Category Archives: Legal

Australia Introduces Bill Requiring Tech Companies Worldwide to Include Encryption Back Doors in their Software

This could get interesting.  The Australian Telecommunications and other Legislation Amendment (Assistance and Access) Bill 2018 would require tech companies to decrypt communications on request and even require tech companies to build back doors into their software if they don’t already have them.

Of course, like all governments (think GDPR), the bill does not stop at Australia’s border and would, in theory, require companies worldwide to comply.  It is not clear what leverage they have against a company that does not have a legal entity in Australia.

It is not clear how they would get Hamas or ISIS to obey their law, so while the law, if enacted, would weaken protections for law abiding citizens worldwide and would possibly allow them to intercept the communications of dumb terrorists, it will do nothing to protect us against smart terrorists – the ones we really need to be concerned about.

The bill defines a designated communications provider as any foreign or domestic communications providers, device manufacturers, component manufacturers, application providers and traditional carriers and carriage service providers.

That means that everything from your email to a physical device that supports encryption is up for grabs.

In explaining the bill the government mentions companies like Facebook, Instagram, Signal, Telegram and even web site logins.

The bill calls for three levels of hacking to be provided on demand:

  1. Technical assistance request – this one is voluntary.  If a company wants to, it can cooperate.
  2. Technical assistance notice – this one requires a company to decrypt stuff that they have the technical ability to decrypt.
  3. Technical capability notice – this one requires the company to build a new back door into the security of their product and somehow secretly get the user to install the new hacked version of the software.  However, the bill says that this back door cannot remove encryption.  HUH?!

The first two are not a big deal.  The last one is a killer.

Australia’s Minister for Law Enforcement and Cyber Security said that this bill would allow law enforcement to access your data without compromising the security of the network.

The Minister did not want to go anywhere near the words encryption back door, but technically that is the only way to accomplish what they are asking for.  The Minister said that tech companies would be able to provide access without weakening security,  He didn’t suggest how this is possible.  It is not.

He said that we are ensuring we don’t break the encryption systems of the company;  so we are only asking them to do what they are capable of doing.  Item 3 above tells companies to do what is not currently possible, so either he has not read the bill, doesn’t understand the bill or is lying.  Take your pick.   The Minister of Magic is convinced that he can do that without breaking the encryption of the technology companies.

On the other side, the tech companies like Apple, Facebook and Google danced around the conversation giving it a wide berth.  They do have a challenge since they don’t want to appear to support terrorists while, at the same time, they know what the government is asking is impossible without compromising the security and privacy of their customers worldwide.  If they give this capability to Australia, what is their justification for not giving it to China or Russia or any other country that asks?

The Australian Prime Minister, Malcolm Turnbull said “The laws of mathematics are very commendable, but the only law that applies in Australia is the law of Australia.”  Apparently, he thinks the laws of physics are optional in his country.

Currently, this is only a bill, so who knows what will happen, but if passed, companies will need to make some very uncomfortable decisions.

Since Australia is a small market, one option for bold companies would be to block the use of their services to residents of that continent.  Remember that there are fewer people in Australia than, say, in Canada or even in just the sate of Texas and a little more than half the population of California.  That being said, businesses rarely like to turn away customers, even if it means violating their core principals, so it will be interesting to see what companies like Apple choose to do.

Information for this post came from CNet.

 

Facebooktwitterredditlinkedinmailby feather

Complying with GDPR and California’s CCPA – Step 3

For those companies who have customers in California – independent of where the company is located – or are doing business in Europe, you have new privacy regulations to deal with.  While California’s law doesn’t go into effect for another 16 months and it is possible that there will be changes to the law before it goes into effect, it is important to start getting ready for the law because complying with all of the requirements will take a significant effort.  For businesses operating in Europe, you should already be compliant with GDPR.

Step 1 was to create a vendor data inventory (see article here).

Step 2 was to create a vendor cyber risk management program (see article here).

Now, here is step 3.

Step 3 – Map the flow of data between systems and between vendors.

Both CCPA and GDPR have requirement to delete data, stop processing data and provide a copy of data that you have, in a machine readable format if possible, if the user requests it.

You have to do this quickly and you have to track and document what you have done.

If you do not know what data you have, who you share it with and all of the places it may be stored, you are unlikely to be able to comply with these laws and you could wind up getting sued.

Where it is stored, for example, could include on web servers, on internal servers, on workstations and at cloud service providers.

Building and maintaining a map will assist in designing the process of complying with those requests when we get to those steps.

If you need assistance with this, please contact us.

Facebooktwitterredditlinkedinmailby feather

Potential Cyber Attack Target: The 2020 Census

Given Russia’s and China’s seeming insatiable desire to know everything possible about us, it is reasonable that they would try and target the 2020 Census.

Congress has been asking questions about the security of the Census process for the last several years and not getting any answers that they like.  We are getting pretty close to 2020 and still don’t have those comforting answers.

Kevin Smith, Chief Information Officer of the Census Bureau last week said that they are working with Homeland Security and using tools like encryption to protect the data.

He assured the folks at the meeting that security is the Census’s highest priority.

I would hope that accuracy is important too, but maybe not.

Critics of the Census Bureau’s work at the House Oversight Committee and former national security officials are less than persuaded.  In fact they are not convinced that the Census Bureau has implemented even basic cyber security practices.

Given the government’s track record when it comes to cyber security, that could be hard to argue with.

Just think about how well Russia could target citizens in the next election after the Census if they have all of the Census data.

Smith said that he didn’t want to say what they were doing because that would help the adversaries.  True enough.  But he also didn’t say that they had hired hackers from, say, another government agency like the NSA to try and hack in.  Or red team hackers from industry either.

Basically it is give us all of your data and trust us.

For people who are less than confident of the government’s ability to keep anything secret – think F-35, Sea Dragon, Office of Personnel Management and a host of other leaks – and it is hard to argue with them.

Oh, yeah, while Smith is trying to convince us that all is good, they actually haven’t finished writing the software yet, so it is kind of hard to test something that isn’t written yet.  Hopefully they will get it finished before they have to use it.  When was the last time you saw a government project finished on time?  Actually, can’t think of one.

But not to worry;  I am sure the White House has a plan.

Congress is less convinced.

And you should be less convinced as well.

Information for this post came from Cybersecurity 202.

 

Facebooktwitterredditlinkedinmailby feather

Sextortionists Shift Scare Tactics

Sextortion is the act of convincing vulnerable people, often teenagers, to provide the sextortionist with sexually explicit photographs and videos under the threat of releasing other embarrassing material, such nude pictures that may already privately exist in the victim’s email, text messages or private social media.

The attacker does this by convincing the victim that they have hacked into their victims digital life and already have what is there.

99% of the time, this is a complete scam,but scared people do desperate things – like sending (more) sexually explicit material to the attackers in the hopes of getting them to not publicly release material the hackers claim to have.  The hacker asks for a fraction of a bitcoin in payment.

One new tactic – including so called “legitimate” passwords to say, the user’s email account, in the pitch message.  These passwords are often legitimate in the sense that the user used it at one time.  This lends credibility to the pitch and the panicked victim does not think through how the hacker may have gotten that password. The attacker likely got the password from one of the thousands of cyber breaches.

So what should you do?  Well, there is before you get a request and after you get a request from a hacker.

Before, you should practice good cyber hygiene.  Install patches promptly for all software, stay away from sketchy web sites, choose good passwords, etc.

Second, enable two factor authentication – using either a text message to your phone as the second authentication factor, or, better yet, using one of the authenticator apps such as  Facebook authenticator or Google authenticator as the second factor.

For parents, talk with your kids about the risk of taking pictures that if, in the wild, would embarrass themselves or worse.

Finally, parents need to talk to their kids about sharing compromising pictures and videos with others, no matter how  much they think they are in love and no matter how many promises the other person makes.  Understand that kids may be under amazing social pressure to conform – do not underestimate that.

After the fact, kids need to trust their parents, even though they are embarrassed, confused and scared.  Parents need to work beforehand to get kids to understand that this is not something they can deal with by themselves.

Unfortunately, you may need to get legal advice and you should definitely not believe the hackers.  One suggestion:  ask for a sample of the photos that they claim to have.  If the hack is legit – likely it is not – then you need to decide what to do.  The police are going to say that you should go to them and that is probably an OK idea, but unless the hacker is someone you know, I would not get your hopes up.  

On the other hand, it may be someone your child knows.  In that case, you need to understand your options and a lawyer may be helpful.  Releasing so-called revenge porn is a crime in many states.

Certainly prevention is easier than dealing with something after the fact and there are no easy answers as kids, especially, tend to do unexpected things.  Discussing and planning is likely a good idea.

Source: Threatpost.

 

 

Facebooktwitterredditlinkedinmailby feather

Security News Bites For Friday July 6, 2018

NSA Deleting All Call Detail Records (CDRs) Acquired Since 2015

While the NSA is not providing a lot of details about what went wrong, the NSA is saying that it is deleting all CDRs acquired since 2015 because of technical irregularities that resulted in it receiving data that, likely, would be illegal under the current law.  They have been accused of breaking the law many times, but this is one of the few times I can remember that they admitted to breaking the law.

Because, they say, it is infeasible to sort out the legal data from the illegal data, they are deleting lots of data.

Gizmodo, in a bit of editorializing, asked if the “technical irregularities” were related to the “programming errors” the FBI said caused it to wildly inflate the number of encrypted phones that they could not access in various criminal cases.

While admitting that they screwed up is important, what would be better would be to get it right as they hoover up all of this data.  (Source:Gizomodo)

3 Weeks Until NOT SECURE Starts Showing Up In Your Browser

I wrote about this a few months ago, but now it is going to happen, so it is worth a reminder.

For all of those web sites that said that HTTPS was not important or a hassle or costs money, as of July 23, 2018, Google is going to flag your site as NOT SECURE in the address bar, every time someone visits your site.

While some visitors will ignore the warning, others will get freaked, especially if your site is not one that they visit often.

Now is the time – like in the next 21 days – to set up an HTTPS certificate for your web site.

By the way, in typical Google fashion, in a few months they will start presenting a pop up box that visitors will have to click through to say, yes, I know this site is not secure, but I want to go there anyway.  Not a great way to attract new visitors.  (Source: The Register)

Bank of England (BoE) Tells British Banks to be on a War Footing

Bank regulators in the UK have told financial service firms to come up with a detailed plan to restore services after a disruption and to invest in the staff and technology to do so.  Bank Boards and senior management should ASSUME that systems and processes that support the business will be disrupted and focus on backup plans, responses and recovery.

Lyndon Nelson, deputy chief executive of the BoE’s regulator said that firms need to be on a “WAR footing: withstand, absorb, recover.”  This is something the Brits understand from World War II, but which the United States hasn’t quite figured out.

In addition to cyber attacks, the BoE said that firms should be ready for disruptions caused by failed outsourcing and tech breakdowns.

As the U.S. relaxes it’s stress tests, the BoE said that it will stress test banks with “severe, but plausible” scenarios.  The BoE will set a time limit for recovery.

It looks like the UK regulators are way ahead of US regulators, but maybe we can learn from them.  (Source: Bloomberg)

US Firms Hit Another Hurdle in GDPR Compliance

Some people say – and no one has proved the contrary – that GDPR was designed to go after big U.S. firms, while dragging along all the little ones with it.

This week, in honor of July 4th (not really), the European Parliament voted in favor of a resolution that says that if the U.S. does not fulfill it’s obligations under Safe Harbor by September 1 of this year, Europe should suspend the deal.  This is in addition to the attacks on Safe Harbor that are currently going on in the EU court system.

Taken together, U.S. firms doing business AND who transfer data between the E.U. and the U.S. should be rightfully worried.

Some of the obligations that the U.S. is behind on include filling vacant posts on the Privacy and Civil Liberties Oversight Board, which has been basically dormant under the current administration,  the lack of a permanent ombudsman, the impact of the President’s executive orders on immigration, the re-authorization of Section 702 of the FISA act and a number of others.

The current relationship between our president and the EU doesn’t help things.

This could turn into a standoff, or, in the worst case scenario, the E.U. could shut off the data spigot for U.S. companies to legally move data from the E.U. to the U.S. for processing, storage and analysis.  While large companies may (repeat MAY) be able to deal with this, smaller companies will be greatly challenged and some may have to abandon the European market to E.U. based businesses, something that would make a lot of E.U. businesses very happy.

Stay tuned!  (Source: The Register)

 

Facebooktwitterredditlinkedinmailby feather

Do You Care If Someone Is Reading Your Email?

For some people, they don’t really care.  For other people, it is a complete invasion of privacy.

For both groups, it is happening every day.

Apps sometimes ask for permission to read your mail.  It could be to get rid of junk mail or clean your mailbox or many other reasons, but in all cases, you MUST give the app permission in order for it to read your mail.

What is sometimes not clear is that while YOU think that means that the app is reading your email, what the developer thinks is that HE/SHE can read your email.

When the app was installed eons ago, Google popped up a dialog box something like this:

You then clicked on the Allow box and the app started working its magic.

The Wall Street Journal reported earlier this week that, for example, employees of Edison Software read the mail of hundreds of users to build a new feature.   Return Path reportedly read the emails of thousands of users.

The developers say, its in the license agreement that I am sure that you read.  NOT!

Google says Not Our Fault!  You gave the app permission.

To see who you gave those permissions to and take them away, follow these steps from Motherboard:

To see which apps you’ve given email permissions to, you can use Google’s Security Checkup for Gmail. To remove these permissions, go to your Google account settings, select “sign-in and security,” navigate to “apps with account access,” click “manage apps,” and then click on your linked apps and hit “remove access.” (Go to the bottom of the post linked at the end of this blog for step-by-step screenshots illustrating how to do this.)

But this really begs a larger question.

Think about all the apps that you have installed on your iPhone or Android phone (or the two people on the planet that are still running Windows phones).

Did you even think about the permissions that the app asked for when you installed it.  Or if it asked for permissions when you ran it.

Absent doing that, there is no telling what your apps are doing.  Reading your texts, tracking your location or who knows what else.

Of course, if you don’t care, then its not a problem.  Otherwise, you should look at the permissions that you have given the various apps that are installed.  And when you install a new app, consider whether you REALLY want that app or its developers to be reading your mail or tracking your location.

 

Information for this post came from Motherboard.

Facebooktwitterredditlinkedinmailby feather