Tuesday Morning: I Don’t Want It Good

I don’t want it good. I want it Tuesday.
— Jack Warner

Pretty sure Mr. Warner would get it just the way he wanted it today.

Surprise: Saudis and Russia agree mutual economic destruction = bad
Expect a rocky market today after a hush-hush agreement by Saudi Arabia and Russia to hold oil production levels to January levels. The FTSE and Brent crude have already taken a hit, though why Brent’s price dropped when supply firmed/tightened makes no sense to me. Good thing I’m not a commodities broker.

Predictable outcome: Dropbox account hacked, contents posted, then teacher fired
I feel awful for this poor teacher, whose privacy was violated and his job lost after someone hacked his Dropbox account, then posted a personal sex tape on his school’s website. Unfortunately, this is another painful real-life lesson: Do NOT store content in the cloud if the content hurt you if leaked.

Shaken by a quake? There’s an app for that
UC Berkeley Seismological Lab released an Android app called MyShake. The application detects vibration fitting earth tremor profiles and reports them to the lab for diagnostics. Enough data combined with other seismic monitoring can confirm an earthquake. The Seismological Lab hopes to build a global seismic detection network which can help detect earthquakes before they begin. With enough advance notice, humans may be able to reduce damage and injury. The Lab says the app runs silently in your phone’s background and doesn’t use up the battery, but this seems like an impossibility. Only one way to find out, though, and only one way for the lab to improve the app’s performance. An iOS version is expected in the near future.

Volkswagen fined by Mexico over emissions — but not the defeat device
Looks like VW imported more than 45,000 vehicles into Mexico without dotting all the Is and crossing all the Ts. The automaker has been fined nearly $9 million dollars (168 million pesos) for failing to obtain mandatory emission and noise certifications. Sounds like VW needs to overhaul its management culture.

Air-gapped computers may not be safe from hacking
A team of researchers from Tel Aviv University and Technion identified a means for hacking air-gapped computers in a completely separate room in order to snag data. Their method only required an antenna, amplifiers, a software-defined radio, and a laptop to measure electromagnetic waves created by a target computer as it deciphered a specific message.

There it is: it ain’t good, but you’ve got it on a Tuesday.

Monday Morning: Fair of Face

Eh. Not so much. I can’t think of many working folks who greet Monday morning with joy, finding it a beautiful thing. But according to old English folk tales, a Monday birthday was supposed to bring better luck.

What good luck will today bring?

Dripping blood tips off discovery of dead body and millions in currency on plane
Reads like a murder-mystery novel, right? Except that this happened Sunday in Zimbabwe at Harare International Airport. Airport staff noticed blood leaking from the plane during refueling, after which an investigation began, revealing a dead body inside the plane and millions in South African rand on board. The plane was registered to Western Global Airlines of Florida and had been flying from Germany to South Africa. What are the odds we never hear of this plane, the body, or the currency again?

Volkswagen chief knew in 2014 U.S. would investigate; Germany wants spot checks
From scandals like Watergate, the U.S. knows the coverup is often worse than the crime. Looks like Volkswagen will learn this, too. Martin Winterkorn, VW’s former CEO, knew in May 2014 that U.S. officials suspected emissions controls defeat devices in VW’s diesel passenger vehicles. BUT…this is not quite news, as the study revealing VW’s non-compliant emissions were reported in May 2014, in a public forum, where VW asked about the results. What did Winterkorn know, and when did he know it?

Germany’s Transport Minister Alexander Dobrindt said yesterday, “There will be controls on vehicles in the style of doping tests (for athletes), …Unannounced and every year.” Dude. Come on. The defeat device evaded random tests in U.S. states like California. Random spot checks will NOT ensure emissions controls work. Only random road tests capturing real world driving outputs will do that. Dobrindt said a draft proposal outlining the test measures would be submitted to the Bundestag on Thursday. Will the lower parliament get wise to this problem?

British teen arrested for the hack on FBI, DHS, CIA director’s email, more
“I am innocent until proven guilty so I have nothing to be worried about…They are trying to ruin my life,” the 16-year-old said after his arrest last week. The most recent hack the teen is accused of included the “leak” of 30,000 FBI and DHS personnel contact information. He’s accused of being a member of Crackas With Attitude (CWA); CWA has said the hacking of CIA director Brennan’s email was “so easy to hack Brennan that ‘a 5-year old’ could have done it.” Doesn’t sound like mad hacking skillz required to pose a threat to law enforcement.

UK’s Investigatory Powers Tribunal said hacking devices by intelligence doesn’t violate human rights
British Foreign Secretary Philip Hammond believes the IPT’s ruling last week is fair, but of course, he would. The case pressed by Privacy International forced the UK’s intelligence agency GCHQ to reveal the use of mass surveillance using computer network exploits (CNE). The case can’t go any further in the UK, but could be reviewed in the EU. Wonder if these same CNE were deployed to identify the 16-year-old teenager charged with hacking Brennan?

From Department of Creepy Spouses: Man + Wife’s FitBit Data + Reddit = PG
A man asked a Reddit forum about wife’s unusual FitBit data and learned she’s pregnant. I would kick this butthead to the curb so fast if he’d been my spouse. Talk about a violation of privacy, let alone a breach of intimacy between married partners. I can only imagine how this discovery will influence hackers snooping wearable devices.

Not looking like good luck today after all. Perhaps better luck tomorrow?

Friday Morning: It’s Five Somewhere

This week has been really long. Painfully dragged out. Mid-week snowstorm probably didn’t help. But here we are, survivors with another week and yet another Presidential campaign debate under our belts.

I’ll keep it short and snappy given how much ugly we’ve been through.

Your information security is only as good as the stupidest person on staff
“Hello, FBI? I’m new here and I don’t have my code. Can you help a girl out?” No joke, that’s about all it took for one unnamed hacktivist to get inside the FBI. And yet the FBI demands backdoors into all mobile devices. I can’t even…

Meet your new immortal overlord: Your self-driving car
This first graf scares the crap out of me:

The computer algorithms that pilot self-driving cars may soon be considered the functional equivalents of human drivers. That’s the early opinion of the National Highway Traffic Safety Administration—and so begins our slow-burn acquiescence in the battle of man versus machine.

And not even for the reasons that PC World’s editor-in-chief Jon Phillips outlines in his editorial. If a governmental agency recognizes an algorithm as equal to a human, how long before humans are actually subordinate to artificial intelligence?  It’s bad enough corporations — legal constructs — have nearly the same rights as humans and can live forever. This needs to die on the vine right now — especially since Google is ramping up hiring for its line of self-driving cars.

Speaking of Google…

Busy week on Zika front

Media commentator Douglas Rushkoff interviewed on digital society

You left Facebook in 2013. How is that working out for you?

Professionally, I’m thinking it may be good for one’s career and business to be off social media altogether. Chris Anderson was wrong. “Free” doesn’t lead to anything but more free. Working for free isn’t leverage to do a talk for loads of money; now they even want you to talk for free. What am I supposed to do? Join YouTube and get three cents for every 100,000 views of my video? That is crap; that is insane! …

A worthwhile read, give it a whirl when the dust begins to settle.

Here’s hoping the weekend moves as slowly as this week did. Huli pau!

Thursday: Thunder Much

[image: Thor's Battle Against the Jötnar by Mårten Eskil Winge, c. 1872, via Wikimedia]

[image: Thor’s Battle Against the Jötnar by Mårten Eskil Winge, c. 1872, via Wikimedia]

It’s Thor’s Day, the Norse god of thunder’s day. This dude has a really poor selection of images available until the 20th century, and most are commercial. Doesn’t say much about his powers, does it.

Speaking of powers, mine are tapped out. I have a massive, partially-completed timeline on the Flint water crisis scheduled to post at 9:00 a.m. EST. When you see it, you’ll understand why my thunder’s depleted. I’ll throw a couple eye-catching items here for now; use this as an open thread.

In case I forget: Skål!

North Korean military chief executed for corruption
NK’s execution of Army General Ri Yong-Gil seems really oddly timed within a week of NK’s satellite launch. Makes one wonder if the launch and the execution were related. The termination is attributed to Kim Jong-Un’s continued efforts at retaining power.

Hundreds of thousands of stolen Social Security numbers used to attack IRS
Where the heck did hackers get 464,000 Social Security numbers? And how the heck did they use 101,000 of them to hammer away at the IRS to obtain e-pin number for filings? The IRS says no one’s personal taxpayer data has been compromised, nor were any filings messed up in this automated mass attack last month.

Comcast pleads with ISP customers in Atlanta
Looks like somebody’s nervous about Google Fiber coming to Atlanta, cutting into their broadband market. A pity, that, should have offered better customer service and more competitive pricing. If Comcast had already delivered these, there’d be no reason for Google to bother in that market.

Absolut-ly profitable year ahead for Pernod Ricard
Huh. I guess it makes sense, with the world in such upheaval that booze would be profitable. Pernod Ricard’s projections of one to three percent growth this year remain unchanged as the second-largest distiller in the world names a new leader for its North American business.

By Thor’s hammer…it’s tequila time somewhere. What’s the old Norse word for booze?

District Attorneys Use Spying as Cover To Demand a Law Enforcement Back Door

In response to a question Senate Intelligence Committee Chair Richard Burr posed during his committee’s Global Threat hearing yesterday, Jim Comey admitted that “going dark” is “overwhelmingly … a problem that local law enforcement sees” as they try to prosecute even things as mundane as a car accident.

Burr: Can you, for the American people, set a percentage of how much of that is terrorism and how much of that fear is law enforcement and prosecutions that take place in every town in America every day?

Comey: Yeah I’d say this problem we call going dark, which as Director Clapper mentioned, is the growing use of encryption, both to lock devices when they sit there and to cover communications as they move over fiber optic cables is actually overwhelmingly affecting law enforcement. Because it affects cops and prosecutors and sheriffs and detectives trying to make murder cases, car accident cases, kidnapping cases, drug cases. It has an impact on our national security work, but overwhelmingly this is a problem that local law enforcement sees.

Much later in the hearing Burr — whose committee oversees the intelligence but not the law enforcement function of FBI, which functions are overseen by the Senate Judiciary Committee — returned to the issue of encryption. Indeed, he seemed to back Comey’s point — that local law enforcement is facing a bigger problem with encryption than intelligence agencies — by describing District Attorneys from big cities and small towns complaining to him about encryption.

I’ve had more District Attorneys come to me that I have the individuals at this table. The District Attorneys have come to me because they’re beginning to get to a situation where they can’t prosecute cases. This is town by town, city by city, county by county, and state by state. And it ranges from Cy Vance in New York to a rural town of 2,000 in North Carolina.

Of course, the needs and concerns of these District Attorneys are the Senate Judiciary Committee’s job to oversee, not Burr’s. But he managed to make it his issue by calling those local law enforcement officials “those who complete the complement of our intelligence community” in promising to take up the issue (though he did make clear he was not speaking for the committee in his determination on the issue).

One of the responsibilities of this committee is to make sure that those of you at at the table and those that comp — complete the complement of our intelligence community have the tools through how we authorize that you need. [sic]

Burr raised ISIS wannabes and earlier in the hearing Comey revealed the FBI still hadn’t been able to crack one of a number of phones owned by the perpetrators of the San Bernardino attack. And it is important for the FBI to understand whether the San Bernardino attack was directed by people in Saudi Arabia or Pakistan that Tashfeen Malik associated with before coming to this country planning to engage in Jihad.

But only an hour before Jim Comey got done explaining that the real urgency here is to investigate drug cases and car accident cases, not that terrorist attack.

The balance between security, intelligence collection, and law enforcement is going to look different if you’re weighing drug investigations against the personal privacy of millions than if you’re discussing terrorist communications, largely behind closed doors.

Yet Richard Burr is not above pretending this about terrorism when it’s really about local law enforcement.

Wednesday Morning: Ashes to Ashes

It’s your second morning-after this week, this one launching the countdown on Christian calendars to Easter. I’m a lapsed Catholic, but we do observe Lent in my household. My agnostic son resists, but I’ve explained this is an opportunity to be mindful about others’ experience of going without. We are privileged to choose to give up, and we consciously recognize it by Lenten observation. Some choices we make, like giving up meat and sugar, are beneficial for us, but it’s still the luxury of choice when others are forced to simply suffer without recourse.

This year we will be mindful of water. We take it for granted every time we turn on the faucet. Yet our brethren go without in nearby Flint, in spite of water’s essential nature to life. I’ll donate the money I would have spent on 46 days of meat-based meals to Flint’s United Way Water Fund and the Food Bank of Eastern Michigan, as both organizations are helping distribute water and filters to Flint residents. Last night’s Boil Water order issued because of a water main break only underlines the difficulties Flint’s residents will face until the entire water system is replaced.

Dept of Duh: Director of National Intelligence says Internet of Things can be used to spy
NO! Say it isn’t so! Like it never occurred to us that any device attached to the internet, including the growing number of WiFi-enabled household appliances, might be used to spy on us.

Volkswagen recalls cars — and not because of emissions
VW didn’t need more trouble; this time, it’s not the German car makers’ fault. 680,000 VW-branded vehicles are being recalled because of Takata-made airbags which may be defective. TAKE NOTE: Mercedes-Benz models were also recalled yesterday.

Toyota, Honda, Acura, BMW, Nissan, Subaru, GM, Ford, Chrysler, and Daimler also issued recalls over the last two years for the very same reason — defective Takata-made airbags. See this article for a running timeline of events related to the recalls as well as a list of affected vehicles (to date).

Attacking the grid? Try a squirrel first – hacking is much harder
A honeypot mimicking an energy management system demonstrated the challenge to hackers trying to crash a power grid. Dewan Chowdhury, MalCrawler’s founder, spoke at Kaspersky Lab security Analyst Summit about the knowledge set needed to attack energy systems:

“It’s extremely difficult. You’ can’t just be a NSA or FSB hacker; you need an electrical engineer on board to weaponize attacks and figure out what’s going on … When it comes to weaponization, you need a power substation engineering who knows what needs to be done and tested.”

After reading about Chowdhury’s presentation, I have two caveats. The first is the notion that an “electrical engineer” or a “power substation engineer” is required. Many non-degreed workers like electricians and technicians are familiar with computers, networks, and SCADA equipment. The second is this bit:

The groups had access to the HMI, which would allow them to manipulate the grid, but Chinese, U.S., and Russian groups, he said, stick to a gentlemen’s agreement and leave the grid alone. Middle Eastern actors, however, will try to perform control actions to sabotage the grid.

A “gentlemen’s agreement”? When do the gloves come off? When one of these actors align with a Middle Eastern actor?

Global disaster — how would you respond?
In case a mess of squirrels are deployed to take down the world’s power grids, one might need to know how to deal with the inevitable meltdown of services. Johns Hopkins Center for Civilian Biodefense Strategies modeled a global disaster in 2013 by way of a simulation game. The results were predictable:

What they discovered was that the country was ill prepared to cope. Within two weeks there would be enormous civilian casualties, a catastrophic breakdown in essential institutions, and mass civil unrest. Food supplies, electricity and transport infrastructures would all collapse.

International security scholar Dr. Nafeez Ahmed was asked how people should respond; he offered a nifty guide, outlined in six points.

But disaster isn’t always global, and current cases show our gross inability to respond to limited disasters. Flint, for example, already struggles with running water, item number three on Dr. Ahmed’s list. Conveniently, Flint doesn’t necessarily rely on government or law enforcement (item number four) because neither responded appropriately to the ongoing water crisis. What remains to be seen is whether Flint will muster long-term self-sufficiency (item number six) as government and law enforcement continue to let them down.

Speaking of Flint, I wonder how today’s Democratic Steering and Policy Committee hearing on Flint’s water crisis will go, as Michigan’s Governor Rick Snyder declined to appear.

“Don’t necessarily trust the government or law enforcement” in global disaster, indeed.

The Unnamed Network Provider Exposing our Infrastructure

Today was Global Threat day, when James Clapper testifies before various committees in Congress and Ron Wyden asks uncomfortable questions (today, directed exclusively at John Brennan). I’ll have a few posts about the hearings (in Senate Armed Services and Senate Intelligence Committees) and Clapper’s testimony, the SASC version of which is here.

One interesting detail in Clapper’s testimony comes in the several paragraph section on Infrastructure within a larger section on “Protecting Information Resources.” Here’s how the testimony describes the Juniper hack.

A major US network equipment manufacturer acknowledged last December that someone repeatedly gained access to its network to change source code in order to make its products’ default encryption breakable. The intruders also introduced a default password to enable undetected access to some target networks worldwide.

There’s no discussion of how many Federal agencies use Juniper’s VPN, nor of how this must have exposed US businesses (unless the NSA clued them into the problem). And definitely no discussion of the assumption that NSA initially asked for the back door that someone else subsequently exploited.

More importantly, there’s no discussion of the cost of this hack, which I find interesting given that it may be an own goal.

Tuesday Morning: The Fat One You’ve Awaited

Mardi Gras. The day before Ash Wednesday. Fat Tuesday. In Brazil, it’s Carnival — plenty of parades with costumed dancers and samba. In New Orleans, it means king cake, beads, and more parades, but here in Michigan, it means pączki. No parades in the snow, just an icy trek to the Polish bakery for some decadent sweets we get but once a year.

I’m still drafting this, too much stuff to weed through this morning. I’ll update as I write. Snag a cup of joe and a pączki while you wait. Make mine raspberry filled, please!

Economic indicators say “Maybe, Try Again”
Asian and European stock markets were a mess this morning. There’s no sign of an agreement between OPEC nations on production and pricing, which may lead to yet more floundering in the stock market. Yet one indicator — truck tonnage on the roads — doesn’t show signs of a recession in the U.S.

UK court cases topsy-turvy: LIBOR Six and a secret trial

  • UK can’t hold the LIBOR Six bankers accountable for their part in the 2008 economic crisis because the prosecution was sloppy. It’s pretty bad when a defense attorney asks if the prosecution was “making this up as they go along.”
  • The article’s first graf is a warning:

    Warning: this article omits information that the Guardian and other news organisations are currently prohibited from publishing.

    The case, R v Incedal and Rarmoul-Bouhadjar, continues to look like a star chamber, with very little information available to the public about the case. The accused have been charged and served time, but the media has been unable to freely access information about the case, and their appeal has now been denied. A very ugly precedent for a so-called free country.

Facebook: French trouble, and no free internet in India

  • Shocked, SHOCKED, I am: French regulators told Facebook its handling of users data didn’t sufficiently protect their privacy. The Commission nationale de l’informatique et des libertés (CNIL) told the social media platform it has three months to stop sharing users’ data with U.S. facilities for processing. CNIL also told Facebook to stop tracking non-Facebook users without warning them.
  • The Indian government told Facebook thanks, but no thanks to its Free Basics offering, a so-called free internet service. The service ran afoul of net neutrality in that country as it implicitly discouraged users from setting up sites outside Facebook’s platform. Many users did not understand there was a difference between Facebook and the internet as a whole. Mr. Zuckerberg really needs to study the meaning of colonialism, and how it might pertain to the internet in emerging markets.

Boy kicked out of school because of his DNA
This is a really sad story not resolved by the Genetic Information Nondiscrimination Act (GINA). The boy has cystic fibrosis; his parents informed the school on his paperwork, as they should in such cases. But because of the risks to the boy or his siblings with similar genes, the boy was asked to leave. GINA, unfortunately, does not protect against discrimination in education, only in healthcare and employment. This is a problem Congress should take up with an amendment to GINA. No child should be discriminated against in education because of their genes over which they have no control, any more than a child should be discriminated against because of their race, gender identity, or sexuality.

All right, get your party on, scarf down the last of your excess sweets, for tomorrow is sackcloth and ashes. I can hardly wait for the sugar hangover to come.

Monday Morning: Taking out the Garbage

Most of the time, I’m here in Michigan and I’m taking out the garbage every Monday. — Bob Seger

Morning-after blues now set in, feeling the weight of too much beer and cheese, doing the Walk of Shame, reeking of regret. Gotta’ love American excess in all things, including sports.

Take out last night’s garbage, pour yourself an herbal tea or a detox smoothie, and let’s get back at it. Speaking of garbage…

VW expected to make appetizing offer to U.S. passenger diesel owners — BUT…

The German car maker has still not decided whether vehicle owners will be offered cash, car buy-backs, repairs or replacement cars, Kenneth Feinberg told the Frankfurter Allgemeine Sonntagszeitung.

In other words, everything compensation manager Kenneth Feinberg said on behalf of VW for a German media outlet is vaporware. Best to keep in mind Feinberg has previously represented shining examples of corporate ethics like BP after the Deepwater Horizon spill.

Zika, Zika, Zika…
The virus is now driving some people mad — and they’re not even infected. Like Republican presidential candidates who believe persons traveling to the U.S. should be quarantined if they come to the U.S. from Brazil (Christie), or could be quarantined if they have been infected (Carson). Or scientists pushing to kill all the Aedes aegypti mosquitoes, without much thought for what removal of a species of insects will do to the rest of the ecological system which they’ve made home. Viruses are opportunistic; lose one host and they’ll hop to another. Are scientists modeling that next likely host?

Electronic toy maker VTech offers to buy LeapFrog
LeapFrog was popular with my kids 10 years ago; their line of educational toys helped my kids’ grades with spelling test games. But LeapFrog made a strategic error leaving the smaller handheld games for children’s tablets, and is now limping along. VTech has its own problems with technology, like the recent breach of user data, exposing millions of children and their families. Perhaps LeapFrog’s information technology will help shore up VTech’s through this acquisition.

Death from outer space
A bus driver in India may have been the first recorded casualty of a meteorite this weekend. Three others were injured when the meteorite exploded, leaving a small crater and broken windows.

Gong Xi Fa Cai or Gong Hey Fat Choy to you, depending on whether you speak Mandarin or Cantonese, as we enter the Year of the Monkey. Oops, perhaps you shouldn’t take out the trash just yet, especially if it requires sweeping. It’s bad luck to do so on the first new moon of the year — you might sweep your good luck out the door! Oh, your team lost last night? Sweep away. Best wishes for a prosperous new year!

Superb Owl: Keeping Eye on Fans and More?

If humans could see the full spectrum of radiation, the San Francisco Bay Area shines bright like the sun this evening — not from lighting, but from communications. The Super Bowl concentrates more than 100,000 people, most of whom will have a wireless communications device on their person — cellphone, phablet, or tablet. There are numerous networks conveying information both on the field, the stands and to the fans watching globally on television and the internet.

And all of the communications generates massive amounts of data surely monitored in some way, no matter what our glorious government may tell us to the contrary. The Super Bowl is a National Special Security Event (NSSE), rated with a Special Event Assignment Rating (SEAR) level 1. The designation ensures the advance planning and involvement of all the three-letter federal agencies responsible for intelligence and counterterrorism you can think of, as well as their state and local counterparts. They will be watching physical and electronic behavior closely.

Part of the advance preparation includes establishing a large no-fly zone around the Bay Area. Non-government drones will also be prohibited in this airspace.

What’s not clear to the public: what measures have been taken to assure communications continuity in the same region? Yeah, yeah — we all know they’ll be watching, but how many of the more than one million visitors to the Bay Area for the Super Bowl are aware of the unsolved 15 or 16 telecom cable cuts that happened over the last couple of years? What percentage of local residents have paid or are paying any attention at all to telecommunications infrastructure, or whether crews “working” on infrastructure are legitimate or not?

Planning for a SEAR 1 event begins almost as soon as the venue is announced — perhaps even earlier. In the case of Super Bowl 50, planning began at least as early as the date the game was announced nearly 34 months ago on March 28th, 2014. The Levi’s stadium was still under construction as late as August that same year.

And the first cable cut event happened nearly a year earlier, on April 16, 2013 — six months after Levi’s Stadium was declared one of two finalists to host the 50th Super Bowl, and one month before Levi’s was awarded the slot by NFL owners.

News about a series of 11 cable cuts drew national attention last summer when the FBI asked for the public’s assistance.  These events happened to the east of San Francisco Bay though some of them are surely inside the 32-mile radius no-fly zone observed this evening.

But what about the other cuts which took place after April 2013, and after the last of 11 cuts in June 2015? News reports vary but refer to a total of 15 or 16 cuts about which law enforcement has insufficient information to charge anyone with vandalism or worse. A report last month quotes an FBI spokesperson saying there were 15 attacks against fiber optic cable since 2014. Based on the date, the number of cuts excludes the first event from April 2013, suggesting an additional four cuts have occurred since June 2015.

Where did these cuts occur? Were they located inside tonight’s no-fly zone? Will any disruption to communications services be noticed this evening, when so many users are flooding telecommunications infrastructure? Will residents and visitors alike even notice any unusual technicians at work if there is any disruption?

Keep your eyes peeled, football fans.