Posts

Three Things: Complaint Declassified, Ambassa-doored, Scripted Call? [UPDATE]

/198 Comments/in , , /by

[NB: Note the byline. This contains some speculation. Update at bottom of post. /~Rayne]

I’m writing this on the fly, publishing before I have this post fully written because the whistleblower complaint situation is moving faster than a pyroclastic flow.

Bear with me and watch for the rest of the things to appear down the page as I update. Thanks!

~ 3 ~

The reason I am publishing before I’m done writing is this:

The complaint isn’t being circulated until sometime Thursday morning, and Rep. Stewart isn’t going to be a reliable source for it as he tag-teamed with Rep. Jim Jordan on Fox earlier to cover the GOP’s behind.

Rep. Jackie Speier’s reaction mirrors those I’ve seen all evening as members of Congress read the complaint inside a SCIF.

The House and Senate both voted to release the whistleblower complaint earlier in the day Wednesday. The bill passed unanimously in the Senate on a bipartisan basis; it passed with 228 votes in the House.

~ 2 ~

From an ABC News report earlier this evening:

… “It was clear that [President Donald] Trump will only have communications if they will discuss the Biden case,” said Serhiy Leshchenko, an anti-corruption advocate and former member of Ukraine’s Parliament, who now acts as an adviser to Zelenskiy. “This issue was raised many times. I know that Ukrainian officials understood.” …

You’ll recall in August 2016 Leshchenko was responsible for revealing the secret payments outlined in the ‘black ledger of the Party of Regions’ showing payments made by the former pro-Russian president Viktor Yanukovych to Trump campaign chairman Paul Manafort.

What’s not clear from ABC’s report or Leshchenko’s remarks is how Ukrainian officials came to know Trump’s expectations in advance of communications.

However, Rudy Giuliani had two meetings with Ukranian officials before key events including the July 25 call at the heart of the whistle blower complaint.

~28-MAR-2019 —  Exact date TBD. In ‘early 2019’, Giuliani met with Ukraine’s prosecutor general Yuriy Lutsenko in New York.

This meeting took place before the first run-off election in Ukraine, narrowing the field down to the incumbent Petro Poroshenko and Volodymyr Zelensky.

A congratulatory phone call from Trump occurred immediately following the April 21 presidential election in which Zelensky was the victor.

~11-JUL-2019 — Date TBD. On or about this time, Giuliani had a phone meeting with Zelensky’s adviser, Andriy Yermak.

This meeting took place approximately two weeks before Ukraine’s parlimentary elections when Zelensky’s Servant of the People party won the majority on July 21.

Another congratulatory phone call by Trump took place days later on July 25.

Giuliani claimed the phone meeting with Yermak had been set up by State Department; State denied this, saying, “Mr. Giuliani is a private citizen and acts in a personal capacity as a lawyer for President Trump. He does not speak on behalf of the U.S. Government.”

There was at least one other contact between Giuliani and a Ukrainian official in June, believed to be in Paris.

Did Giuliani “brief” former prosecutor general Lutshenko and newly-appointed adviser Yermak about Trump’s anticipated calls?

Did Giuliani go so far as to offer talking points or a script for a successful call with Trump?

~ 1 ~

Community member Eureka and I both found the mention of former Ambassador Marie Yovanovitch in the July 25 call memo a bit odd or off. Recall these three events pertinent to her from the whistleblower complaint timeline:

05-MAR-2019 — U.S. Ambassador to Ukraine Marie Yovanovitch criticized Ukraine’s record on corruption; she noted the country’s high court’s decision weakens Ukraine’s National Anti-Corruption Bureau (NABU).

20-MAR-2019 — The Hill’s John Solomon interviewed Ukraine’s prosecutor general Yuriy Lutsenko; Lutsenko claimed Amb. Yovanovitch gave him a do-not-prosecute list during their first meeting. State Department denied this claim in an email to Radio Free Europe.

07-MAY-2019 — Amb. Yovanovitch was recalled — removed from her position.

It’s important to these events to recall that Ukraine’s president Zelensky ran on an anti-corruption platform and is a supporter of NABU’s work.

Giuliani announced May 9 he was going to visit Ukraine just days after Yovanovitch made her critical remarks about corruption, though he canceled his trip the next day when the Senate started nosing into his planned trip.

And Giuliani had at least one meeting with prosecutor general Lutsenko between the ambassador’s remarks about corruption and her departure from her role.

Another key event was Zelensky’s election on April 21 — roughly two weeks before Yovanovitch was recalled, which was another two weeks before Zelensky was inaugurated.

Here’s the bit that bothered Eureka and myself from the memo:

There’s the odd remark by Trump, “Well, she’s going to go through some things,” which is very unsettling, particularly when coming from a man with a history of assault complaints, most of a sexual nature.

But not noted in the context of this memo is that Yovanovitch — incorrectly called Ivanovich by Zelensky or incorrectly recorded by the note taker — was recalled early, before her three-year assignment was complete in July, after a campaign of character assassination via social and commercial media had been launched against her. One of the participants was Donnie Jr. himself, according to the Washington Post and Newsweek.

Who and what triggered the character attacks? It appeared to begin with Lutsenko’s claim on Hill.TV in the US in early March that Yovanovitch gave him a Do-Not-Prosecute list. In April he admitted his claim was false — too late to undo the damage and stop the right-wing pile on.

Is the subsequent abuse-via-media what Trump was referring to in his creepy remark, or was there something else?

Eureka noted that Trump didn’t refute being the one to tell Zelensky about Yovanovitch. She also noted Zelensky’s language seemed more declarative than her past experience with Ukrainian-Americans.

This clicked with my question about Zelensky’s statement, which seemed really pat for a new president only weeks into his role: did someone feed Zelensky some or all of his remarks to Trump before the July 25 phone call? Was Zelensky told to affirm Trump’s position on issues including Yovanovitch’s removal in advance of the call, perhaps using a scripted response?

It would explain the puzzling certainty Zelensky has about Yovanovitch’s work given the narrow two-week time frame between his election and her recall from Ukraine. How would he have had enough time to get to know her work that well in two weeks?

And why would a president who was committed to anti-corruption efforts find a like-minded diplomat from the U.S. to be a “bad ambassador” in that short amount of time?

~ 0 ~

This is an open thread. I know you’re going to have a lot to say about all of this.

And at nearly 2:00 a.m. here I am finally heading for bed. Whew.

UPDATE — 10:20 A.M. 26-SEP-2019 —

The whistleblower complaint has been released. It can be read here:

https://intelligence.house.gov/news/documentsingle.aspx?DocumentID=708

Note the links at that page to open the complaint.

Joseph Maguire the Acting Director of National Intelligence, is appearing before the House Intelligence Committee right now. The hearing began at 9:00 a.m. EDT.

Brandi Buchman at CourthouseNews has a live tweet thread of the hearing in progress – start here: https://twitter.com/BBuchman_CNS/status/1177196206675701760

Be sure to check Marcy’s tweets though she’s still on her epic road trip: https://twitter.com/emptywheel

Check the feed at my Trump-Russia list because they’re all focused on the complaint and hearing: https://twitter.com/raynetoday/lists/trump-russia

Three Things: One Is Not a Transcript

/144 Comments/in , /by

[NB: Check the byline, thanks! /~Rayne]

“This thing, what is it in itself, in its own constitution? What is its substance and material? And what its causal nature (or form)? And what is it doing in the world? And how long does it subsist?”

— Marcus Aurelius, Meditations, Book VIII, sect. XI

I relied on Marcus Aurelius more than two years ago when looking at what we knew about the relationship between Michael Flynn and Donald Trump.

This same meditation provides a nice starting point after the release of a document purported by many to be a transcript (pdf) of the July 25 phone call by Trump to Ukraine’s president Volodymyr Zelensky.

~ 3 ~

What is this thing?

It says right there in black-and-white that it is a memorandum. It is NOT a transcript.

There’s a caveat at the bottom of the same page, too, explaining that it is NOT a transcript:

~ 2 ~

We’re told there was no quid pro quo. But what is this thing?

Zelensky said his country is ready for more military aid, and Trump said he wants a favor, though.

That’s a quid pro quo. It’s right there again, in print, something (like military aid) for something (like a favor).

~ 1 ~

This last thing to be examined is a little more tricky. It does whatever it can to avoid being taken at face value.


This is a member of Trump’s legal team, Rudy Giuliani. He’s been a member since April 2018.

He is not an ambassador to Ukraine. There is no current ambassador as one has not been nominated by Trump and approved with the advice and consent of the Senate according to Article II, section 2 of the Constitution.

Nor is he the Chargé d’Affaires as that role has been filled William B. Taylor, Jr. since June 2018. He is not the Deputy Chief of Mission at the U.S. Embassy in Kyiv; that role has been filled by Kristina A. Kvien since May 2019.

Nor is he a State Department employee in some other capacity besides ambassador.

He is not an employee of the Department of Justice or Federal Bureau of Investigation, which are responsible for criminal investigations. He was not a member of the Special Counsel’s Office.

He is not the White House Counsel; that role has been filled since December 2018 by Pat Cipollone.

Nor is he a member of Congress or a congressional staffer yet he says someone read to him the ‘transcript’ before any member of Congress received it.

Who or what is this thing? What is it doing? How does it subsist?

Because he’s not working for the American public though he’s been pushing for investigations into American citizens overseas.

Because he’s not furthering the investigation into Paul Manafort or the hacking of the DNC in 2016 as part of the Special Counsel’s Office investigation or as an employee of any other U.S. law enforcement.

Because he’s not representing broader American ties with Ukraine, only whatever it is his client and the rest of his legal team have assigned to him.

We can’t rule out that he’s working for Trump’s campaign in some capacity. It’s not clear any news media outlet has asked him if he is.

What is he really?

~ 0 ~

This is an open thread, but bring your comments about the whistleblower complaint and U.S.-Ukraine here.

Minority Report: Ukraine as Bugbear

/44 Comments/in , /by

[NB: Note the byline; I began writing this as one of my Minority Report pieces; it’s been in my Work In Progress folder for nearly two years, and an unfinished draft here at emptywheel for 18 months. I left off work on it well before the final Special Counsel’s Report was published. This post’s content has become more relevant even if it’s not entirely complete, needing more meat in some areas, and now requiring the last two-plus years of fossil fuel-related developments and events related to the U.S.-Ukraine-Russia triangle after the 2016 U.S. general election. /~Rayne]

This post looks at the possibility that the hacking of U.S. election system and events affecting the election’s outcome are part of a much larger picture — one in which NATO figures large, and the future of energy figures even larger.

One could attribute Russian attempts at hacking and influencing the 2016 general election to retaliation for the CIA’s involvement in Ukraine, or to a personal vendetta against former Secretary of State Hillary Clinton with regard to Ukraine ahead of the Maidan revolt, or to rousing anti-Putin sentiment in Russia:

… Five years ago, he blamed Secretary of State Hillary Clinton for the anti-Kremlin protests in Moscow’s Bolotnaya Square. “She set the tone for some of our actors in the country and gave the signal,” Putin said. “They heard this and, with the support of the U.S. State Department, began active work.” (No evidence was provided for the accusation.) …

But after looking at the mission and history of NATO, the integral role of natural gas to Europe’s industry and continuity, Ukraine’s role as a conduit for Russian gas to European states, one might come to a very different conclusion.

Especially given the death of Alexander Litvinenko on UK soil by radioactive poisoning and the downing of Malaysian Air flight 17, a passenger plane carrying passengers who lived across several NATO countries.

Has the U.S. been asked to provide protection to European NATO members’ supply of fossil fuels transiting Ukraine? Has the U.S. been asked during the last two administrations to push back on Russia because of incursions related to energy?

What makes Ukraine so different from Belarus, Georgia, Lithuania, and Moldova, which also have pipelines carrying Russian gas and experienced price disputes — is it the percentage of energy supplied to EU states crossing Ukraine in comparison? Of these four countries, only Lithuania is a NATO member.

How does tiny Montenegro, the newest NATO member state, fit into this picture?

NATO

In 1949, twelve North American and European countries signed a treaty creating an intergovernmental military alliance, the North Atlantic Treaty Organization (NATO). They pledged a collective system of mutual defense against external forces attacking any one or all of its member states. The alliance has grown over the years to 29 nation-states with Bosnia and Herzegovina, Georgia, North Macedonia and Ukraine having expressed interest in joining. Each member state commits to spending at least 2% of its GDP on defense spending to support the organization’s mission.

It’s critical to note NATO members agreed under the treaty’s Article V that an ‘armed’ attack against any member in North America or Europe would be considered an attack against all of them. Response to an attack upon a NATO member does not require armed or military force. Over time, threats to NATO states were not limited to armed attacks; they were economic in the case of fuel pipeline shutdowns.

In the digital age, what is an armed attack, especially if both sides call it “cyber warfare” or “information warfare”?

FOSSIL FUELS

Like the U.S., Europe has been entirely too reliant on fossil fuels. It has been far too lax in governance when it comes to resulting pollution let alone political and economic volatility related to fossil fuel use. Volkswagen’s Dieselgate scandal and the EU’s slow response to VW’s fraud and resulting air pollution offer a perfect example.

While Europe has made substantive headway to reduce fossil fuels and replace them with alternatives — Germany, for example, drew 30% of its energy from non-fossil fuel alternatives in 2014 — until the EU has completely eliminated fossil fuels including natural gas it will be vulnerable to pressure by Russia and other fossil fuel-rich countries. It has been too easy for Russia to threaten the EU and Ukraine alike by simply throttling the flow of natural gas through Ukraine’s major pipelines originating in Russia.

But this is not the only front; the “long war” (pdf) across the middle east and northern Africa is also driven by competition for fossil fuels. So, too, is much of the instability in South and central America, and increasingly in North America as the population rejects fracking, shale extraction, and related pipeline installation.

There is only one true solution to socio-economic volatility caused by fossil fuels: development and implementation of alternative energy resources which are not reliant on extraction, nor limited tightly by resource location (ex: cobalt (from DRC), lithium (South America), uranium (Australia, Canada, others)). The amount we have spent on warfare to preserve fossil fuel’s status quo would have paid for this many times over, and we might have had better education and health care along with it. NATO’s EU states could not be threatened by the loss of natural gas from Russia if it could rely entirely on renewable alternatives produced inside the EU.

Magnitsky Act and retaliation

One other key question arises from this timeline. In addition to all the other tension and conflicts between the U.S. and its NATO allies and Russia, note the passage of  the U.S. Magnitsky Act  of 2012 and the Russians’ corresponding retaliatory sanction which stopped all further adoptions of Russian children by U.S. parents. If the adoption issue is itself a retaliatory sanction and reversing or changing this Russian sanction requires changing or lifting the U.S. Magnitsky Act, didn’t Donnie Jr.’s June 9 talk during the campaign season with Natalia Veselnitskaya about resuming adoptions under a Trump presidency mean Donnie Jr. conspired or negotiated with a foreign government in a dispute with the U.S. — a violation of the Logan Act? Wasn’t the issue of adoptions merely cover — a coded alternative term — for negotiating Magnitsky Act and other Russian sanctions prior to the election?

Timeline: NATO and Ukraine

1949 — North Atlantic Treaty signed.

1982-1984 — Urengoy-Uzhgorod-Germany pipeline constructed; it provides transcontinental transport of gas from Western Siberia to Western Europe. The Reagan administration did not support this pipeline, preventing U.S. companies from selling construction materials to the Soviets partly in protest against the Soviets’ policies toward Poland and partly due to the perceive imbalance of trade the pipeline would create in Europe’s energy market. European countries did not respect the U.S.’ boycott of the pipeline, resulting in sanctions against some European companies.

15-DEC-1983 — A fire broke out at a compressor station in Urengoy, USSR in western Siberia. Construction of the pipeline was still underway. (Cause of the fire not clear from available resources.)

1985 — Vladimir Putin was stationed by KGB to Dresden — located north of the western end of the Uzhgorod-Waidhaus pipeline — after Urengoy-Uzhgorod-Germany pipeline began operation.

19-NOV-1990 — Treaty on Conventional Armed Forces in Europe was signed, setting limits of weaponry between North Atlantic Treaty Organization (NATO) and the Warsaw Pact states.

26-DEC-1991 —  USSR was dissolved; the Commonwealth of Independent States (CIS) formed in its wake from some of the former Soviet Union’s members. The  Baltic states of Estonia, Latvia and Lithuania elected not to join CIS.

1992-1994 — Russia suspended natural gas to Ukraine for non-payment several times over the course of two years.

XX-SEP-1993 — (into November 1994) Ukrainian companies diverted natural gas from pipelines several times. The reasons for the diversions are not clear; was gas diverted in lieu of transit tariffs, topping off reserves, or due to local shortages?

XX-SEP-1993 — Russia’s Boris Yeltsin offered a deal to Ukraine’s Leonid Kravchuck: Ukrainian debts would be forgiven in exchange for control of the Black Sea Fleet and Ukraine’s nuclear arsenal. The deal is scrapped after negative feedback from Ukrainian politicians. (pdf, pg 19)

XX-MAR-1994 — Tentative agreement made that Russia could acquire a 51% state in the Ukraine pipeline system.

1995 — Early in the year, Russia and Ukraine agreed to form a joint venture, Gaztransit, which would operate pipeline system in exchange for write down of Ukraine debt to Russia.

XX-NOV-1995 — Ukraine’s parliament banned privatization of oil and gas assets. The agreement for Gaztransit was never implemented nor was debt forgiven.

1997 — Hungary, the Czech Republic, and Poland were invited to join NATO.

1998 — A new contract between Gazprom and Naftohaz was written linking gas prices and transit tariffs but did not resolve pre-existing gas debts. Later the same year, Gazprom claimed Ukraine diverted gas and owed USD$2.8 billion, suspending oil and gas exports to Ukraine for 1999.

1999 — Hungary, the Czech Republic, and Poland became NATO members (pdf).

2000 — Ukraine’s Deputy Prime Minister Oleh Dubyna acknowledged that 7-8 billion cubic meters of Russian natural gas were diverted from pipelines before export that year. (pdf, pg 22)

04-OCT-2001 — 2001 Transit Agreement signed, settling the debt between Ukraine and Russia. (pdf, pg 22)

2002 — Estonia, Latvia, Lithuania, Slovenia, Slovakia, Bulgaria, and Romania were invited to join NATO.

2004 — (April?) Estonia, Latvia, Lithuania, Slovenia, Slovakia, Bulgaria, and Romania became members.

XX-JUL-2004 — Ukraine’s debt of USD$1.25 billion for gas was settled with Gazprom and NAK Naftogaz. Ukraine may have been importing more gas from Turkmenistan.

22-NOV-2004 — Orange Revolution began.

23-JAN-2005 — Orange Revolution ended; Ukraine was one of three Commonwealth of Independent States to experience a “color revolution” between 2003-2005.

24-JAN-2005 – Yulia Tymoshenko takes office as Ukraine’s 10th prime minister; she is a proponent of Ukraine joining the EU and NATO.

08-SEP-2005 – President Viktor Yushchenko fires Tymoshenko and her government; observers believe this is political trumpery targeting Tymoshenko.

01-NOV-2006 — Former FSB officer Alexander Litvinenko was poisoned with radioactive PO-210 and died a few weeks later on 23-NOV. Litvinenko met former KGB members Andrei Lugovoy and Dmitry Kovtun at the Millennium Hotel in London’s Grosvenor Square where it is believed he drank tea containing the poison. Multiple byzantine theories about Litvinenko’s death arose.

28/29-NOV-2006 — Energy security was a key topic at NATO’s Riga, Latvia summit. Efforts aimed at a bilateral discussion with Vladimir Putin on the topic of energy security during this summit fell through. From RFERL on the joint summit declaration:

The Riga summit declaration breaks new ground with a reference to energy, saying the alliance recognizes its security can be affected “by the disruption of the flow of vital resources.” NATO undertakes to study the risks and identify areas where it could “add value” to its members’ relevant security interests.

07-MAY-2007 — Urengoy-Uzhgorod-Germany pipeline exploded near Boyarka in central Ukraine, just west of Kyiv/Kiev. Gazprom said the 30-meter break in pipe would not cause a disruption in gas delivery.

22-MAY-2007 — UK determined Andrei Lugovoy should be charged and tried for Litvinenko’s murder, then asked Russia to extradite Lugovoy in relation to Litvinenko’s death.

05-JUL-2007 — Russia refused to extradite Lugovoy due to the terms of its constitution. This perceived lack of cooperation may have discouraged relations between UK and Russia.

02-OCT-2007 — ‘Gazprom may cut gas to Ukraine‘ due to debt of USD$1.3B

08-OCT-2007 — ‘Ukraine settles Russian gas row‘

18-DEC-2007 — Yulia Tymoshenko takes office as Ukraine’s 13th prime minister.

05-JAN-2008 — ‘Gazprom threatens Ukraine gas cut‘; Gazprom said it would throttle gas on 11-JAN if USD$1.5B still not paid.

12-FEB-2008 — ‘Russian, Ukraine gas deal averts crisis’ reported after Putin and Yuschenko announce an agreement in which Ukraine would pay for Nov-Dec 2007 gas and USD$179.5/1000cm would be maintained through 2008. They also announced the formation of new energy intermediary companies as a JV between Gazprom and Ukraine’s Naftohaz.

04-APR-2008 — Accession of Croatia and Albania addressed at Bucharest summit in April. NATO pledges Georgia and Ukraine will someday become members but are not invited to this summit. Czech Republic agrees to the installation of a U.S. missile defense radar tracking system. Installation of 10 interceptor missiles in Poland remains in negotiation.

18-AUG-2008 — Georgia exited the Commonwealth of Independent States as a result of the five-day Russo-Georgian War in early August.

XX-APR-2009 — Croatia and Albania become NATO members.

27-JUN-2010 — Illegals Program spy ring broken with arrest of 10 Russian spies including Anna Chapman.

09-JUL-2010 — All 10 Illegals Program spies arrested in US were swapped in Vienna for four Russian nationals. Two other spies had left the US before they could be arrested.

XX-OCT-2011 — Litvinenko’s widow Marina won the right to an coroner’s inquest in London; the inquest is delayed repeatedly. She insisted her deceased husband had worked with UK’s MI6 after fleeing to the UK in 2000.

24-FEB-2012 — ‘Russia threatens Ukraine over gas‘ after a shortfall of gas to EU through Ukraine during a severe cold snap. It’s not clear what caused the shortfall; Russia may try to run around Ukraine by way of the South Stream pipeline to avoid future disruptions blamed on Ukraine’s state oil and gas company, Naftogaz Ukrainy. The conflict could be a head fake to mask Gasprom’s inability to respond to rapid short-term uptick in gas demand in Europe.

19-JUL-2012 — Magnitsky Act was introduced in  the House.

14-DEC-2012 — President Obama signed the Magnitsky Act into law.

XX-MAY-2013 — (into JUL-2013) Coroner decided a public inquiry into Litvinenko’s death would be better than an inquest. Ministers rule out the request for an inquiry.

11-FEB-2014 — UK’s High Court rules Home Office in the wrong to decided against a public inquiry into Litvinenko’s death.

18/23-FEB-2014 — Protests erupt in the Maidan Nezalezhnosti (Maidan Square) in Kyiv.

01-MAR-2014 — Russia’s parliament approved the use of troops in Ukraine.

01-APR-2014 — (Related/unrelated?) Russia’s GLONASS satellite location system is offline beginning at midnight and not fully back up for 12 hours. No initial cause reported though some months later the outage its blamed on software update.

14-MAY-2014 — An alleged terrorist attack blamed for a gas pipeline explosion near Ivano-Frankivsk, Ukraine.

17-JUN-2014 — Urengoy-Uzhgorod-Germany pipeline exploded near Poltave in central Ukraine, located ~240 miles northwest of Donetsk and ~210 miles southeast of Kyiv/Kiev.

17-JUL-2014 —  Malaysia Air flight MH17 downed over eastern Ukraine by a missile.

01-DEC-2014 —  Vladimir Putin cancels the South Stream pipeline project running from Russia through the Black Sea to northern Bulgaria. (Recall Bulgaria became a NATO member in 2004.)

01-DEC-2014 —  Gazprom signed signed a Memorandum of Understanding with Turkish BOTAŞ for construction of a new gas pipeline running beneath the Black Sea from Russia to the Turkey-Greece border. Part of the deal includes providing Russia gas to Turkey with the rest shipping to the European market.

26-JAN-2015 — Evgeny Buryakov was arrested for acting as an unregistered foreign agent and conspiracy; his counterparts Victor Podobnyy and Igor Sporychev had already fled the country.

27-JAN-2015 — A public inquest began into the death of Alexander Litvinenko.

21-JAN-2016 — UK public inquest into the death of Alexander Litvinenko concluded it was an FSB operation likely approved by Putin.

11-MAR-2016 — Evgeny Buryakov pleaded guilty to begin a 30-month sentence.

28-MAR-2016 — Paul Manafort joins the Trump campaign.

06-JUN-2016 — Donnie Trump Jr. meets with Russian attorney Nataliya Veselnitskaya ostensibly to discuss Russia’s ban on adoptions of Russian children by Americans.

10/18-JUL-2016 — In the run up to Trump’s nomination at the Republican National Convention, the Republican Party’s platform on Ukraine was ‘softened’; the final wording said the U.S. would provide “appropriate assistance” to Ukraine and “greater coordination with NATO defense planning” instead of “lethal” assistance. The wording was changed to coordinate with Trump’s position, in contrast with that of the original proposed by an RNC delegate.

ODNI Whistleblower Complaint: Shoes Dropping All Over the Place [UPDATE-2]

/325 Comments/in , , , /by

[NB: Check the byline. Updates are anticipated and will appear within the timeline or at the bottom of the text. /~Rayne]

In an effort to guess at the likely subject of a whistleblower complaint, the emptywheel community started a crowdsourced timeline of events surrounding the complaint received by the Intelligence Community Office of Inspector General on August 12.

As noted in the timeline, the House Intelligence Committee subpoena issued last Friday required the acting Director of National Intelligence (ADNI) Joseph Maguire to report to Congress about the complaint by Tuesday, September 17; failure to comply would require an appearance before Congress on Thursday, September 19. Maguire did not report as expected.

However dates for the ADNI to testify before the House have now been arranged:

. . .

[emphasis mine]

The Washington Post reported more details Wednesday evening about the whistleblower complaint:

Trump’s communications with foreign leader are part of whistleblower complaint that spurred standoff between spy chief and Congress, former officials say

One bit stood out for me in the lede:

The whistleblower complaint that has triggered a tense showdown between the U.S. intelligence community and Congress involves President Trump’s communications with a foreign leader, according to two former U.S. officials familiar with the matter.

Emphasis mine. Two former officials.

Speculation about the whistleblower’s identity is rampant across social media. Some suggest Fiona Hill, former Special Assistant to the President and National Security Council Senior Director for European and Russian Affairs, as the whistleblower; her planned departure in August was announced June 18. Others suggest an as-yet unnamed low-level analyst.

Marcy tweeted earlier,

It’s not outside the realm of possibility. Bolton seems in a mood to burn it all down, ‘shanking’ POTUS during a Trumpists-dense luncheon on Wednesday. But given the “two former U.S. officials” and former DNI Dan Coats interruption of a meeting to ask his deputy Sue Gordon to resign, I wonder if both Coats and Gordon resigned so they would be able to testify before Congress while escaping the appearance of being compromised by unethical or unlawful acts?

Important points for consideration:

  • What constitutes an “urgent concern” validated by the Intelligence Community Inspector General as credible?
  • What constitutes an unlawful act that would compel a whistleblower to file a complaint if the president can declassify information at will?
  • What kind of unlawful act characterized as an “urgent concern” could occur as a “promise” in communications with a foreign leader?
  • How does the existing timeline frame this “promise”?
  • Who is the “higher authority” who ordered the ADNI not to turn over the whistleblower complaint to the HPSCI, obstructing investigatory oversight?

Promising to violate or ignore violation of bipartisan sanctions against Russia would be unlawful, but would this be an “urgent concern”?

Was there instead an unlawful act with regard to the doxxing of the exfiltrated Russian asset?

Or was there a promise related to surveillance of North Korea?

Did the tensions between the U.S. and Iran spawn an unlawful promise?

There are probably dozens more scenarios that might fit. They may be related to items we didn’t add to the crowdsourced timeline, like these items directly related to North Korea:

28-FEB-2019 — Trump cut short the two-day summit with North Korea for no clear reason.

11-JUN-2019 — Trump received a “beautiful letter” from North Korea’s Kim Jong-un.

09-AUG-2019 — Trump received another “very beautiful letter” from Kim.

This one related to Iran:

03-SEP-2019 — New sanctions were placed on Iran after Trump administration claimed it was developing ballistic missile technology using its communications satellite program as cover.

And these related to Russia:

26-JUN-2019 — Trump told reporters that his anticipated discussion with Vladimir Putin at the G20 summit in Japan was “none of your business.”

31-JUL-2019 — Trump and Putin talked over the phone about Siberian wildfires and trade.

29-AUG-2019 — Trump’s trip to Poland canceled, ostensibly to monitor Hurricane Dorian though he ended up playing golf instead at his N. Virginia course. Was he avoiding conflict over increased Russian troop presence at the administrative border between Russian-occupied South Ossetia and Georgia? (Georgia has been pursuing NATO membership but is not yet a member state.)

Time will tell what other events were needed to pick out the narrative behind the complaint. One more data point may flesh out the nature of the challenge:

Is the complaint about a Trump-Russia issue alone, or does it also include a promise related to one of the other countries in the timeline — like North Korea or Iran?

Share your thoughts in comments with supporting content.

UPDATE — 19-SEP-2019 9:23 A.M. —

The ADNI should be in a closed door session with the House Intelligence Committee at this time.

Important to note that the IC IG is a Trump appointee — Michael Atkinson. He’s responsible for the determination that the unidentified whistleblower’s complaint was credible and an “urgent concern.”

ADNI broke the law as Amee Vanderpool noted here because the complaint was deemed credible:

Very, very odd how CNBC’s website news crawl makes zero mention of this unfolding story even though an NBC story confirmed WaPo’s report last night.

UPDATE — 19-SEP-2019 8:20 P.M. —

This is like a really cheap game of Clue. It wasn’t Professor Plum in the Library with a Lead Pipe.

It was Trump about Ukraine with a phone call to Zelensky, according to the latest report by WaPo.

(Although Trump does look like a crappy version of Colonel Mustard.)

Explains why the suggestions the matter was part of an ongoing investigation; the House was already investigating whether Trump and his lawyer Rudy Giuliani were trying to persuade President of Ukraine Volodymyr Zelensky to help dig up dirt on Joe Biden to help Trump’s 2020 campaign.

Now we need to know if the $250M aid to Ukraine was dependent on this matter, as well as a meeting later this month between Trump and Zelensky — and if Vladimir Putin had been involved in this exchange in any way.

Waiting for the next version of  “No Collusion!” tweets from Team Trump.

May explain why Rudy had been radio silent for three days on Twitter though he’s resumed his brand of trash talking in the last hour.

Hybrid or Ambiguous, Asymmetric Warfare is Here to Stay

/21 Comments/in , , /by

[As always, check the byline — this is Rayne with another minority report.]

After the hacking of the U.S. Office of Personnel Management, I wrote in early 2013 about asymmetric warfare. At the time I was puzzled by Americans’ surprise at such an extensive breach of a government asset by China.

We were warned in 1999 by the PRC in a white paper, Unrestricted Warfare, written by two Chinese military officers. They told us what they perceived about U.S.’ defense stance and where they were likely to press given their perception of our weaknesses and strengths.

Our own military processed this warning; it was incorporated into a number of military white papers. The U.S. intelligence community likewise digested the same white paper and military assessments of the same.

And yet the U.S. was not ready for an asymmetric attack.

More disturbingly, we were warned in 2013 — possibly earlier — that Russia was adopting asymmetric warfare. Valery Gerasimov, Chief of the General Staff of the Armed Forces of Russia, wrote a paper discussing the application of “hybrid warfare” or “ambiguous warfare,” partially exemplified in Russia’s 2014 annexation of Crimea.

Our Defense Department analyzed Gerasimov’s Doctrine, as it is now known. The CNA, a nonprofit research and analysis organization working for DOD, published a paper defining “ambiguous warfare” (pdf):

“Ambiguous warfare” is a term that has no proper definition and has been used within U.S. government circles since at least the 1980s. Generally speaking, the term applies in situations in which a state or non-state belligerent actor deploys troops and proxies in a deceptive and confusing manner—with the intent of achieving political and military effects while obscuring the belligerent’s direct participation. Russia’s actions in Crimea and Ukraine clearly align with this concept, though numerous participants pointed out that it is not a new concept for Russia.

CNA even applied a term used by the U.S. to describe Russia’s military action in Crimea — and yet the U.S. was not ready for an asymmetric attack.

The earlier paper PRC paper, Unrestricted Warfare, elaborated,

War in the age of technological integration and globalization has eliminated the right of weapons to label war and, with regard to the new starting point, has realigned the relationship of weapons to war, while the appearance of weapons of new concepts, and particularly new concepts of weapons, has gradually blurred the face of war. Does a single “hacker” attack count as a hostile act or not? Can using financial instruments to destroy a country’s economy be seen as a battle? Did CNN’s broadcast of an exposed corpse of a U.S. soldier in the streets of Mogadishu shake the determination of the Americans to act as the world’s policeman, thereby altering the world’s strategic situation? And should an assessment of wartime actions look at the means or the results? Obviously, proceeding with the traditional definition of war in mind, there is no longer any way to answer the above questions. When we suddenly realize that all these non-war actions may be the new factors constituting future warfare, we have to come up with a new name for this new form of war: Warfare which transcends all boundaries and limits, in short: unrestricted warfare.

If this name becomes established, this kind of war means that all means will be in readiness, that information will be omnipresent, and the battlefield will be everywhere. It means that all weapons and technology can be superimposed at will, it means that all the boundaries lying between the two worlds of war and non-war, of military and non-military, will be totally destroyed, and it also means that many of the current principles of combat will be modified, and even that the rules of war may need to be rewritten.

In spite of this warning, the U.S. has not been adequately prepared for asymmetric warfare.

More importantly, the U.S. has not grasped what is meant that “all the boundaries lying between the worlds of war and non-war” no longer exist.

We are in a permanent state of non-war warfare.

And we were warned.

If the CNA’s paper is any indication, the U.S. has been blinded by the lens of traditional warfare. This is an unintended conclusion we can take away from this paper: we are smack in the middle of a debris field in which our entire democratic system has been rattled hard and our president and his dominant political party in thrall to at least one other country’s leader, without a single traditional combat weapon aimed and fired at our military. Yet the paper on “Russia’s ‘Ambiguous Warfare'” looked at the possible effect such war would have on traditional defense, making only the barest effort to include information warfare. The shoot-down over Ukraine of Malaysian Airline flight MH-17 carrying EU citizens offers an example — there is little mention in this paper of Russian and separatists’ efforts to mask the source of the shooting using information warfare, thereby managing to avoid an official invocation of NATO Article 5.

Perhaps the scale of our traditional defense spending and the commitment to sustaining this spending driven by both states’ economies and by corporatocracy locked us into an unwieldy and obstructive mindset unable to respond quickly to new threats. But PRC warned us in 1999 — we have no excuses save for a lack of imagination at national scale, combined with a detrimental perception of American exceptionalism.

If there is something we can still use in this permanent state of non-war warfare, it is one of the oldest lessons of warfare, transcending place, culture, and tradition:

All warfare is based on deception. … Keep him under strain and wear him down. When he is united, divide him. Attack where he is unprepared; sally out when he does not expect you. … 

— Sun Tzu, The Art of War

What were we not expecting? For what were we not prepared? What form may the next ambiguous attack assume, and are we ready to defend ourselves?

More importantly, what does an effective, ambiguous offense look like?

Open Thread: All in the Families?

/127 Comments/in , /by

This is an open thread dedicated to this morning’s news. By now many of  you have heard that Alex van der Zwaan, a lawyer at mega-lawfirm Skadden, Arps, Slate, Meagher & Flom, was charged today by Team Mueller for making false statements while answering questions about his work for the Ukrainian Ministry of Justice in its case against Ukraine’s former prime minister Yulia Tymoshenko.

The “materially false, fictitious, and fraudulent statements and representations” arose from questions about interactions related to Paul Manafort’s partner Rick Gates and “Person A.”

[insert blogger’s laugh] Gee, I wonder who Person A could be? *

You can read the short and sweet court filing here (pdf).

These folks from Team Mueller signed the filing: Andrew Weissman, Greg Andres, Kyle Feeny, Brian Richardson. Add them and this assignment to Marcy’s bingo card

Richardson is a new name, which Marcy noted, already wondering if he is Mystery Prosecutor 17? She’ll probably elaborate in a separate post.

For a little background on Skadden Arps’ relationship to Ukraine, see this this NYT piece from September 21 last year: Skadden, Big New York Law Firm, Faces Questions on Work With Manafort

There was related legal news last autumn — emphasis on related.

Alfa Bank co-owners German Khan, Mikhail Fridman, and Peter Aven filed suit last October against Fusion GPS and Glenn Simpson claiming the Steele dossier was defamatory. Their reputations were “gravely” damaged as the dossier indicated they were engaged in criminal activity with Russia’s president Vladimir Putin.

Khan just happens to be van der Zwaan’s father-in-law. It’s a small world, yes?

It’ll be amusing if the Mueller-led investigation ends up unintentionally corralling multiple families.

* EDIT — 1:30 pm EST — I meant to add that  Andrea Manafort Shand, Paul Manafort’s daughter, was an associate at Skadden Arps-Washington DC office. I haven’t seen anything to suggest she’s involved in any way with today’s charges or that she’s Person A but stranger things have happened. Like the leaking of hacked text messages between Manafort’s daughters which have not been disavowed.

– – – – –

In case you missed it this morning, Marcy was on Democracy Now this morning, talking about the Mueller probe and the IRA indictment last Friday.

A transcript isn’t up as I type this but the video and audio are up on the main site under the Daily Show at the right side of Democracy Now’s homepage. I’ll add a link to the transcript as it becomes available.

Have at it!

 

Minority Report: An Alternative Look at NotPetya

/6 Comments/in /by

NB: Before reading:

1) Check the byline — this is NotMarcy;

2) Some of this content is speculative;

3) This is a minority report; I’m not on the same paragraph and perhaps not the same page with Marcy.

Tuesday’s ‘Petya/Petna/NotPetya’ malware attacks generated a lot of misleading information and rapid assumptions. Some of the fog can be rightfully blamed on the speed and breadth of infection. Some of it can also be blamed on the combined effect of information security professionals discussing in-flight attacks in full view of the public who make too many assumptions.

There’s also the possibility that some of the confusing information may have been deliberately generated to thwart too-early intervention. If this isn’t criminal hacking but cyber warfare, propaganda should be expected as in all other forms of warfare. Flawed assumptions, too, can be weaponized.

A key assumption worth re-examining is that Ukraine was NotPetya’s primary target rather than collateral damage.

After the malware completed its installation and rebooted an infected machine, a message indicated files had been encrypted and payment could be offered for decryption.

Thousands of dollars were paid $300 at a time in cryptocurrency but a decryption key wouldn’t be forthcoming. Users who tried to pay the ransom found the contact email address hosted by Posteo.net had been terminated. The email service company was unhelpful bordering on outright hostile in its refusal to assist users contacting the email account holder. It looked like a ransom scam gone very wrong.

As Marcy noted in her earlier post on NotPetyna, information security expert Matt Suiche posted that NotPetya was a wiper and not ransomware. The inability of affected users to obtain decryption code suddenly made perfect sense. ‘Encrypted’ files are never going to be opened again.

It’s important to think about the affected persons and organizations and how they likely responded to the infection. If they didn’t already have a policy in place for dealing with ransomware, they may have had impromptu meetings about their approach; they had to buy cryptocurrency, which may have required a crash DIY course in how to acquire it and how to make a payment — scrambling under the assumption they were dealing with ransomware.

It all began sometime after 10:30 UTC/GMT — 11:30 a.m. London (BDT), 1:30 p.m. Kyiv and Moscow local time, even later in points across Russia farther east.

(And 4:30 a.m. EDT — well ahead of the U.S. stock market, early enough for certain morning Twitter users to tweet about the attack before America’s work day began.)

The world’s largest shipping line, Maersk, and Russia’s largest taxpayer and oil producer Rosneft tweeted about the attack less than two hours after it began.

By the end of the normal work day in Ukraine time, staff would only have just begun to deal with the ugly truth that the ransom may have been handed off and no decryption key was coming.

As Marcy noted, June 28th is a public holiday in Ukraine — Constitution Day. I hope IT folks there didn’t have a full backup scheduled to run going into the holiday evening — one that might overwrite a previous full backup.

The infection’s spread rate suggested early on that email was not the only means of transmission, if it had been spread at all by spearfishing. But many information security folks advocated not opening any links in email. A false sense of security may have aided the malware’s dispersion; users may have thought, “I’m not clicking on anything, I can’t get it!” while their local area network was being compromised.

And then it hit them. While affected users sat at their machines reading fake messages displayed by the malware, scrambling to get cryptocurrency for the ransom, NotPetya continued to encrypt files under their noses and spread across business’s local area networks. Here’s where Microsoft’s postmortem is particularly interesting; it not only gives a tick-tock of the malware’s attack on a system, but it lists the file formats encrypted.

Virtually everything a business would use day to day was encrypted, from Office files to maps, website files to emails, zip archives and backups.

Oh, and Oracle files. Remember Oracle pushed a 299 vulnerability mega-patch on April 19, days after ShadowBrokers dumped some NSA tools? Convenient, that; these vulnerabilities were no longer a line of attack except through file encryption.

While information security experts have done a fine job tackling a many-headed hydra ravaging businesses, they made some rather broad assumptions about the reason for the attack. Kaspersky concluded the target was Ukraine since ~60% of infected devices were located there though 30% were located in Russia. But the malware’s aim may not have been the machines or even the businesses affected in Ukraine.

What did those businesses do? What they did required tax application software MEDoc. If the taxes to be calculated were based on business’s profits — (how much did they make) X (tax rate) — they hardly needed tax software. A simple spreadsheet would suffice, or the calculation would be built into accounting software.

No, the businesses affected by the malware pushed at 10:30 GMT via MEDoc update would be those which sold goods or services frequently, on which sales tax would have been required for each transaction.

What happens when a business’s sales can’t be documented? What happens when their purchases can’t be documented, either?

Which brings me to the affected Russian businesses, specifically Rosneft. There’s not much news published in English detailing the impact on Rosneft; we’ve only got Kaspersky’s word that 30% of infections affected Russian machines.

But if Rosneft is the largest public oil company in the world, Russia’s largest taxpayer as Rosneft says on their Twitter profile, it may not take very many infections to wreak considerable damage on the Russian economy. Consider the ratio of one machine invoicing the shipment of entire ocean tanker of oil versus many machines billing heating oil in household-sized quantities.

And if Rosneft oil was bought by Ukraine and resold to the EU, Ukraine’s infected machines would cause a delay of settlements to Russia especially when Rosneft must restore its own machines to make claims on Ukrainian customers.

The other interesting detail in this malware story is that the largest container line in the world, Maersk, was also affected. You may have seen shipping containers on trucks, trains, in shipyards and on ships marked in bold block letters, MAERSK. What you probably haven’t seen is Maersk’s energy transport business.

This includes shipping oil.

It’s not Ukraine’s oil Maersk ships; most of what Ukraine sells is through pipelines running from Russia in the east and mostly toward EU nations in the west.

It’s Russian oil, probably Rosneft’s, shipping overseas. If it’s not in Maersk container vessels, it may be moving through Maersk-run terminal facilities. And if Maersk has no idea what is shipping, where it’s located, when it will arrive, it will have a difficult time settling up with Rosneft.

Maersk also does oil drilling — it’s probably not Ukraine to whom Maersk may lease equipment or contract its services.

Give the potential damage to Russia’s financial interests, it seems odd that Ukraine is perceived as the primary target.

 

NotPetya’s attack didn’t happen in a vacuum, either.

A report in Germany’s Die Welt reported the assassination of Ukraine’s chief of intelligence by car bomb. The explosion happened about the same time that Ukraine’s central bank reported it had been affected by NotPetya — probably a couple hours after 10:30 a.m. GMT.

On Monday, privately-owned Russian conglomerate Sistema had a sizable chunk of assets “arrested” — not seized, but halted from sale or trading — due to a dispute with Rosneft over $2.8 billion dollars. Rosneft claims Sistema owes it money from the acquisition of oil producer Bashneft, owned by Sistema until 2014. Some of the assets seized included part of mobile communications company MTS. It’s likely this court case Rosneft referred to in its first tweet related to NotPetya.

The assassination’s timing makes the cyber attack look more like NotPetya was a Russian offensive, but why would Russia damage its largest sources of income and mess with its cash flow? The lawsuit against Sistema makes Rosneft appear itchy for income — Bashneft had been sold to the state in 2014, then Rosneft bought it from the state last year. Does Rosneft need this cash after the sale (or transfer) of a 19.5% stake worth $10.2 billion last year?

Worth noting here that Qatar’s sovereign wealth fund financed the bulk of the deal; commodities trader Glencore only financed 300 million euros of this transaction. How does the rift between other Middle Eastern oil states and Qatar affect the value of its sovereign wealth fund?

In her previous post, Marcy spitballed about digital sanctions — would they look like NotPetya? I think so. I can’t help recall this bit at the end of the Washington Post’s opus on Russian election interference published last week on June 23:

But Obama also signed the secret finding, officials said, authorizing a new covert program involving the NSA, CIA and U.S. Cyber Command.

[…]

The cyber operation is still in its early stages and involves deploying “implants” in Russian networks deemed “important to the adversary and that would cause them pain and discomfort if they were disrupted,” a former U.S. official said.

The implants were developed by the NSA and designed so that they could be triggered remotely as part of retaliatory cyber-strike in the face of Russian aggression, whether an attack on a power grid or interference in a future presidential race.

I’m sure it’s just a coincidence that NotPetya launched Tuesday this week. This bit reported in Fortune is surely a coincidence, too:

The timing and initial target of the attack, MeDoc, is sure to provoke speculation that an adversary of Ukraine might be to blame. The ransomware hid undetected for five days before being triggered a day before a public Ukrainian holiday that celebrates the nation’s ratification of a new constitution in 1996.

“Last night in Ukraine, the night before Constitution Day, someone pushed the detonate button,” said Craig Williams, head of Cisco’s (CSCO, +1.07%) Talos threat intelligence unit. “That makes this more of a political statement than just a piece of ransomware.” [boldface mine]

Indeed.

Two more things before this post wraps: did anybody notice there has been little discussion about attribution due to characters, keyboards, language construction in NotPetya’s code? Are hackers getting better at producing code without tell-tale hints?

Did the previous attacks based on tools released by the Shadow Brokers have secondary — possibly even primary — purposes apart from disruption and extortion? Were they intended to inoculate enterprise and individual users before a destructive weapon like NotPetya was released? Were there other purposes not obvious to information security professionals?

Friday: Sinnerman

/11 Comments/in , , /by

In this roundup: A look outside the U.S.’ borders — TTIP’s end, Turkey at risk, Chile and women’s reproductive rights, more.

Featured jazz artist today is Eunice Waymon, known best by her stage name Nina Simone. Recognized for her powerful political work, Mississippi Goddamn, Simone was an incredibly gifted pianist trained at Juilliard with a predilection for the works and method of Johann Sebastian Bach. She became a singer only after nightclubs for which she performed insisted she must sing and play piano together.

Two of my favorites apart from Sinnerman shared here are Feeling Good and I Put a Spell on You. I’ll always have a warm, fuzzy place for Ain’t Got No/I Got Life medley, a variation of the song from the 1960s Broadway musical Hair. I can remember singing along to this recording during long road trips.

Why Nina Simone today? Because of Sinnerman, which seems particularly appropriate during this election season.

Looking away from our nation’s navel

  • Op-ed: Is Turkey nearing civil war? (Süddeutsche Zeitung) — Guest contributor Yavuz Baydar reviews developments in Turkey after the so-called coup attempt, including calls to arm citizens, reestablish an Ottoman caliphate, and create militarized youth groups attached to mosques. Turkish media, operating with the blessing of President Tayyip Erdoğan, has shown maps featuring Mosul and parts of northern Greece as part of a Turkish empire.
  • TTIP may be in death throes, but resuscitation attempted (euronews) — This article quotes a Spanish automotive partmaker who complains the need to inspect parts both on export and import is expensive, and the Transatlantic Trade and Investment Partnership (TTIP) agreement would eliminate the costly redundancy. Except the existing duplicative inspections didn’t prevent Volkswagen Group and its vendor Bosch from shipping fraudulent vehicles and parts, did it? Yeah. Not so much…in spite of TTIP’s near-death, the US and EU met earlier this month to regroup and try to force TTIP through before the end of President Obama’s term.
  • Chile’s president aims to change restrictive anti-abortion laws (NPR) — Chile is among the five most restrictive countries in the world, outlawing abortion even to save the life of the mother. President Michelle Bachelet made it her goal to change the laws; the country’s lower house has already approved legislation to allow abortion in case of rape, to save the mother, or in case of mortal fetal defect. Chile’s senate must yet vote to approve this legislation before it becomes law. In the mean time, women must travel abroad to obtain abortions or risk jail if they attempt it in Chile on their own.
  • Radical Ukrainian nationalists rising (euronews) — Members of far-right groups Azo regiment and the Right Sector recently marched through Kyiv to celebrate Ukrainian patriotism while protesting pro-Russian separatists.

Tech Debris
Here’s a collection of odd technology bits I’ve run across recently worth a read:

  • Dutch researchers working on anti-hacking technology (euronews) — They’re working on unique identifiers for devices attached to the internet, like the myriad Internet of Things (webcams, baby monitors, so on). This seems like a waste of time given every device should already have an ID assigned by a network. Keep an eye on this; it’d certainly make surveillance easier. Ahem.
  • Troubling case of Facebook v. Vachani (NPR) — Fluffy overview of the suit filed against Steven Vachani whose portal site product pissed off Facebook greatly. But you should read the op-ed from July by Orin Kerr about this case — brace yourself for your freak out.
  • From the archives: Interview with John Arquilla on cyberwarfare (FRONTLINE) — Perspective on the origins of current cyberwarfare policies arising from Bush administration post-9/11. As you read this, keep in mind Arquilla is a proponent of preemptive warfare and the use of cyberwarfare against terrorism.
  • Twitter as a government tool against the people (Bloomberg) — We take for granted we can type anything we want in social media. Not so in much of the rest of the world, and Twitter is an example of social media with both great potential to inform while putting users at risk where speech is not free. Although after the recent revelations Twitter sold data to a U.S. intelligence front, speech isn’t exactly free on Twitter for U.S. citizens, either.

Longread: Did newspapers screw up?
We’ve watched the decline of newspapers for over a decade as its analog business model met the reality of a digital age. Jack Shafer wrote about the possibility newspapers may have made a critical error during the generational shift to online media — perhaps the seasoned existing outlets should have remained firmly committed to print. Two key problems with this analysis: 1) printing and distribution remains as expensive as all other factors in producing a newspaper, and 2) the population consuming newspaper content is changing, from a print-only to digital-only audience. This must be acknowledged or newspapers will continue to struggle, and large papers will continue to pursue consolidation in order to reduce costs to operate.

With that in mind, I still don’t understand why The Washington Post, owned by Jeff Bezos, hasn’t opted to offer a Kindle to subscribers willing to pay for a full print subscription a year in advance. A low-level Kindle is cheaper than the cost to print. Ditto to The New York Times; why hasn’t it considered a tie up with Kobo or another e-reader manufacturer?

That’s it for this week; have a good weekend!

Tuesday Morning: Flip Off

/29 Comments/in , , /by

Flip off a few caps; Death came for a few more well-loved artists. Rest well, Glenn Frey, Dale Griffin, Dallas Taylor. Gonna’ be one heck of a band on the other side. [Edit: Mic Gillette, too? Stop already, Grim Reaper, check your targeting.]

Hope the cull is done because obituaries are not my thing. Hard to type and sniffle copiously at the same time.

GM Opel dealers may be altering emissions control software on Zafira diesel cars
Great, just great. Like GM didn’t have enough on its plate with the ignition switch debacle. A Belgian news outlet reports GM Opel dealers have been changing the software on the 2014 Zafira 1.6l diesel engine passenger vehicles in what looks like a soft recall. This comes on the heels of an EU-mandated recall of Zafira B models due to fires caused by bad electronics repairs. Sorry, I don’t speak Dutch, can’t make out everything in this video report. What little I can see and read doesn’t look good. Wouldn’t be surprised if the EU puts the hurt on GM Opel diesel sales until all are fixed to meet EU emissions regulations. Should also note that a different electronics manufacturer may be involved; images online of ECUs for late model Zafiras appear to be made by Siemens — unlike Volkswagen’s passenger diesel ECUs, which are made by Bosch.

Texas manufacturer swindled out of cash by fraudulent email request, sues cyber insurer
AFGlobal, based in Houston, lost $480,000 in May 2014 after staff wired funds based on orders in emails faked by crooks overseas. The manufacturing company had a cyber insurance policy with a subsidiary of the Chubb Group, and filed a claim against it. The claim was denied and AFGlobal filed suit. This isn’t the first such loss nor the first such lawsuit. Companies need to create and publish policies documenting procedures for authorizing any online payments, including two-step authentication of identities, and review overall spending authorization processes with an eye on audit trails.

Ukrainian officials say Kiev’s main airport hacked
Hackers who attacked Ukrainian power companies in late December are believed to be responsible for the malware launched on Kiev’s airport servers. There are very few details — okay, none, zero details — about the attack and its affect on airport operations. A military spokesman only said “the malware had been detected early in the airport’s system and no damage had been done,” and that the malware’s point of origin was in Russia. Among the details missing are the date the attack was discovered and how it was detected as well as the means of removal.

Hold this thought: FBI still looking for info on cable cuts, with eye to Super Bowl link
Remember the post last summer about the 11 communications cable cuts in the greater San Francisco Bay Area near Silicon Valley? This is a hot issue again, given the impending Super Bowl 50 to be held at Levi’s Stadium in Santa Clara. But reports now mention 15 or 16 cuts, not 11 — have there been more since last summer, or were there more not included in the FBI’s request for information? I’ll do some digging and post about this in the near term.

All right, carry on, and don’t drink all the añejo at once.

Ukraine’s Power System Hacking: Coordinated in More than One Way?

/12 Comments/in , /by

[original graphic: outsidethebeltway.com]

[original graphic: outsidethebeltway.com]

Analysis by industrial control team SANS determined hacking of Ukrainian electrical power utilities reported on 23-DEC-2015 was a coordinated attack. It required multiple phases to achieve a sustained loss of electricity to roughly 80,000 customers. SANS reported they “are confident” the following events occurred:

  • The adversary initiated an intrusion into production SCADA systems
  • Infected workstations and servers
  • Acted to “blind” the dispatchers
  • Acted to damage the SCADA system hosts (servers and workstations)
  • Action would have delayed restoration and introduce risk, especially if the SCADA system was essential to coordinate actions
  • Action can also make forensics more difficult
  • Flooded the call centers to deny customers calling to report power out

An investigation is still underway, and the following are still subject to confirmation:

  • The adversaries infected workstations and moved through the environment
  • Acted to open breakers and cause the outage (assessed through technical analysis of the Ukrainian SCADA system in comparison to the impact)
  • Initiated a possible DDoS on the company websites

The part that piques my attention is the defeat of SCADA systems by way of a multiphased attack — not unlike Stuxnet. Hmm…

Another interesting feature of this cyber attack is its location. It’s not near sites of militarized hostilities along the border with Russia. where many are of Russian ethnicity, but in the western portion of Ukraine.

More specifically, the affected power company served the Ivano-Frankivsk region, through which a large amount of natural gas is piped toward the EU. Note the map included above, showing the location and direction of pipelines as well as their output volume. Were the pipelines one of the targets of the cyber attack, along with the electricity generation capacity in the region through which the pipes run? Was this hack planned and coordinated not only to take out power and slow response to the outage but to reduce the pipeline output through Ukraine to the EU?