This Month in... Bots Gone Wild

Sneaky parrot uses Amazon Alexa to shop while owner is away. more

GPS signals across far northern Norway and Finland failed. Civilian airplanes were forced to navigate manually, and ordinary citizens could no longer trust their smartphones. more

Virgin Australia is under investigation after two engines on one of its aircraft "flamed out" during descent and had to be manually re-ignited before the aircraft hit the tarmac. more

Drone shatters passenger jet’s nosecone and radar during landing. more

Uber manager in March: “We shouldn’t be hitting things every 15,000 miles.” "They told me incidents like that happen all of the time," whistleblower wrote. more

New Zealand courts banned naming Grace Millane’s accused killer. Google just emailed it out. more

She'd just had a stillborn child. Tech companies wouldn't let her forget it. A woman pleads with tech companies like Facebook and Twitter to stop serving her ads to intensify her grief. more

Microsoft is sending users who search for Office 2019 download links via its Bing search engine to a website that teaches them the basics about pirating the company's Office suite. more

Delivery robot bursts into flames at UC Berkeley. more

Rudy Giuliani Says Twitter Sabotaged His Tweet (not true) more
Mystery Drone Still on the Loose at Gatwick Airport, But Flights Resume Anyway more

Thousands of people trusted Blind, an app-based "anonymous social network," as a safe way to reveal malfeasance, wrongdoing and improper conduct at their companies. But Blind left one of its database servers exposed without a password, making it possible for anyone who knew where to look to access each user's account information and identify would-be whistleblowers. more

...and a cautionary tale.

FutureWatch: 2019 - Stricter Privacy Regulation (we hope)

After decades of complacency, the regulatory tide is finally turning against the unchecked personal data collection that powers the ad-revenue machines at Google, Facebook, and other big tech firms. 

In Europe, the General Data Protection Regulation (GDPR) is an unprecedented leap forward in privacy regulation, with strict rules and harsh penalties designed to limit personal data collection.

Though the US has been slower to act, there is a growing demand for an Internet Dodd-Frank, a sweeping federal legislation designed to protect the privacy of US citizens.

The recently passed California Protection Act (AB 375) is one potential, though imperfect, template for a federal consumer privacy law. This new law affords California residents new privacy rights that entitle them more insight into, and more control over, the personal data companies collect on them...

Google already commented that they "...look forward to improvements to address the many unintended consequences of the law," which could easily translate to prioritizing the protection of the practices that have allowed these companies to make billions at the expense of consumer privacy. more

Government Spying... Outsourced

New Zealand - The State Services Commission delivered a damning report into the use of companies like Thompson and Clark (Investigations Limited) to carry out surveillance on protestors, activists and other members of the public, as well as inappropriately close relationship between investigators and some public servants.

https://amzn.to/2SaAd8i

The Commissioner described the way some agencies allowed some New Zealanders to be targeted by investigators as an affront to democracy.

The report has already claimed its first casualty.

Ross Butler quit as chair of the government insurance agency Southern Response last night before his meeting with the Greater Christchurch Regeneration Minister Megan Woods.

The insurer broke its code of conduct, and possibly the law, when it used security firm Thompson and Clark to secretly record meetings of earthquake victims. more & more

When Technical Surveillance Countermeasures Warnings Are Met With a Shrug

Hackers infiltrated the European Union’s diplomatic communications network for years, downloading thousands of cables that reveal concerns about an unpredictable Trump administration and struggles to deal with Russia and China and the risk that Iran would revive its nuclear program...

The cables were copied from the secure network and posted to an open internet site that the hackers set up in the course of their attack, according to Area 1, the firm that discovered the breach...

Asked on Tuesday about the hack, the National Security Agency said it was still examining the discovery of the European trove. But the former senior intelligence official said that the European Union had been warned, repeatedly, that its aging communications system was highly vulnerable to hacking by China, Russia, Iran and other states.

The official said the warnings were usually received with a shrug...

The Europeans appear, belatedly, to be waking up to the threat. Its senior staff members increasingly use encrypted telephones, and isolated “speech rooms” of Lucite are being installed in key posts... more

When Customs and Border Protection Wants to See Your Cell Phone

Last Thursday's post: Your Mobile Device Could Spill Its Guts (and worse) Get You Arrested  

Today: Man sues feds after being detained for refusing to unlock his phone at airport 

A Southern California man has become the latest person to sue the federal government over what he says is an unconstitutional search of his phone at the Los Angeles International Airport.

According to his lawsuit, which was recently filed in federal court in Los Angeles, Haisam Elsharkawi had arrived at LAX on February 9, 2017 and was headed to Saudi Arabia to go on a hajj, the Muslim religious pilgrimage...

Officer Rodriguez, began searching Elsharkawi’s pockets and discovered his phone. Rodriguez asked Elsharkawi to unlock his phone, which he declined to do. He then also refused to answer further questions without having an attorney present...

Elsharkawi was taken to a holding cell...

Yet another officer entered the scene, identified in the civil complaint as "Officer Jennifer," who again began questioning Elsharkawi. Eventually, after some back-and-forth, Elsharkawi "felt he had no choice but to acquiesce and unlocked his phone."

Officer Jennifer began searching his phone and asked Elsharkawi about his eBay and Amazon accounts, and "where he got merchandise for his e-commerce business, and what swap meets he frequents. more

El Chapo Got Wiretapped Because the IT Guy Screwed Up

It only took five weeks, but jurors in the trial of Joaquín “El Chapo” Guzmán finally got hear the infamous drug lord speak. Chapo's voice filled the courtroom Thursday as prosecutors played a taped phone call between the alleged Sinaloa cartel leader and members of the FARC guerrilla group. The two sides could be heard negotiating a six-ton cocaine deal. The exchange was damning...

It’s still unclear exactly how U.S. authorities obtained the recording, but witness Jorge Cifuentes seemed to have a pretty good idea. He blamed the cartel’s IT guy...

Cifuentes appeared to be vigilant about digital security. Prosecutors showed the jury his detailed accounting records, which included items like "cellular inhibitors" and "microphone searchers" among his expenses. "You turn it on during a meeting and there's no way anyone can tape it or send out anything," Cifuentes said, describing one of the devices...

The irony was that authorities were only able to obtain the call because the men were forced to use conventional cellphones while their secure network was down. Cifuentes called Cristián "an irresponsible person," and said the engineer screwed up by forgetting to renew the license on the software they had purchased. more

Note: This also reveals what can happen when someone with a little knowledge (Jorge Cifuentes) tries to play TSCM expert... "You turn it on during a meeting and there's no way anyone can tape it or send out anything,"

Be careful who you hire to advise you on corporate technical counterespionage.

Quote of the Week

"It’s generally the government’s view that corporations are as responsible for their own information technology security as they are for their own physical security." — Dick Fadden, former national security adviser to Stephen Harper and past director of the Canadian Security Intelligence Service (CSIS)

National Security Agency (NSA) - 136 issues of its internal Cryptolog periodical spanning 1974 through 1997.

Five years ago, the National Security Agency (NSA) released 136 issues of its internal Cryptolog periodical spanning 1974 through 1997. The collection offered a look into the some of the discussions being held within one of America’s most secretive intelligence agencies. Today the GWU-based National Security Archive is providing a complete index of all 1,504 items in the declassified collection, including but not limited to articles, interviews, and puzzles. more

Man's IoT Security Camera Starts Giving Him Advice

An Arizona real estate agent was shocked when a voice started broadcasting from his Nest security camera recently, addressing him directly.

Andy Gregg was in his backyard when he heard the voice, belonging to someone who claimed to be a “white hat hacker” from Canada, Gregg told the Arizona Republic. A white hat hacker is a hacker who exposes security vulnerabilities for the greater good, rather than their own benefit.

Gregg recorded the conversation that followed. In the video, a voice can be heard over the speaker telling Gregg that he was contacting him in the creepiest way possible to warn him about the security risks of his internet-connected camera. more

Federal Court Rules Cops Can't Arrest You for Secretly Filming Them

Contrary to popular belief, in many states, recording the police is a crime.

Laws in 38 states plainly allow citizens to openly film the police in public. However, there are 12 states–California, Connecticut, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Pennsylvania, and Washington–where wiretap laws prohibit citizens from secretly recording police. These states require “two-party consent,” which means every party must agree before they are recorded.

But in a victory against Boston’s police commissioner and district attorney, a federal judge ruled on Tuesday that a Massachusetts law used by Massachusetts police to target people who secretly recorded them was unconstitutional. more

Just Add One More Thing and The Counterespionage Law Works

The following sounds good, but as is, it is just more of what hasn't worked.
The missing element: requiring the victims to lock their doors. 
Pennsylvania was the first to get it right. 

U.S. Senator Kamala D. Harris (D-CA), a member of the Senate Judiciary Committee, introduced the Deterring Espionage by Foreign Entities through National Defense (DEFEND) Act, which would update the Economic Espionage Act (EEA) to better address the growing threat of economic and industrial espionage perpetrated by foreign actors. The legislation increases the damages available for victims of trade theft, extends the statute of limitations, and expands the scope of the EEA to encompass a broader range of offenses occurring outside of the United States, including cybercrime and hacking. more

Landlord Plants Spycams - Watches While Jetsetting

Australia - An accused pervert landlord who has been charged with hiding secret cameras in tenant bathrooms could allegedly spy on renters live from wherever he was jetsetting around the world.

Barbadian-born James Maxwell, who calls himself “Tiger”, allegedly installed tiny secret spy cameras in the male bathrooms and a bedroom of the apartments in Pyrmont, Sydney, which he managed.

When police allegedly uncovered the cameras they also allegedly found an app on Mr Maxwell’s phone which enables accessing video footage from anywhere in the world...

....also alleged that Mr Maxwell had had tiny cameras in his watch and key ring...

News.com.au understands the cameras included a black rectangular digital clock and wall clocks in a bedroom and two bathrooms. more

Your Mobile Device Could Spill Its Guts (and worse) Get You Arrested

Last year, over 29,000 travelers had their devices searched at the US border.

A new report by the Department of Homeland Security’s internal watchdog has concluded that the agency does not always adequately delete data seized as part of a border search of electronic devices, among other concerns.

According to a new 24-page document released Tuesday by DHS’ Office of Inspector General, investigators found that some USB sticks, containing data copied from electronic devices searched at the border, "had not been deleted after the searches were completed."...

Federal authorities do not need a warrant to examine a phone or a computer seized at the border. They rely on what’s known as the "border doctrine"—the legal idea that warrants are not required to conduct a search at the border. This legal theory has been generally recognized by courts... more

Spybuster Tip #841: Device searches occur (even more often) when entering (or leaving) certain foreign countries. If you need to take your mobile device on a trip you should consider doing a data extraction on your device, before you leave... and before they do it for you.

1. To be sure you are not carrying data that you can't afford to loose.
2. To be sure you are not carrying contraband data (porn, propaganda, etc.).
   Remember, even erased data can be exhumed by them.
3. To document the actually data you are taking—to counter false accusations.

Learn more here. Upon returning a spyware detection inspection is also recommended.

A Spycam that Sucks

Blown by theregister.co.uk
Next time you're closing a big drug deal you may want to watch the cleaner. Or more specifically their vacuum cleaner. That's right, because thanks to publicly available federal acquisition records we now know that America's Drug Enforcement Agency (DEA) has planted cameras in cleaners. Canon cameras in Shop-Vacs appear to be the latest tool in the drug war.

To be fair, we don't know it's a Shop-Vac for certain because like the brand "Hoover," "Shop-Vac" has become a generic term for a heavy-duty vacuum cleaner. The DEA could be planting surveillance equipment in a Rigid, a Craftsman or even a Stanley. What we do know for sure is that is a Canon M50B.

And we know that because it lists "custom shop vac concealment with Canon M50B" in the contract, dated November 28.

It's a good choice: The Canon VB-M50B is a network camera so video can be live-streamed - presumably to agents parked in a van nearby – and it has a very large aperture ratio, meaning that you get good color and clarity out of it even in low-light situations. more

FutureWatch: Tooth Bugs

Sonitus Technologies, creators of the Sonitus Sensory Interface Platform, is enabling real-time wireless communications and monitoring of physiological information of users in the most challenging defense, security and commercial environments.

The company’s initial sensory platform-based solution is Molar Mic, a novel personal communications device that snaps-easily to the back teeth of a user and creates an entirely new audio interface.

By creating a new audio path (bone conduction), it eliminates the need for ear pieces, microphones and wires on a user’s head.

Incorporating a miniaturized microphone and receiver into a dime-sized mouthpiece, Molar Mic sustains unbroken two-way voice connectivity in communications networks critical to personal safety and performance across defense, public safety, aerospace, power, oil & gas, and professional applications.

Molar Mic is in its final field testing with the US Air Force. more