The FBI’s Asinine Attempt to Retroactively Justify Cracking Farook’s Phone

/7 Comments/in , /by

“Hold on honey,” said Syed Rizwan Farook, who had just murdered 14 of his co-workers, “let me go get my work phone in case they call me during our getaway”

That’s the logic the FBI is now peddling to reporters who are copping onto what was clear from the start: that there was never going to be anything of interest on Farook’s phone. After all, they’re suggesting geolocation data on the phone (some of which would be available from Verizon) might explain the 18 minutes of the day of the attack the FBI has yet to piece together.

For instance, geolocation data found on the phone might yet yield clues into the movements of the shooters in the days and weeks before the attack, officials said. The bureau is also trying to figure out what the shooters did in an 18-minute period following the shooting.

Farook drove a SUV to the attack and was killed in the same SUV. To suggest his work phone, which was found in a Lexus at his house, might have useful geolocation data about the day of the attack would suggest he made a special trip to the car to leave his phone in it and turned it off afterwards (if we really believe it was off and not just drained when the FBI found it the day after the attack).

Hold on honey, let me go place my work phone in the Lexus.

Similarly, it is nonsensical to suggest the phone would yield evidence of ties with foreign terrorists.

The FBI has found no links to foreign terrorists on the iPhone of a San Bernardino, Calif., terrorist but is still hoping that an ongoing analysis could advance its investigation into the mass shooting in December, U.S. law enforcement officials said.

They’ve had the metadata from the phone since December 6, at the latest. That’s what would show ties with foreign terrorists, if Farook had been so stupid as to plot a terrorist attack against his colleagues on his work phone, to which his employer had significant access.

Finally, reporters should stop repeating the FBI’s claim that Farook turned off his backups.

In particular, the bureau wanted to know if there was data on the phone that was not backed up in Apple’s servers. Farook had stopped backing up the phone to those servers in October, six weeks before the attack.

The government has actually never said that in sworn declarations. Rather, their forensics guy, Christopher Pluhar, asserted only that Farook may have turned them off.

Importantly, the most recent backup is dated October 19, 2015, which indicates to me that Farook may have disabled the automatic iCloud backup feature associated with the SUBJECT DEVICE. I believe this because I have been told by SBCDPH that it was turned on when it was given to him, and the backups prior to October 19, 2015 were with almost weekly regularity. [my emphasis]

But if he did, he was a damned incompetent terrorist, because — as Jonathan Zdziarski, who is quoted in this article, pointed out — at the same screen he would have used to turn off the iCloud backup, he could have also deleted all his prior backups, which we know he didn’t do.

  • Find my iPhone is still active on the phone (search by serial number), so why would a terrorist use a phone he knew was tracking him? Obviously he wouldn’t. The Find-my-iPhone feature is on the same settings screen as the iCloud backup feature, so if he had disabled backups, he would have definitely known the phone was being tracked. But the argument that Farook intentionally disabled iCloud backup does not hold water, since he would have turned off Find-my-iPhone as well.
  • In addition to leaving Find-my-iPhone on, the option to delete all prior backups (which include iMessage history and other content) is also on the same settings screen as the option to disable iCloud backups. If Farook was trying to cover up evidence of leads, he would have also deleted the existing backups that were there. By leaving the iCloud backup data, we know that Farook likely did not use the device to talk to any leads prior to October 19.

We also know from a supplemental Pluhar declaration that Farook had not activated the remote-wipe function, which he also would have done if he were a smart terrorist trying to cover his tracks.

Finally, Apple’s Privacy Manager, as Erik Neuwenschander demonstrated, Pluhar didn’t know what the fuck he was talking about with regards to backups.

Agent Pluhar also makes incorrect claims in paragraph 10(b). Agent Pluhar claims that exemplar iPhones that were used as restore targets for the iCloud backups on the subject device “showed that … iCloud back-ups for ‘Mail,’ ‘Photos,’ and ‘Notes’ were all turned off on the subject device.” This is false because it is not possible. Agent Pluhar was likely looking at the wrong screen on the device. Specifically, he was not looking at the settings that govern the iCloud backups. It is the iCloud backup screen that governs what is backed up to iCloud. That screen has no “on” and “off” options for “Mail,” “Photos,” or “Notes.

Zdziarski offers another possible explanation for the lack of backups on Farook’s phone, so there are other possible explanations.

iCloud backups could have ceased for a number of reasons, including a software update that was released on October 21, just two days after the last backup, or due to iCloud storage filling up.

The point is, we don’t know, and it’s not even clear Pluhar would know how to check. So given all that other evidence suggesting Farook may not have turned off his backups, journalists probably should not claim, as fact, he did.

Of course, that claim is really just a subset of the larger set of the bullshit FBI has fed us about the phone. It’d really be nice if people stopped taking their bullshit claims seriously, as so few of the past ones have held up.

Friday Morning: Dark Water Jazz

/5 Comments/in , , /by

It’s Friday and that means jazz here at emptywheel. But no genre exploration today, just this lovely, evocative downtempo jazz/trip hop fusion work.

It’s dark water jazz indeed this week…

Congress oublies the Flint water crisis
I can’t find anything in C-SPAN about the House Energy and Commerce Committee hearing which was to address the crisis. Convenient for Republicans running for office right now to keep themselves at arm’s length from a Republican scandal. We’re lucky the hearing was captured at all; it can be found at the committee’s website. (Video 3:44:08)

It must be difficult to kowtow to traditional GOP underwriters while trying to appear like you’re doing a credible job of representing Americans most in need. But it’s a lot easier to bury and forget the inconvenient.

The latest scuttlebutt is that the bipartisan Energy Policy Modernization Act of 2015 (S.2012) will proceed without additional funding to remedy Flint’s damaged water system, still replete with lead piping. Senate Republicans led by Senator Mike Lee of Utah protested the inclusion of funding for Flint in this bill, threatening to reject it altogether.

Wait — you know who’s up for reelection this season? Senator Mike Lee! Amazing coincidence! Or not. You know, Senator Lee, when your fellow senators leak about your obstruction, you should catch a clue. Sometimes actually helping Americans is more important than sucking up to your anti-tax overlords.

You know who else is up for reelection this season? Senator Lisa Murkowski, the chair of the counterpart Senate Energy Committee and the sponsor of S.2012. You’d think she’d want to look effective as a leader and at governance.

Roughly 8,000 children will continue to live as if they are in a third world country, with a patchwork of assistance for their health and education, but no relief from the lead pipes which continue to run from the water department to their homes. Imagine them drinking water out bottles for the rest of their childhoods, their families having to take additional time and effort to lug bottles upon bottles for their daily essential needs.

Don’t even suggest these families leave. They are stuck, STUCK in Flint, because their property values have been gutted by the failure of a GOP-led state administration, and the continued avoidance by a GOP-led Congress. Who wants to buy a home with lead pipes in Flint now? Which banks want to finance new mortgages to those homes? Which insurers want to write coverage on them?

Some government aid has been offered to Flint — which the ever-ineffectual Rep. Fred Upton recited like a litany during the hearing (see 0:13:30 in the video) — but none of it addresses the lead piping.

Donald Trump won the Republican primary in Flint’s home county of Genessee, by the way. Can’t understand why…

Cleaning off the desk
Stuff worth perusing, but I’m not going to elaborate on before I chuck it in the bin for the week.

  • Microsoft suing U.S. government for gagging the software company about government requests for users’ information. (Microsoft) — MSFT president Brad Smith wrote in a blog post about the suit; note the complaint here (pdf) in which MSFT shared these details:

    Between September 2014 and March 2016, Microsoft received 5,624 federal demands for customer information or data. Of those, nearly half—2,576—were accompanied by secrecy orders, forbidding Microsoft from telling the affected customers that the government was looking at their information. The vast majority of these secrecy orders related to consumer accounts and prevent Microsoft from telling affected individuals about the government’s intrusion into their personal affairs; others prevent Microsoft from telling business customers that the government has searched and seized the emails of individual employees of the customer. Further, 1,752 of these secrecy orders contained no time limit, meaning that Microsoft could forever be barred from telling the affected customer about the government’s intrusion. The government has used this tactic in this District. Since September 2014, Microsoft received 25 secrecy orders issued in this District, none of which contained any time limit. These secrecy orders prohibit Microsoft from speaking about the government’s specific demands to anyone and forbid Microsoft from ever telling its customers whose documents and communications the government has obtained. The secrecy orders thus prevent Microsoft’s customers and the public at large from ever learning the full extent of government access to private, online information

    Emphasis Microsoft’s. Therein the one way to release a limited amount of information: file suit against the government.

  • Claims after March attack that Brussels airport security was lax impels Belgium’s transport minister to quit (euronews) — Bombs were detonated before security clearance area; not certain how minister could have prevented bombing except to move clearance all the way to the edge of the airport’s perimeter instead of after check-in.
  • UC-Davis sanitized the internet to prop its image (SacBee) — School paid $175K to excise references to a 2011 attack on student protesters by police using teargas. Should keep in mind UC-Davis is part of the University of California, of which former Homeland Secretary Janet Napolitano is president, who authorized spying-by-malware on UC-Berkeley.
  • Hey, did you know there’s a tiny sovereign country inside U.S. borders? (Atlas Obscura) — Welcome to Molossia, have a nice day! Surprised no uber-wealthy hit on this as a potential money-laundering. tax-avoidance strategy: make your own country inside the U.S.

And with that we’re off, headed for a nice spring weekend ahead. Have a good one!

FBI Has Been Not Counting Encryption’s Impact on Investigations for Over a Decade

/4 Comments/in /by

During the first of a series of hearings in the last year in which Jim Comey (at this particular hearing, backed by Deputy Attorney General Sally Yates) pushed for back doors, they were forced to admit they didn’t actually have numbers proving encryption was a big problem for their investigations because they simply weren’t tracking that number.

On the issue on which Comey — and his co-witness at the SJC hearing, Deputy Attorney General Sally Yates — should have been experts, they were not. Over an hour and a quarter into the SJC hearing, Al Franken asked for actual data demonstrating how big of a problem encryption really is. Yates replied that the government doesn’t track this data because once an agency discovers they’re targeting a device with unbreakable encryption, they use other means of targeting. (Which seems to suggest the agencies have other means to pursue the targets, but Yates didn’t acknowledge that.) So the agencies simply don’t count how many times they run into encryption problems. “I don’t have good enough numbers yet,” Comey admitted when asked again at the later hearing about why FBI can’t demonstrate this need with real data.

In point of fact, a recent wiretap report shows that in the criminal context, at least, federal agencies do count such incidences, sometimes. But they don’t report the numbers in a timely fashion (5 of the 8 encrypted federal wiretaps reported in 2014 were from earlier years that were only then being reported), and agencies were eventually able to break most of the encrypted lines (also 5 of 8). Moreover, those 8 encrypted lines represented only 0.6 percent of all their wiretaps (8 of 1279). Reporting for encrypted state wiretaps were similarly tiny. Those numbers don’t reflect FISA wiretaps. But there, FBI often partners with NSA, which has even greater ability to crack encryption.

In any case, rather than documenting the instances where encryption thwarted the FBI, Comey instead asks us to just trust him.

Which is important background to an ancillary detail in this NYT story on how FBI tried a work-around for PGP in 2003 — its first attempt to do so — to go after some animal rights activists (AKA “eco-terrorists).

In early 2003, F.B.I. agents hit a roadblock in a secret investigation, called Operation Trail Mix. For months, agents had been intercepting phone calls and emails belonging to members of an animal welfare group that was believed to be sabotaging operations of a company that was using animals to test drugs. But encryption software had made the emails unreadable.

So investigators tried something new. They persuaded a judge to let them remotely, and secretly, install software on the group’s computers to help get around the encryption.

[snip]

“This was the first time that the Department of Justice had ever approved such an intercept of this type,” an F.B.I. agent wrote in a 2005 document summing up the case.

DOJ didn’t include this encounter with encryption in the wiretap reports that mandate such reporting.

It is also unclear why the Justice Department, which is required to report every time it comes across encryption in a criminal wiretap case, did not do so in 2002 or 2003. The Justice Department and F.B.I. did not comment Wednesday.

It didn’t count that encounter with crypto even though FBI was discussing — as Bob Litt would 13 years later — exploiting fears of “terrorism” to get Congress to pass a law requiring back doors.

“The current terrorism prevention context may present the best opportunity to bring up the encryption issue,” an F.B.I. official said in a December 2002 email. A month later, a draft bill, called Patriot Act 2, revealed that the Justice Department was considering outlawing the use of encryption to conceal criminal activity. The bill did not pass.

Now, it may be that, as remained the case until last year, FBI simply doesn’t record that they encountered encryption and instead tries to get the information some other way. But by all appearances, encryption was tied to that wiretap.

Which suggests another option: that FBI isn’t tracking how often it encounters encryption because it doesn’t want to disclose that it is actually finding a way around it.

That’d be consistent with what they’ve permitted providers to report in their transparency reports. Right now, providers are not permitted to report on new collection (say, collection reflecting the compromise of Skype) for two years after it starts. The logic is that the government is effectively giving itself a two year window of exclusive exploitation before it will permit reporting that might lead people to figure out something new has been subjected to PRISM or other collection.

Why would we expect FBI to treat its own transparency any differently?

Update: This post has been updated to include more of the NYT article and a discussion of how encryption transparency may match provider transparency.

FBI’s Latest Story about the Hack of Farook’s Phone

/3 Comments/in /by

There’s a lot that doesn’t quite make sense in Ellen Nakashima’s explanation for how FBI broke into Syed Rizwan Farook’s iPhone.

The FBI cracked a San Bernardino terrorist’s phone with the help of professional hackers who discovered and brought to the bureau at least one previously unknown software flaw, according to people familiar with the matter.

The new information was then used to create a piece of hardware that helped the FBI to crack the iPhone’s four-digit personal identification number without triggering a security feature that would have erased all the data, the individuals said.

The researchers, who typically keep a low profile, specialize in hunting for vulnerabilities in software and then in some cases selling them to the U.S. government. They were paid a one-time flat fee for the solution.

[snip]

At least one of the people who helped the FBI in the San Bernardino case falls into a third category, often considered ethically murky: researchers who sell flaws — for instance, to governments or to companies that make surveillance tools.

This last group, dubbed “gray hats,” can be controversial. Critics say they might be helping governments spy on their own citizens. Their tools, however, might also be used to track terrorists or hack an adversary spying on the United States. These researchers do not disclose the flaws to the companies responsible for the software, as the exploits’ value depends on the software remaining vulnerable.

Don’t get me wrong. I don’t doubt Nakashima is reporting what she learned; I know other reporters were working on a similar direction.

It’s just that the FBI’s currently operative story still makes no sense. For starters, why would the FBI pay someone selling zero days but not be willing to consider the solutions offered by (just as an example of one forensics person I know who offered to help) Jonathan Zdziarski?

And I still wonder why the government apparently unsealed the warrant in Farook’s case once before it unsealed it to compel Apple. Indeed, while Nakashima (and other reporters) says FBI “did not need the services of the Israeli firm Cellebrite,” I still think using them (or someone similar) as a middle-man might offer the best of all worlds: no official possession of this exploit, easy contracting, the ability to give (as FBI has been) conflicting stories without any of them being fully false. Just as an example, if Cellebrite told FBI it currently couldn’t crack the phone before FBI got an All Writs Act order obligating Apple, then FBI could fairly claim, as they did, that only Apple or FBI could open the phone (even if they hadn’t actually asked many other people who might be able to hack the phone). But if someone went to Cellebrite or even FBI with the exploit after that, then FBI would have a way of using the exploit without having it and therefore having to submit it to the Vulnerabilities Equities Process (though technically they should still have to). FBI would have a way of promising to keep the exploit hidden, which the vendor would require, because it would technically never be in possession of it.

There’s one more thing that is getting lost in this debate. Comey and others keep talking about the use of this for an intelligence function, as if to justify keeping this exploit secret. I know that’s the convenient part of using a terrorism case to raise the stakes of back dooring phones. But this is ultimately a law enforcement issue, not an intelligence one, no matter how much FBI wants to pretend we’re going to find out something going forward. And as such it should be subject to greater standards of disclosure than a pure use of an exploit for intelligence purposes would.

In other words, FBI is still playing word games.

Wednesday Morning: A Whiter Shade

/5 Comments/in , /by

She said, ‘There is no reason
and the truth is plain to see.’
But I wandered through my playing cards
and would not let her be

— excerpt, Whiter Shade of Pale by Procol Harum
cover here by Annie Lennox

I’ve been on an Annie Lennox jag, sorry. I’m indulging myself here at the intersection of a favorite song which fit today’s theme and a favorite performer. Some of you will take me to task for not using the original version by Procol Harum, or another cover like Eric Clapton’s. Knock yourselves out; it’s Lennox for me.

Speaking of a whiter shade and truth…

FBI used a ‘gray hat’ to crack the San Bernardino shooter’s phone
Last evening after regular business hours WaPo published a story which made damned sure we knew:

1) The FBI waded into a fuzzy zone to hack the phone — oh, not hiring a ‘black hat’, mind you, but a whiter-shade ‘gray hat’ hacker;
2) Cellebrite wasn’t that ‘gray hat’;
3) The third-party resource was referred to as ‘professional hackers’ or ‘researchers who sell flaws’;
4) FBI paid a ‘one-time fee’ for this hack — which sounds like, “Honest, we only did it once! How could we be pregnant?!
5) A ‘previously unknown software flaw’ was employed after the third-party pointed to it.

This reporting only generated more questions:

• Why the careful wording, ‘previously unknown software flaw’ as opposed to zero-day vulnerability, which has become a term of art?
• How was the determination made that the party was not black or white but gray, and not just a ‘professional hacker who sold knowledges about a flaw they used’? Or was the explanation provided just stenography?
• However did Cellebrite end up named in the media anyhow if they weren’t the source of the resolution?
• What assurances were received in addition to the assist for that ‘one-time fee’?
• Why weren’t known security experts consulted?
• Why did the FBI say it had exhausted all resources to crack the San Bernardino shooter’s phone?
• Why did FBI director Jim Comey say “we just haven’t decided yet” to tell Apple about this unlocking method at all if ‘persons familiar with the matter’ were going to blab to WaPo about their sketchy not-black-or-white-hat approach instead?

That’s just for starters. Marcy’s gone over this latest story, too, be sure to read.

Volkswagen execs get a haircut
Panic among employees and state of Lower Saxony over VW’s losses and anticipated payouts as a result of Dieselgate impelled executives to share the pain and cut their bonuses. Germany’s Lower Saxony is the largest state/municipal shareholder in VW, but it’s doubly exposed to VW financial risks as nearly one in ten Germans are employed in the automotive industry, and VW is the largest single German automotive company. The cuts to bonuses will be retroactive, affecting payouts based on last year’s business performance.

Fuzzy dust bunnies

  • Verizon workers on strike (Boston Globe) — Until minimum wage is raised across the country and offshoring jobs stops, we’ll probably see more labor actions like this. Should be a warning to corporations with quarter-after-quarter profits and offshore tax shelters to watch themselves — they can afford to pay their workers.
  • Facebook deploys bots across its services (Computerworld) — But, but AI is years away, said Microsoft research…meanwhile, you just know Amazon’s Alexa is already looking to hookup with Facebook’s chatbot.
  • Google’s charitable arm ponied up $20M cash for disabled users’ technology improvements (Google.org) — IMO, this was a great move for an underserved population.
  • Judge’s rejects Obama administration blow-off of apex predator wolverines (HGN) — Wolverines, a necessary part of health northern and mountain ecosystems, need cold weather to survive. Montana’s U.S. District Court ruled the administration had not done enough to protect biodiversity including the wolverine. Crazy part of this entire situation is that the feds don’t believe the wolverine warrants Endangered Species Act (ESA) protection and that they can’t tell what effects climate change has on this species, but the species is seen rarely to know. Hello? A rarely-seen species means the numbers are so low they are at risk of extinction — isn’t that what the ESA is supposed to define and prevent?

UPDATE — 12:10 PM EDT —
From @cintagliata via Twitter:

Back in 1971, researchers observed Zika virus replicating in neurons and glia. (in mice) http://bit.ly/1XvsD4d

I’m done with the pesticides-as-causal theory. It may be a secondary exacerbating factor, but not likely primary. In short, we’ve had information about Zika’s destructive effects on the brain and nervous system for 45 years. It’s past time for adequate funding to address prevention, treatments, control of its spread.

It’s all down the hump from here, kids. See you tomorrow morning!

Tuesday Morning: Toivo’s Tango

/9 Comments/in , /by

Did you know the tango evolved into a Finnish subgenre? Me neither, and I’m part Finn on my mother’s side of the family. Both my grandmother and great-grandmother spoke Finn at home after their immigration to the U.S., but apparently never passed the language or Finnish music on to my mother and her siblings. The Finnish tango became so popular a festival — the Tangomarkkinat — was established to celebrate it.

The tango makes its way back again, nearly 9000 miles from its origin to Finland, in this music video. The performer featured here is a very popular Argentine tango singer, Martin Alvarado, singing in Spanish a popular Finnish tango, Liljankukka, written by Toivo Kärki. If you search for the same song and songwriter in YouTube, you’ll trip across even more Finnish tango.

Let’s dance…

Police raid in Belgium today
There were more arrests in Belgium today in connection to Paris attack in November. Not many details yet in the outlets I follow, suggesting information is close to the vest; there was more information very early, which has now moved off feeds, also suggesting tight control of related news. A raid in the southern Brussels suburb of Uccle resulted in the arrest of three persons now being questioned. This raid follows the arrest last Friday of Mohamed Abrini, who has now admitted he is the man seen in security camera video as the ‘man in the hat’ observed just before the bombing of the Brussels’ airport. Thus far, intelligence gathered from suspects and locations indicates a second attack had been planned, attacking the Euro 2016 football championship. Worth noting the media has now been reporting only the given name and a family name first initial for some of those arrested recently.

Up All Night growing, annoying some Parisians
This Occupy movement subset called ‘Up All Night’ or ‘Night Rising’ (Nuit debout) has been rallying during evening hours, protesting austerity-driven labor reforms, France’s continued state of emergency after November’s terrorist attacks, and more. The number of protesters has grown over the last 12 days they have taken to the streets, driven in part by the Panama Papers leak. The crowd has annoyed those navigating the area around the Place de la Republique where the Nuit debout gather. (More here on video.)

Upset over Burr-Feinstein draft bill on encryption continues
The Consumer Technology Association (CTA) issued a statement last night conveying their displeasure with this proposed bill which would mandate compliance with law enforcement access to encrypted digital content. The CTA’s 2200 members include Apple, Google, Microsoft, and any consumer electronic technology manufacturer featured at the annual Consumer Electronics Show each year. This formal statement follows a wave of negative feedback from technology and privacy experts since the draft bill was revealed late last week.

Odds and ends

  • Cellebrite makes the news again, this time for a ‘textalyzer’ (Ars Technica) — Huh. What a coincidence that an Israeli company attributed with the cracking of the San Bernardino shooter’s iPhone 5c is now commercializing a device for law enforcement to use on drivers’ cellphones. Do read this piece.
  • DARPA still fighting for relevance with its Squad X initiative (Reuters) — Not a single mention of exoskeletons, but enough digital technology to make soldiers glow in the dark on the battlefield.
  • Microsoft’s director of research calls some of us chickenshit because AI is peachy, really (The Guardian) — Uh-huh. This, from the same company that released that racist, sexist POS AI bot Tay not once but twice. And we should all just trust this stuff in our automobiles and in the military. Ri-ight.
  • Farmers watching more than commodities market and the weather (Fortune) — Chinese IP rustlers are sneaking commercially-developed plant materials back to PRC. Hope the Chinese realize just how likely American farmers are to use firearms against trespassers.
  • CDC’s deputy director on Zika: “Everything we look at with this virus seems to be a bit scarier than we initially thought” (Reuters) — I swear multiple news outlets including WaPo have changed the heds on stories which originally quoted this statement. Zika’s observed destruction of brain cells during research is really distressing; so is Zika’s link to Guillain-Barre syndrome in addition to birth defects including microcephaly. In spite of the genuine and deep concern at CDC over this virus’ potential impact on the U.S., the CDC is forced to dig in sofa cushions for loose change to research and fight this infectious agent. Absolutely ridiculous, like we learned nothing from our experience here with West Nile Virus.

That’s it, off to mix up my tango with a whiskey foxtrot. See you tomorrow morning!

Monday Morning: The Urge to Merge

/6 Comments/in , /by

In my eyes, indisposed
In disguises no one knows
Hides the face, lies the snake
The sun in my disgrace

— excerpt, Black Hole Sun by Soundgarden

Looks like this week is all about mergers. Enjoy this simulation on replay several times while listening to Soundgarden’s Black Hole Sun while we dig in.

Roll Call

  • Yahoo’s vulnerability brings all the nasty suitors to the yard (MarketWatch) — If Daily Mail wins, Yahoo will be one massive tabloid, and Tumblr will become a cesspool. Bidding’s open until next Monday; what other potential buyers may emerge this week?
  • Big names in hotels to join after shareholders approve Marriott offer for Starwood Hotels (UPI) — The vote came last Friday after Chinese insurance holding group Anbang withdrew from bidding.
  • Merger of beer producers SABMiller and A-B InBev still in holding pattern (Milwaukee Business Journal) — The deal is languishing for approval by South Africa’s Competition Commission. Part of SABMiller was once South African Brewing.
  • UK balks at Hutchins and Telefonica tie up (Reuters) — Cousins across the pond better watch out; this proposed merger, even if shot down by regulators, portends another telecom marriage ahead. With UK’s Competition and Markets Authority recommending a spin-off of either Three Mobile or O2 mobile network business in order to approve the deal, a divestment of one of these may happen anyhow.

The Yahoo and Hutchins-Telefonica deals bear scrutiny for their potential for mass surveillance depending on how the proposals play out. Yahoo could end up operating under UK laws, and some part(s) of either Hutchins or Telefonica could end up with a non-UK or non-EU partner.

All of these proposed mergers were in the works before the Panama Papers were released; none them appear to be motivated solely by tax reduction, but instead by economies of scale and weak market conditions. It’d be nice if executives of all companies raking in profits realized that failing to pay their hourly workers well has a direct impact on overall market demand. Their businesses could retain autonomy instead of spending time and money on M&A they could spend on employees’ wages.

Speaking of Panama Papers: revelations still shaping policy and politics

  • U.S. Treasury still working on tax rules to reduce tax avoidance and evasion by offshoring (Bloomberg) — Many large holding company structures use intra-group loans to move money out of the U.S. The new rules which may limit these moves may affect not only U.S. corporations but foreign corporations with subsidiaries in the U.S.
  • UK’s PM David Cameron facing heat about tax avoidance strategies used by his family (Scotsman) — Strategies included a tax-free gift of 200,000 pounds to Cameron from his mother. He is supposed to appear before Parliament for questioning.
  • Mossack Fonseca still getting hacked due to poor security response (The Register) — At what point do we ask if MossFon is really just a honeypot, given continued insufficient security?

Just for fun: Rockets!
If you didn’t watch SpaceX’s Falcon 9 launch on Friday, you really ought to make some time to do so for entertainment purposes. The first stage of the rocket returned successfully for reused, nailing a landing on a drone ship — a DRONE SHIP AT SEA. I missed the fact the landing pad was a drone vessel when I watched the first attempts. It’s a really narrow thing, landing on a speck of a pad in the ocean which is pushed around a bit by ocean currents in spite of the drone ship’s programming and/or remote control. (I would love to know who named the drone ship, ‘Of Course I Still Love You’ and why…)

What’s similarly remarkable is the SpaceX team — their excitement is off the map, rather like watching a K-12 FIRST LEGO robotics competition than an aeronautics business at work. Note in the video the team’s reaction just seconds (about 27:30) to the first stage return landing; it’s as if they KNEW they had it nailed before it happened. Wouldn’t you love to know just how they knew?

Also for grins: compare SpaceX’s landing on Friday (start at 23:48 into video) to competitor Blue Origin’s recent rocket return. Blue Origin is owned by Amazon’s Jeff Bezos; the return is so smooth and slick, but it’s in the west Texas desert where potential disruption of the landing has been minimized. Important to keep in mind that SpaceX actually delivered a payload after reaching orbit, where Blue Origin is still limited to sub-orbit elevation.

With that our week’s been launched — let’s go!

Friday Morning: Far Over Yonder

/41 Comments/in , /by

It was rough road this week, but we made it to Friday again for more jazz. Today’s genre is ska jazz, which will feel like an old friend to many of you.

The artist Tommy McCook was one of the earliest artists in this genre. Just listen to his work and you’ll understand why he has had such a deep and long-lasting influence on contemporary Jamaican music.

Let’s get cooking.

Apple pan dowdy

  • Need a hashtag for NotAlliPhones after FBI says hack only works on “narrow slice” (Reuters) — The method offered by a third party to open San Bernardino shooter’s iPhone 5c won’t work on later phones like the iPhone 5s in the Brooklyn case, according to FBI director Jim Comey. While it may be assumed newer technology is the barrier, this could be a simple line in the sand drawn by the FBI so as to limit potential risk.
  • Yet another pearl-clutching essay asking us if Apple went too far protecting privacy (MIT Technology Review) — This is the second such POS in this outlet in the last couple of months. Oh, by all means, let’s risk exposing hundreds of millions of iOS users to any surveillance because law enforcement needs access to the kind of information they didn’t have 20 years ago.
  • Apple has complied with government requests to crack iPhones 70 times, beginning in 2008 (Mac Rumors) — The first request, believed to have occurred while George Bush was still in office, arose from a child abuse and pornography case. In a case like this where children may have been endangered, one can understand the impetus for the request. But maybe, just maybe, Apple was so firm about the San Bernardino iPhone 5c is that Apple knows the government has gone too far after nearly eight years of compliance.
  • And for a change of pace, a recipe for Apple Pan Dowdy. Don’t fret over the pastry flour; just use all-purpose and not bread flour.

Leftovers

  • Yahoo up for bids, Verizon interested (Reuters) — The same telecom once in trouble for using persistent cookies is interested in a search engine-portal business which may offer them access to non-Verizon customers. Plan ahead for the next level of consumer tracking if Verizon’s bid wins. Bidding deadline has been extended from April 11 to the 18th.
  • Households at bottom income levels can’t afford food, housing (Vox) — Can’t understand why the rise of angry white man candidates? This is one big reason — things are getting much worse for those who can afford it least. And nobody working in Capitol Hill or the White House seems to give a rat’s whisker.
  • Banksters blame Hollywood for lack of interest in dodgy subprime automotive bonds (Indiewire) — Investment banking firm Morgan Stanley credits the film The Big Short, based on Michael Lewis’ book about the 2000s housing bubble and the subprime mortgage crisis, with spooking investors away from subprime automotive bonds. By all means, let’s not look in the mirror, banksters, or at the inability of working poor to make ends meet, increasing likely uptick in automotive loan defaults.
  • Venezuela makes every Friday a holiday (Bloomberg)

    — The deep El Nino cycle caused drought conditions, substantively lowering reservoir levels. President Maduro is asking large customers to make their electricity in addition to declaring every Friday for the next two months a work holiday to conserve energy. Clearly Venezuela needed investment in solar energy before this El Nino began.

  • Researchers found people do stupid stuff when they find a flash drive (Naked Security) — After sprinkling a campus with prepared USB flash drives, a study found nearly half the people who found them plugged them into a computer, ostensibly to find the owner. DON’T DO IT. If you find one, destroy it. If you lost one, consider it a lost cause — and before you lose one, make sure you’ve encrypted it just in case somebody is stupid enough to try and find the owner/look at the contents.

HIGHLY EDITORIAL COMMENT: Bill, STFU.
Just because a single African American author called you “The First Black President” doesn’t mean you are literally a black man (and the label wasn’t meant as a compliment). Your massive white/male/former-elected privilege is getting in the way of listening to people you helped marginalize. You cannot fake feeling their pain or triangulate this away. Just shut up and listen, if for no other reason than you’re hurting your wife yet again. (Sorry, I had to get that off my chest. This opinion may differ from those of other contributors at this site. YMMV.)

Phew. Hope you have a quiet, calm weekend planned. We could use one. See you Monday morning!

Richard Burr’s Encryption (AKA Cuckoo) Bill, Working Thread

/6 Comments/in /by

A version of Richard Burr and Dianne Feinstein’s ill-considered encryption bill has been released here. They’re calling it the “Compliance with Court Orders Act of 2016,” but I think I’ll refer to it as the Cuckoo bill. This will be a working thread.

(2) Note the bill starts by suggesting economic prosperity relies on breaking encryption. There are many reasons that’s not true, most obviously that it will put US products at a disadvantage in other countries.

(2) Note this only applies to “providers of communications services and products (including software).” Does it apply to financial companies? Because they’re encrypting data between themselves that should be accessible to law enforcement. Does it apply to car companies? IoT companies?

(2) Note they mention “judicial order” and “court order” here. It’s clear (and becomes clearer later) that this includes orders that aren’t warrants, so FISA orders. Which suggests they’re having a problem with encryption under FISA too.

(3) The Cuckoo Bill builds in compensation. That’s one way companies could fight this: to make sure it would take a lot to render data intelligible.

(4) I suspect this license language would expand to do scary things with other “licensing” products.

(4) Note that they’ve expanded the definition of metadata to include “switching, processing, and transmitting” data. I bet that has already been done in secret somewhere.

(5) The language on destination and switching suggests they’re trying to include location data in metadata.

(6) Note the “order or warrant” language.

(6) The covered entity might include banks and cars, though not obviously so.

(8) An odd use of “original form” in decrypted definition.

(9) Wow, they even want to require entities to have to provide decrypted data in motion.

Thursday Morning: Eye in the Sky

/6 Comments/in , /by

I am the eye in the sky
Looking at you
I can read your mind
I am the maker of rules
Dealing with fools
I can cheat you blind

— excerpt, Eye in the Sky by Alan Parsons Project

It’s not like I wanted to haul out all my high school and college music, but they sure seem to work well this week.

Speaking of the eye in the sky…

FBI and DHS circle overhead a LOT
Buzzfeed published its findings after looking into FBI and DHS surveillance flight records, finding a lot of planes circling over mosques. The results also looked at flights immediately after the San Bernardino shooting. You know what would be interesting? Comparing that information against the handling timeline for the Apple iPhone issued to Syed Farouk by his employer.

U.S. dealerships sue Volkswagen – but expand on Dieselgate
Not only are three family-owned dealerships suing VW for its fraudulent use of an emissions control defeat system in their diesel passenger vehicles — they are suing because of VW’s financing practices, which steered money away from dealership’s preferred financing while leaving the dealerships stuck with rapidly depreciated business value. The potential losses to VW just swelled by another magnitude.

Iceland’s new PM expects elections this fall
Rather than dissolving the government, the former Prime Minister Sigmundur David Gunnlaugsson’s coalition partners negotiated the appointment of Sigurdur Ingi Johannsson as his replacement after Gunnlaugsson’s Panama Papers-driven resignation. Johannsson said the coalition expects elections this autumn while continuing to focus on working on stability. That’s a nice way of saying the Progressive Party and the Independence Party are stalling for time to avoid a likely rout if elections were held today. Polling indicates the Pirate Party would stomp the other three major parties if a vote was held now.

MP and Official spokesperson of the Pirate Party Birgitta Jónsdóttir was interviewed by Democracy Now! about Iceland’s current political climate. Jonsdottir, a possible contender for PM, explained her country’s reaction to the Panama Papers’ revelations:

…What is in particular disturbing about the prime minister’s conduct in this matter is that the day before new laws took effect in Iceland about how you declare and how tax havens are dealt with, because Iceland is a part of a sort of a campaign, international campaign, to stop tax havens being a part of a solution on how to get away from participating in paying tax in your own country. He signed—his sold his wife his share for one dollar the day before the laws took effect. And that, in itself, seems highly dubious. And then, he has actually been using his wife as a shield and saying that people that are criticizing him are attacking his wife. I actually think that this guy is in some sort of meltdown, because his behavior in the last few days has been so outrageous that it seems like we are stuck in a satire by Dario Fo, you know, in a complete theater of the absurd. And I’m just so deeply humiliated on behalf of my nation that this is what the outside world is looking at. …

The feeling of betrayal is palpable. It’s a good read, do check it out in its entirety.

Odd lots

  • Massive breach exposes 55 million Philippine voters’ identities (The Register) — That’s Philippines’ Commission on Elections (COMELEC) *entire* database, which COMELEC claims doesn’t contain anything sensitive. Except for stuff like fingerprints and passport numbers. Oh, and all the information for half the entire country’s population.
  • China’s ‘Great Firewall’ architect reduced to using VPN during a speech (Shanghaist) — Oops.
  • Adobe patching a Flash zero-day (Naked Security) — Again. I know, I know, when will Flash die?
  • Climate change could lengthen Europe’s dengue fever season (Science Daily) — Longer, warmer summers will extend the season for Aedes aegypti and Aedes albopictus mosquito populations, the disease’s key infection vectors. Hey, you know what else might show up for longer periods of time, too? Zika, since it’s carried by Aedes aegypti.

Wow. It’s coffee break time already? Have at it. Catch you tomorrow morning!