Thursday, June 11, 2015

Administration rejects criticism of NSA’s surveillance of foreign hackers

Administration rejects criticism of NSA’s surveillance of foreign hackers

Published 11 June 2015
Just two years after the Edward Snowden leaks exposed the NSA’s domestic surveillance program, another report released last Friday from the Snowden files shares information about the NSA’s efforts to track foreign hackers. As with the NSA’s controversial foreign surveillance program which kept metadata records of suspected foreign terrorists’ conversations with Americans, the NSA’s hacker program may incidentally gather Americans’ private information from the files of foreign hackers.

Just two years after the Edward Snowden leaks exposed the NSA’s domestic surveillance program, another report released last Friday from the Snowden files shares information about the NSA’s efforts to track foreign hackers. As with the NSA’s controversial foreign surveillance program which kept metadata records of suspected foreign terrorists’ conversations with Americans, the NSA’s hacker program may incidentally gather Americans’ private information from the files of foreign hackers. Lawmakers and the Foreign Intelligence Surveillance (FISA) court were made aware of the hacker program, but critics say it violates privacy rights.
The program, which has been in operation for at least five years, initially tracked Internet signatures associated with cyberthreats that originated from foreign or terrorist sources. The New York Times reported last week that in 2012, the NSA sought to expand the program to including surveillance of Internet signatures linked to “malicious cyber activity,” not just foreign or terrorist sources. “Without public notice or debate, the Obama administration has expanded the National Security Agency’s warrantless surveillance of Americans’ international Internet traffic to search for evidence of malicious computer hacking, according to classified NSA documents,” the Times story read.
Many in defense of the program say it carries out “warrantless” searches because it operates under Section 702 of the Foreign Intelligence Surveillance Act, which authorizes foreign intelligence collection programs after approved by the FISA court. Still critics point to a 2010 NSA Office of General Counsel briefing slide presentation, released by Snowden, that comments on the hacker program and warns NSA analysts, “Hacker signatures pull in a lot.” The slide, however, goes on to tell analysts, “Focus on foreign target use of intrusion capabilities.” It adds that the “worst thing” the NSA could do is “to collect against a USP (U.S. person) hacker” because that would be using NSA surveillance capabilities “for LE (law enforcement) purpose without a warrant.”
NSA analysts were told to halt surveillance of an Internet signature if that signature led to an American hacker. If the U.S. hacker had gone into a “protected computer,” a violation of U.S. law, then the analysts were to provide details of the hacker to the General Counsel for transmission to the Justice Department. TheWashington Post points out that generally, federal employees, particularly those involved in collecting and reviewing information, have an obligation to report potential federal criminal acts to the Justice Department.
The NSA slide also advised that if analysts came across a foreign hacker’s download of Internet traffic from or about American individuals or companies, they were to limit what was not foreign intelligence and minimize retained information, including removing names of Americans, gathering only what was needed to show the hacker’s intentions.
Last Friday’s disclosure of the NSA foreign hacker surveillance program came at the same time the Obama administration released information about the hacking of records of four million current and former federal employees held by the Office of Personnel Management, allegedly by Chinese hackers. Since then, legislators have proposed increasing rather than reducing the NSA’s anti-foreign hacking efforts.
Representative Adam B. Schiff (D-California), the ranking minority member on the House Permanent Select Committee on Intelligence, said on Fox News last Sunday that the NSA’s anti-foreign hacking program “is fundamentally what the American people expect of their government” and “we ought to be aggressively going after identifying and protecting the country from cyber hackers.”

Wednesday, June 10, 2015

Can the power grid survive a cyberattack?

Can the power grid survive a cyberattack?

By Michael McElfresh
It is very hard to overstate how important the U.S. power grid is to American society and its economy. Every critical infrastructure, from communications to water, is built on it and every important business function from banking to milking cows is completely dependent on it. And the dependence on the grid continues to grow as more machines, including equipment on the power grid, get connected to the Internet. The grid’s vulnerability to nature and physical damage by man, including a sniper attack in a California substation in 2013, has been repeatedly demonstrated. But it is the threat of cyberattack that keeps many of the most serious people up at night, including the U.S. Department of Defense. In a 2012 report, the National Academy of Sciences called for more research to make the grid more resilient to attack and for utilities to modernize their systems to make them safer. Indeed, as society becomes increasingly reliant on the power grid and an array of devices are connected to the internet, security and protection must be a high priority.

It is very hard to overstate how important the U.S. power grid is to American society and its economy. Every critical infrastructure, from communications to water, is built on it and every important business function from banking to milking cows is completely dependent on it.
And the dependence on the grid continues to grow as more machines, including equipment on the power grid, get connected to the Internet. A report last year prepared for the president and Congress emphasized the vulnerability of the grid to a long-term power outage, saying “For those who would seek to do our Nation significant physical, economic, and psychological harm, the electrical grid is an obvious target.”
The damage to modern society from an extended power outage can be dramatic, as millions of people found in the wake of Hurricane Sandy in 2012. The Department of Energy earlier this year said cybersecurity was one of the top challenges facing the power grid, which is exacerbated by the interdependence between the grid and water, telecommunications, transportation, and emergency response systems.
So what are modern grid-dependent societies up against? Can power grids survive a major attack? What are the biggest threats today?
The grid’s vulnerability to nature and physical damage by man, including a sniper attack in a California substation in 2013, has been repeatedly demonstrated. But it is the threat of cyberattack that keeps many of the most serious people up at night, including the U.S. Department of Defense.
Why the grid so vulnerable to cyberattack
Grid operation depends on control systems — called Supervisory Control And Data Acquisition (SCADA) — that monitor and control the physical infrastructure. At the heart of these SCADA systems are specialized computers known as programmable logic controllers (PLCs). Initially developed by the automobile industry, PLCs are now ubiquitous in manufacturing, the power grid and other areas of critical infrastructure, as well as various areas of technology, especially where systems are automated and remotely controlled.
One of the most well-known industrial cyberattacks involved these PLCs: the attack, discovered in 2010, on the centrifuges the Iranians were using to enrich uranium. The Stuxnet computer worm, a type of malware categorized as an Advanced Persistent Threat (APT), targeted the Siemens SIMATIC WinCC SCADA system.
Stuxnet was able to take over the PLCs controlling the centrifuges, reprogramming them in order to speed up the centrifuges, leading to the destruction of many, and yet displaying a normal operating speed in order to trick the centrifuge operators. So these new forms of malware can not only shut things down but can alter their function and permanently damage industrial equipment. This was also demonstrated at the now famous Aurora experiment at Idaho National Lab in 2007.
Securely upgrading PLC software and securely reprogramming PLCs has long been of concern to PLC manufacturers, which have to contend with malware and other efforts to defeat encrypted networks.
The oft-cited solution of an air-gap between critical systems, or physically isolating a secure network from the internet, was precisely what the Stuxnet worm was designed to defeat. The worm was specifically created to hunt for predetermined network pathways, such as someone using a thumb drive, which would allow the malware to move from an internet-connected system to the critical system on the other side of the air-gap.
Internet of many things
The growth of smart grid — the idea of overlaying computing and communications to the power grid — has created many more access points for penetrating into the grid computer systems. Currently knowing the provenance of data from smart grid devices is limiting what is known about who is really sending the data and whether that data is legitimate or an attempted attack.
This concern is growing even faster with the Internet of Things (IoT), because there are many different types of sensors proliferating in unimaginable numbers. How do you know when the message from a sensor is legitimate or part of a coordinated attack? A system attack could be disguised as something as simple as a large number of apparent customers lowering their thermostat settings in a short period on a peak hot day.
Defending the power grid as a whole is challenging from an organizational point of view. There are about 3,200 utilities, all of which operate a portion of the electricity grid, but most of these individual networks are interconnected.
The U.S. government has set up numerous efforts to help protect the United States from cyberattacks. With regard to the grid specifically, there is the Department of Energy’s Cybersecurity Risk Information Sharing Program (CRISP) and the Department of Homeland Security’s National Cybersecurity and Communications Integration Center (NCCIC) programs in which utilities voluntarily share information that allows patterns and methods of potential attackers to be identified and securely shared.
On the technology side, the National Institutes for Standards and Technology (NIST) and IEEE are working on smart grid and other new technology standards that have a strong focus on security. Various government agencies also sponsor research into understanding the attack modes of malware and better ways to protect systems.
But the gravity of the situation really comes to the forefront when you realize that the Department of Defense has stood up a new command to address cyberthreats, the U.S. Cyber Command (USCYBERCOM). Now in addition to land, sea, air, and space, there is a fifth command: cyber.
The latest version of the Department of Defense’s Cyber Strategy has as its third strategic goal, “Be prepared to defend the US homeland and US vital interests from disruptive or destructive cyberattacks of significant consequence.”
There is already a well-established theater of operations where significant, destructive cyberattacks against SCADA systems have taken place.
In a 2012 report, the National Academy of Sciences called for more research to make the grid more resilient to attack and for utilities to modernize their systems to make them safer. Indeed, as society becomes increasingly reliant on the power grid and an array of devices are connected to the internet, security and protection must be a high priority.
Michael McElfresh is Adjunct Professor of Electrical Engineering at Santa Clara University. This story is published courtesy of The Conversation (under Creative Commons-Attribution/No derivatives.

Local U.S. Muslim communities fight Islamic State's recruitment efforts

Local U.S. Muslim communities fight Islamic State's recruitment efforts

Published 10 June 2015
In U.S. cities with larger Muslim populations across the country, local communities are reaching out to fight the threat of Islamic State online propaganda targeting their youth. Recognizing that previous years’ experience of attempting actively to foil plots through espionage and enforcement has damaged the relationship between Muslim-American communities and the government, a new low-key approach is taking shape.

In U.S. cities with larger Muslim populations across the country, local communities are reaching out to fight the threat of Islamic State online propaganda targeting their youth.
As theColumbus Dispatch reports, in cities such as Columbus, Ohio, Jersey City, New Jersey, and Portland, Maine, leaders of Muslim communities are refining the ways in which they independently deal with an increasingly digital and social media-based onslaught from fundamentalist terror groups abroad.
“The goal on this is to really stay in front of it and have consistent outreach that reflects the community,” said Jersey City Mayor Steven Fulop. “You have to talk to young people about what’s important to them on a cultural front, and the important thing is to do it on their terms, not yours.”
Fulop and others in the city have formed an advisory council between the police department and local Arab-American leaders, with the hopes that an investment in recreation — providing youths with sports, chess, and other physical activities as is often used to quell street gang recruitment — will help stem the tide of influence from groups like the Islamic State.
The threat of recruitment from overseas extremist groups has come into sharper focus in recent months, following a string of arrests around the country. In Boston last week, authorities fatally shot a knife-wielding man that they said had wanted to kill police officers and had been recording statements that the FBI had determined as references to the influence of Islamic State recruitment videos.
Recognizing that previous years’ experience of attempting actively to foil plots through espionage and enforcement has damaged the relationship between Muslim-American communities and the government, a new low-key approach is taking shape.
“As law enforcement started casting around and trying to predict and interdict the next terrorist plot, by definition we damaged the relationship with that community because we saw that as the source of the threats, or at least the seeds that the threats were hiding in,” said James Shea, Jersey City’s director of public safety.
Thos bonds were increasingly frayed following the 2011 revelations that they New York Police Department had spied on Muslims in New Jersey without telling local officials. In Jersey City, that legacy has shaped the way the city is attempting to work with at-risk youth today.
“Absent the outreach at different levels, you could have the younger generations feeling alienated,” added Shea.
In Columbus and Portland, the homes to some of the largest Somali populations in the nation, measures have been taken to create a similar approach — connecting law-enforcement agencies and Somali community leaders in a friendly manner with the creation of the Law Enforcement Somali Advisory Group. While also better informing and connecting law enforcement, the group also works to congregate Somali-American youth ages 13-23, offering language classes, basketball leagues and field trips.
“The key is education,” said Abshir Haji, an adviser to the group. “Everyone has Internet access in their house. Everybody can get on YouTube and watch whatever. We cannot control that,” Haji said. “But what we can control is teaching them or giving them the right tools for them to distinguish what is correct and what is not correct.”
In Portland, these new approaches are already seeing favorable results.
“Such community policing is important for fighting day-to-day crime.” said Portland acting City Manager Michael Sauschuck. “It’s important for general, neighborhood problem-solving. And, it’s important for dealing with terrorism.”

Iran’s refusal to allow inspection of military sites could derail nuclear agreement

Iran’s refusal to allow inspection of military sites could derail nuclear agreement

Published 10 June 2015
As the five permanent members of the United Nations Security Council— the United States, Britain, France, Russia, and China — plus Germany near a deal to ease international sanctions if Iran agrees to restrictions and monitoring of its nuclear activities, diplomats say Iran’s refusal to provide inspectors access to its military bases could set back the negotiations, which have been in the works for over twenty-months. Deputy Secretary of State Antony Blinken has publicly said that U.S. officials want IAEA inspectors to be given “anywhere, anytime” access to sites where nuclear work is suspected, adding that the Obama administration will not accept a deal unless access is granted “to whatever Iranian sites are required to verify that Iran’s program is exclusively peaceful — period.”

As the five permanent members of the United Nations Security Council — the United States, Britain, France, Russia, and China — plus Germany near a deal to ease international sanctions if Iran agrees to restrictions and monitoring of its nuclear activities, diplomats say Iran’s refusal to provide inspectors access to its military bases could set back the negotiations, which have been in the works for over twenty-months.
Gary Samore, former nonproliferation advisor to President Barack Obama, told the Los Angeles Times that with Iran’s known enrichment facilities at Natanz and Fordow, as well as a heavy-water reactor at Ark, under international oversight, the country’s leaders would likely look elsewhere to conduct any secret nuclear work. “It’s the undeclared sites that are the real threat,” he said.
Iran continues to deny its interest in building a nuclear weapon, saying its nuclear ambitions are for peaceful purposes, but U.S. negotiators have reasons to be skeptical; considering that the uranium enrichment facilities at Natanz and Fordow were built and operated in secret until disclosed by outsiders.
Several months ago, U.S. officials involved with the negotiations believed Iran had agreed in principle on a plan in which the International Atomic Energy Agency (IAEA) would have wide latitude to investigate undeclared sites, but Iran would be able to dispute those request for investigation on a global stage. The Times notes that Iran’s negotiators recently began to reject that agreement after supreme leader Ayatollah Ali Khamenei made public that he would never allow foreigners into Iranian military bases.
Deputy Secretary of State Antony Blinken has publicly said that U.S. officials want IAEA inspectors to be given “anywhere, anytime” access to sites where nuclear work is suspected, adding that the Obama administration will not accept a deal unless access is granted “to whatever Iranian sites are required to verify that Iran’s program is exclusively peaceful — period.”
In the negotiating rooms, however, U.S. diplomats are not demanding immediate access to suspected nuclear sites. Instead, they are considering allowing a panel to review Iranian objections to certain inspections. Under this plan, in less than thirty days, IAEA inspection requests will be judged by a commission with representatives from the six negotiating countries, Iran, and possibly the European Union. Access to suspected sites would be granted if a majority of the eight representatives supported the IAEA request for access. A required majority would mean Iran alone, or Iran supported by Russia and China, would not have enough votes to stop an inspection if other members of the commission supported it. If Iran refused to cooperate or was found operating unauthorized nuclear work, sanctions would be quickly imposed.
Though Iranian leaders have vowed to reject foreign requests for access to the country’s military bases, U.S. negotiators are viewing the rejections as bargaining tactics and predict Iran will ultimately agree to the proposals. “The most positive interpretation is they’re just seeking negotiating leverage,” said Richard Nephew, a sanctions expert who was part of the U.S. team until earlier this year. “But if they start backing away from this key element, that becomes a real problem for the negotiations.”

“Dark Internet” inhibits law enforcement’s ability to identify, track terrorists

“Dark Internet” inhibits law enforcement’s ability to identify, track terrorists

Published 10 June 2015

For several months, Islamic State militants have been using instant messaging apps which encrypt or destroy conversations immediately. This has inhibit U.S. intelligence and law enforcement agencies from identifying and monitoring suspected terrorists, even when a court order is granted, because messaging companies and app developers say they are unable to unlock the coded conversations and/or do not have a record of the conversations.
“We’re past going dark in certain instances,” said Michael B. Steinbach, the FBI’s top counterterrorism official. “We are dark.”
FBI officials want Congress to expand their authority to monitor apps such as WhatsApp and Kik, as well as data-deleting apps such as Wickr and Surespot, used by hundreds of millions of people, including terrorists and their supporters, because they guarantee security and anonymity.
About 200,000 people worldwide are exposed to “terrorist messaging” daily from ISIS supporters via direct messaging, online videos, or social media posts. ISIS recruiters also monitor Twitter and Facebook to connect with individuals who share the group’s posts, often inviting them to private conversations over encrypted or data-deleting apps.
FBI officials fear that law enforcement agencies are missing important clues about potential plots as terror-linked conversations go from social media to private messaging apps. The FBI has arrested nearly forty people since last summer on the suspicion of seeking to support terrorist groups. A vast majority of those people communicated their intentions through social media. Last Tuesday, an FBI agent and a Boston police officer shot and killed a 26-year old former security guard in Roslindale, Massachusetts after he allegedly lunged at them with a knife. The FBI had been tracking his social media communications with ISIS for at least several days.
ISIS and its supporters are now increasingly communicating via secure and encrypted messaging platforms. “These tactics are a sea change for spreading terror, and they require from us a paradigm shift in our counter-terrorism, intelligence and our operations,” Representative Michael McCaul (R-Texas), chairman of the House Homeland Security Committee, said last Wednesday at a congressional hearing.
The Los Angeles Times reports that FBI officials have not disclosed details of cases in which private messaging apps have been used by terrorists, but they have appealed to tech and software companies to work with law enforcement to monitor suspected terrorist communications.
Apple chief executive Tim Cook in a 1 June speech at the annual awards dinner for the Electronic Privacy Information Center, defended his company’s decision to encrypt the content of Facetime and iMessage communications. He lashed out at government officials who have asked Apple and other tech firms to create a backdoor key to encrypted messages. “Let me be crystal clear,” Cook said. “Weakening encryption or taking it away harms good people that are using it for the right reasons. And ultimately, I believe it has a chilling effect on our 1st Amendment rights and undermines our country’s founding principles.”
At last Wednesday’s congressional hearing, Steinbach said that the FBI seeks a legal way to access stored text messages and active communications in suspected terrorism cases. “We’re talking about going before the court, whether the criminal court or the national security court, with evidence, a burden of proof, probable cause, suggesting a crime has been committed or, in our case, that there’s a terrorist,” he said.
“We’re not looking at going through a backdoor or being nefarious,” he said.
“We are imploring Congress to help us seek legal remedies toward that as well as asking the companies to provide technological solutions to help that,” Steinbach said.
Public demand for e-mail and text messaging services which guarantee security and anonymity has risen since Edward Snowden leaked details about the NSA’s bulk data collection program. Still, federal officials want tech companies to know the risk associated with their services. “It is important for those who are providing the services to understand what the threats are and to be responsible … in terms of taking action to prevent designated terrorist groups from using their services to try to get people to commit terrorist acts here,” John Carlin, head of national security for the Justice Department, said in a recent interview.
While ISIS seems to have successfully mastered how to use social media to recruit new followers, the medium has its weaknesses. Air Force analysts at Hurlburt Field, Florida recently helped destroy a command center in Syria after a militant revealed enough information online to disclose his position. “The (airmen are) combing through social media and they see some moron standing at this command,” Gen. Herbert “Hawk” Carlisle, head of Air Combat Command at Langley Air Force Base, Virginia, said in a speech on 1 June, according to Air Force Times. “And in some social media, open forum, bragging about command and control capabilities for (ISIS). And these guys go, ‘Ah, we got an in.’”
“So they do some work. Long story short, about 22 hours later through that very building, three (‘smart’ bombs) take that entire building out. Through social media. It was a post on social media. Bombs on target in 22 hours,” he said. “It was incredible work, and incredible airmen doing this sort of thing.”
ISIS, however, has been aware of the vulnerabilities of social media. Last fall, the group’s leaders issued an order forbidding fighters to photograph attacks and locations without permission from the group’s general council. The Times notes that ISIS also distributed a guide to removing geo-location and metadata from cell phone images.

Administration asks court for six more months of NSA bulk metadata collection

Administration asks court for six more months of NSA bulk metadata collection

Published 10 June 2015

Just four hours after President Barack Obama vowed to sign the USA Freedom Act which limits the NSA’s domestic bulk data collection program, his administration asked the Foreign Intelligence Surveillance (FISA) court to ignore a ruling by the second circuit court of appeals declaring the bulk surveillance program unauthorized, and instead grant the NSA power to continue bulk collection for six months.
“This court may certainly consider ACLU v Clapper as part of its evaluation of the government’s application, but second circuit rulings do not constitute controlling precedent for this court,” Justice Department national security chief John A. Carlin wrote in the 2 June application. Carlin pointed to a six months transition period provided in the USA Freedom Act as a reason to permit an “orderly transition” of the NSA’s domestic bulk collection program.
On 7 May, the second circuit court ruled that Section 215 of the USA Patriot Act, cannot be legitimately interpreted to allow the bulk collection of domestic calling records and that the government misinterpreted the act’s authorization of data collection as “relevant” to an ongoing investigation to permit bulk collection.
TheGuardian notes that the second circuit court of appeals is supposed to bind only the circuit’s lower courts, but the unique and secretive nature of the FISA court has left confusion over which public courts it is obliged to follow. “While the FISA court isn’t formally bound by the second circuit’s ruling, it will certainly have to grapple with the second circuit’s interpretation of the ‘relevance’ requirement. The (court) will also have to consider whether Congress effectively adopted the second circuit’s interpretation of the relevance requirement when it passed the USA Freedom Act,” said Jameel Jaffer, the deputy legal director of the American Civil Liberties Union (ACLU).
The second circuit court did not issue an injunction halting the NSA’s domestic bulk collection program. It instead suggested the then-congressional debate over the USA Freedom Act and the resulting legislation as the appropriate solution to the domestic bulk collection debate.
The ACLU is seeking an injunction in a federal district court should the FISA court grant the government’s surveillance request, but Carlin has already informed the FISA court that “in the event an injunction of some sort were to issue by the district court, the government would need to assess, in light of the nature and scope of whatever injunction the district court issued, its ability to carry out authority granted under an order issued by this court.”
“The only federal appeals court to have considered this surveillance concluded, after very careful analysis, that it’s unlawful. It’s disturbing and disappointing that the government is proposing to continue it,” said Jaffer.
Last Friday, FreedomWorks filed a motion before the FISA court, asking it to reject the government’s surveillance request as it violates the fourth amendment’s prohibition on unreasonable searches and seizures. FISA court judge Michael Moseman gave the Justice Department until this coming Friday to respond — and barred the Obama administration from arguing that FreedomWorks lacks the standing to petition the court.

Tuesday, June 9, 2015

Israel conducted tests to assess the impact of dirty bombs

Israel conducted tests to assess the impact of dirty bombs

Published 9 June 2015

Between 2010 and 2014, Israeli scientists at the Dimona nuclear reactor conducted a series of experiments, under the code name “Green Field,” to examine the consequences of a dirty-bomb explosion in Israel. The purpose of the experiments was defensive – to measure the likely effect of a dirty bomb and evaluate countermeasures. The experiments did not evaluate to offensive potential of a dirty bomb.
In the experiments, scientists detonated twenty explosive charges weighing between a quarter of kilogram and twenty-five kilograms, mixed with the radioactive material technetium-99m, which is widely used in medical imaging. The experiments employed Dimona’s most advanced technologies, including micro-UAVs to measure radiation and sensors to measure the explosive yield.
Haaretz reports that most of the test explosions were done in the Negev desert, and that one of the explosions was conducted in an enclosure.
Scientists found that intense radiation could be detected at the core of the explosion, and that wind-carried radioactive particles would carry low-level radiation to the surrounding area. The scientists concluded that the most serious impact of a dirty bomb is the psychological impact on the population.
If the dirty bomb exploded in an enclosed area, that area would have to be closed for a long time to be decontaminated.
As part of the project, an experiment called “Red House” was meant to examine a scenario of radiological material being placed in a crowded location, but without exploding it. Radioactive material, diluted in water, was placed in the ventilation system of a two-story building. The experiment showed that this is not an effective way of spreading the material inside the building, as most of it was stopped by the air-conditioning filters.
The newspaper notes that after the 9/11 terrorist attacks in the United States, Israel began preparations for dealing with a possible dirty-bomb explosion. In 2006 the Israel Ministry of Health issued instructions on the steps which had to be taken in the event of a radiological attack