Case History: How Foreign Espionage is Killing U.S. Companies

A cautionary tale of woe...

Last June, three men squeezed inside a wind turbine in China’s Gobi Desert. They were employees of American Superconductor Corp., a maker of computer systems that serve as the electronic brains of the device... to test a new version of its control system software...

The software was designed to disable the turbine several weeks earlier, at the end of the testing period. But for some reason, this turbine ignored the system’s shutdown command and the blades kept right on spinning.

The problem wasn’t immediately clear, so the technicians made a copy of the control system’s software and sent it to the company’s research center...

...some startling findings... The Sinovel turbine appeared to be running a stolen version of AMSC’s software. Worse, the software revealed Beijing-based Sinovel had complete access to AMSC’s proprietary source code. In short, Sinovel didn’t really need AMSC anymore...

...in March 2011, Sinovel abruptly and inexplicably began turning away AMSC’s shipments...

AMSC had no choice but to announce that Sinovel -- now its biggest customer, accounting for more than two-thirds of the company’s $315 million in revenue in 2010 -- had stopped making purchases. Investors fled, erasing 40 percent of AMSC’s value in a single day and 84 percent of it by September.

What happened to AMSC may be incredibly brazen, but it’s hardly exceptional. There have been a large number of corporate spying cases involving China recently, and they are coming to light as President Barack Obama and the U.S., along with Japan and the European Union, have filed a formal complaint to the World Trade Organization over China’s unfair trading practices. 

...14 U.S. intelligence agencies issued a report describing a far-reaching industrial espionage campaign by Chinese spy agencies. This campaign has been in the works for years and targets a swath of industries.

“It’s the greatest transfer of wealth in history,” General Keith Alexander, director of the National Security Agency, said at a security conference at New York’s Fordham University in January. (more)

Manufacturing is gone.

Intellectual property is going.

What will we have left to sell?

Please. Start taking espionage seriously. ~Kevin

FutureWatch: The Most Powerful Spy Center In the World

Deep in the Utah desert, at the feet of the Wasatch mountain range, is one of the most secret, most guarded, most secure facilities in the world. Here is where everything you say is analyzed to search for security threats against the United States.

It's the National Security Agency's Utah Data Center, a $2 billion facility that will capture, record and scrutinize every communication in the world, from emails to phone calls to text messages to chats. It will also crack codes. According to Threat Level, the encryption cracking will be the most powerful in the world, and will help get into "financial information, stock transactions, business deals, foreign military and diplomatic secrets, legal documents, confidential personal communications."

There will be four data rooms, 25,000-square-foot each, full of servers, cooled down by 60,000 tons of machinery and 1.7 million gallons of water per day. The site has its own 65-megawatt electrical substation, as well as backup generators that can power the whole thing for three days, uninterrupted. Just the video security system alone costs more than $10 million. (more)

SpyCam Story #657 - Rutgers SpyCam Case Verdict

NJ - An ex-Rutgers student accused of using a webcam to spy on his gay roommate was convicted of invasion of privacy but cleared of some of the more serious charges of bias intimidation Friday.

Dharun Ravi, 20, was stoic as the jury rendered its mixed verdict in New Jersey’s Middlesex Country Superior Court after deliberating since Wednesday.

Ravi was accused of 15 counts after using a webcam to spy on roommate Tyler Clementi’s dorm-room tryst with another man in 2010.

Clementi, 18, jumped to his death from the George Washington Bridge three days after the spying incident. (more)

Two Simple Tips to Prevent Snooping on Your Lost Cell Phone

Anyone who loses their mobile phone should expect the data to be accessed by the person who finds it, and business data is no exception, according to a study released this week by security firm Symantec.

In its Smartphone Honey Stick Project, Symantec "lost" 10 phones in each of five cities, leaving them on top of newspaper boxes, in food courts, and even the ladies restroom of a Chinese restaurant. In all but one instance, people who found the phones accessed the devices, with 83 percent of people accessing one or more of the four business applications, including two human resources files, corporate email, and a remote administration tool. More than 4 out of 10 people even accessed the banking application on the device.

...two simple security measures can protect the data on devices... 

• While complex passcodes are best, using even a simple four-digit code would protect the devices from casual access.

• Installing a remote management tool to remotely track the device can help to quickly recover a lost phone. Most device management tools also allow users to remotely delete the data on the device, a hedge against a more tech-savvy data thief. (more)

Advice: Use Cell Phone Forensics, not Spyware, to Gather Evidence

via Pursuit Magazine...
"As a private investigator, I’m often asked by businesses to gather information from cell phones owned by a company; you can protect your business by tracking your employee’s cell phone data. Even though I know the best method for collecting data from phones is through mobile phone forensics, one client was insistent that we use spyware to track calls, text messages, etc. from one specific employee they suspected of stealing from the company..." (and it goes downhill from here) (more)

Privacy Invading Lawsuit - Apps

Facebook, Apple, Twitter, Yelp and 14 other companies have been hit with a lawsuit accusing them of distributing privacy-invading mobile applications.
 
The lawsuit was filed by a group of 13 individuals in the United States District Court for the Western District of Texas earlier this week. The suit charges 18 companies with surreptitiously gathering data from the address books of tens of millions of smartphone users. (more)

Psychopath Chat

To investigate whether there are actually “psychopathic tendencies” in the way a person talks, researchers at Cornell University compared stories told by 14 imprisoned psychopathic male murderers with those of 38 convicted murderers who were not diagnosed as psychopathic. 

Each subject was asked to describe his crime in detail; the stories were taped, transcribed and subjected to computer analysis.

The analysis showed that psychopaths are more likely than other criminals to use words that reveal a great degree of selfishness, detachment from their crimes and emotional flatness, the study found. These include conjunctions like “because,” “since” or “so that,” to imply that the crime “had to be done” to obtain a particular goal. 

Here are a few other notable differences:

• Psychopaths used twice as many words relating to physical needs, such as food, sex or money, while non-psychopaths used more words about social needs, including family, religion and spirituality.
• They were also more likely to use the past tense, suggesting a detachment from their crimes.
• They tended to be less fluent in their speech, using more “ums” and “uhs.” The exact reason for this is not clear, but the researchers speculate that the psychopath is trying harder to make a positive impression and needs to use more mental effort to frame the story. (more)

"Yer out!" Baseball Spy Gets the Boot

AZ - A scout for the Los Angeles Angels who was watching San Francisco take infield practice Wednesday morning was ejected from Scottsdale Stadium at the request of Giants manager Bruce Bochy.

Media reports said Angels scout Jeff Schugel was taking notes during the Giants’ routine drills when he was told to leave the ballpark.

Earlier this spring, Diamondbacks manager Kirk Gibson had scouts removed while they were watching drills at Arizona’s camp. (more)

FS - Slightly Tarnished Surveillance Equipment Company - Buyer's Identity Protected

French technology company Amesys is offloading its business that sells Internet-interception equipment, a move that comes six months after it became public that Moammar Gadhafi's regime had been using the technology to spy on Libyans.

Bull SA, Amesys's parent company, said Thursday it had "signed an exclusivity agreement with a view to negotiating the sale of the activities" related to its Eagle interception product. Bull declined to identify the buyer. (more)

From Racoon Twsp. in Beaver County a Bed Bugger's Comedy

PA - A Raccoon Township man was charged after police said he hid a listening device under his wife's bed in an attempt to catch her having an affair.
Suzanne Cripe, contacted police and said she had found a "transmitter device" under her bed... She told police she thought the device had been placed there by her husband, Wayne Comet Cripe.

The Cripes "have been separated for some time," and were still sharing a house, but they had separate bedrooms, the police report said.
 

When police made contact with Wayne Cripe he said, "I guess she found the transmitter," before police even asked him any questions.
 

Cripe told the police he put the transmitter under his wife's bed because he wanted to know whether she and her boyfriend were having sex. He told police he was tired of hearing them and wanted to know "if the coast was clear" before entering his home. (more)

SpyCam Story #657 - This Week in SpyCam News

SpyCam stories have become commonplace and the techniques used, repetitive. We continue to keep lose track of the subject for statistical purposes, but won't bore you with the details. Only links to the stories will be supplied unless there is something useful to be learned.

CA - Man spying in college Men's Restroom- Low tech, using mirror.

NJ - Jury gets case in Rutgers webcam spying trial.

Canada - Man charged with voyeurism in Halifax has waived his right to a bail hearing.

LA - Man faces 23 more counts of video voyeurism and child pornography.

LA - Guard's coat-hook cams in 2 office ladies restroom and on dumpster at Marti Gras.

UT - Man tapes encounter with BYU male student and tried to extort money for silence.

UK - Teacher secretly filmed women and kids, many locations – including Botanical Gardens.

Canada - Pen spycam captures woman swim teacher in changing room.

Canada - City sweeps all the change rooms of all the swimming pools for staff and citizens.

OH - Park ranger indicted - accused of placing an iPod on record mode in a restroom.

UT - Man charged with voyeurism - allegedly set up cameras in estranged wife’s bedroom.

MA - Man arraigned for cell phone spycaming in YMCA girl's locker room. 

NV - School police use hidden cameras, catch teacher's aide roughing two students.

FL - Video voyeurism bill passes House and Senate; goes to Gov. Rick Scott. 

MS - Mississippi bill would make voyeurism a felony... but only if victim is under 16.

Australia - Former lawyer jailed for indecently filming boys with hidden cameras.

IL - Man taped employees of local restaurant using commodes in employees' bathroom.

ID - Man indited on video voyeurism - woman unable to resist due to being drugged.

UT - Previously convicted spycam'er at University of Utah re-arrested.

IN - Former Notre Dame office employee pleds guilty - pen cam in women's restroom.

LA - Man in Pecanland Mall men's room looking for nuts with cell cam.

FutureWatch - Facebook and the Fourth Amendment

Click to enlarge

"...as Justice Sotomayor recently suggested, the wholesale sharing of your reading history with Facebook friends may ultimately impact the Supreme Court’s understanding of what constitutes a “reasonable expectation of privacy...”
"The recent trend toward social readers and other types of frictionless sharing may at first glance seem innocuous, if inane... users may not understand that sharing what they read with friends may mean sharing what they read with the government, as well. That is a whole lot more serious than just annoying your friends with your taste for celebrity gossip. Indeed, it may be another step toward the death of the Fourth Amendment by a thousand cuts." —Margot Kaminski, writing in the Wake Forest Law Review (more)

Surprise! Trade Secret Theft is not automatically Economic Espionage

Corporate espionage used to be rather straight forward as the typical Coke-Pepsi textbook example illustrates. It is a crime when one stole company data/trade secrets and passed it to a business rival.

This was, however, not quite the case of former Goldman Sachs computer programmer Sergey Aleynikov. A US federal appeals court acquitted Aleynikov in mid-February after he had served a year of his eight-year sentence... His acquittal was not only a blow to his former employer but also the Department of Justice.

Most importantly, his case is an acid test of the 16-year old Economic Espionage Act that specifically targets theft of trade secrets.

The Economic Espionage Act makes theft or misappropriation of a trade secret a federal crime, whether it is with the knowledge or intent that the theft will benefit a foreign power or for interstate and/or international commerce with the knowledge or intent that it will hurt the owner of the trade secret.

Coincidentally just a week before Aleynikov was let go, another US court acquitted Chinese-born American software developer Hanjuan Jin for allegedly stealing confidential information from her employer Motorola Inc...

But the judge said while the evidence showed she stole trade secrets...it was not enough to prove she committed economic espionage by selling the information to a foreign government or entity. (more)

Moral: Prevention is more swift and sure than legal protection. Get professional help.

Social Media Spy Trick #101 - Know Who Your Friends Are... really.

Spies opened a fake Facebook account under the name of NATO’s supreme allied commander, Adm. James Stavridis, and fooled senior British defense and government officials into accepting friend requests, it was reported yesterday. 

The incident allowed the reportedly Chinese spies access to the personal e-mail and contact information of some British officials, but it was unlikely any military secrets were compromised, according to The Sunday Telegraph.

“Discussions/chats/postings on Facebook are of course only about unclassified topics,” a NATO official said of the information that was accessed. (more)

Is this Web Site Malicious?

Special thanks to Lenny Zeltser...

Several organizations offer free on-line tools for looking up a potentially malicious website. Some of these tools provide historical information; others examine the URL in real time to identify threats:

• AVG LinkScanner Drop Zone: Analyzes the URL in real time for threats
• BrightCloud URL/IP Lookup: Presents historical reputation data about the website
• Cisco IronPort SenderBase Security Network: Presents historical reputation data about the website
• G-Data MonkeyWrench Beta: Analyzes the URL in real time for threats (about)
• F-Secure Browsing Protection: Presents historical reputation data about the website
• Finjan URL Analysis: Analyzes the URL in real time for threats
• KnownSec: Presents historical reputation data about the website; Chinese language only
• Norton Safe Web: Presents historical reputation data about the website
• ParetoLogic URL Clearing House: Looks up malicious sites discovered using a web honeypot; registration required
• PhishTank: Looks up the URL in its database of known phishing websites
• Malware Domain List: Looks up recently-reported malicious websites
• MalwareURL: Looks up the URL in its historical list of malicious websites
• McAfee Site Advisor: Presents historical reputation data about the website
• McAfee TrustedSource: Presents historical reputation data about the website
• Trend Micro Web Reputation: Presents historical reputation data about the website
• Unmask Parasites: Looks up the URL in the Google Safe Browsing database
• URL Blacklist: Looks up the URL in its database of suspicious sites
• URL Query: Looks up the URL in its database of suspicious sites and examines the site's content
• URLVoid: Looks up the URL in several website blacklisting services
• vURL: Retrieves and displays the source code of the page; looks up its status in several blocklists
• Web of Trust: Presents historical reputation data about the website; community-driven
• Wepawet: Analyzes the URL in real time for threats
• Zscaler Zulu URL Risk Analyzer: Examines the URL using real-time and historical techniques

On Corporate Intellectual Fruit ...and how to keep it.

Dodd-Frank related governance issues such as say-on-pay and proxy access have been well known focal points for boardrooms during the 2012 proxy and annual meeting season, but another issue has topped headlines and is of increasing concern to boardrooms: business intelligence gathering activities...

Effective corporate governance principles dictate that those who conduct unethical or, worse, illegal activities on behalf of a company must be brought to heel. 

The phrase “traditional intelligence gathering” has its roots corporate espionage. 

Popular targets include technology related industries such as software, hardware, aerospace, biotechnology, telecommunications and energy, among others... It is clear, however, that no specific industry or sector is immune to these issues. (more)

Intelligence is the fruit of creativity; the food by which companies grow. Fruit that falls and rolls into the road is picked up by competitive intelligence professionals, legally. But when they come on property and pick fresh, ripe fruit off the trees, it's illegal. With a good fence, you can keep all your fruit.

Pursuit Magazine Book Review - "Is My Cell Phone Bugged?"

By Stephanie Mitchell, CompassPoint Investigations / Pursuit Magazine

"'Nearly everyone carries instant access to phone service, and tapping has become a personal concern.' The well documented comprehensive guide Is My Cell Phone Bugged, by Kevin D. Murray, provides well-documented information and research addressing cell phone privacy issues.

I found the book well written and superbly formatted. Even those who are not technologically savvy will find it to be very user-friendly. At no time during my reading did I feel bogged down with complicated technical language! Mr. Murray’s explanation and thorough direction assists the reader in regaining their privacy and the security of their personal information. Mr. Murray’s guidance ensures the reader that cell phone security and privacy can be achieved even if you are not a counterespionage expert.

I was impressed with the wealth of information and knowledge I gained from this book. Topics include: communications technology, purchasing secure cordless devices, how to avoid pre-bugged cell phones, understanding and identifying spyware, preventing tapping and information leaks, caller-ID technology, and identifying when your phone is under surveillance. As an investigator, I was particularly appreciative of the Legal Issues chapter covering privacy laws in a clear and precise manner." (complete review)


Thank you — Kevin

From that wonderful state that brought you the Hatfield–McCoy feud... The Rat App

“If every West Virginia resident that owns a smart phone (and knows how to use it) gets this app . . . you'll literally have 10 (sic) citizen spy's working for you!” – a review at the Google Android app store

Snitching has eventually entered the digital age thanks to a new smartphone app that lets anyone, anywhere tell the police: “Hey! That’s kind of weird!”

Authorities in the state of West Virginia are encouraging residents to install an Android and iPhone application that lets alerting law enforcement of suspicious activity become as easy as a click of a button — or, for some smartphone owners, the touch of a screen.

The official government website for the state of West Virginia now prominently features a product available for download on select mobile devices. It’s the Suspicious Activity Reporting mobile application and it lets users type up notes about any mundane yet worrisome incident they witness and send it straight over to local law enforcement. The app even allows the user to capture and upload a photo of someone they might consider suspicious, only to then provide the police with a detailed visual description of someone who may — or may not — be up to no good...

The device’s manufacturers add that any tips, such as suspicious vehicles or mysterious packages, can be reported anonymously if the user opts for that choice. (more)

FutureWatch - The actual process of filing a report with a live police official filtered out most casual / grudge / unfounded / harassment complaints in the past. With app-happy ease and the promise of anonymity might not the floodgates of neighborly bile open? And, should we really believe that identifying information (phone number, GPS, etc.) won't get transmitted just because you pressed an app's anonymous button? When you call 911, caller ID blocking doesn't block.

Van Eck 2012 - Brain Sucking Cell Phone Spiders

The processors in smart phones and tablets leak radio signals that betray the encryption keys used to protect sensitive data. 

At the RSA computer security conference last week, Gary Kenworthy of Cryptography Research held up an iPod Touch on stage and looked over to a TV antenna three meters away. The signal picked up by the antenna, routed through an amplifier and computer software, revealed the secret key being used by an app running on the device to encrypt data. An attacker with access to this key could use it to perfectly impersonate the device he stole it from—to access e-mail on a company server, for example.

The antenna was detecting radio signals "leaking" from the transistors on the chip inside the phone performing the encryption calculations. Transistors leak those signals when they are active, so the pattern of signals from a chip provides an eavesdropper a representation of the work the chip is doing. When Kenworthy tuned his equipment to look in the right place, a clear, regular pattern of peaks and troughs appeared on his computer screen. They could be seen to come in two varieties, large and small, directly corresponding to the string of digital 1s and 0s that make up the encryption key.

"You could build an antenna into the side of a van to increase your gain—well, now you've gone from 10 feet to 300 feet." (more) (creepy computerized audio version) (Van Eck)

Info Security in 2 Steps - Train Your Humans, Have Your Technical Vulnerabilities Checked and Patched

There’s a famous saying that “amateurs hack systems, while professionals hack people.” The point is that security technology designed to stop hackers, spies, phishers and frauds are always compromised by timeless human weaknesses: inattention, incompetence and complacency.

Click to enlarge.

The only thing standing between your company’s information systems and the people who are out to compromise them is employees. Technical security vulnerabilities can be patched but humans are always vulnerable. (more) (need patching?)

Do Company Execs Know Sensitive Data When They See It? Many in IT Say No

Today’s companies, clearly very good at collecting data, seem “less savvy when it comes to how to classify and manage it.”

That’s the conclusion of a survey among 100 IT executives and others conducted by global consulting firm Protiviti, which finds that there is “limited or no understanding of the difference between sensitive information and other data” at nearly a quarter of the companies participating in its survey.

The report is titled “The Current State of IT Security and Privacy Policies and Practices." Its topics: how organizations classify and manage the data they accumulate; specifically how they ensure customer privacy when they handle sensitive data, and how they comply with federal and state privacy laws and regulations. (more)

Jamming on the Bus, or The Cell Phone Vigilante

PA - A man in Philadelphia decided he'd had enough with listening to his fellow bus passengers blab away on their cellphones. But instead of buying himself some noise-cancelling headphones or politely asking people to pipe down, he chose to fight back with a handheld device that jams their signals.

"I guess I'm taking the law into my own hands," he told NBC10, which caught him red-handed with the illegal jammer, "and quite frankly, I'm proud of it."

Those who ride the bus with the man say he should be ashamed, not proud. (more)

Certified Ethical Hacker (CEH) Course Growing

India - "We started ethical hacking courses in 2009 with five students which has increased to approx 200 students today," said Jyoti Chandolia, assistant manager, corporate education sales at Udyog Vihar-located Mercury Solutions Ltd, the first ethical hacking training centre to come up in the city authorised by the International Council of E-Commerce consultants (EC-Council).

"Hacking is not legal in India and this particular course can distinguish black hat hackers (bad guys) and white hat hackers (good guys) after being certified as a Certified Ethical Hacker (CEH). The main objective behind this is to make people aware that CEH course is not all about how to hack but also to scan and protect IT systems and networks of an organisation," she added.

The EC-Council is a member-based organisation that certifies individuals in various e-business and information security skills. It is the owner and creator of the world-famous CEH, Computer Hacking Forensics Investigator (CHFI) as well as many others programmes, that are offered in over 60 countries through a training network of more than 450 training partners globally. (more)

Former US Marine, Accused CIA Spy, to be Re-tried in Iran

Click to enlarge.

Iran’s Supreme Court has overturned a death sentence for spying handed down to a former U.S. Marine, Amir Mirzai Hekmati, ISNA news agency reported on Monday quoting a top judiciary official.

“The sentence was overturned by the Supreme Court … The case has been sent back” to the court for retrial, prosecutor general Gholam Hossein Mohseni Ejei told a press conference, ISNA reported. (more)

Poison Text Messages and Malicious Mobile Apps on the Rise

Nearly one in five mobile phone users have experienced some type of security threat with their device. That's the finding of a Cloudmark survey of 1,000 cellphone users, scheduled to be released Tuesday.

Poison text messages, nearly non-existent in the U.S. a few years ago, grew 300% in 2010 and 400% in 2011, accounting for about 1% of all text messages. "We've gone from totally clean to a trickle," says Rachel Kinoshito, head of Cloudmark's security operations. "Most people are seeing about one a month."

That foothold is part of a broader concern. Variations of scams that infest the Internet, through PC browsers, have begun spreading on a meaningful scale through mobile devices. And it looks like the bad guys are just getting warmed up. (more)

Business Espionage: Spy Who Stole DuPont's Secrets Pleads Guilty

A former DuPont Corp. scientist has pleaded guilty to conspiring to commit economic espionage for a company controlled by the Chinese government and agreed to testify against others charged with stealing secrets of a manufacturing process sought by China.

Tze Chao, 77, a DuPont employee from 1966 to 2002, admitted Thursday in a San Francisco federal court that he had provided confidential information about DuPont's titanium dioxide process to the Chinese-controlled Pangang Group Co. (more)

Japanese Acoustic Ray Gun Silences Blabbing Godzillas

Tired of listening to a boring talk, a lecture or a colleague rattling in the office? The Japanese have found an answer to your woes. You can now silence the talk with a speech jamming gun.

The device developed by Kazutaka Kurihara at the National Institute of Advanced Industrial Science and Technology and Koji Tsukada at Ochanomizu University can silence any person talking from about 100 feet distance.

When used the gun, an inbuilt microphone picks up the words being said and then plays it back 0.2 seconds later. According to an explanation provided by the two inventors, the human brain interprets this echo effect as silence. (more) (Kazutaka Kurihara's Website) (Speech Jammer Research Paper)

Kazutaka also has a flare for the dramatic. Watch as the jammer comes into view to do its deed. Reminds me of those wonderful Japanese 1950's horror movies.

Computer Mouse with Ears ...and its own Cell Phone

UK - Innocent-looking, regular office equipment are now increasingly being used by employers to monitor staff in Britain.

Employers use tools such as calculators and clocks that come with built-in cameras and listening device, to keep a track of their employees.

Now, even the regular PC mouse is no longer innocent. A variant, spy mouse, that looks the same as the normal mouse, comes with a listening device and a SIM card embedded in it. A phone call is used to activate the device, which then captures sounds and conversations within a 10-metre radius. (more) (many spy mice)

SpyCam Story #656 - This Week in SpyCam News

SpyCam stories have become commonplace and the techniques used, repetitive. While I will continue to keep lose track of the subject for statistical purposes, I won't bore you with the details. Only links to the stories will be supplied unless there is something useful to be learned.

SC - Teen in school Girl's Room with camera.

OR - Man in theater dressing room with camera.
IN - Former Notre Dame assistant registrar - video in bathrooms and dressing rooms.

WA - Missing Susan Powell's husband, and his father, video voyeurism.

SC - Two indictments in Myrtle Beach on voyeurism charges.

NJ - Rutgers spycam trial continues.

IN - Shoecam man sentensed to six months.

ID - Sister-in-law spycam'er appeals.

NC - Middle school teacher spycam'ing bathroom.

WA - High school teacher charged with voyeurism resigns.

ID - Man charged with video voyeurism; no details.

IN - High school custodian spycam's Boy's locker room.

FL - Man charged with through-the-bedroom-window video voyeurism.

UK - Camera in business washroom charged filed.

NY - Man spycam'ing in local tanning salon.

OH - Man videos woman in shower, three times.

IN - New trial date for swim coach accused of locker room filming.

FL - New video voyeur legislation making progress.

NM - Spycam in business bathroom; allegedly installed by owner.

Spy School - Monitor a Twitter Account Without Following It

Investigator's Tip: "Monitoring an opponent’s Twitter account is an important part of opposition research. If you would like to keep up with someone’s Tweets, but not actually publicly follow the author, try using Twitter to RSS. This service allows you to enter the name of a public Twitter account and create an RSS feed for popular RSS readers like Google Reader, Yahoo, Bloglines, and Newsgator." — Larry Zilliox, Investigative Research Specialists, LLC

Privacy Tip:  
Don't be a twit. Make your sweet tweets private.

Read up on how to protect your tweets here, 

and don't approve any "twitter to RSS" requests.

NSA-Level Cell Phone Security (No, you can't have one.)

The US National Security Agency has modified Google’s Android operating system to create smart phones that use powerful encryption to protect every call. The “Fishbowl” devices were announced today at the RSA security conference in San Francisco by Margaret Salter, the agency’s Technical Director, who said she hoped to encourage companies to adopt some of ideas used in the system.

Such was the interest in the NSA’s presentation that this reporter – and most others – weren't able to gain access to the room where the demo was held. Australian IT publication SC Magazine did, though, reporting that Salter said 100 Fishbowl phones are being used to test the new technology. The Fishbowl phones allow fully encrypted calls that can be used to discuss the most classified information. Commercially available phones would require NSA employees to “speak in code”, SC say.
 

The NSA has made rough specifications of the system available online. They show that Fishbowl phones make calls using a Skype-style VOIP app that routes connections through NSA servers. (more)

Just in time to celebrate "International Speak Like A Spy Day"

THE DICTIONARY OF ESPIONAGE: SPYSPEAK INTO ENGLISH

We use words to tell each other what we mean. Words illuminate reality. But sometimes, and it seems increasingly so in these troubled times, words can be used to conceal truth.

This is why “The Dictionary of Espionage” is so timely and will appeal to the average citizen who is made vaguely uneasy when he is told that his government is engaged in “surgical strikes” against our enemies, which on occasion, unfortunately, result in “collateral damage” - that is, the U.S. government set out to kill someone but ended up killing someone else.

In this accessibly written book, Washington author Joseph C. Goulden illuminates and defines much of the standard jargon of the intelligence community with refreshing asides about many of spying’s urban legends - many of which may or may not be true. 

Informed by remarkable access to the intelligence community, the book, first issued in 1986, has been significantly updated and contains a foreword by Peter Earnest, the founding executive director of the International Spy Museum in Washington and a former CIA operations officer. (more)

Smartphone Spyware Reaches the Drive-By Infection Stage

(summary) A team of researchers infected a Google Android smartphone, live, in front of a packed audience of computer security buffs to prove how mobile malware is now on the cusp of the big time... "drive-by" attack...the attack did not require a phone be jailbroken and would work on any of the devices using Webkit*...such an attack would be possible on the iPhone because of the root access obtained via the browser vulnerability...the point we are making: drive-by attacks will hit the phone just like the PCs. 

The technique: The attack followed several steps: the first was a text message delivered to the smartphone appearing to come from the mobile carrier requesting a system update via a link. Once clicked, the drive-by link delivered the first part of the malware to the phone to elevate access (root) privilege, then cause it to crash. It then automatically rebooted, executing the second part of the malware and hijacking the phone's communications. (more)

* Webkit - "Webkit is a tool used by Apple, Google and RIM to render HTML websites in Safari, Chrome and Android, and the latest versions of the BlackBerry."

Now that you know how this works, I'm sure you won't click on any text links unless you are 100% certain are safe. ~Kevin

Young Lawyers Win Suit Against Secret Wiretapping Powers

Georgia’s Constitutional Court has decided that parliament did not have the right to give prosecutors powers to conduct secret wiretappings.

Tamar Khidasheli and Georgian Young Lawyers Association filed a lawsuit at the Constitutional Court regarding the law of Georgia on Operational Investigative Activities, which gave the police extended powers during investigation. (more)

Colombia-Gate Continues

Colombia - Bernardo Moreno, former President Alvaro Uribe's then-chief of staff ordered the illegal wiretapping of judges, senators, and journalists, the former intelligence chief of Colombia's now-defunct intelligence agency DAS told the court Wednesday.

Former DAS executive Fernando Tabares reiterated the accusations in the trial against Mario Arangunen, the former director of Colombia's financial intelligence agency UIAF who is on trial for his alleged involvement in the wiretap scandal. (more)

Fernando Tabares news archive / Wiretap scandal news archive

Judge Declares Illinois Eavesdropping Law Unconstitutional

IL - A Cook County Judge declared the state’s eavesdropping law unconstitutional Friday.

Judge Stanley J. Sacks read his ruling in the case of Christopher Drew, a Chicago artist who was charged with felony eavesdropping after he recorded his Dec. 2, 2009, arrest on State Street by Chicago Police.

“The Illinois Eavesdropping Statute potentially punishes as a felony a wide array of wholly innocent conduct,” he read. “A parent making an audio recording of their child’s soccer game, but in doing so happens to record nearby conversations, would be in violation of the Eavesdropping Statute.” (more)

$140 Million Surveillance Balloon Popped

After spending more than $140 million, the Air Force is poised to pull the plug on its ambitious project to send a king-sized, all-seeing spy blimp to Afghanistan. Which is a bit of a strange move: Not only is the scheduled first flight of the 370-foot-long “Blue Devil Block 2” airship less than six weeks away...

Not long ago, Blue Devil and its kind were being pushed as the future of aerial surveillance. Instead of a drone’s single sensor, Blue Devil would employ an array of cameras and eavesdropping gear to keep tabs on entire villages for days at a time. And with so much space aboard the airship, racks and racks of processors could process the data generated by those sensors in the sky, easing the burden on intelligence analysts currently overloaded by drones’ video feeds. Now, that lighter-than-air future could be in jeopardy, thanks to a series of schedule delays, technical complications and, above all, inflated costs. (more)

New Delhi Gummy Bugs

India - BJP on Friday dubbed the reports of alleged bugging of Defence Minister AK Antony's office as a "serious" matter which should be thoroughly probed and wondered what the reasons were for spying on the cabinet minister.

"The Defence Minister who is responsible for defending our borders, his own office borders are not secure. The reports of the bugging of his office is a matter of serious concern," BJP spokesperson Prakash Javadekar said.

The BJP pointed out that this is not the first case of bugging of the office of a Cabinet minister as there were earlier reports that Finance Minister Pranab Mukherjee's office was also bugged.

"Then, it was maintained that chewing gums were stuck at 12 places in the Finance Minister's office. We hope this time too, the same excuse is not made. This matter cannot be taken lightly and the truth should be told to the country," Javadekar said. (more) 

Sing along...

Menwith Hill Eavesdropping Base Undergoes Massive Expansion

UK - America's largest eavesdropping centre in Britain, Menwith Hill in North Yorkshire, is being expanded in a multimillion-pound programme as it becomes increasingly vital to US intelligence and military operations, according to a study of the controversial base released on Thursday. 

The base, which plays a key role in the global network of the National Security Agency (NSA), GCHQ's American partner, now includes 33 radomes – commonly called "golf balls" after the white sheeting protecting the satellite receiving and transmission stations – and is undergoing a big construction programme.

The study describes the programme, called Project Phoenix, as "one of the largest and most sophisticated high technology programmes carried out anywhere in the UK over the last 10 years". Work on it has been reserved for US-based arms corporations including Lockheed Martin and Northrop Grumman, and their personnel with high-level security clearance, it notes. (more)

"Houston, we have a problem."

The "algorithms used to command and control the International Space Station" were lost when an unencrypted NASA laptop computer was stolen in March 2011. 

That tidbit came in testimony Wednesday delivered by NASA Inspector General Paul K. Martin as he reported on the space agency's IT security track record. The loss of the ISS command code was symbolic of one glaring deficiency: a lack of data encryption on mobile devices. (more)

IKEA Spy Inquiry

A French union on Thursday lodged a formal legal complaint against Swedish furniture giant IKEA accusing it of illegally spying on staff and customers, legal sources said. (more)

In the latest twist in a damaging ‘spying’ scandal, Swedish furniture giant IKEA was on Thursday accused of “harassing” its employees after media reports emerged Wednesday that the company had illegally obtained police files on French workers, clients and union leaders.
The latest allegations centre on a former employee who told Europe 1 radio that she had been asked to profile her colleagues and to keep the information on a USB key and to avoid leaving it on company computers “for security reasons”. (more)

Privacy Check: Google's Privacy Policy Changes on March 1

via pcworld.com...

If you use Gmail, Google Docs, or any other popular G-service, you’re about to surrender a lot more personal information to the Googleplex...unless you take these steps to prevent it. 
1. Check the Dashboard
Your first destination is Google Dashboard. It provides an overview of the information Google has stored on your account across many of its most popular services. To get started, go to google.com/dashboard and log in with your Google account (typically an email address). There, you can see much of the data that Google has on you--from your Google+ account to your Gmail account.

Take a few minutes to click through the various services and to review the information Google is storing. Then clear out any data you no longer want associated with your account.

2. Clear Your Google Web History

3. Tweak Your Ads Preferences

4. Liberate Your Data
If you want to remove some (but not all) of your personal data from multiple Google services, head over to Google Takeout, which lets you download a copy of your data from Google Buzz, Circles, Docs, Picasa Web Albums, Gmail contacts, and other tools and services. Get started by logging in to the Google Takeout page.

5. The Nuclear Option: Delete Your Google Account
(more)