New location for the blog! Please bookmark our new site: http://www.fortalicesolutions.com/blog/

Hello dear readers!

I wanted to let you know that we have moved to a new spot.  Same posts that you like but now more integrated with our company webpage.

As always, we'd love to hear from you regarding topics and ideas that you'd like to hear about.

We appreciate all the input over the years and we hope you will join us and follow us at our new location.

http://www.fortalicesolutions.com/blog/

Security Questions...How Do You Answer Them?

May 2011


We have all been presented online with secret questions and passwords.  This is supposed to help a company website know it is really you when you need a password reset.  But, how secret are those answers and should you give a completely different answer to the question to throw off cybercreeps?

We all see the security questions and take them seriously.  We dutifully enter in our Mother’s maiden name when asked.  But where does that information go?  Is it really protected?  Is it really used to validate that it’s you or does a cybercreep just need to know the answer?  With the recent Sony PlayStation breach, they are concerned that your answers to their secret questions might be at risk. Cyber Expert Theresa Payton says that you may want to think about how you answer those secret security questions on various sites.

When you fill out a job or bank application, you need to truthfully answer these questions.  When you are on sites such as email, social networking, or other internet sites you should look for options that make sense.

Tips to Protect Your Secret Questions and Answers:
1. Look first to see if you can create your own questions.  If you can create your own question, that is the best option.
You can make up something such as a question:  “Where I wish I could go right now” and answer “On Vacation with my honey!”.
2. Avoid responding to quizzes online:  A lot of those funny quizzes you can answer online on Facebook or other sites might give away clues that can help guess your password or your answers to security questions
3. Come up with your own code phrase and choose the first letter of each phrase and use numbers or symbols. Example: When answering “your favorite color” create a phrase like, “I love yellow because it reminds me of daisies” and answer with Ilybirm@d!
4. Use completely different answers but make sure it is something you can remember!

Our word for the week is:  PIMP
A play on the phrase, “pimp my ride”, this is geek speak for using words, cool backgrounds, or graphics to embellish your online profile.  An example would be, finding cool backgrounds for your Twitter or blog page.  Pimping your profile means boosting the look and content of your profile online by adding various information or links to your profile to make it stand out.

Web Resources:
McAfee has great tips on security questions and answers as well as the latest scams floating around at www.McAfee.com
Facebook has a great safety page at:  https://www.facebook.com/fbsafety
You can keep up with the latest Facebook scams at:  https://www.facebook.com/Facecrooks?ref=ts

My Day with USASOC at CAPEX

A fortunate group of civilians gets chosen each year to participate in a Capabilities Exercise with the brave men and women in the United States Army Special Operations Command (USASOC).    I was fortunate to be on this year's CAPEX list and drove with great anticipation to attend the event in Fort Bragg N.C.

USASOC oversees Special Operations Forces (SOF).

The current commander of USASOC is an amazing American patriot, Lieutenant General John F. Mulholland, Jr.

I had the opportunity to speak to Mulholland a few different times during the day.  The man is humble, focused on team, a patriot, and no nonsense.  His soldiers spoke about how what the man says in public is truly how the man commands.

CAPEX takes us civilians through a capabilities exercise, and at times you feel as if you are actually in the presence of the X-Men.  The men and women are not just amazing athletes, they have the smarts, instincts, bravery, and resolve to conduct their missions.  Being in their presence for a mere 24 hours inspires me to be more focused on life and work and to, well, just be better.

While going through our activities, I was struck at how often these brave men and women are deployed.  Some go out on 8 month missions, come home for 2-4 months, and rotate back out.  During the 2 months "at home", they are expected to train, do paperwork, stay certified, be "on call", and fit in time with their families.

Our day was action packed.  The goal is to show us the capabilities, so as civilians, we understand how funding is used to support and build capabilities.  I can tell you that when the world needs a hero, you cannot go find a unit of heroes overnight.  Heroes are made over a period of time.  You have to build them over years and help them perfect their trade so they can avoid the need for a hero, or, when the worst happens, you have heroes at the ready.  Without fail, these men and women do not want to be recognized as heroes.  If you want to laud their team, go for it, but they prefer not to be singled out.

The CAPEX methodology uses progressive unconventional warfare scenarios.  They are somewhat based on inevitable or plausible future world events designed to demonstrate Army Special Operations Forces’ diverse capabilities.

I attended a lovely dinner with my new team mates at the Chris' Steak house (not Ruth's Chris, just Chris).  The conversation was spirited and lively.  When we talked about the injured and the fallen, and the needs for their families, even the war hardened men in the room became choked up.  I was not the only one holding back the lump in the throat.

The morning came early and I got ready in my room, anticipating the day.  Stretching.  A few exercises to get ready.  Then board the bus.

As we rode towards the exercise, they started to tell us a little about what to expect.  Then our bus hit a checkpoint and we were boarded by the (exercise) enemy.  The enemy wanted to indoctrinate us and make us work in socialized labor camps.  We got off the bus for our indoctrination.  We were told to turn off our cell phones, face the back of the person in front of us, walk in 2 lines, hands out of pockets.  I saw a man talking on his phone.  Suddenly his feet left the ground and there was shouting.  The man was hauled away screaming for us to help him.  I was yelled at to not look away from the back of the person in front of me.  In my head I am thinking, "This is not right.  We outnumber them.  I don't care if they have guns.  They are beating him."  I know this an exercise and I'm wondering what part of my psychology is being tested.  I asked a soldier later if I "did the right thing" going along and he told me that every situation is different.  Sometimes you fight early on, sometimes you go.  It just depends.

Then, we get to "come out of role" so we can be briefed by Mulholland.  He asks us to do three things:  1.  pray for our troops; 2.  when we see them in uniform, go up and shake their hand, talk to them, thank them; and 3.  support their mission space - with words and budget.  The US Navy Seal instructors have a saying, "The more you sweat in training, the less you bleed in war".  I wear a USMC shirt when I run that exclaims, "Pain is just weakness leaving the body".  USASOC is a good example of both of those mottos.

Back in role, we are told to use the bathrooms quietly for a "comfort break" and to assemble in the hall in 2 lines.  We are then treated to a demonstration by the Black Daggers.  Amazing feats of mind and body over nature.  Reminding me again, heroes are not created overnight.

Back on the bus we are headed to our labor camp.  I'm wondering what my contribution will have to be in this labor camp.  I think to myself, "Maybe I can dig a ditch and then create a secret way out.  How involved will this exercise go?"  But I did not have to think about it for long.  Our brave troops had trained guerrilla fighters and these fighters came to rescue us and help us re-connect with our US troops for repatriation.

Since we kept running into bad guys, the exercise naturally gives us an opportunity to train with guns.  I shot 5 different weapons.  My trainers told me I had missed my calling, under their expert guidance, I shot all targets on first shot with two exceptions.  My first shots on the Glock were low and wide.  My soldier gave me some pointers and suddenly I was rocking the Glock to take down hostiles.  My other challenge was on the sniper target range and a last, far away target on the Scar (Special forces Combat Assault Rifle) gave me a little trouble but after the soldier "doped the scope" and told me to aim the cross hair a little off to the right, bullseye.  Heroes are not created overnight.

Once we were trained on how to man the scopes and the guns, we were ready for the next event, witnessing a hostage rescue.  The soldiers smiled when I walked up to put on my flak jacket.  They kept looking around and found what they announced to be "the smallest one we could find Ma'am".  Then came the helmet which, by the time we fitted it on my head, the strap was quite long.  We stood on top of a structure - visualize sort of a grated structure that creates a see-through roof.  We watched our soldiers break into the house with amazing precision and take out the hostiles while preserving the hostage's life.  I marveled at this.  All soldiers are on separate legs but they they moved along, in separate rooms, in precise synchronization, it was as if they belonged to one being.  Heroes are not created overnight.  After all was clear, the soldiers then showed us how they are trained to create their own tools of trade, including their own explosive devices.

Then, it's off to a village.  We go through a house and see how the soldiers are trained to look for digital devices, home made bomb making, and the subtleties they need to learn.  You cannot just barge through homes looking for things.  A digital device could be taped to back of a carpet.  A tarp that is rolled up but looks a little worn might be scraped for bomb making.  This takes smarts and strategic thinking, not just brawn.

We then meet up with Mulholland and other soldiers at a mess tent and a feast of MREs.  I am actually quite surprised at the breadth of choices.  There is a vegetarian MRE waiting for me at the table.  Nice touch all y'all!  I look at the caloric content on back and this one meal has more calories in it then I eat in a day!  Leaving me to wonder what type of workouts I am really doing?  There are instructions:  eat carbs first.  If you are not hungry enough to eat everything, then eat a little of everything.  My feast is a veggie burger in BBQ sauce, a muffin top, applesauce, and a protein bar.  I ate a little bit of the MRE and marveled at how the soldiers ate them like you and I would eat a meal at home.

Break time is over and now we head to a conflict between the bad guys and our soldiers.  We are standing on roof top and watch a German shepherd pick out a man just walking along.  The dog was trained to look for bomb makers.  He got his man!

Then a gunfight breaks out.  One of my soldiers, a 24 year old that dreamed of being part of special ops since he was 3 years old, is on the ground and in pain. I am ticked! I had just talked to this young man earlier.  He is so self assured.  Entered the US Army right after high school graduation.  I had told him, "Your parents did something right.  They must be so proud!" He said, "Ma'am, I hope you are right.  Frankly, they are pi###d that I joined.  Not sure they are over the shock still.  I have no military in my family."  He smiled, so proud to serve.   This image is in my head as I walk up to my lead soldier and tell my lead soldier I want to help carry our fallen man off the field.  He looks at all 60 inches of me and says, "Are you sure ma'am?  He's going to be very heavy.  You have to get him out of harm's way and then fight the downwind from the 3 helos to load him up."  I smile and say, "I can do this." As I approach my downed soldier, the medic, and 3 men they are a little puzzled as I stand near the feet and say, "Hi there.  Tell me what to do, I want to help carry him to safety."  One man shouts, "Don't drop him ma'am.  If you think you are going to drop him, yell so we can hear you and gently put him down."  I just smile and nod.  Yes, I carried him and did not drop him.  We load him onto the Chinook.  One of my soldiers looks at me and says, "Ma'am, you are a bad a##".  I smile and buckle up into my seat.  I cannot get the lap belt tight so my seat mates start a heave-ho to tighten the belt laughing as we get it tight.  I notice machine gunners in the front windows and ask if we can get a chance to shoot, not allowed.  I ask if we are going to get a chance to rappel out the back of the helo.  Not allowed.

We fly in circles, the machine guns are buzzing.  The gunners are busy.  It sounds like a high pitched drill hum?  Not sure how to define it.   I look across the aisle and give a thumbs up to the person that was sponsoring our group.  Lump back in the throat again.  Great granddaughter, granddaughter, daughter and wife of men that served and the amazing women married to them, I gave thanks to God for the day's experience.  My name made the list at CAPEX.  A gift and a blessing.  What I need to do with that gift and blessing, I am not completely sure.  I will continue praying for the brave men and women that volunteer to serve and their families.  I will pray for God to lead me and guide me on what to do with this amazing experience.

I am sure I am missing many details from the day, such as the demonstration of leaflets dropping to warn the village of upcoming operations.  Or the focus on winning hearts and minds of the countries we are located in and helping them, help themselves.  Or the focus on helping women learn how to have a safer childbirth.  It's not just about might and fight, it's about men and women with hearts that fight for right.

Hooah.

This unit is truly SINE PARI - without equal.

From a leadership perspective, here are the core SOF Truths:

SOF Truths
Humans are more important than Hardware.
Quality is better than Quantity.
Special Operations Forces cannot be mass produced.
Competent Special Operations Forces cannot be created after emergencies occur.
Most Special Operations require non-SOF assistance



For more about USASOC, go to:  http://www.soc.mil/UNS/Fact%20Sheets/Fact%20Sheets.html 

Do You Ever Get The Feeling Like Somebody Is Watching You?

Do you think that R&B singers, Rockwell, Michael and Jermaine Jackson could have predicted that Geico commercials and today's surveillance age would make their song, "Somebody's Watching Me" such a popular ditty well after it's release in 1984?

If you went to the airport, bank, or a store today, you probably expected to be watched and maybe even tracked, while on premises.

But those are the old school ways of being watched.  Now, the smartphone in your pocket could watch you or your laptop webcam can watch you.

Having an emotional reaction?  There's a wristband monitor for that.

Have a lot of old photos that you need to categorize?  Google and Picassa offer a helpful feature, photo tagging, where they auto suggest who your friends might be and potential names of people in photos based on previously tagged photos.  Helpful?  Yes, and a little spooky too.

At the Consumer Electronics Show, Microsoft and Intel showed attendees an in-store digital billboard that memorizes faces.  The memorization helps track products you like.  That is quite a step up from my grocery store loyalty program.

What happens when technology advances fuse the photos your friends tagged you in, with the grocery store digital billboard, and other information?

All of this data collection can be helpful and put to very good use.  Monitors can alert law enforcement of a potential bad guy's whereabouts.  Monitors could help avert a major health issue for example.

However, there are concerns about privacy:
1.  Who is allowed to collect data via sensors?
2.  Should they have permission first or do they need to disclose that sensors are in use?
3.  Are they allowed to bundle that with other information to create individual profiles?
4.  If you are tagged in a photo by a friend, who else can use that tag?  Is that available for searching by anyone that takes a photo of you and wants to profile and track you?
5.  Employers use Facebook and other online searches now to look up candidates - this will transform information available about you


Sources:
"Hello, Big Brother: Digital sensors are watching us", USA Today, January 27, 2011.

Fortalice Welcomes Spring Interns: Michael and Stephanie

Fortalice is pleased to announce that we have brought on two spring interns from Immaculata University.  They will be providing research on key topic areas which will be posted to our company blog.  Please welcome Michael and Stephanie.  They look forward to hearing your feedback!

Stephanie Graziano

Stephanie hails from Ridgefield, Connecticut, which is located on the outskirts of New York State. She is a senior at Immaculata University, studying public relations and graphic design. Throughout her college experience I have been involved in a few clubs and organizations. Stephanie started her sophomore year as a Mac Mentor for the incoming freshman assisting them in their transition into college. The following year she was appointed the universities Communications Committee Chair and is responsible for creating and designing Immaculata University’s clubs and organizations monthly event calendars. After graduation she would like to work in the field of public relations and eventually would love to work as an event planner. She is undecided as to where she wants to relocate after college, she is considering Philadelphia or New York City.

Michael Senatore

Michael Senatore is currently a junior attending Immaculata University and is pursuing a degree in communications.  Michael wants to work in a media broadcasting field, specifically radio after graduation.  Michael has worked various jobs recently such as enumerating for the U.S. Census and overseeing catering sales for the local Boston Market.  Michael is looking forward to the spring 2010 internship with Fortalice Solutions because of the freedom to work on different topics of interest and the invaluable experience it will provide.

An Internet ID for Americans

The Obama Administration is reviewing a plan called the National Strategy for Trusted Identities in Cyberspace.  This would essentially mean crating Internet IDs for all Americans.  An early draft of the plan indicates that the implementation would be handled via the U.S. Commerce Department and not Department of Homeland Security or the National Security Agency.  Experts feel this may be in a nod to privacy concerns.


CBS News quoted the White House Cybersecurity Coordinator, Howard Schmidt, "I don't have to get a credential if I don't want to."  Schmidt has also said there would not be a centralized database and they are counting on the private sector to lead how this is implemented.


U.S. Commerce Secretary, Gary Locke, was also quoted as saying at the Stanford Institute for Economic Policy Research, "We are not talking about a national ID card. We are not talking about a government-controlled system. What we are talking about is enhancing online security and privacy and reducing and perhaps even eliminating the need to memorize a dozen passwords, through creation and use of more trusted digital identities."


Some potential Pros and Cons based on what we know so far:


Pros:
1.  Child  safety experts have long felt that an internet identity system is critical to protecting kids
2.  Trusted identities could be used as another layer of authentication before accessing your personal information online, such as your bank account balance
3.  There might be a way to create an economical, digital certificate that belongs to you, think of it as a password passport so you can have one digital identity vs. many passwords to access information 


Cons:
1.  Large collections of userid/password or other identifying parts of information are targets for cybercriminals
2.  Who do you trust to be the agent that holds your internet identity?
3.  It is not clear what information is part of your identity or follows your internet identity around.  Is it just who you are or what you like to do on the internet?
4.   If this is "optional" and led by the private sector as suggested, we may be creating bureaucracy within the Commerce Department that cannot actually manage this or may not be needed


I did an informal poll and asked people what their thoughts were.  The responses were surprisingly consistent.   Here is a summary:


Overall many had mixed feelings: 
1.  Many respondents feel there is so much anonymity that it allows cybercreeps and cybercriminals to prey on others, however,


2.  Respondents have followed the data privacy breaches that come with centralized ids/passwords both in the private and the public sector and they feel this could create new forms of identity theft.


Bottom line:  Not one person answered and said we must have IDs for All Americans without saying in the next sentence they were concerned about privacy, security, and governance.  


I would love to know your opinion.    Do you see additional pros that I did not mention?  


Sources:


"Obama Wants Internet ID for All Americans", Kevin Parrish, Tom's Guide, January 12, 2011.



"No more passwords? Obama considers Internet ID for Americans in bid to boost web security", David Gardner, Daily Mail Online UK, January 10, 2011.

Read more: http://www.dailymail.co.uk/news/article-1345576/Obama-considers-Internet-ID-Americans-bid-boost-web-security.html#ixzz1B0T2xQyx



"Obama Administration Reportedly Plans to Create Internet ID for All Americans", Fox News, January 8, 2011.

"Who Watches The Watchmen?" When Computers Watch Us Who Watches Them?

When security guards walk their watch and use surveillance TVs they apply acumen, logic, intuition and skill.  When computers man the watch they use face recognition software and behavior patterns.

Recently various prisons sent their correctional officers to West Virginia for a training exercise that was different than previous exercises.  The difference was a new set of watchmen - computers.

This has far reaching opportunities to improve lives but potentially at the cost of your privacy.  That does not mean I am opposed to it.  I want to see open and vigorous debate on the pros and cons of computer surveillance and the safeguards needed to insure the government ,or the cyberbad guys, cannot abuse the technology.

I pulled this quote from a New York Times article written by Steve Lohr:
“Machines will definitely be able to observe us and understand us better,” said Hartmut Neven, a computer scientist and vision expert at Google. “Where that leads is uncertain.”

This is a vision expert from Google admitting that where this leads is uncertain.

Google is the company with the fabulous feature rich Google Maps that also had citizens concerned for their personal privacy.  The same company that has an app called "Goggles" where you can snap a photo on your smartphone and then Goggles will search the internet for matches.  Goggles purposely omitted facial recognition software due to privacy concerns.

If you have Kinect and love it, you are benefitting from the same technology.  As a player, you can wave your hand and the computer sees you through sensors and a digital camera.

There are many wonderful ways to use this technology - preventing theft or assault; searching for bad guys; checking on employees; and proactive protection and detection services.

But, it's hard to know where technology could lead us.  Using geocoding to check in at your favorite spots around town - was that on your radar before you had a smart phone?  The first time you had a videoconference at work did you think to yourself, "Oh no!  Now some kid is going to create Chatroulette?"

One more quote from the New York Times article that drives home the sensitivity and planning that needs to be considered.  When asked why they did not include facial recognition software into Goggles Eric Schmidt said, "“It was just too sensitive, and we didn’t want to go there. You want to avoid enabling stalker behavior.”

Who Watches The Watchmen?

Sources:
"Computers that see you and keep watch over you", Steve Lohr, New York Times, January 1, 2011

The new heist - your conversations and text messages

The good guys strike again.  I have said before that technology functionality typically outpaces the ability to secure it.  Good guys are constantly trying to think like the bad guys to expose weaknesses that put you at risk.

Also, the term "hacker" has been hijacked and is associated with bad guys.  A hacker is someone who knows how to break into a system to override it.  This skill can be used for good, or for evil.  It's at the hands of the person's moral compass.

Two cybersecurity good-guy hackers worked on cell phone vulnerabilities for roughly a year designing ways to think like bad guys to see if they could steal text messages.  They recently accomplished this feat and showed how they could steal text messages from any phone within 20 seconds.  Wow!

The demonstration:
1.  The hacker sends a ghost text message  to a target phone which does NOT show up on the phone
2.  By sending the message to the target phone, they are able to obtain the unique id number on the phone
3.  Once they grab the id number, the recorded phone conversations and texts from that phone
4.  The demonstration took place on the GSM Network which houses roughly 80% of all phones globally. (GSM - Global System for Mobile)

So, is this affordable or scalable?  What was the cost of the technology?  You'll be surprised:
Roughly 36 British Sterling for the 4 Motorola phones ($56.09 US) and some sweat equity in programming.

The good-guy hackers did this as a wake up call to the mobile security industry.  It should also be a wake up call to consumers, businesses, and government agencies.

Great quote from one of the researchers pulled from the Security News Daily:
“This is all a 20-year-old infrastructure, with lots of private data and not a lot of security,” Karsten Nohl.

Sources:
"Cybersecurity Experts Create Program That Steals Text Messages", Matt Liebowtiz, Security News Daily, January 4, 2011.

"GSM Phones Vulnerable to Hacking, Claim Researchers", John Plunkett, The Guardian, December 31, 2010.

New Cybersecurity Coordinator to Assist in Protecting Information

The State Department announced this week that they will create a coordinator for cyber security to help protect classified materials.

The announcement was covered globally and you can see posts in the international newspapers such as the Hindu Daily, Saudi News Today, Telegraph in the UK.

Be Aware - Your Kid May Be a Target for Joining a Botnet

I did a research project and story for WBTV earlier this year about botnet herders and how they run marketing campaigns that lure and entice young people into their lair.  Some savvy kids know exactly what they are partaking in and love the thrill of it.  Some kids think they are doing "work from home" for lucrative pay.  Often, the parents seem to be the last to know.

If you are not sure what a DDoS attack does to someone's website, I love the description provided by Graham Cluley at Sophos.  He says to think of  "15 fat men trying to get through a revolving door at the same time".  Got an image?

There are websites and forums that are encouraging people to join a botnet and they are even kind enough to offer you tools to download so you do not have to even bother with any programming.  This is risky for many reasons, I will highlight a few here:

1.  Why would you trust a tool that was built to attack websites to reside on your computer?  What will it do to your computer?

2.  Legal issues are muddy in cyberspace but we do have legal precedent where people are tried, convicted and paying penalties and/or serving jail time.

Two examples:
a.  A 23 year old man learned this recently as his trial wrapped up and he received a 30 month prison sentence for launch attacks against Bill O'Reilly, Ann Coulter, and Rudy Giuliani.

b.  A 17 year old young man was arrested recently for using "Phenom Booter" which allows gamers to score more points and even block other gamers on the popular game "Call of Duty". The UK has a Computer Misuse Act which he was charged under.



Sources:
"Are DDoS (distributed denial-of-service) attacks against the law?" and "Youth arrested over Call of Duty DDoS attack", Graham Cluley, Sophos NakeSecurity, December 9, 2010.

Link to: story on Botnet Herders for WBTV

If you see something, say something - DHS program

The Department of Homeland Security has created videos of Secretary Napolitano that will play in hotels and retail stores.  They will start with 200+ locations and plan to spread it to 600 across the nation.

According to a Time News Feed article, there is a video for Walmart stores.  The video has Secretary Napolitano asking shoppers:

"If you see something suspicious in the parking lot or in the store, say something immediately. Report suspicious activity to your local police or sheriff. If you need help, ask a Walmart manager for assistance."

If you visit the Mall of America, Amtrack, DC's Metro system, Walmart and other places you may see the video.


Sources:

"Attention, Wal-Mart Shoppers, an Urgent Message from the Department of Homeland Security", Madison Gray, Time News Feed, December 7, 2010.

Spending is up by 9% on Federal Information Security Spending

According to Mr. Chabrow of GovInfoSecurity.com, the Federal Government will spend $13.3 billion on cybersecurity purchases from vendors within the next 5 years.  This equates to an annualized growth of 9% .

By the end of 2010, Federal Government will have purchased Information Security totaling around $8.6 billion.

Protecting information, critical infrastructure and assets is critical.  There has been a 445% increase in cyber threats in the last 4 years which may make a 9% growth rate look like a bargain?

What is your opinion?

Food for thought:
1.  Spending money on security technology does not equal security.
2.  Many security breaches are because of people; technology can help build a safety net when people make mistakes, but investments in people and process are also critical.
3.  How much spending is "enough"?  It is essential that industry continue to provide approaches to help organizations calculate the return on investment.



Sources:


"Fed Infosec Spending Seen Rising By 9% a Year.  Study: U.S. to Earmark $13.3 Billion for Cybersecurity Wares by 2015", Eric Chabrow, Executive Editor, GovInfoSecurity.com, December 1, 2010.

User Surveillance - Free or $25 bucks a head

Government surveillance has to keep up with the times.  You use Google and Yahoo for free, so why does your U.S. Government need to pay when they want to watch you?

Take heart, Microsoft does not charge.

Christopher Soghoian filed a FOIA (Freedom of Information Act) request to look at DEA spending on wiretaps and pen registers.  The wiretaps include phone and internet.  Pen registers show numbers and addresses.

By conducting his research, Mr. Soghoian determined that Microsoft does not charge but Google charges $25 and Yahoo $29 per person.

Most wiretap orders in the U.S. involve narcotics cases which fall under the DEA.

Sources:  "Google charges feds $25 a head for user surveillance, Microsoft charges zilch', Cade Metz, The Register,  November 18, 2010.

A Wake Up Call: Internet Re-Routed by Accident By Way of China

A service provider, IDC China Telecommunication, broadcasted inaccurate web traffic routes for roughly 18 minutes in April.  The inaccurate routes just happened to go by way of China's state-owned "China Telecommunciations".  Essentially sending bits and bytes from across the world through Chinese government controlled servers.

For the U.S., the bits and bytes that went across the servers belonged to U.S. companies, the U.S. government and the U.S. military.  Data from many companies and departments such as the U.S. Senate, NASA, and the U.S. Armed Forces traveled this path.

A commission was formed to investigate and no evidence was found that this was intentional.

There are lots of conspiracy theories but I find these to be counter productive.

The real questions to me are:
1.  What can companies and countries do to "own" their internet traffic supply chain?  Is it even possible or economically feasible?

2.  When accidents like this occur, what should the notification process be?

3.  What governance and assurance process could we (or should we) create to avoid a copy-cat situation that would be on purpose?

4.  How does one know for sure what was an "accident" vs. a test of capabilities?

Sources:
"Report Looks at How China Meddled with the Internet", John Markoff, November 17, 2010.

The Federal Reserve Bank hacked - Secret Service Foils the Plot

Quote of note:
U.S. Attorney Loretta Lynch said this case is an example of how "cybercriminals continue to use their sophistication and skill as hackers to attack our financial and national security sectors."

A cybercriminal managed to hack his way into the Federal Reserve bank's computers and had also stolen 400,000+ credit card numbers.  Luckily for all involved the U.S. Secret Service nabbed the person believed responsible.  The man was arrested at JFK Airport, his name is Lin Mun Poo and he is from Malaysia.

The man was traveling to New York to meet with other cybercriminals.  He planned to sell the information he gained hacking the Federal Reserve and potentially the credit card numbers he had stolen.  His next plan?  He mentioned he was going to hit the ATM machines using the stolen credit card numbers.

During questioning they learned he also compromised the computers at a defense contractor.

The final tally of how bad his compromise of the Federal Reserve may not be known for a while but Federal Reserve officials said he was not able to steal money or data.


Sources:
"Hacker Breaks into Federal Reserve:  Feds", Jonathan Dienst, NBC New York, November 18, 2010.

A Woman Goes to Labor Camp Over Twitter Post - China

A man and his fiancee posted comments on Twitter which mocked Chines protesters who smashed products made by Japan during a demonstration.

The man was carted away first and held for 5 days.  When he returned home, he learned from his fiancee's family that she had been taken away and sentenced to labor camp for one year.

The crime?  "Disturbing Social Stability".

Ms. Cheng, who is 46, also recently supported the imprisoned Nobel Peace Prize Laureate, Liu Xiaobo, on Twitter.

Ms. Cheng's lawyer, Lan Zhixue said, "This is ridiculous and a typical case of censorship jail.  People should not be put in jail due to their sarcastic words."


Sources:
"China Sentences Woman to Labor Camp for Twitter Post", CNN Wire Staff, November 18, 2010.

"Check In" Software Dark Side - Troop Safety Implications

We have covered the fun and the dark side of location software on this blog before.

Examples of Check In Software:  Facebook Places, GoWalla, Foursquare, Loopt - once you check in, I can find you on a map.

Examples of Location Aware Software:  Twitter allows you to turn on your location when you tweet

Benefits:
Locate your friends & family easily
Earn rewards points
Special deals

Dark Side:
Reputation:  You may be broadcasting an image, based on where you check in, that you don't want to broadcast
Stalking:  Young people or women traveling alone open themselves up to potential issues

The US Air Force put out a warning recently to its troops to be careful when they use social media networks because many of the new features show exactly where you are when you use them. This is potentially devastating for U.S. forces in war zones.

To put it into perspective, we have roughly 95,000 troops in Afghanistan and approximately 50,000 in Iraq.

If you have loved ones serving overseas, thank them for their service and then show them this warning and ask them to be safe.

Sources:  "Air Force Warns Troops:  Don't 'Check In' to Wars", Associated Press, November 18, 2010.

U.S. Military Expands Its Cybersecurity Role

A series of new processes and procedures for cybersecurity were put into place this month.  They pave the way to better leverage the Defense Department's cyberwarfare capabilities in case there is an attack on the U.S. networks.

Think about the situation where you have a wildfire raging or a major hurricane.  The President can sign an order that allows FEMA to organize and coordinate recovery efforts using U.S. military forces.  The new procedures adopted for cybersecurity follow similar guidelines.

In this case, DHS would direct the work of the U.S. military.

According to a New York Times article, DHS team will deploy to a military base on Fort Meade, Md where the NSA and the military have instituted the Cyber Command.  A team of experts from Cyber Command will be assigned to the operations center at DHS.

Protection of civil liberties will be managed through a team of lawyers.

Sources:

"Pentagon Will Help Homeland Security Department Fight Domestic Cyberattacks',  Thom Shanker, New York Times, October 20, 2010.

Arab Student Busts the FBI

There is a legal option called the "open field" precedent that allows law enforcement to plant tracking devices on your car without your knowledge or a warrant.

Yasir Afifi, a 20 year old US born citizen is a business marketing student at Mission College in Santa Clara, CA.

He learned after an oil change that there was a tracking device attached to his car.  The garage owner, Mazher Khan, helped him remove it.

Mr. Afifi then posted pictures of the device on Reddit to see what others might say about it.  A person saw his post and told him it was a Cobham Orion Guardian GPS Tracker typically used by U.S. Law Enforcement.

FBI agents, noticing the device no longer working, came to Mr. Afifi's house to ask for the device back.  Mr. Afifi says in conversations with them he got the idea they might have been tracking him 3-6 months.

He gave the device back.

So what is your opinion here?  Many felt that more should have been done to track the attempted "panty bomber" and we are fortunate he was not successful.  This young man's story shows the difficulty we have in balancing freedom and privacy with security.  Where should the needle fall?

I do not pretend to have the answer but believe it lies in open debate and relying on the constitution.

Sources:

"Caught Spying on Student, FBI Demands GPS Tracker Back", Wired Magazine, Kim Zetter, October 7, 2010.



"FBI Gets Busted Spying on Arab-American Student With Tracking Device",  Jason Mick, DailyTech (Blog) - October 8, 2010.

Chitty Chitty Bang Bang We Love You - Flying Humvees and Self Driving Cars

It was a big week for those of that grew up watching Chitty Chitty Bang Bang.

Google announced it is testing self driving cars.  The tests, of all places, are in California.  Why not New York City?

Not to be outdone by Google, the Defense Advance Research Projects Agency (DARPA) announced its Transformer X project - building a Humvee that can fly and land with little human instruction.  Some of the vendors and braintrusts that will come together to build this include:  Carnegie Mellon University, Aurora Flight Services, Lockheed Martin.

Transformer X will move soldiers and supplies.

Sources:

Danger Room, Wired Magazine, "Darpa moves a step closer to its flying Humvee", Spencer Ackerman, September 29, 2010.

Forbes Blog - The Firewall, "Forget Google's Self-Driving Cars.  The Pentagon is Building a Self Flying Humvee, Andy Greenberg, October 13, 2010.