"They just make nice paperweights."

Thailand - Chief of Department of Special Investigation (DSI) Thawee Sodsong denied having tapped a telephone of Justice Minister Pirapan Salirathavibhaga. His statement came after Mr Pirapan claimed his phone has been tapped.

Although DSI has the bugging equipment, the organisation has the rules and laws of using it, and the ones who want to use the equipment need to ask for permission from DSI chief or his deputy, he said.

"Since I have taken this position for about one year, I can ensure you that we do not use the equipment to tap anyone," Pol Col Thawee told reporters. (more)

Bugging accusation adds to woes as M&S plans 1,100 job cuts

UK - The GMB union has accused Marks & Spencer of systematically bugging private conversations of its workers...

According to Personnel Today's sister publication Computer Weekly, the union will claim that M&S installed a secret, illegal "special line" in the workers' meeting room that allowed management to overhear their conversations.

Maria Ludkin, a GMB lawyer, alleged the information came from an employee at the technology company Eurosis, which supplied the microphones and other equipment used to bug the room. (more)

Murray Associates has been warning its corporate clients about the relationship between the down economy and increased snooping and dirty tricks. This is a good real-life example.

If M&S indeed made this mistake, they deserve what they will get. However, if this is a union 'set-up' ("The news comes as the trade union is preparing to take the retailer to tribunal over the sacking of whistleblower Tony Goode."), they deserve what they will get... if, the truth wins out.

Today, this is unnecessarily time-consuming and expensive ...and a PR nightmare for both sides.

All this might have been avoided if independent eavesdropping detection audits were part of the company's security program. Audits a very cost-effective alternative to litigation.

Tot's Tattle-Toy Bugs Pop

NE - The teddy bear had a bug. That's what a man alleges in a lawsuit that grew out of a child custody fight in Nebraska.

William Lewton is accusing his ex-wife Diane Divingnzzo and her father of hiding a recording device in his daughter's toy in order to spy on him... His attorney says it's believed hundreds of hours of conversations were recorded.

Lewton, his daughter -- who is now 5 -- and five other plaintiffs are requesting a jury trial. They're also seeking damages, alleging invasion of privacy and violation of state and federal wiretapping laws. (more)

SpyCam Story #507 - Bowling for Blackmail

via gizmodo.com...
Like the Rovio, WowWee's Spyball is a Wi-Fi-enabled spycam robot. But it transforms from sorta conspicuous ball to spycam for surreptitious shots. You can connect ad-hoc via Wi-Fi or over the internet.

The Spyball™ spy-cam is a remote controlled, Wi-Fi enabled, transforming robotic ball that introduces an element of play to telepresence functionality. Affordable, easy-to-use, and rechargeable, the Spyball spy-cam captures video and still images and is equipped with sleek wheels for fast, smooth mobility and 360-degree turns. Transforming from ball to camera and back again, the Spyball spy-cam moves with stealth and in disguise – perfect for spying on siblings or peeking into the kitchen. (more)

Corporate Data Protection Spending Up in 2009

...small and medium-sized businesses (SMBs) will spend... more of their IT budgets on security in 2009 than 2008, according to a new study from Forrester Research Inc. The change will result from a shift in security strategy from computer security threat defense to corporate data protection. That more closely mirrors the strategy at large companies, says Forrester's "The State of SMB Security: 2008-2009." (more)

Data is dormant. Protection, relatively easy.
Data becomes much more valuable when it is discussed and decisions are made. At this stage it is also easier to snatch. Protection against electronic eavesdropping is often overlooked.
Every company – small, medium or large – needs this minimal protection program.

Spying On Mayor's Emails, An Inside Job

Canada - A former senior bureaucrat ordered Vaughan's chief information officer to snoop on Mayor Linda Jackson's emails without her knowledge, a newly released forensic review shows...

The report, obtained by the Toronto Star yesterday through a freedom of information request, was unable to determine conclusively who accessed those emails or how, but did conclude it wasn't an outside job. (more)

Microphones with Brains

Ireland - One of those leading the work (an electronic stethoscope) at University College Dublin is Dr. Scott Rickard, a US scientist with a sparkling academic pedigree in applied mathematics and electrical engineering.

As an expert in audio identification techniques his work brought him to the attention of the FBI, where he helped develop an eavesdropping technology to identify a speaker's location in a crowded room.

Using two closely spaced microphones, it was possible to separate and localise an arbitrary number of speakers. "So if you were in a room and 10 people were speaking, you could tell who said what, when," said Dr Rickard. "That is really important for the FBI - they have lots of recordings of people and they want to know what was said and who said it." (more)

SpyCam Story #506 - Marriage Privacy Rights

Attorney, Steve Lombardi reports...
Family Law: Electronic surveillance of wife's bedroom activity leads to $22,500 judgment
The decision discusses a video cassette recorder positioned above the ceiling, a camera concealed in an alarm clock located in the bedroom regularly used by Cathy, and a motion sensing “optical eye” installed in headboard of the bed in that room.” The District Court found Jeffrey had invaded Cathy’s privacy and entered judgment in the amount of $22,500.00.

It’s pretty clear the Court finds married spouses even during the marriage, and while living in the same residence could be found to violate the other’s right to privacy if electronic equipment is used to record activity.

This is a case of first impression in Iowa but one that has been decided in North Carolina finding estranged spouses living separately have an expectation of privacy between themselves. (Miller v. Brooks, 472 S.E.2d 350 (N.C. Ct. App 1996)) And also Clayton v. Richards, 47 S.W.3d 149 (Tex. App. 2001) Even during a marriage the bedroom carries with it an expectation of privacy. (more)

Reporter Reviews Commonly Available Spy Gear

An entertaining article about the latest eavesdropping tools available to the general public. Includes: detailed usage, evaluation and pricing information. Oriented toward marital situations. Serious information security and privacy ramifications for workplace environments.
from...
Phase one: bugging the house. In the old days a bug worked using radio waves. Meaning it had a range. Meaning you had to stand within 50 yards of the room you were bugging, wearing a large pair of headphones and a suspicious expression to hear anything. Now the latest bug uses GSM technology, so you can phone it from anywhere in the world and listen in without contravening any communications laws. (more)

Run, Duck and Cover

Turkey - Following the recent discovery of two covert listening devices at the main opposition Republican People’s Party’s (CHP) headquarters in Ankara, party officials have begun to investigate whether the devices were planted by party members. (more)
meanwhile...
Turkey’s National Intelligence Organization, or MİT, is undergoing a comprehensive restructuring to increase its effectiveness... The Information Systems unit, which tapped wires and undertook grey zone activities, was left outside the intelligence department. Deputy undersecretariat for operations is replaced with the technical deputy undersecretariat, which now coordinates departments of information systems and electronic and technical intelligence. (more)

Meanwhile, at another Scot Palace...

(see previous palace story first)
Scotland - Royal security chiefs have launched an investigation after plans of the Queen's official residence in Scotland were found near a footpath...

The architect's drawings were discovered under a bush on a path leading to the Water of Leith, in Roseburn, Edinburgh... the plans showed power ducts, cables and a transformer, as well as the sizes of the gardens and locations for boiler rooms, gas meters, store cupboards, kitchens, toilets and wash areas. (more)

The spy doth protest too much, methinks.

Remember the story Queen's Electric Teapot 'Bugged'?
It happened in The Queen's Scottish Castle, Balmoral.
If not, take a moment to review.

A Scottish newspaper, The Press and Journal, is now reporting... Russian ex-secret agent rejects Balmoral samovar bugging claims. Unfortunately, reporter, Ryan Crighton's fact-checker must have taken the day off. (It was New Year's Day).

Let's review the story...
"A former Russian agent (Mikhail Lyubimov) has rejected claims that the Royal Family’s north-east residence was the target for Soviet spies." This reflects the official Russian position. Lyubimov, now a novelist with a Kim Philby book under his belt, backed Russian official position during the last British/Russian spy row, as well.

"...(Lyubimov) dismissed the reports, saying that the alleged bugging method was ineffective and useless." No surprise here, but no logic either.

“'Buckingham Palace and the Queen were never objects of great interest to us...'" No verisimilitude here, either. Russian surveillance, dating back to 1832, is famous. Everything is a possible target. Getting a bug into the Queen's Castle - even an "ineffective and useless" one - would be a major brag for the KGB.

"...a souvenir which had been given to the US in the 1960s contained a bugging device, however." Funny, one would think a Cold War secret agent would be more familiar with his agency's biggest hit. The Thing, as it was called, was "given to the US" in 1946 and discovered in 1952.

John La Carre, another ex-secret agent turned spy novelist, summed up his opinion of Lyubimov's last documentary novel this way: "Mikhail Lyubimov isn't just an ex-KGB officer. He's a ... mischievous novelist and a skillful self-publicist. My hunch is, we're dealing with one of his little fantasies..." Who knows if Mr. La Carre's hunch is correct, but...

"Madam, how like you this play?"
Hamlet Act 3, scene 2, 222–230

If you have read this far, you will really want to see this!

SpyCam Story #505 - The Church Robber

NC - The Cleveland County Sheriff's Office is searching for a man who was caught on camera stealing electronics from a church. Anyone with information on the man should call Cleveland County Crime Stoppers at 704-481-TIPS. (more photos)

Side lesson: If you buy a CCTV system to document crime, be sure to consider picture quality. Just keep repeating, "Facial recognition. Facial recognition. Fac..."

Dog Bites Man Story (Bug Version)

Australia - Russian intelligence bugged Australia's embassy in Moscow, cabinet documents published by the National Archives today show.

The major security breach is revealed for the first time in a cabinet minute recording that foreign minister Andrew Peacock briefed cabinet on July 25, 1978...

It was not the first occasion that listening devices had been found at the Australian embassy in Moscow. An extensive array of microphones were found in the newly established chancery in late 1946. Australian embassies in other Eastern bloc countries were also subject to ''technical attack'' by communist intelligence services. (more)

Recent USB Memory Stick Policy Poll

Many organizations have policies governing the use of thumb drives.
What best describes your situation?
A. Thumb drives are banned and not used. (41%)
B. Thumb drives are banned, but we still use them on occasion. (12%)
C. My company had no policy on the use of thumb drives. (46%)
(source)
(I know, it only adds up to 99%. Take it to PollDaddy.com)

Bugging Device Found - Şeref Sağıroğlu Smiles

Turkey - A covert listening device has been discovered at the headquarters of the main opposition Republican People’s Party (CHP) in Ankara.

The bugging device was found in the office of Algan Hacaloğlu, the CHP’s assistant secretary- general, earlier this week by his secretary. The CHP’s chief accountant, Mustafa Özyürek, said on Tuesday that experts were examining the device. (more) (told you so)

Lecture - “Electronic Eavesdropping on the Presidents — and Living to Tell About It”

Vero Beach Museum of Art’s
2009 Distinguished Professor Lecture Series
Feb. 18: George H. Gilliam, University of Virginia,
“Electronic Eavesdropping on the Presidents — and Living to Tell About It”

Budget Booster #493 - Economic Espionage, UP

"The Cold War is not over. It has merely moved into a new arena: the global marketplace." -- The U.S. Federal Bureau of Investigation

The U.S. Federal Bureau of Investigation also notes that foreign competitors try to find economic intelligence in three ways:
1. Aggressively targeting and recruiting susceptible people, often from the same national background, working for domestic companies and research institutions.
2. Hiring or bribing people to steal information, search through dumpsters and tap telephones.
3. Setting up seemingly innocent business relationships between foreign companies and domestic enterprises to gather economic intelligence including classified information.

During a recession, expect external and internal problem to increase...

Twelve Internal Spybusting Tips...

1. Recognize the threat. Economic espionage is more likely to happen if your business isn't prepared. Once the risk is acknowledged, management must take an active role in ensuring that the company puts into place tactics to effectively combat theft. Prime example.

2. Know the criminals' methods. Confidential information is often stolen, concealed or carried away. Data can be copied, duplicated, sketched, drawn, photographed, downloaded, uploaded, altered, destroyed, replicated, transmitted, delivered, mailed, communicated, or conveyed.
(Electronic eavesdropping is also common and very effective. Fortunately, you can discover it easily.)

3. Monitor database access logs. Many fraud detection engines can be used to keep an eye on the number of times a database is accessed, as well as the number of documents that are printed by each user.

4. Encrypt electronic files so that they cannot be read or taken off the premises.

5. Mark as confidential any sensitive documents, photographs and sketches.

6. Prohibit photocopying of trade secrets and other sensitive company information. Consider forbidding cameras on the premises, including those included in cell phones.

7. Remind departing employees during exit interviews of their obligations and your company's trade secret protection policies.

8. Warn all staff to change their passwords if there is the slightest chance they may have shared them with a former employee. Colleagues often share passwords even when that practice violates an enterprise's policy.

9. Coordinate denial to both the building and computer accounts as soon as an employee leaves the business. Let colleagues know a person has left the company. Otherwise, they might unwittingly allow a former employee on the premises.

10. Maintain logs of employees in the company who have rights to access trade secrets.

11. Review technical literature, service manuals, press releases and other material distributed outside the company. Similar reviews should be made of regulatory filings and patent applications. Watch what employees disclose at industry trade shows.

12. Consult with a forensic specialist to help your business set up the appropriate infrastructure to detect, classify and protect the intellectual property. Trade secrets are the core of your company. (more)

Occam's razor & TSCM

Occam's razor - a 14th Century principle which states that the explanation of any phenomenon should make as few assumptions as possible. Good advice.

These days Occam's razor is often - incorrectly - paraphrased as, "All things being equal, the simplest solution is the best." Wrong, because a simple phenomenon - like information loss - may be complex in structure.

Occam's razor is more correctly interpreted as, "Simplify. Consider just essential and relevant elements. Exclude assumptions."
This is the basis of Murray Associates security consulting philosophy.

Historically...
1. Most information losses are caused by people - insiders, not spies.
2. Some information losses are caused by poor security - unlocked desks, not picked locks.
3. A few information losses (the worst, and easiest to discover) are technical - bugs in rooms, not laser beams bounced off windows.

Practical prioritization...
1. Before you accuse people, eliminate the eavesdropping possibility.
2. While doing this, conduct an information security audit.
Upon completion, pin-pointing problem people and bolstering defenses is easy.

It pays to think before acting; plan before spending money.
Let's plan.
~Kevin

NSA patents a way to spot network snoops

The U.S. National Security Agency has patented a technique for figuring out whether someone is tampering with network communication.

The NSA's software does this by measuring the amount of time the network takes to send different types of data from one computer to another and raising a red flag if something takes too long, according to the patent filing. (more)

The first thing that everyone asks is, "If this was developed with taxpayer money..."

Calm down, your two cents were taken into consideration.
If you are an American taxpayer, you own a piece of this...
Assignee: The United States of America as represented by the Director, National Security Agency (Washington, DC)

"Are there any entry-level TSCM jobs?"

Not very many,
but here is one...

PRINCIPAL DUTIES AND RESPONSIBILITIES
The Technical Security Specialist responsibilities including, but not limited to:

• Review and make recommendations for technical security upgrades design based on counter-threat plans, physical security and technical security policies.
• Providing support services for a comprehensive technical security program designed to protect facilities and employees. Assists in developing and reviewing technical security designs for facilities. Providing input/review of proposed policies.
• Working under the direction of a Sr. TSCM specialist, to advise, and assist program office personnel on matters of technical security policy, procedures, and regulations.
• Conducting technical security needs surveys for preventing unauthorized access to facilities and possible loss of life or classified information. Providing a report of findings for each survey conducted...

REQUIREMENTS
The Technical Security Specialist shall possess the following background, knowledge, and skills... (more)

1957 - How To Tap A Phone

Over 50 years ago, Mechanix Illustrated magazine promised us flying cars and ways to tap phones.

Guess which one people-of-the-21st-Century are doing today...
"There are many ways to tap a phone... used to great advantage at home or in the office." (more)

Alert: DECT Hacked

Heise Security is reporting that... researchers in Europe's dedected.org group have published an article (pdf) showing how to eavesdrop on DECT transmissions, using a PC-Card costing only EUR 23. The DECT protocol is the world's most popular wireless telephony protocol. The standard is also used in baby monitors, emergency call and door opening systems, wireless debit card readers and even traffic management systems. There are hundreds of millions of terminals using the DECT standard. Also announced, the next version of the WLAN sniffer, Kismet, will support DECT, thereby rendering tricks with laptop cards superfluous. (more)

Rare: A Bugger Speaks Out About His Craft

Today, the technologies for communications monitoring and recording conversations are so advanced, practically unnoticeable, and easily available...

An electronics technician from Skopje (Macedonia) who is selling these devices has had a very unpleasant experience with the victims of his clients. He insisted that we do not publish his name.

I’m only making these devices, and I am not responsible for how people are using them. My “bug” has a range of 50 meters, and the recording can also be heard on a mobile phone. It is recording excellent on an FM-radio frequency, except when waves from the radio stations in Skopje are causing interference – he says, while showing us the small transmitter...

“A professor from a gymnasium in Skopje called me. I could feel the anger in his voice. He caught his students cheating during an exam by using my “bug”. What can I say; I am not encouraging children to do this. I also explained to him that there are also other young electronics technicians, who are manufacturing transmitters” he said.

Let me be clear, I am not selling these devices so that they could be abused. Some people are using my “bugs” to discover marital infidelities. Sometimes people are calling me, as if I had placed the device. I want these devices to be used for noble purposes, so that mothers could hear their babies crying, for instance. I am even prepared to give one of my bugs to each mother with twins, he added.

The devices of the Macedonian electronics technician are just part of the technological array of devices that can be used for eavesdropping. Almost all of the mobile phones have voice recorders. The new voice recorders are so small that they can be hidden in one’s sleeve. Online store “e-Bay” and other websites are selling mobile phones worth up to 1,000 euros that can be used to eavesdrop on other mobile phones. Hacker websites on the Internet are offering small programs for free, that can be sent via e-mail, that are afterwards sending back usernames and passwords of the email’s user to the original sender. The list is quite long. There are even so called “spy shops” in the USA. (more)

Security Budget Cuts Cost More Than They Save

• "If it were to become manifest just how routinely hugely sensitive corporate and governmental data is being hacked, I can guarantee that none of us would rest easy in our beds again."

• "Sixty percent of office workers faced with redundancy or the sack admit they will take valuable data with them, if they could get away with it! 40% are downloading sensitive company secrets right now under their bosses nose in anticipation that they could lose their job."

• "Sixty-two percent of workers admitted it was easy to sneak company information out of the office."

• "In the wake of the recession, more businesses are facing a growing financial threat: employee theft. New research shows that employers are seeing an increase in internal crimes..."

• "More than half the workers surveyed who admitted to already downloading competitive corporate data said they would use it as a negotiating tool to secure their next post because they know the information will be useful to future employers."
To read the whole story behind each of these quotes, visit: interopsgroup.com