relief assistance to help victims of that conflict. The Knights of Malta operates in Damascus, Aleppo, Hama, and Homs, and assists Syrian refugees in Lebanon and Turkey.

THE PLAGUE - New Argus Spy Cam Is Watching You . . . in great detail!

Check out this new Argus camera that can be mounted on any UAV (like a Predator drone). At 17,550 feet, it can spot a bird taking off from the ground! Of course, it's quite data intensive, generating around 1 Terabyte per day while aloft via its 1.8 billion (with a b) pixel video stream. Wow!

 

THE PLAGUE - Broad Powers Seen for Obama in Cyberstrike ~ WE ARE AT WAR!

This unsigned article in the New York Times for the first time reveals a secret legal review of the President's ability -- and right -- to order a pre-emptive cyber strike against foreign enemies. Why would you do this if you weren't already planning such an attack? I find it fascinating that this comes out the day the DOE revealed their systems had been hacked, and only days after both the New York Times and the Wall Street Journal revealed similar attacks. WE ARE AT WAR, AND THE COUNTRY DOES NOT EVEN KNOW IT. The target? It could be Iran, following up on Olympic Games, when the US covertly targeted their nuclear centrifuges for destruction; with Israel poised to strike Iran, we would be well-served to launch a pre-emptive cyber strike ahead of a conventional bunker bombing. It could be China, in anticipation of heightened tensions over the Kojima islands, and in response to thousands and thousands of similar attacks by the Chinese against the US over the last few months (and years). Or, it could be against North Korea, which recently announced a successful rocket launch (though the satellite is wobbling) -- rockets that could be used to target South Korea and, possibly, the US. Do you know? Check out The Plague (404) for a possible answer to this question.

Broad Powers Seen for Obama in Cyberstrike

By THE NEW YORK TIMES

A secret legal review on the use of America's growing arsenal of cyberweapons has concluded that President Obama has the broad power to order a pre-emptive strike if the United States detects credible evidence of a major digital attack looming from abroad, according to officials involved in the review, report David E. Sanger and Thom Shanker in Monday's New York Times.

That decision is among several reached in recent months as the administration moves, in the next few weeks, to approve the nation's first rules for how the military can defend, or retaliate, against a major cyberattack. New policies will also govern how the intelligence agencies can carry out searches of faraway computer networks for signs of potential attacks on the United States and, if the president approves, attack adversaries by injecting them with destructive code - even if there is no declared war.

The rules will be highly classified, just as those governing drone strikes have been closely held. John O. Brennan, Mr. Obama's chief counterterrorism adviser and his nominee to run the Central Intelligence Agency, played a central role in developing the administration's policies regarding both drones and cyberwarfare, the two newest and most politically sensitive weapons in the American arsenal.

Cyberweaponry is the newest and perhaps most complex arms race under way among large and small powers. The Pentagon has created a new Cyber Command, and computer network warfare is one of the few parts of the military budget that is expected to grow despite looming spending cuts. Officials said that the new cyberpolicies had been guided by a decade of evolution in counterterrorism policy, particularly on the division of authority between the military and the intelligence agencies in deploying cyberweapons.

Officials spoke on condition of anonymity because they were not authorized to talk on the record.

 

THE PLAGUE - Energy Department Is the Latest Victim of an Online Attack ~ WE ARE AT WAR!

If you were planning a major attack on this nation's energy infrastructure -- including our nuclear power plants -- what better way to begin than by securing the names and passwords of all those who have IP access to said systems. THIS STORY DOCUMENTS SUCH AN ATTACK. LIKE IT OR NOT, FELLOW CITIZENS, WE ARE AT WAR.

Energy Department Is the Latest Victim of an Online Attack

By NICOLE PERLROTH

The Energy Department was hit by an online attack last month that compromised the personal data of several hundred employees.

In an e-mail sent to employees Friday evening, the agency confirmed that hackers penetrated computers and servers at the agency's Washington headquarters and stole the personal information of hundreds of employees and contractors. The agency said it was working with federal authorities to investigate the attack. It said that, based on its findings, "no classified data was compromised."

The attack on the Energy Department is the latest in a string of major attacks to surface in the last week. Last week, after The New York Times reported that Chinese hackers had attacked its computers and stolen employee passwords, The Wall Street Journal said it had also been attacked. The Washington Post was also attacked by Chinese hackers last year, according to people with knowledge of The Post's investigation. And on Friday, Twitter announced that a group of sophisticated hackers had penetrated its systems, possibly stealing the personal information of 250,000 users.

"We're seeing a widespread colonization of significant U.S. infrastructure," said Tom Kellermann, a vice president for cybersecurity at TrendMicro, a Tokyo-based security company. "The level of organization and premeditation behind these attacks is really unprecedented."

William Gibbons, an Energy Department spokesman, did not say whether the agency had determined who was behind the attack.

A person close to the investigation said the attack was unrelated to a separate incident last January when Anonymous, the loose hacking collective, dumped what appeared to be sensitive information from the Energy Department on Pastebin, a Web site frequently used by hackers. In that case, the data turned out to be more than two years old.

A former Energy Department security employee told The Washington Free Beacon Monday morning that the agency made for an easy target.

"It's a continuing story of negligence," Ed McCallum, a former Energy Department security official, told the Free Beacon. Mr. McCallum said that the agency continued to have security issues despite the fact that it manages the most "sophisticated military and intelligence technology the country owns."

Here is the e-mail that the Energy Department sent to its employees:

The Department of Energy (DOE) has just confirmed a recent cyber incident that occurred in mid-January which targeted the Headquarters' network and resulted in the unauthorized disclosure of employee and contractor Personally Identifiable
Information (PII).

The Department is strongly committed to protecting the integrity of each employee's PII and takes any cyber incident very seriously. The Department's Cybersecurity Team, the Office of Health, Safety and Security and the Inspector General's office are working with federal law enforcement to promptly gather detailed information on the nature and scope of the incident and assess the potential impacts to DOE staff and contractors. Based on the findings of this investigation, no classified data was compromised.

We believe several hundred DOE employees' and contractors' PII may have been affected. As individual affected employees are identified, they will be notified and offered assistance on steps they can take to protect themselves from potential identity theft.

Once the full nature and extent of this incident is known, the Department will implement a full remediation plan. As more specific information is gathered regarding affected employees and contractors, the Department will make further notifications.

The Department is also leading an aggressive effort to reduce the likelihood of these events occurring again. These efforts include leveraging the combined expertise and capabilities of the Department's Joint Cybersecurity Coordination Center to address this incident, increasing monitoring across all of the Department's networks and deploying specialized defense tools to protect sensitive assets.

Cybersecurity is a shared responsibility, and we all play an important role in maintaining the integrity and security of our networks. To help minimize impacts and reduce any potential risks, please keep the following best practices in mind:

* Encrypt all files and emails containing PII or sensitive information, including files stored on hard drives or on the shared network.
* Do not store or email non-government related PII on DOE network computers

 

THE PLAGUE - New York Times says Chinese hackers hit its networks as paper investigated leader’s wealth

Once again we see Chinese state-sponsored hackers being accused of penetrating Western systems . . . this time, The New York Times! While getting a jump on the news most New York Times reporters may be storing behind their firewall isn't particularly heinous a crime (!), it's the list of contacts they've cultivated -- informants -- about whom I most worry. Since the hack, I wonder how many sources/informants the Chinese government has arrested as a result. Even one would be too many. Sometimes, it's best to stick to non-IP pieces of paper!

Check out this piece from the Washington Post. (Sorry, NYT; don't trust any newspaper's objectivity when they report on themselves.)

New York Times says Chinese hackers hit its networks as paper investigated leader’s wealth

By Associated Press, Updated: Thursday, January 31, 6:29 AM

BEIJING — Chinese hackers repeatedly penetrated The New York Times’ computer systems over the past four months, stealing reporters’ passwords and hunting for files on an investigation into the wealth amassed by the family of a top Chinese leader, the newspaper reported Thursday.

Security experts hired to investigate and plug the breach found that the attacks used tactics similar to ones used in previous hacking incidents traced to China, the report said. It said the hackers routed the attacks through computers at U.S. universities, installed a strain of malicious software, or malware, associated with Chinese hackers and initiated the attacks from Chinese university computers previously used by the Chinese military to attack U.S. military contractors.

The attacks, which began in mid-September, coincided with a Times investigation into how the relatives and family of Premier Wen Jiabao built a fortune worth over $2 billion. The report, which was posted online Oct. 25, embarrassed the Communist Party leadership, coming ahead of a fraught transition to new leaders and exposing deep-seated favoritism at a time when many Chinese are upset about a wealth gap.

Over the months of cyber-incursions, the hackers eventually lifted the computer passwords of all Times employees and used them to get into the personal computers of 53 employees.

The report said none of the Times’ customer data was compromised and that information about the investigation into the Wen family remained protected, though it left unclear what data or communications the infiltrators accessed.

“Computer security experts found no evidence that sensitive emails or files from the reporting of our articles about the Wen family were accessed, downloaded or copied,” the report quoted executive editor Jill Abramson as saying. A Times spokeswoman declined to comment further.

The Chinese foreign and defense ministries called the Times’ allegations baseless, and the Defense Ministry denied any involvement by the military.

“Chinese law forbids hacking and any other actions that damage Internet security,” the Defense Ministry said in a statement. “The Chinese military has never supported any hacking activities. Cyber-attacks are characterized by being cross-national and anonymous. To accuse the Chinese military of launching cyber-attacks without firm evidence is not professional and also groundless.”

China has been accused by the U.S., other foreign governments and computer security experts of mounting a widespread, aggressive cyber-spying campaign for several years, trying to steal classified information and corporate secrets and to intimidate critics. Foreign reporters and news media, including The Associated Press, have been among the targets of attacks intended to uncover the identities of sources for news stories and to stifle critical reports about the Chinese government.

“Attacks on journalists based in China are increasingly aggressive, disruptive and sophisticated,” said Greg Walton, a cyber-security researcher who has tracked Chinese hacking campaigns. China’s cyber-spying efforts have excelled in part because of the government’s “willingness to ignore international norms relating to civil society and media organizations,” he said.

The Times reported that executives became concerned just before the publication of the Wen investigation after learning that Chinese officials had warned of unspecified consequences. Soon after the Oct. 25 publication, AT&T, which monitors the Times’ computer networks, notified the company about activity consistent with a hacking attack, the report said.

After months of investigation by the computer security firm Mandiant, experts are still unsure how the hackers initially infiltrated the Times’ computer systems, the report said.

THE PLAGUE - Tools of Modern Gunmaking: Plastic and a 3-D Printer

The idea that you can use a 3-D Printer to create a gun is frightening. 3-D Printers play an important role in my new novel, The Plague (404). Imagine having a device in your home that can be used to fashion pretty much anything out of plastic -- from guns to VR goggles (as in my book). Check out this story from The New York Times. Chilling.

A gun with a plastic lower receiver that was produced using a 3-D printer.

Tools of Modern Gunmaking: Plastic and a 3-D Printer

By HENRY FOUNTAIN

A man in Wisconsin viewed it as a technical challenge. Another, in New Hampshire, was looking to save some money. And in Texas, a third wanted to make a political point.

The three may have had different motivations but their results were the same: each built a working gun that included a part made in plastic with a 3-D printer.

What they did was legal and, except for the technology and material used, not much different from what do-it-yourself gunsmiths have been doing for decades. But in the wake of the shootings in Newtown, Conn., and the intensified debate over gun control, their efforts, which began last summer, have stoked concerns that the inexpensive and increasingly popular printers and other digital fabrication tools might make access to weapons even easier.

“We now have 3-D printers that can manufacture firearms components in the basement,” said Representative Steve Israel, Democrat of New York. “It’s just a matter of time before a 3-D printer will produce a weapon capable of firing bullets.”

A 3-D printer builds an object layer by layer in three dimensions, usually in plastic. To effectively outlaw weapons made with them, Mr. Israel wants to extend an existing law, set to expire this year, that makes weapons that are undetectable by security scanners — like a printed all-plastic gun — illegal.

But there are also major technical obstacles to creating an entire gun on a 3-D printer, not the least of which is that a plastic gun would probably melt or explode upon firing a single bullet, making it about as likely to kill the gunman as the target.

In the meantime, Michael Guslick in Milwaukee, Chapman Baetzel in Dover, N.H., and Cody Wilson in Austin, Tex., did something much simpler and, for now, more effective. They printed the part of an AR-15 assault rifle called the lower receiver, the central piece that other parts are attached to. Then, using standard metal components, including the chamber and barrel — the parts that must be strong enough to withstand the intense pressure of a bullet firing — they assembled working guns.

In all, the three men, who have written about their efforts on the Web, have fired hundreds of rounds, although the plastic receivers eventually deform, crack or otherwise fail from heat and shock. But Mr. Wilson, for one, is working on a fourth-generation design that he says should be more durable.

A lower receiver is the only part of an AR-15 that, when bought, requires the filing of federal paperwork. But it is legal to make an AR-15 — and many other guns — for personal use as long as there is no intent to sell them. And if the lower receiver is homemade, no paperwork is required.

Amateur gunsmiths have made lower receivers for years, in metal, although the process requires a certain level of machining expertise. Inexpensive 3-D printers have grown in popularity — their rise has been compared with that of personal computers in the 1980s — in part because they are easy to use. It is not even necessary to know how to create the design files that instruct the device to print bit after bit of plastic to build the object, as there are files for tens of thousands of objects available on the Internet, created by other users and freely shared.

Still, some tinkering is usually required. Mr. Guslick, who works in information technology and describes himself as a hobbyist gunsmith, printed his receiver on a machine he bought online through Craigslist. He used a file and abrasive paper to make the piece fit properly, but over all the project was not much of a technical challenge. “Anybody could do this,” he said.

Mr. Baetzel, who made his receiver on a 3-D printer he built from a kit, said the part worked fine until he cracked it when bumping the gun while putting it in his car. He has since printed a replacement along with a modified grip and stock which, he said, has made the gun sturdier.

For Mr. Baetzel, who works as a software tester, the motivation for printing gun parts was economic. “Shooting is an expensive sport,” he said. He figured he could save perhaps $40 by making the receiver rather than buying one.

Only Mr. Wilson, a law student who prints his receivers on friends’ machines, had overtly political motives, wanting to demonstrate what he called the absurdity of gun-control laws. He took his efforts even further, printing high-capacity magazines like those that would be banned under recommendations proposed by President Obama and successfully testing them this month on a firing range south of Austin. He has posted the drawing files at his Web site, defcad.org, so that others can print the magazine.

“It’s unbannable,” he said. “The Internet has it now.”

Mr. Wilson also has a project to develop a fully printable one-shot weapon, although he has not made much progress. He is seeking a firearms manufacturer’s license, which he would need to even make prototypes of a complete weapon.

He gets advice and technical help from a network of about 15 collaborators around the world, and has posted other printer files at his site, including Mr. Guslick’s file for a lower receiver.

Mr. Baetzel posted his files on his own blog, Ambulatory Armament Depot, after a printer file-sharing site, Thingiverse, forced him to remove them in December. A spokeswoman for MakerBot, a 3-D printer manufacturer that sponsors Thingiverse, pointed out that the site’s terms of service prohibit content that “contributes to the creation of weapons.”

Mr. Guslick, who is currently machining a few metal lower receivers, said 3-D printers were far from the best tool for gun-making, an opinion shared by Neil Gershenfeld, a professor at M.I.T. and director of the school’s Center for Bits and Atoms.

“A well-equipped machine shop for a long time has been able to make gun parts,” Mr. Gershenfeld said. “Three-D printers make not very good ones.”

The types of computer-controlled tools found in a machine shop — primarily laser cutters and milling machines — are expensive. But smaller and cheaper versions are now available to dedicated hobbyists, though they do not yet have quite the mass appeal of 3-D printers.

Yet the printers have other drawbacks besides the use of plastic. They are slow, often taking hours to build an object, and the results, while impressive to the eye, can be too crude for extremely close-fitting parts.

And as Mr. Guslick pointed out, anyone who is desperate for a weapon “has the ability to assemble a zip gun from parts bought in a hardware store for $15.”

The National Rifle Association did not respond to messages requesting the group’s position on 3-D manufacturing. But for gun-control advocates, the real worry regarding 3-D printers and other machines is what the future might bring in the way of technological advances.

“Down the road it’s going to be a big concern,” said Josh Horwitz, executive director of the Coalition to Stop Gun Violence. “We don’t know how that’s going to come about and don’t know what technology.”

Mr. Baetzel, for one, said he did not worry about what other people might do with the technology. “I follow the laws,” he said. “I personally think everyone else should follow them.”

He said he did not post his designs hoping that someone would use them illegally. “It was more, ‘Look at this cool thing I did.’”

THE PLAGUE - In China, Beware: A Camera May Be Watching You

Thirty million+ cameras in China . . . and they're watching you. Check out this frightening story from NPR. Looks like The Plague (404) is not that far away from reality after all!

 

The use of security cameras such as these, looking out over Tiananmen Square in Beijing, is on the rise in China. Critics say the government is using them to discourage dissident. (Ed Jones /AFP/Getty Images)

China is becoming a surveillance state. In recent years, the government has installed more than 20 million cameras across a country where a decade ago there weren't many.

Today, in Chinese cities, cameras are everywhere: on highways, in public parks, on balconies, in elevators, in taxis, even in the stands at sporting events.

Officials say the cameras help combat crime and maintain "social stability" — a euphemism for shutting up critics.

In fact, the government routinely uses cameras to monitor and intimidate dissidents. Human rights activists worry that more surveillance will erode the freedom of ordinary people and undermine what little ability they have to question their rulers.

Life Under Surveillance

Li Tiantian knows firsthand how the state can use video images against people it doesn't like. Li, 46, is an outspoken human rights lawyer in Shanghai.

Police watch Li so closely, it's best to visit her after dark and use a grove of trees behind her apartment building as cover. Once inside, she'll tell you to turn off your cellphone and put it in another room.

"People with technological know-how all said the cops can use cellphones to monitor people, track your location, even use cellphones as a listening device," Li explains, as dumplings she's prepared bubble in a pot. "People have reached a consensus that when we chat together, we put cellphones away."

Li Tiantian, a human rights lawyer, is under heavy surveillance by Chinese authorities. She says police tried to get her boyfriend to break up with her by showing him photos of other men she had been involved with. (Frank Langfitt/NPR)

Sound paranoid?

It isn't.

Chinese state security agents have privately confirmed they can turn cellphones into listening devices. Li says they also eavesdrop on her conversations to track her movements and arrest her.

"One morning, when I was going to a court hearing, I called a gypsy cab," says Li. "Police found out through the telephone that the car was coming to my compound. Then they waited there to catch me."

Li takes most of this in stride, but what really angered her was when agents invaded her private life. In 2011, they showed her boyfriend photos of other men she'd been involved with.

They also tried to show him surveillance camera video of Li entering hotels with the men at various times, but the boyfriend refused to watch.

Li criticizes China's government, talking freely with journalists and other people on China's increasingly freewheeling Internet. She says Shanghai authorities are trying to force her to leave the city and return to her home in far western China.

"What they can do is to destroy my life," says Li, who wears her hair in a mop top and serves dinner while wearing a down coat to ward off the chill in her sparsely furnished apartment. "So, they asked my boyfriend to break up with me."

He hasn't yet, but he's feeling the heat. The government has already stripped Li of her lawyer's license.

When I asked to interview her boyfriend on tape, he refused, fearing he could lose his job, too, and the couple would become destitute. Li and her boyfriend argued, revealing the very real strains of a life under police surveillance and political pressure. Li says this is the true face of the Communist Party: a regime that will resort to any means to crush its critics.

"Many people have been deceived by the government," she says. "They think this government is OK and it wouldn't do such dirty, disgusting and shameless things. I feel they are all like poisonous snakes. I fear them and hate them." 

Cameras Everywhere

In 2005, China began building a nationwide surveillance system. Officials dubbed it "Skynet," with no apparent sense of irony. "Skynet" is also the name of the computer system in the Terminator films that attacks mankind.

The government placed cameras along streets, on public buses and outside the homes of dissidents. After uprisings in the western regions of Xinjiang and Tibet, the authorities also installed cameras in mosques and temples.

In recent years, the southwestern city of Chongqing set a goal to install half-million cameras. Police there boasted that during Chinese New Year in 2010 their surveillance apparatus identified 4,000 undesirables who had entered town. According toSWeekly, a Chinese magazine, the police confronted most of them within six hours and forced them to leave.

Human rights activists say the implications of so much surveillance in the hands of an authoritarian regime operating without the rule of law are scary.

"The greatest fear is the state uses its surveillance and technology to curtail the modest freedoms that Chinese enjoy today," says Nicholas Bequelin, a Hong Kong-based researcher for Human Rights Watch.

Bequelin says the Communist Party's ultimate goal is highly accurate, facial-recognition technology that would allow the government to visually track critics in real time.

"That would be a game changer," he says, one that could "prevent the emergence of any challenge to the party in the short and long term."

China already uses facial recognition in places like immigration checkpoints.

Bo Zhang, who follows China's surveillance camera market for IMS Research, says facial recognition is much less effective on the street, where lighting varies.

"Frankly, the technology is not as good as described in the movies," he says. "It's not that easy to find people in crowds."

And, Zhang says, the government still has to knit together the country's disparate surveillance networks into one, all-seeing eye.

As elsewhere, surveillance has many positive uses in China. Shanghai police say video cameras helped them catch more 6,000 suspects in 2010, but declined to discuss those successes with NPR.

Last year, police in Chongqing used a series of cameras to identify a serial killer, analyze his habits, track his movements and ultimately kill him.

Some Feel Safer, Many Feel Dread

The volume of surveillance cameras on a Chinese city street can be overwhelming at times. On a stretch of road half a block from NPR's Shanghai bureau, I counted 11 cameras within a 100-foot radius.

Despite the density, many ordinary Chinese are unfazed. Liao Guosheng, who sells shoes and hats from a three-wheel bike, says the cameras deter shoplifters.

"Before, when I parked my tricycle in neighborhoods, thieves always stole things," says Liao. "Now, they rarely steal. I feel a sense of safety."

Other people, though, feel a sense of dread.

Last year, Beijing's China University of Politics and Law installed cameras in classrooms. Officials said it was to prevent cheating, but professors didn't believe them.

Liu Xin, who teaches administrative law, thinks the school plans to target teachers who might criticize China's current system in front of students.

"Because things are recorded, once they suspect certain teachers are problematic ... they can find the recordings and that means they've found evidence," Li says.

She says cameras will intimidate instructors from speaking their minds and undermine learning. Li thinks professors will just teach from textbooks to protect themselves.

"I think teachers will lose interest and students will lose interest as well," she says.

The Ministry of Education refused NPR's request for an interview and insisted the cameras are just to deter cheating. Bo Zhang, the analyst, estimates there are now about 30 million cameras operating in China — or about one for every 43 citizens. He expects camera sales to grow 20 percent annually over the next five years.

THE PLAGUE - At CES, Vendors Hope to Link All Your Appliances To the Net

This story from NPR speaks to all the new gadgets and gizmos that are being shown at CES this January - all designed to link you to the Net.

Having just finished The Plague, I can tell you that that's not always such a good thing!

As more devices connect to the Internet, more companies are flocking to the Consumer Electronics Show in Las Vegas. Dozens of them are hoping to bring all the appliances in your home online.

RENEE MONTAGNE, HOST:

That big consumer electronics show in Las Vegas ends today. And while big tech firms like Google and Apple did not attend, an increasingly diverse range of companies took their place. With more and more devices connecting to the Internet, many companies are flocking to this festival of gadgets, hoping to bring all the appliances in your home online. NPR's Steve Henn reports.

STEVE HENN, BYLINE: The Internet isn't just for people anymore. What began as a way for human beings to communicate using computers, smartphones or tablets has evolved into a network that's connecting more and more machines to each other. And the machines have a lot to say. Meet Ivee.

JONATHON NOSTRANT: Hello, Ivy.

(SOUNDBITE OF BEEPING)

HENN: That's Jonathon Nostrant, the founder and CEO of the company that makes Ivee.

NOSTRANT: What's the weather in London on Saturday?

IVEE: Saturday in London, the temperature will be 34 degrees. You can expect partly cloudy skies mid-morning.

HENN: Ivee is a next generation alarm clock.

NOSTRANT: So we started making voice-activated talking alarm clocks. And basically what we found is that people like to talk to devices. The biggest benefit with our products today is that they can set the time of the alarm, but tomorrow they're going to be able to do so much more.

HENN: Say you're chilly. Just tell Ivee to turn up the heat.

IVEE: OK. I've set your thermostat to 73.

HENN: Sensors that can connect to the Net are already embedded in some thermostats, scales, door locks, light switches, windows, and even some sprinkler systems. This is supposed to be the future, right? The smart connected home.

NOSTRANT: Typically people see the phone and the tablet as being the only interface to interact with the smart home.

HENN: But Nostrant thought, why not just talk to it? I mean do you really want to use your iPhone to turn on and off the lights?

NOSTRANT: Instead of taking your phone out of your pocket, sliding over the bar, hitting the app to get in the app, going to the button, selecting the lights on and off, why not just say, hello, Ivee, turn the lights on?

HENN: The thing is, Ivee is just one of dozens of different companies which are competing to get the smart home to actually work. There are crowd-funded start-ups like Smart Things. There are security companies, like ADT and Alarm.com. Even giant telecoms like Verizon - all want to sell you something to help you connect every little appliance you own to the Net. There's even one very big hardware store getting into this act: Lowe's.

KEVIN MARR: My name's Kevin Marr and my title VP of Smart Home for Lowe's.

HENN: When did Lowe's decide that it needed a VP for Smart Home? How long have you had this job?

MARR: Exactly a year - just a little over a year, but...

HENN: Marr has been building connected gadgets for so-called smart homes for more than a decade.

MARR: You walk out to your car and frankly everything in your car works, interacts with each other. You've got central locking, electric windows. The door locks when you turn the ignition on. You know, there's a logic to the way all these things work.

HENN: In the home, Marr says, these same kinds of technologies could help save energy and water. They can make your home safer. They could even send you a text if an elderly parent doesn't get up and fire up the coffee maker at the usual time.

MARR: Everything but everything is going to be connected to the Internet.

HENN: And a lot of good could come of that, so Lowe's created a simple control system called Iris you can install yourself, that can talk to almost any connected appliance Lowe's sells. In the past, companies built different kinds of sensors into products and all these little gizmos couldn't talk to each other.

MARR: And that's the advantage we have at Lowe's. We sell this stuff and we can talk with our vendors and we can say, look, guys, I want you to make it so that when it connects, it connects this way.

HENN: And if you're an executive at, say, Pella Windows or Whirlpool, when Lowe's calls, you take the call. So if you've been waiting years for a smart fridge to go with your smartphone, that wait could possibly be coming to an end. Steve Henn, NPR News.

THE PLAGUE - Aerial Drones May Be Vulnerable to Sabotage Because of GPS

This piece by excellent journalist Tara McKelvey, 2011 Guggenheim fellow, and correspondent for Newsweek/The Daily Beast and a frequent contributor to The New York Times Book Review suggests our drones may have already been hacked by the Iranians, resulting in their skyjacking a Sentinel to Iran.

Aerial Drones May Be Vulnerable to Sabotage Because of GPS

The recovery of a drone in Iran may have exposed a serious flaw in the system that has become the cornerstone of America's military campaign against terrorists.

Earlier this fall, the Air Force acknowledged in a little-noticed press release that a virus had affected computers at its Nevada base where many of America’s unmanned aerial vehicles—those famed drones—are operated remotely in faraway war zones. Air Force officials emphasized that the breach did not specifically impact the operation of drones, describing it as “more of a nuisance than an operational threat.”

Now, three months later, government officials are eerily quiet on how a fully operational drone managed to get captured in Iran amid reports the GPS system may have been hacked. Suddenly, America’s vaunted drones—the weapon of choice for spying, killing and tracking U.S. enemies these last few years—seem to have lost a sliver of invincibility and created worries about the vulnerabilities to increasingly curious enemies.

Iranian scientists say that they tricked the CIA-directed drone, a model known as an RQ-170 Sentinel, and forced it to land on their soil, according to The Christian Science Monitor. U.S. officials, speaking only on condition of anonymity because of the sensitive nature of the subject, say that the claims of the Iranians are utterly untrue.

Officials in Tehran and Washington will probably argue for years about what really happened. Still, some uncomfortable facts about the incident are beyond dispute. Michael Toscano, president of the Arlington, Va.–based Association for Unmanned Vehicle Systems International, notes: “A UAV did not perform the way it was supposed to,” using an abbreviation for an unmanned aerial vehicle. “And the bad guys got it.”

This photo released by the Revolutionary Guards, claims to show a U.S. Sentinel drone, which Iranian officials say was downed in an undisclosed location in Iran. (Sepahnews / AP Photo)

This has been a public-relations bonanza for officials such as Iranian Foreign Minister Ali Akbar Salehi, who described the drone’s incursion into Iran as a “hostile and aggressive act.”

U.S. officials, unsurprisingly, remain committed to the Sentinel and other drones, regardless of what the Iranians say, but meanwhile some people in this country are wondering if the drones are really as awesome, or flawless, as they have been made out to be.

“Falling in love with your own technology is always a mistake. That’s what they did with the Titanic.”

Ten years have passed since a U.S.-directed aerial drone, gliding over Afghanistan, fired a missile for the first time, and since then the drone has become the most important weapon in the global war against al Qaeda and other terrorist groups.

Yet despite its success in taking out al Qaeda leaders in Pakistan, Yemen and other countries, the flaws in the drone program are becoming apparent: insurgents hacked into video feeds from drones in Iraq and Afghanistan a couple years ago; the unmanned aircraft tend to spin off course and crash; and now questions are being raised about the security of their tracking devises.

Security experts say that a new arms race, involving drone technology, is heating up. As Americans increase the deployment of the unmanned aerial vehicles, sending out thousands every year, people in other countries are starting to learn how to take them down.

Air Force officials refuse to speak about “operational” issues in the drone program, and CIA officials refuse to speak about it at all. Nevertheless, the officials will say in general terms that they work hard to eliminate kinks in their operations abroad, and they also say that things are running smoothly.

“We’re obviously constantly looking to identify potential vulnerabilities,” says Lt. Col. John Haynes, a spokesman for the U.S. Air Force, “and when we do see them, we take the most appropriate action.”

They may be taking some action in the future, given the weaknesses that appear to have been exposed in the Sentinel. The main problem lies not with the Sentinel itself or with other drones, say researchers who are familiar with the aircraft, but with their tracking devices: the GPS that they use to navigate rugged lands in Afghanistan, Pakistan, Iran, and other places in the world using global positioning system satellites.

The drones apparently use encrypted GPS devices during their flights, and are also outfitted with civilian tracking devices, just in case the encrypted system goes down. That might have been what happened to the Sentinelthat landed in Iran.

Like with any technical problem, there is a way to work around it. Drones could operate on their own, without GPS or input from ground commanders, for example. “It’s possible to recognize a mountain on the horizon and then another mountain and then cross-reference it,” explains Kasper Rasmussen, a visiting researcher at University of California, Irvine, who has written about GPS spoofing attacks.

Yet the challenges are immense, and for that reason officials equip the aircraft with GPS tracking devices. “It’s probably the best tool they have available,” Rasmussen says.

When engineers and supporters of the drone program talk about the failure of the Sentinel in Iran, they sound like ... engineers and drone supporters. “You take a look at what went wrong,” the Association for Unmanned Vehicle Systems International’s Toscana says. “Then you look at what measures you need to put in place so it doesn’t happen again.” He also believes that the incident in Iran has an upside.

“It’s like when the oil spill happened in the Gulf, and it caused people to pay more attention to the problem, and after that things got better,” he explains.

Others, too, believe Americans will learn—and in this way benefit—from the incident in Iran. “These problems with GPS are relatively trivial. We will fix it. That’s how innovation happens,” says Missy Cummings, a former U.S. Navy pilot who is now an associate professor of aeronautics at Massachusetts Institute of Technology. “It is the natural course of technological development.”

Not everybody is sanguine. Roger Johnston, the section manager of the Vulnerability Assessment Team at the Department of Energy’s Argonne National Laboratory in Illinois, helped to demonstrate weaknesses in civilian GPS tracking devises nine years ago in a New Mexico desert. He and his colleagues used a GPS satellite simulator and managed to send GPS signals for more than a mile.

Johnston and his colleagues later wrote papers about the weaknesses in the GPS tracking devices, alerting government officials about the problem and also about the dark scenarios that could unfold. “They just kind of went, ‘Oh,’ and then they said, ‘That’s not very likely,’” he recalls.

Years later, the technological prowess of the drone won over President Barack Obama and administration officials, as well as top-level officials at the Pentagon and the CIA, and they made it into a signature weapon of the Obama White House. That may have been part of the problem. Johnston believes that government officials, as well as engineers, have been so taken with the seductive appeal of the drone that it has blinded them to its flaws.

“Falling in love with your own technology is always a mistake,” he explains. “That’s what they did with the Titanic.”

When Johnston talks about the failure of the Sentinel in Iran, he sounds frustrated. “In my view, this was a total no-brainer,” he says. “If indeed it involves spoofing of civilian GPS, this is jaw-droppingly stupid. I don’t buy the argument, ‘Oh, well, who could have seen this?’ We did.”

THE PLAGUE - Bank Hacking Was the Work of Iranians, Officials Say

This story just in from The New York Times confirms that recent attacks on U.S. banks is the work of the Iranians.  But this time, instead of stringing together individual PCs into Botnets and executing DDoS attacks, they're putting together networks of computers in data centers.

Bank Hacking Was the Work of Iranians, Officials Say

By NICOLE PERLROTH and QUENTIN HARDY

SAN FRANCISCO — The attackers hit one American bank after the next. As in so many previous attacks, dozens of online banking sites slowed, hiccupped or ground to a halt before recovering several minutes later.

James A. Lewis of the Center for Strategic and International Studies in Washington believes that recent online attacks on American banks have been the work of Iran.

But there was something disturbingly different about the wave of online attacks on American banks in recent weeks. Security researchers say that instead of exploiting individual computers, the attackers engineered networks of computers in data centers, transforming the online equivalent of a few yapping Chihuahuas into a pack of fire-breathing Godzillas.

The skill required to carry out attacks on this scale has convinced United States government officials and security researchers that they are the work of Iran, most likely in retaliation for economic sanctions and online attacks by the United States.

“There is no doubt within the U.S. government that Iran is behind these attacks,” said James A. Lewis, a former official in the State and Commerce Departments and a computer security expert at the Center for Strategic and International Studies in Washington.

Mr. Lewis said the amount of traffic flooding American banking sites was “multiple times” the amount that Russia directed at Estonia in a monthlong online assault in 2007 that nearly crippled the Baltic nation.

American officials have not offered any technical evidence to back up their claims, but computer security experts say the recent attacks showed a level of sophistication far beyond that of amateur hackers. Also, the hackers chose to pursue disruption, not money: another earmark of state-sponsored attacks, the experts said.

“The scale, the scope and the effectiveness of these attacks have been unprecedented,” said Carl Herberger, vice president of security solutions at Radware, a security firm that has been investigating the attacks on behalf of banks and cloud service providers. “There have never been this many financial institutions under this much duress.”

Since September, intruders have caused major disruptions to the online banking sites of Bank of America, Citigroup, Wells Fargo, U.S. Bancorp, PNC, Capital One, Fifth Third Bank, BB&T and HSBC.

They employed DDoS attacks, or distributed denial of service attacks, named because hackers deny customers service by directing large volumes of traffic to a site until it collapses. No bank accounts were breached and no customers’ money was taken.

By using data centers, the attackers are simply keeping up with the times. Companies and consumers are increasingly conducting their business over large-scale “clouds” of hundreds, even thousands, of networked computer servers.

These clouds are run by Amazon and Google, but also by many smaller players who commonly rent them to other companies. It appears the hackers remotely hijacked some of these clouds and used the computing power to take down American banking sites.

“There’s a sense now that attackers are crafting their own private clouds,” either by creating networks of individual machines or by stealing resources wholesale from poorly maintained corporate clouds, said John Kindervag, an analyst at Forrester Research.

How, exactly, attackers are hijacking data centers is still a mystery. Making matters more complex, they have simultaneously introduced another weapon: encrypted DDoS attacks.

Banks encrypt customers’ online transactions for security, but the encryption process consumes system resources. By flooding banking sites with encryption requests, attackers can further slow or cripple sites with fewer requests.

A hacker group calling itself Izz ad-Din al-Qassam Cyber Fighters has claimed in online posts that it was responsible for the attacks.

The group said it attacked the banks in retaliation for an anti-Islam video that mocked the Prophet Muhammad, and pledged to continue its campaign until the video was scrubbed from the Internet. It called the campaign Operation Ababil, a reference to a story in the Koran in which Allah sends swallows to defeat an army of elephants dispatched by the king of Yemen to attack Mecca in A.D. 571.

But American intelligence officials say the group is actually a cover for Iran. They claim Iran is waging the attacks in retaliation for Western economic sanctions and for a series of cyberattacks on its own systems. In the last three years, three sophisticated computer viruses — calledFlame, Duqu and Stuxnet — have hit computers in Iran. The New York Times reported last year that the United States, together with Israel, was responsible for Stuxnet, the virus used to destroy centrifuges in an Iranian nuclear facility in 2010.

“It’s a bit of a grudge match,” said Mr. Lewis of the Center for Strategic and International Studies.

(On Wednesday, the Iranian government denied involvement in the cyberattacks. “Unlike the United States, which has per reports in the media given itself the license to engage in illegal cyber-warfare against Iran, Iran respects the international law and refrains from targeting other nations’ economic or financial institutions,” wrote Alireza Miryousefi, first secretary of the Iranian mission to the United Nations, in an e-mail.)

Researchers at Radware who investigated the attacks for several banks found that the traffic was coming from data centers around the world. They discovered that various cloud services and public Web hosting services had been infected with a particularly sophisticated form of malware, called Itsoknoproblembro, that was designed to evade detection by antivirus programs. The malware has existed for years, but the banking attacks were the first time it used data centers to attack external victims.

Botnets, or networks of individual infected slave computers, can typically be traced back to a command and control center, but security experts say Itsoknoproblembro was engineered to make it very difficult to tie it to one party. Security researchers have come up with a new name for servers infected with Itsoknoproblembro: they call them “bRobots.”

In an amateur botnet, the command and control center can be easily identified, but Mr. Herberger said it had been nearly impossible to do so in this case, suggesting to him that “the campaign may be state-sponsored versus amateur malware.”

Attackers used the infected servers to fire traffic simultaneously at each banking site until it slowed or collapsed.

By infecting data centers instead of computers, the hackers obtained the computing power to mount enormous denial of service attacks. One of the banks had 40 gigabits of Internet capacity, Mr. Herberger said, a huge amount when you consider that a midsize business may only have one gigabit. But some banks were hit with a sustained flood of traffic that peaked at 70 gigabits.

Mr. Herberger declined to say which cloud service providers had been compromised, citing nondisclosure agreements with Radware’s clients, but he said that each new bank attack provided evidence that more data centers had been infected and exploited.

The attackers said last week that they had no intention of halting their campaign. “Officials of American banks must expect our massive attacks,” they wrote. “From now on, none of the U.S. banks will be safe.”

THE PLAGUE - U.S. Terrorism Agency to Tap a Vast Database of Citizens

As I come to the end of my new novel, The Plague (404), it's startling to see the NCTC in the news again. This relatively obscure agency is where my hero, Jonatatan Carlsen, works. See how it is mired in controversy over the use of certain datamarts, as reported in the Wall Street Journal by Julia Angwin.

 

U.S. Terrorism Agency to Tap a Vast Database of Citizens

By JULIA ANGWIN

Top U.S. intelligence officials gathered in the White House Situation Room in March to debate a controversial proposal. Counterterrorism officials wanted to create a government dragnet, sweeping up millions of records about U.S. citizens—even people suspected of no crime.

Not everyone was on board. "This is a sea change in the way that the government interacts with the general public," Mary Ellen Callahan, chief privacy officer of the Department of Homeland Security, argued in the meeting, according to people familiar with the discussions.

A week later, the attorney general signed the changes into effect.

Through Freedom of Information Act requests and interviews with officials at numerous agencies, The Wall Street Journal has reconstructed the clash over the counterterrorism program within the administration of President Barack Obama. The debate was a confrontation between some who viewed it as a matter of efficiency—how long to keep data, for instance, or where it should be stored—and others who saw it as granting authority for unprecedented government surveillance of U.S. citizens.

The rules now allow the little-known National Counterterrorism Center to examine the government files of U.S. citizens for possible criminal behavior, even if there is no reason to suspect them. That is a departure from past practice, which barred the agency from storing information about ordinary Americans unless a person was a terror suspect or related to an investigation.

Now, NCTC can copy entire government databases—flight records, casino-employee lists, the names of Americans hosting foreign-exchange students and many others. The agency has new authority to keep data about innocent U.S. citizens for up to five years, and to analyze it for suspicious patterns of behavior. Previously, both were prohibited. Data about Americans "reasonably believed to constitute terrorism information" may be permanently retained.

The changes also allow databases of U.S. civilian information to be given to foreign governments for analysis of their own. In effect, U.S. and foreign governments would be using the information to look for clues that people might commit future crimes.

"It's breathtaking" in its scope, said a former senior administration official familiar with the White House debate.

Counterterrorism officials say they will be circumspect with the data. "The guidelines provide rigorous oversight to protect the information that we have, for authorized and narrow purposes," said Alexander Joel, Civil Liberties Protection Officer for the Office of the Director of National Intelligence, the parent agency for the National Counterterrorism Center.

The Fourth Amendment of the Constitution says that searches of "persons, houses, papers and effects" shouldn't be conducted without "probable cause" that a crime has been committed. But that doesn't cover records the government creates in the normal course of business with citizens.

Congress specifically sought to prevent government agents from rifling through government files indiscriminately when it passed the Federal Privacy Act in 1974. The act prohibits government agencies from sharing data with each other for purposes that aren't "compatible" with the reason the data were originally collected.

The Wall Street Journal is conducting a long-running investigation into the profound transformation of personal privacy in America.

Selected findings:

• Companies today are increasingly tying people's real-life identities to their online browsing habits.
• Two students are outed as gay—provoking a crisis within their families—by a Facebook privacy loophole . (10/12/12)
• Suspicious spouses are taking investigations into their own hands as snooping technologies become cheaper and easier to use. (10/6/12)
• Americans' license plates are now being tracked not only by the government, but also by repo men who hope to profit from the information. (10/2/12)
• Google bypassed the privacy settings on millions of Web browsers on Apple iPhones and computers— tracking the online activities of people who intended that kind of monitoring to be blocked. (2/17/12)
• The government follows the movements of thousands of Americans a year by secretly monitoring their cellphone records . (9/9/11)
• iPhone and Android apps secretly shared data about their users, a Journal investigation found.(12/10/10)
• Top apps on Facebook transmit personal identifying details to tracking companies, a Journal investigation found. (10/18/10)
• One of the fastest growing online businesses is that of spying on Americans as they browse the Web. (6/30/10)
• Plus, the global surveillance bazaar, a secretive phone-tracking "stingray" and RapLeaf's clever way of figuring out Web surfers' real names .

But the Federal Privacy Act allows agencies to exempt themselves from many requirements by placing notices in the Federal Register, the government's daily publication of proposed rules. In practice, these privacy-act notices are rarely contested by government watchdogs or members of the public. "All you have to do is publish a notice in the Federal Register and you can do whatever you want," says Robert Gellman, a privacy consultant who advises agencies on how to comply with the Privacy Act.

As a result, the National Counterterrorism Center program's opponents within the administration—led by Ms. Callahan of Homeland Security—couldn't argue that the program would violate the law. Instead, they were left to question whether the rules were good policy.

Under the new rules issued in March, the National Counterterrorism Center, known as NCTC, can obtain almost any database the government collects that it says is "reasonably believed" to contain "terrorism information." The list could potentially include almost any government database, from financial forms submitted by people seeking federally backed mortgages to the health records of people who sought treatment at Veterans Administration hospitals.

Previous government proposals to scrutinize massive amounts of data about innocent people have caused an uproar. In 2002, the Pentagon's research arm proposed a program called Total Information Awareness that sought to analyze both public and private databases for terror clues. It would have been far broader than the NCTC's current program, examining many nongovernmental pools of data as well.

"If terrorist organizations are going to plan and execute attacks against the United States, their people must engage in transactions and they will leave signatures," the program's promoter, Admiral John Poindexter, said at the time. "We must be able to pick this signal out of the noise."

Adm. Poindexter's plans drew fire from across the political spectrum over the privacy implications of sorting through every single document available about U.S. citizens. Conservative columnist William Safire called the plan a "supersnoop's dream." Liberal columnist Molly Ivins suggested it could be akin to fascism. Congress eventually defunded the program.

The National Counterterrorism Center's ideas faced no similar public resistance. For one thing, the debate happened behind closed doors. In addition, unlike the Pentagon, the NCTC was created in 2004 specifically to use data to connect the dots in the fight against terrorism.

Even after eight years in existence, the agency isn't well known. "We're still a bit of a startup and still having to prove ourselves," said director Matthew Olsen in a rare public appearance this summer at the Aspen Institute, a leadership think tank.

The agency's offices are tucked away in an unmarked building set back from the road in the woodsy suburban neighborhood of McLean, Va. Many employees are on loan from other agencies, and they don't conduct surveillance or gather clues directly. Instead, they analyze data provided by others.

The agency's best-known product is a database called TIDE, which stands for the Terrorist Identities Datamart Environment. TIDE contains more than 500,000 identities suspected of terror links. Some names are known or suspected terrorists; others are terrorists' friends and families; still more are people with some loose affiliation to a terrorist.

TIDE files are important because they are used by the Federal Bureau of Investigation to compile terrorist "watchlists." These are lists that can block a person from boarding an airplane or obtaining a visa.

The watchlist system failed spectacularly on Christmas Day 2009 when Umar Farouk Abdulmutallab, a 23-year-old Nigerian man, boarded a flight to Detroit from Amsterdam wearing explosives sewn into his undergarments. He wasn't on the watchlist.

He eventually pleaded guilty to terror-related charges and is imprisoned. His bomb didn't properly detonate.

However, Mr. Abdulmutallab and his underwear did alter U.S. intelligence-gathering. A Senate investigation revealed that NCTC had received information about him but had failed to query other government databases about him. In a scathing finding, the Senate report said, "the NCTC was not organized adequately to fulfill its missions."

"This was not a failure to collect or share intelligence," said John Brennan, the president's chief counterterrorism adviser, at a White House press conference in January 2010. "It was a failure to connect and integrate and understand the intelligence we had."

As result, Mr. Obama demanded a watchlist overhaul. Agencies were ordered to send all their leads to NCTC, and NCTC was ordered to "pursue thoroughly and exhaustively terrorism threat threads."

Quickly, NCTC was flooded with terror tips—each of which it was obligated to "exhaustively" pursue. By May 2010 there was a huge backlog, according a report by the Government Accountability Office.

Legal obstacles emerged. NCTC analysts were permitted to query federal-agency databases only for "terrorism datapoints," say, one specific person's name, or the passengers on one particular flight. They couldn't look through the databases trolling for general "patterns." And, if they wanted to copy entire data sets, they were required to remove information about innocent U.S. people "upon discovery."

But they didn't always know who was innocent. A person might seem innocent today, until new details emerge tomorrow.

"What we learned from Christmas Day"—from the failed underwear bomb—was that some information "might seem more relevant later," says Mr. Joel, the national intelligence agency's civil liberties officer. "We realized we needed it to be retained longer."

Late last year, for instance, NCTC obtained an entire database from Homeland Security for analysis, according to a person familiar with the transaction. Homeland Security provided the disks on the condition that NCTC would remove all innocent U.S. person data after 30 days.

After 30 days, a Homeland Security team visited and found that the data hadn't yet been removed. In fact, NCTC hadn't even finished uploading the files to its own computers, that person said. It can take weeks simply to upload and organize the mammoth data sets.

Homeland Security granted a 30-day extension. That deadline was missed, too. So Homeland Security revoked NCTC's access to the data.

To fix problems like these that had cropped up since the Abdulmutallab incident, NCTC proposed the major expansion of its powers that would ultimately get debated at the March meeting in the White House. It moved to ditch the requirement that it discard the innocent-person data. And it asked for broader authority to troll for patterns in the data.

As early as February 2011, NCTC's proposal was raising concerns at the privacy offices of both Homeland Security and the Department of Justice, according to emails reviewed by the Journal.

Privacy offices are a relatively new phenomenon in the intelligence community. Most were created at the recommendation of the 9/11 Commission. Privacy officers are often in the uncomfortable position of identifying obstacles to plans proposed by their superiors.

At the Department of Justice, Chief Privacy Officer Nancy Libin raised concerns about whether the guidelines could unfairly target innocent people, these people said. Some research suggests that, statistically speaking, there are too few terror attacks for predictive patterns to emerge. The risk, then, is that innocent behavior gets misunderstood—say, a man buying chemicals (for a child's science fair) and a timer (for the sprinkler) sets off false alarms.

An August government report indicates that, as of last year, NCTC wasn't doing predictive pattern-matching.

The internal debate was more heated at Homeland Security. Ms. Callahan and colleague Margo Schlanger, who headed the 100-person Homeland Security office for civil rights and civil liberties, were concerned about the implications of turning over vast troves of data to the counterterrorism center, these people said.

They and Ms. Libin at the Justice Department argued that the failure to catch Mr. Abdulmutallab wasn't caused by the lack of a suspect—he had already been flagged—but by a failure to investigate him fully. So amassing more data about innocent people wasn't necessarily the right solution.

The most sensitive Homeland Security data trove at stake was the Advanced Passenger Information System. It contains the name, gender, birth date and travel information for every airline passenger entering the U.S.

Previously, Homeland Security had pledged to keep passenger data only for 12 months. But NCTC was proposing to copy and keep it for up to five years. Ms. Callahan argued this would break promises the agency had made to the public about its use of personal data, these people said.

Discussions sometimes got testy, according to emails reviewed by the Journal. In one case, Ms. Callahan sent an email complaining that "examples" provided to her by an unnamed intelligence official were "complete non-sequiturs" and "non-responsive."

In May 2011, Ms. Callahan and Ms. Schlanger raised their concerns with the chief of their agency, Janet Napolitano. They fired off a memo under the longwinded title, "How Best to Express the Department's Privacy and Civil Liberties Concerns over Draft Guidelines Proposed by the Office of the Director of National Intelligence and the National Counterterrorism Center," according to an email obtained through the Freedom of Information Act. The contents of the memo, which appears to run several pages, were redacted.

The two also kept pushing the NCTC officials to justify why they couldn't search for terrorism clues less invasively, these people said. "I'm not sure I'm totally prepared with the firestorm we're about to create," Ms. Schlanger emailed Ms. Callahan in November, referring to the fact that the two wanted more privacy protections. Ms. Schlanger returned to her faculty position at the University of Michigan Law School soon after but remains an adviser to Homeland Security.

To resolve the issue, Homeland Security's deputy secretary, Jane Holl Lute, requested the March meeting at the White House. The second in command from Homeland Security, the Justice Department, the FBI, NCTC and the office of the director of national intelligence sat at the small conference table. Normal protocol for such meeting is for staffers such as Ms. Callahan to sit against the walls of the room and keep silent.

By this point, Ms. Libin's concern that innocent people could be inadvertently targeted had been largely overruled at the Department of Justice, these people said. Colleagues there were more concerned about missing the next terrorist threat.

That left Ms. Callahan as the most prominent opponent of the proposed changes. In an unusual move, Ms. Lute asked Ms. Callahan to speak about Homeland Security's privacy concerns. Ms. Callahan argued that the rules would constitute a "sea change" because, whenever citizens interact with the government, the first question asked will be, are they a terrorist?

Mr. Brennan considered the arguments. And within a few days, the attorney general, Eric Holder, had signed the new guidelines. The Justice Department declined to comment about the debate over the guidelines.

Under the new rules, every federal agency must negotiate terms under which it would hand over databases to NCTC. This year, Ms. Callahan left Homeland Security for private practice, and Ms. Libin left the Justice Department to join a private firm.

Homeland Security is currently working out the details to give the NCTC three data sets—the airline-passenger database known as APIS; another airline-passenger database containing information about non-U.S. citizen visitors to the U.S.; and a database about people seeking refugee asylum. It previously agreed to share databases containing information about foreign-exchange students and visa applications.

Once the terms are set, Homeland Security is likely to post a notice in the Federal Register. The public can submit comments to the Federal Register about proposed changes, although Homeland Security isn't required to make changes based on the comments.

THE PLAGUE - Hackers Claim to Have 12 Million Apple Device Records

This just in from the NY Times:  Hackers from Anonymous claim to have stolen 12 million Apple device records from an FBI agent.

No, it was not John Decker!

By NICOLE PERLROTH

Hackers released a file that they said contained a million identification numbers for Apple mobile devices, claiming that they had obtained it by hacking into the computer of an F.B.I. agent. The F.B.I. said it had no evidence that this was true.

The hacking group, known as AntiSec - a subset of the loose hacking collective known as Anonymous - posted copies of the file on Sunday and claimed to have a total of 12 million numbers for iPhone, iPad and iPod Touch devices, along with some phone numbers and other personal data on their owners. They said their goal in releasing a slice of the data was to prove that the F.B.I. used device information to track people.

While the leaked identification numbers appeared to be real, security experts said the release posed little risk. They said that without more information on the devices' owners - like e-mail addresses or date of birth - it would be hard for someone to use the numbers to do harm.

And the actual source of the file was not clear. The F.B.I. said in a statement that "at this time there is no evidence indicating that an F.B.I. laptop was compromised or that the F.B.I. either sought or obtained this data."

The F.B.I. has been a frequent target of so-called hacktivists, hackers who attack for political causes rather than for profit. In February, Anonymous hackers intercepted a call between the bureau and Scotland Yard. But the frequency of such attacks tapered off after several members of Anonymous and a spinoff group, LulzSec, were arrested in March.

Apple's unique device identifiers - known as U.D.I.D.'s - are 40-character strings of letters and numbers assigned to Apple devices. Last year, Aldo Cortesi, a New Zealand security researcher, demonstrated how in some cases U.D.I.D.'s could be used in combination with other data to connect devices to their owners' online user names, e-mail addresses, locations and even Facebook profiles.

"A U.D.I.D. is just a jumble of digits," said Jim Fenton, the chief security officer of OneID. "It is only powerful when it is aggregated with other information."

Security experts said the identification numbers appeared legitimate, and one number in the file matched that of a New York Times employee's iPad. "The structure and format of the data indicates this is a real breach," said Rob Rachwald, director of security at Imperva, a computer security firm. An Apple spokesman did not respond to requests for comment.

The hackers released only U.D.I.D.'s, a separate Apple-specific identifier and the device names that owners give their devices, like "Lori's iPad." Only a few identifiers were tied to e-mail addresses, apparently because the device's owner chose to use an e-mail address when naming it.

Apple stopped letting app developers take advantage of device identifiers last year, to make it harder for marketers to track its customers as they moved from app to app.

The hackers claimed to have obtained the file from the computer of Christopher K. Stangl, a supervisory agent of the F.B.I.'s Cyber Action Team. In 2009, Mr. Stangl appeared in a Facebook promotional video titled "Wanted by the FBI: Cyber Security Experts" that encouraged hackers to get involved with the F.B.I.

He was also one of 44 law enforcement agents invited to participate in the F.B.I.-Scotland Yard conference call that hackers intercepted.

But security experts said the file could have come from a number of places.

"There are a million ways this could have happened," said Marcus Carey, a researcher at Rapid7. "Apple could have been breached.AT&T could have been breached. A video game maker could have been breached. The F.B.I. could have obtained the file while doing forensics on another data breach."

In their statement, the hackers said they would not grant any interviews about the breach until a reporter for Gawker, Adrian Chen, posed for his employer's site, for a full day, in a ballet tutu with a shoe on his head.

On Tuesday evening, Mr. Chen complied. "There's me in a tutu," he wrote in a blog post with accompanying photos. "Get used to it because it's going to be up until around 6:30 p.m. tomorrow."

 

THE PLAGUE - Virus Seeking Bank Data Is Tied to Attack on Iran

Once again, a virus is found wreaking havoc in the Middle East, according to the New York Times.  Was it made by the US and American governments?  Or, was it made by someone or something far more sinister?  You'll have to read The Plague to find out!

By NICOLE PERLROTH

A security firm said Thursday that it had discovered what it believed was the fourth state-sponsored computer virus to surface in the Middle East in the last three years, apparently aimed at computers in Lebanon.

The firm, Kaspersky Lab, said that the virus appeared to have been written by the same programmers who created Flame, the data-mining computer virus that was found to be spying on computers in Iran in May, and that it might be linked to Stuxnet, the virus that disrupted uranium enrichment work in Iran in 2010.

The latest virus, nicknamed Gauss after a name found in its code, has been detected on 2,500 computers, most in Lebanon, the firm said. Its purpose appeared to be to acquire logins for e-mail and instant messaging accounts, social networks and, notably, accounts at certain banks - a function more typically found in malicious programs used by profit-seeking cybercriminals.

The researchers said the target banks included several of Lebanon's largest - the Bank of Beirut, Blom Bank, Byblos Bank and Credit Libanais - along with Citibank and the online payment system PayPal.

"We have never seen any malware target such a specific range of banks," Costin Raiu, Kaspersky's director of global research and analysis, said in an interview. "Generally, cybercriminals target as many banks as possible to maximize financial profit, but this is a very focused cyberespionage campaign targeting certain users of online banking systems."

Lebanon experts said that an American cyber espionage campaign directed at Lebanon's banking system would seem to be a plausible possibility, given Washington's concerns that the country's banks are being used as a financial conduit for the Syrian government and for Hezbollah, the Lebanese militant group and political party.

"The United States has had a number of Lebanese banks under the microscope for a while," said Bilal Y. Saab, a Lebanon expert at the Monterey Institute of International Studies, who said the banks "operate much like Swiss banks" in terms of secrecy. "A computer virus could completely undermine that," he said.

Researchers at Kaspersky Lab, based in Moscow, said they found the Gauss virus while analyzing the Flame virus in June. Flame is a reconnaissance tool that can capture images of a user's computer screen, record e-mail and chat sessions, turn on microphones remotely and monitor keystrokes and network traffic. It can infect an offline computer through a USB stick or a Bluetooth connection.

Kaspersky's researchers said they were confident that Gauss was the work of the same hands as Flame, because the two viruses were written in the same language (known as C++) on the same platform and shared some code and features. Different people probably wrote Doqu and Stuxnet, the first two state-sponsored viruses to surface in recent years, they said, but all four were probably commissioned by the same state-sponsored entity.

"There is absolutely no doubt that Gauss and Flame were printed by the same factories," Mr. Raiu said. "An early version of Stuxnet used a module from Flame, which shows they are connected. Stuxnet was created by a nation-state - it simply could not have been designed without nation-state support - which means Flame and Gauss were created with nation-state support as well."

Kaspersky Lab has declined to speculate on which nation-states were responsible. The New York Times reported in June, based on interviews with officials in several countries, that Stuxnet was jointly developed by the United States and Israel.

Security experts not connected with the lab were less sure that a government was behind Gauss. "It's a fairly large leap, in terms of deductive reasoning, to assume that because they share a common architectural platform, this variant is also state-sponsored," said Will Gragido of RSA, a security firm, who has studied Flame but has not yet analyzed Gauss. "It's possible the code was made available underground and repurposed or reused by cybercriminals."

Kaspersky researchers said Gauss contained a "warhead" that seeks a very specific computer system with no Internet connection and installs itself only if it finds one. "It's done in such a clever way that security researchers cannot analyze it, because they don't know the decryption key that unlocks the true purpose of that program," Mr. Raiu said.

THE PLAGUE - Sky-high thinking for African internet

This story in from the BBC talks about how certain parts of Africa are getting most of their Net access via satelite, 8MB connection speeds for around £20 per month.  Leap-frogging traditional cable-based solutions, satelite and mobile telephony may bring the Web, e-Commerce and micro-payments to the most remote regions of the earth.

 

Hylas 2 was the second of three satellites to be launched. Hylas 3 is due in 2015

 

By Dave LeeTechnology reporter, BBC News

How do you solve a problem like broadband in Africa?

Some believe it's by looking up to the heavens.

Not in hope of divine intervention, but as an opportunity: satellite-powered broadband could be the answer to Africa's connectivity conundrum.

The internet is, as one US senator once put it, a series of tubes.

His comments went down in internet folklore and were roundly mocked - but his remarks were loosely true. For the internet to get around the world it needs cables - lots of them.

They cost millions, span entire oceans and meander across deserts. Many are laid through some of the world's most volatile areas, such as Syria.

So when it comes to connecting Africa to the high-speed information super-highway, the enormity of the task cannot be over-exaggerated.

Under the sea

In the past few years, the continent has benefited from major investment into its internet economy.

Since 2009, three high-speed internet cables have been laid across the ocean, reaching out from Europe and Asia, and bringing huge speed increases - not to mention lower costs - to east Africa.

Kenya has arguably made the most of this connectivity. In just 12 months after the installation of the high-speed cables, the number of Kenyans on broadband rocketed from 1.8 million to more than 3 million.

With a lot of businesses now able to set themselves up and serve customers online, savings were able to be made across the board.

But cables are expensive - and they break. Earlier this year, cables linking east Africa to the Middle East and Europe were severed in an accident.

Internet users' connectivity suffered for more than three weeks - with data transfer rates in nine countries taking a serious, crippling hit. Such long-term technical problems undermine Africa's credibility as a potential future global technology hub.

Coupled with the logistical barrier associated with enabling internet connections in the most rural parts of Africa, and it's arguable that a rethink is desperately needed.

Up into space

Avanti's rethink launched into space on 2 August.

The company says its satellite, Hylas 2, will bring high speed connectivity to southern and eastern Africa, the Middle East and the central Asia.

The growth potential for businesses on the ground, Avanti chief executive David Williams says, is simply enormous.

"We have always believed there is a huge opportunity for satellite communications services in emerging markets because growth for data and voice services is high whilst supply of telecoms network capacity is low," Mr Williams says.

"This is very attractive to Government and enterprise customers, particularly those working in oil, mining, agriculture, banking and security sectors."

The satellite is the company's second to reach orbit. The first, Hylas 1, went up in 2010, and the company plans another - Hylas 3 - for 2015.

Hylas is shorthand for "Highly Adaptable Satellite", an apt name which describes one of its key attributes - the ability to direct its beams to different areas of the continent in order to satisfy demand.

All of the satellites utilise the Ka-band frequency, which operates in the 30Ghz section of the radio spectrum. Avanti says this means it is able to offer 99.9% uptime, no matter what the weather conditions may be.

It is hoped that the satellites build on the progress brought by the undersea cables and lower the cost of broadband further, be it residential users or those running a business.

Although costs have become far cheaper since cable installations, broadband is still prohibitively expensive.

For example, in Kenya, a small business broadband connection can cost around £60 a month for a relatively slow connection of 256kb per second.

Better than the West

With the new satellites, Avanti says it can offer 8MB connection speeds for around £20 - a dramatic rise in speed coupled with what some believe is a game-changing drop in price.

"Whatever the investments that you see happening, they will [all] make the internet cheaper," says Paul Kukubo, chief executive of the Kenyan ICT board.

"The internet is getting cheaper anyway," he tells the BBC.

"It's getting cheaper on two accounts - investments and also the economies of scale.

"As more people get connected, it's more effective financially to actually invest and therefore the internet gets cheaper."

He argued that lessons can be learned from the mobile networks who, with enhanced technology, were able to offer individuals and businesses attractively-priced internet connectivity, even in rural areas.

As a result, Africa has in fact left the developed world in its wake when it comes to adopting breakthrough mobile technologies - particularly mobile payments such as the hugely popular M-Pesa system.

In Angola, this kind of mobile connectivity is being taken to the next level. In partnership with Chinese telecoms firm ZTE, the country is rolling out 4G mobile infrastructure.

It means Angola, which just over 10 years ago was in the grip of a civil war, will offer its citizens better and faster mobile coverage than is currently on offer in London. Other countries, like Namibia, are attempting to follow suit.

Africa's surge in mobile internet use can be repeated in the fixed broadband world, Mr Kukubo says.

"We've got good examples of people who have made money by providing connectivity to the rural communities," he said.

"The large telephone networks have priced their products in a way that allows people to access it through cellphones."

He believes that by encouraging more businesses to adopt broadband services, the knock-on effect will see a significant change in costs as prices are lowered across the board.

"As consumers [learn] what to do online, you get greater usage, and that usage also drives the prices down, and also drives greater business applications, greater consumer applications.

THE PLAGUE - N.Y.S.E. Halts Some Trading After Irregular Price Swings

A "rogue algorithm", huh?  Hmmmmmmm.  This just in from The New York Times.

By NATHANIEL POPPER

United States stock markets were thrown into turmoil on Wednesday morning after more than 100 stocks were hit with a surge of volatile and unexpected trading immediately after markets opened.

The New York Stock Exchange said later in the morning that it was reviewing “irregular trading” that occurred soon after the 9:30 a.m. opening bell in 148 stocks listed on the exchange. Many of the nation’s most popular stocks were among those that saw extreme price swings, including Citigroup, Bank of America and American Airlines.

Traders immediately pointed fingers at one of Wall Street’s most powerful brokerage firms, Knight Capital Group, speculating that a “rogue algorithm” kept buying or selling millions of shares of companies for 30 minutes, sending their shares soaring or plunging. The Jersey City-based company said in a statement that “a technology issue occurred” in the division of the company that uses computer algorithms to buy and sell stocks from other market participants.

As Knight, one of the biggest market makers in the United States financial markets, rushed to contain the problem, it asked customers to send trades to other brokers. Knight’s stock dropped nearly 25 percent on Wednesday morning.

The event draws renewed attention to the increasing fragility of the United States stock markets as they have grown more fragmented and reliant on high-speed-trading firms like Knight. The volatility recalled the so-called flash crash of May 6, 2010, when the entire American market dropped nearly 10 percent in about a quarter of an hour.

On that occasion, stocks recovered from their most extreme losses but still finished down sharply. That event has been blamed in part for the increasing flow of money out of American markets and the waning confidence of investors. The turbulent trading on Wednesday morning did not have the same impact on the broader market as the flash crash, and the benchmark Standard & Poor’s 500-index was trading up 0.3 percent at midday on Wednesday.

The trading problems took place on the same morning that the New York Stock Exchange introduced a new program, the Retail Liquidity Program, that is set to bring it into competition with Knight for orders from retail investors. The program created a platform where orders from ordinary investors to buy and sell shares can be sent to receive a slightly better price than the publicly listed price. The exchange faced strident opposition from Knight and other market participants, which complained that the program would make markets less transparent, but regulators decided to allow it last month.  

There was no immediate information from Knight or the exchange on whether the Retail Liquidity Program played a role in the morning’s problems, but Matthew Heinz, an analyst at Stifel Nicholaus wrote a note to clients in which he said that the program “could have something to do with today’s confusion as market participants adjust to the new order types and routing methods.”

 

 

 

THE PLAGUE - Talk to Me, One Machine Said to the Other

This story in the NY Times really made me stop and think.  Imagine a world where every machine is talking with another.

 

Talk to Me, One Machine Said to the Other

By KEVIN J. O’BRIEN

BERLIN — Ocado, an online grocery store in England, prides itself on its delivery of refrigerated foods: When the company says the goods will arrive at a certain temperature, they mean it.

The promise is more than a marketing boast. Aided by microchip transmitters, heat sensors and a fast-growing form of wireless communication, the boast is a measurable fact.

Inside each Ocado delivery van is a SIM-card module the size of a postage stamp that monitors the air temperature. The sensor sends data to a computer used by fleet managers back at headquarters near London every few minutes.

Ocado says incidents of spoilage of goods have declined since the transmitters were installed last year.

“It has saved us time and given us more confidence in our real-time monitoring, as well as being a safety check for the driver,” said Paul Clarke, Ocado’s director of technology, who oversees a 300-person department that develops software and hardware for the retailer.

The drone of low-density conversation between Ocado’s trucks and headquarters in Hatfield is one example of machine-to-machine communication, a stream of consciousness based on semiconductors that is poised to reinvigorate the mobile industry.

Berg Insight, a research firm in Goteborg, Sweden, says the number of machine-to-machine devices using the world’s wireless networks reached 108 million in 2011 and will at least triple that by 2017. Ericsson, the leading maker of wireless network equipment, sees as many as 50 billion machines connected by 2020. Only 10 billion or so are likely to be cellphones and tablet computers. The rest will be machines, talking not to us, but to each other.

The combined level of robotic chatter on the world’s wireless networks — measured in the digital data load they exert on networks — is likely soon to exceed that generated by the sum of all human voice conversations taking place on wireless grids.

“I would say that is definitely possible within 10 years,” said Miguel Blockstrand, the director of Ericsson’s machine-to-machine division in Stockholm. “This is a ‘What if?’ kind of technology. People start to consider the potential, and the possibilities are endless.”

Machine-to-machine communications has been around for more than two decades, initially run on landline connections and used for controlling industrial processes remotely. With advances in mobile broadband speeds and smartphone computing, the same robotic conversations are now rapidly shifting to wireless networks.

When the total amount of data traffic generated by machines overtakes that created by human voice conversations — or possibly before — mobile operators will have to choose who waits in line to make a call or receive an e-mail — the machine or the human.

“It really does raise some quandaries for the operators,” said Tobias Ryberg, an analyst at Berg Insight. “Most mobile networks are set up for human communication, not for machines. So there will have to be a whole revamping of the system to make this possible.”

Currently, about a third of all machine-to-machine communication involves so-called smart utility meters, which perform duties like sending data on household electric and gas consumption to utilities; the utilities use the information to tailor production to actual demand. In Europe, all households in Sweden and Italy are equipped with smart meters, many of them running wirelessly. In Austria, a law will require five million homes to be equipped with smart electric meters by 2019.

Another third is taking place in the auto industry, through car and truck fleet management systems, which allow transport companies or corporate car managers to track their vehicles in real time, or that are used by emergency accident, repair and location services like General Motors’ OnStar system, now installed on a quarter of new GM vehicles. In Europe, similar technology is beginning to appear in preparation for 2015, when the eCall initiative, an E.U. law requiring all new cars to be equipped with wireless transmitters will take effect. The transmitters would automatically report accident data, as well as airbag deployment and location, to emergency responders

But it is variations on consumer applications like Ocado’s that are expected to provide the biggest growth over the next decade, said Yiru Zhong, an analyst at Frost & Sullivan, a research firm in London that tracks the sector.

In Japan, the government is considering installing a bigger system of seismic sensors to detect earthquakes, Ms. Zhong said. In Calitri, a town in southern Italy, wireless sensors are helping produce caciocavallo, a type of Pecorino cheese made by Caseificio di Cecca e di Roma. The cheese ages in cellars shielded from the searing heat, and sensors regularly send data on humidity to a monitoring station at a local agricultural extension center.

European mobile operators have begun exploiting the financial potential of machine-to-machine communication, and have set up independent units to develop the business. Telefónica, Deutsche Telekom, Vodafone and France Télécom have all established separate business entities or internal centers to develop new products catering to machines.

“Right now, this is a nice contribution to our company’s bottom line,” said Bernd Liebscher, the managing director of Telekom Austria’s machine-to- machine division, which was set up last September. The operator does not break out machine-to-machine sales. “But over time, should we assume services for an entire vertical industry, like utility smart metering, we are talking about a significant business,” he said.

Telekom Austria’s mobile networks wirelessly connected 500,000 machines in eight countries at the end of 2011, a figure Mr. Liebscher said would grow 50 percent this year to 750,000. The tiny transmitter modules provide traffic and weather updates to 1.3 million users of TomTom navigation systems, link Otis elevators in Slovenia to emergency breakdown centers and connect 900 automatic teller machines of Priorbank in Belarus, among other uses. The two biggest applications are electronic payment terminals and fleet management.

Ms. Zhong, the Frost & Sullivan analyst, estimated that machine-to- machine conversations made up less on average than 10 percent of an operator’s total revenue, but the growth potential is considered large.

For wireless machine communication to become ubiquitous — imagine every home or office window opening and closing automatically to control temperature and humidity — the makers of the modules, SIM cards and associated network equipment will have to agree on broad series of technical standards to enable seamless communication between various devices.

Those megastandards do not exist now, and the biggest makers of devices, industry groups and mobile operators have split into different standards- setting groups, which is likely to delay adoption of uniform communications across industries, networks and module makers.

A 2011 research paper produced by researchers at Intel, the leading chip maker, concluded that the lack of broad, overarching standards and technologies that enable mobile networks to keep up with the explosion in robotic communication, are needed to bring about an Internet “embedded” in everyday life.

“I think there will be an effort to work to convergence, but the reality is not there yet,” Ms. Zhong said.

Jim Morrish, an analyst with Machina Research, a London firm that focuses on the sector, said he had no doubts that engineers would come up with the requisite advances to bring about that kind of future.

“I think by the time we reach 50 billion connected devices, we will be in such a different technological stage that those won’t be issues anymore,” he said.