Chinese Government Dragnet Now Folding In American Social Media Platforms To Silence Dissent

from the multinational-surveillance-startup-seeks-nonconsensual-investment dept

The Chinese government's surveillance of undesirables isn't limited to its borders. It has been working with tech companies to produce an outsider-oriented surveillance platform to keep tabs on visiting students and foreign journalists -- neither of whom might feel particularly obliged to maintain the party line.

The journalist-targeting surveillance system, detailed in a December 2021 Yahoo report, is apparently already mostly a reality. This New York Times report shows the government is already applying its oppression to visitors to the country, hoping to ensure nothing contradicting the official narrative makes its way to the internet airwaves.

Jennifier Chen went back to China to visit her hometown for the Lunar New Year. While she was there, she tweeted from her anonymous account to around 100 followers. Those actions managed to attract the attention of the Chinese government's social media surveillance apparatus.

While living in China, she retweeted news and videos, and occasionally made comments censored on Chinese platforms, like voicing her support for Hong Kong’s protesters and her solidarity with minorities who have been interned.

It wasn’t much, but it was enough for the authorities to go after her. The police knocked on her parents’ door when she was visiting. She said they had summoned her to the station, questioned her and then commanded her to delete her Twitter posts and account. They continued to track her when she went overseas to study, calling her and her mother to ask if Ms. Chen had recently visited any human rights websites.

This isn't completely a new idea for China, which has always sought to suppress anti-government sentiment, no matter where it originates. But the surveillance system behind this tracking of visitors and foreigners is somewhat new, and it utilizes new techniques to harvest social media content from foreign accounts posted to sites blocked in China. Security forces -- including local law enforcement -- keep tabs on the internet, combining offending social media posts with public records and government databases to identify and track surveillance targets.

Content not specifically under the government's jurisdiction can still cause trouble back at home. Anyone associated with the person offending the government will be targeted by efforts to suppress speech.

One video recording, provided by a Chinese student living in Australia, showed how the police in her hometown had summoned her father, called her with his phone and pushed her to remove her Twitter account.

[...]

Three weeks later, they summoned him again. This time, calling her via video chat, they told her to report to the station when she returned to China and asked how much longer her Australian visa was valid. Fearful, she denied owning the Twitter account but filmed the call and kept the account up. A few months later, Twitter suspended it.

This foreign-facing work begins at home. Documents seen by the New York Times show law enforcement agencies are paying up to $1,500 per "investigation" targeting an overseas social media account. Contractors start with easily accessible social media content before digging into voter registries, drivers license databases, and whatever hacked data can be purchased or obtained from dark web data purveyors.

The offending content is subjected to a ranking system that allows the government to determine the person's threat level. Criticism of government officials or attempts to organize protests is considered the biggest threat. Forbidden content like libel or porn is considered the least threatening, although it can also subject people to government harassment. The end result of these surveillance programs manifest themselves as visits from law enforcement, not-so-veiled threats delivered to close relatives, and, in at least one case, the temporary "disappearing" of parents or siblings.

Oppression without borders. That's the Chinese government's goal. Visitors who can't play by the rules will be encouraged to leave. Locals traveling abroad will be reminded they can never escape their homeland's grasp. A surveillance system that operates without constraint or consent rolls on uninterrupted, gaining power and momentum with each new iteration.

Filed Under: china, dissent, free speech, social media, surveillance

Chinese Government Fines Local Car Dealerships For Surveilling While Not Being The Government

from the look,-this-is-something-only-we-can-do dept

The Eleventh Commandment (paraphrased from the original Homer Simpson):

THOU SHALT NOT HORN IN ON THY [GOVERNMENT'S] RACKET

Lots of nations are surveillance states. Very few engage in the depth and breadth of surveillance China does. Whatever any other country does, China has already done, redone, and modded to abstraction. The government not only loves deploying facial recognition tech, but is working on adding things like racial recognition to keep an eye on pesky foreigners and unwanted minorities.

It's one thing if the government does it. It's apparently quite another if private companies try to get in on the Big Brothering.

Many Chinese provinces and cities have explicitly legislated against companies collecting facial recognition information from late last year to early this year, and it appears that a subsidiary of XPeng Motors has ignored those regulations.

An XPeng sales company in Shanghai was recently fined RMB 100,000 ($15,710) by local market regulators for illegally collecting facial recognition information, according to an administrative penalty decision included by data provider Tianyancha.

The irony of forbidding the use of private facial recognition tech is probably lost on the Chinese government. I mean, it doesn't seem to appreciate any form of humor, even grimdark irony like fining a private company for stepping on its surveillance turf.

It may be unfair to single out China for this sort of thing. It happens everywhere. Countries where facial recognition tech has been deployed by governments also have laws in place that forbid the same sort of collection by private companies. In some US states, government use is legal but private use violates local laws. In most of the US, though, it's still the tech Wild West, with both governments and private entities subject to few guidelines or regulation.

But you can't applaud the Chinese government for taking a tough stance on surveillance tech use by private entities. It clearly finds nothing wrong with its pervasive, ever-expanding surveillance state, which makes its regulation of private use extremely hypocritical. And the fact that it works closely with local companies to expand its surveillance opportunities makes its double-standard especially pronounced.

Xpeng, for its part, claims this was all a mistake. It claims a subsidiary purchased the cameras from a third party and deployed them without verifying they complied with local laws. But that doesn't explain how this oversight went unnoticed for nearly six months, resulting in the collection of nearly 450,000 facial images.

But this fact is undeniable: if these cameras had been operated by the government and trained on people doing nothing more than buying cars, it all would have been above-board. The Chinese government can't possibly justify all the surveillance it engages in. It does it because it can. But the far more innocuous collection of information to analyze customer demographics is apparently where the Chinese government draws the line.

Filed Under: china, facial recognition, government, private companies, surveillance

Boston Police Department Used Forfeiture Funds To Hide Purchase Of Surveillance Tech From City Reps

from the cops-are-upstanding-individuals-who-play-by-the-rules dept

Asset forfeiture is just cops going shopping for things they want. The analogy -- one prompted by statements made by Sean McMurty, the head of a county forfeiture unit in New Jersey -- works on multiple levels. McMurtry encouraged cops to seize stuff they wanted or needed.

Mr. McMurtry made it clear that forfeitures were highly contingent on the needs of law enforcement. In New Jersey, the police and prosecutors are allowed to use cars, cash and other seized goods; the rest must be sold at auction. Cellphones and jewelry, Mr. McMurtry said, are not worth the bother. Flat screen televisions, however, “are very popular with the police departments,” he said…

Mr. McMurtry said his handling of a case is sometimes determined by department wish lists. “If you want the car, and you really want to put it in your fleet, let me know — I’ll fight for it,” Mr. McMurtry said, addressing law enforcement officials on the video. “If you don’t let me know that, I’ll try and resolve it real quick through a settlement and get cash for the car, get the tow fee paid off, get some money for it.”

That's direct shopping, utilizing law enforcement's version of the five-finger discount. Take what you think you can use. Convert the rest to cash.

With cash in hand, cops can once again go shopping (albeit without the discount) for things they want. Even better, they can hide this shopping from the public and their oversight, stocking their cupboards with surveillance tech they don't want the public to know about and make purchases that would never be approved by those holding the rest of their purse strings.

We've seen this happen (obviously months or years after the fact thanks to the secretive source of funds) in some of the largest police departments in the country. Both the Chicago and New York City police departments have used secret funds to buy surveillance tech. In Chicago's case, the secret slush fund was powered by forfeitures. In New York, it was a fund the city gave explicit permission to the NYPD to spend as it wanted.

Now it's the Boston Police Department being caught… well, not in the act, but, I guess, after the fact(?), thanks to local journalists.

[I]n 2019 the Boston Police Department bought the device known as a cell site simulator — and tapped a hidden pot of money that kept the purchase out of the public eye.

A WBUR investigation with ProPublica found elected officials and the public were largely kept in the dark when Boston police spent $627,000 on this equipment by dipping into money seized in connection with alleged crimes.

There are plenty of funds to work with. Law enforcement agencies and prosecutors in the state directly profit from forfeitures, encouraging cops to perform more seizures and district attorneys to initiate as many proceedings as possible. What's supposed to be draining organized criminal enterprises of much needed cash is instead a slush fund for both entities. District attorneys get to buy what they want and cops get to do their own, off-the-books shopping to obtain controversial tech.

According to the documents obtained by WBUR and ProPublica, the only interaction the city had with this Stingray purchase was confirming there was enough in the forfeiture fund to buy it. When reached for comment, Boston city reps had no idea the Boston PD had bought itself a cell site simulator.

The Boston PD obviously knows it made this purchase but it isn't talking. No comment from the BPD spokesperson. No comment from any PD official.

And this sort of secrecy will remain normal, at least for the immediate future. There is no mandated reporting on spending of forfeiture funds and nothing forcing the Boston PD to run all purchases past its city oversight, no matter what funds it's spending. A proposed ordinance would change that, requiring explicit permission from the city to purchase surveillance gear but it's not law yet.

But a better solution would be to end the practice of civil asset forfeiture, which allows law enforcement to take money from alleged criminals but without having to actually prove the person formerly in possession of the money was actually engaged in criminal activity. An acceptable stopgap would be to take the seized money out of law enforcement's hands, as state rep Jay Livingstone suggests, and reroute it to a state general fund less likely to be abused or the source of secret purchases.

For now, law enforcement agencies are still free to spend off-the-books forfeiture funds on whatever they want. Until that incentive goes away, forfeiture programs will be still be heavily abused.

Filed Under: asset forfeiture, boston, boston police, civil asset forfeiture, surveillance, transparency

Internal Documents Show Huawei Is Staying On The Cutting Edge Of Oppression Tech

from the great-work-if-you-can-plausibly-deny-it dept

Pretty much exactly a year ago, the Washington Post obtained documents that showed Chinese tech giant Huawei was working with the government to create facial recognition on steroids: a system capable of not just recognizing faces, but also certain ethnicities.

There's only one reason for developing ethnicity recognition in China. The government's war on its Muslim Uighur population continues with no sign of letting up. Huawei's tech would enable the government to identify and track its most undesirable citizens, most likely to find any reason at all to disappear them into the country's many prisons and reeducation camps.

Huawei denied involvement in this project. It did not deny the documents seen by the Washington Post were legitimate, however. Instead, it claimed the documents referred to a test project that had not been deployed. According to its spokesperson, the company would never provide the powerful Chinese government with tools developed for the purpose of targeting Uighur citizens.

It was a pretty weak denial, considering Huawei's disadvantaged position. If it wishes to maintain its healthy market share in China, it will have to comply with the government's demands. That's how it works in China and that's how it's worked for years. And, no matter where they're located, companies don't often spend money on test runs of products they don't intend to sell or deploy in the future. Some testing may be done to see if something is feasible. But if the product works well enough to put on the market (or sell to governments), it will eventually result in real-world applications.

One year later and it's the Washington Post again obtaining documents about Huawei's relationship with the Chinese government. Huawei has suggested it's not working directly with the government to create surveillance gear, claiming it's nothing more than a provider of apolitical networking hardware and software.

But the documents seen by the Post strongly suggest otherwise.

A review by The Washington Post of more than 100 Huawei PowerPoint presentations, many marked “confidential,” suggests that the company has had a broader role in tracking China’s populace than it has acknowledged.

These marketing presentations, posted to a public-facing Huawei website before the company removed them late last year, show Huawei pitching how its technologies can help government authorities identify individuals by voice, monitor political individuals of interest, manage ideological reeducation and labor schedules for prisoners, and help retailers track shoppers using facial recognition.

Pretty disturbing stuff. Also, sadly, pretty normal stuff for the Chinese government, which has shoved thousands of people into hard labor/reeducation camps and subjected its more "free" residents to always-on monitoring of pretty much everything they do.

Huawei, of course, denies this. It told the Post that it "had no knowledge" of the documents referred to in the article. This is a strange statement to make considering the documents were posted on Huawei's site and contain a Huawei watermark.

It also said this:

“Privacy protection is our top priority,” the company said.

Well, clearly it isn't. It's top priority is whatever sells. And it appears to have a lot of products in the pipeline that may prove lucrative if and when it decides these are ready to go live.

The Post reviewed more than 3,000 PowerPoint slides Huawei apparently inadvertently left exposed on its site. The presentations appear to be legitimate and created by the company. However, it's unclear whether these pitches have been made to government agencies. But some of the presentations appear to have been specifically created with the Chinese government in mind.

The Post could not confirm whom the Chinese-language presentations were shown to, or when. Some of the slides showcase surveillance functions specific to police or government agencies, suggesting that Chinese government authorities may have been the intended audience. Many of the PowerPoints have a creation timestamp of Sept. 23, 2014, with the latest modifications to the files made in 2019 or 2020, according to the presentations’ metadata.

That echoing noise you hear is Huawei's claiming ringing hollow. The government's statements in support of Huawei don't actually deny its interest in buying more surveillance gear that can be used to target Uighurs, government critics, and other undesirables. The statement from the government refers only to Huawei's "no back door" agreement, which is really a shot at the US government's blacklisting of Huawei products, rather than a clarification on the products and services discussed in the presentations.

One presentation describes voiceprint analysis developed by Huawei and iFlytek. The latter company has been sanctioned by the US Commerce Department for its human rights violations against the Uighur population. Supposedly, this tech would be used for "national security" purposes -- a purpose heavily exploited by the Chinese government to do everything from imprison Uighur Muslims to imprison protesters fighting its premature takeover of Hong Kong.

Other documents posted by the Post are clearly government-oriented. There's a "smart prison" platform for managing inmates and their reeducation. There's a location tracking system for "political persons of interest." And there's a "Xinjiang surveillance system" that targets the region of the country where most Uighur residents are located.

Huawei's denials are pretty weak in the face of this evidence. It would clearly like to sell surveillance tech to the Chinese government -- tech that will enhance its oppression of minorities and political opponents. That's not going to get it excused from any blacklists, though, so weak denials it is. The Chinese government has long since stopped caring what anyone thinks of it, so it's likely hoping these new and exciting oppression enhancers will be on the market sooner, rather than later.

Filed Under: china, facial recognition, privacy, surveillance
Companies: huawei

Investigation Shows Egyptian Government Hacked A Dissident's Phone Twice, Using Two Different Companies' Malware

from the doublecheck-your-work-I-guess dept

Citizen Lab has uncovered more state-level spying targeting political opponents and journalists. There's a twist to this one, though. One of those targeted had his phone infected by two forms of malware produced by two different companies. And yet another twist: both companies have their roots in Israel, which is home to at least 19 entities that develop phone exploits. Here's the summary from Citizen Lab:

Two Egyptians—exiled politician Ayman Nour and the host of a popular news program (who wishes to remain anonymous)—were hacked with Predator spyware, built and sold by the previously little-known mercenary spyware developer Cytrox.

The phone of Ayman Nour was simultaneously infected with both Cytrox’s Predator and NSO Group’s Pegasus spyware, operated by two different government clients.

Both targets were hacked with Predator in June 2021, and the spyware was able to infect the then-latest version (14.6) of Apple’s iOS operating system using single-click links sent via WhatsApp.

Ayman Nour, the lucky recipient of two different strains of malware, is the head of an opposition group who ran against former Egyptian President Hosni Mubarak. Shortly after Nour's election loss, he was jailed for allegedly forging signatures on petitions -- a move generally recognized as retaliation from his victorious opponent.

The other target is a journalist now in exile who has been openly critical of Egypt's new president.

Unsurprisingly, these attacks have been traced back to the Egyptian government. What's more surprising is that attribution can be made since attackers using these powerful hacking tools usually do a little better covering their tracks.

We attribute the attacks on the two targets to the Egyptian Government with medium-high confidence. We conducted scanning that identified the Egyptian Government as a Cytrox Predator customer, websites used in the hacks of the two targets bore Egyptian themes, and the messages that initiated the hack were sent from Egyptian WhatsApp numbers.

Once again, powerful hacking tools deployed against government critics have been traced back to companies with an Israeli presence. NSO Group has always been located in Israel. Cytrox, however, has moved around, changing both its home base and its name several times to distance itself from its irresponsible malware sales. But the Times of Israel has the receipts.

Cytrox was part of a shadowy alliance of surveillance tech companies known as Intellexa that was formed to compete with NSO Group. Founded in 2019 by a former Israeli military officer and entrepreneur named Tal Dilian, Intellexa includes companies that have run afoul of authorities in various countries for alleged abuses.

Four executives of one such firm, Nexa Technologies, were charged in France this year for “complicity of torture” in Libya while criminal charges were filed against three company executives for “complicity of torture and enforced disappearance” in Egypt. The company allegedly sold spy tech to Libya in 2007 and to Egypt in 2014.

It appears there's a healthy market for powerful phone exploits. But the market consists of unhealthy governments more interested in tracking and surveilling critics than engaging in counterterrorism or investigating serious criminal activity. NSO claims it only sells malware for those more acceptable reasons. Cytrox/Intellexa has never offered any such assurances, possibly because it has an international rap sheet that would immediately undercut its assertions.

It's an ugly world out there. Plenty of companies operating out of free countries are willing to sell exploits to governments they know will abuse them to commit human rights violations. If NSO Group shuts down its malware arm, it won't make things safer for dissidents, government critics, and journalists. There are plenty of companies willing to fill this void. And they're very good about obscuring who they are and what they do.

But one thing is undeniable: malware merchants are enabling abusive governments and it's going to take more than a few sanctions and fines to prevent this from happening in the future. So far, the countries these companies call home have done little about these residents who are making the world a worse place to live. That has to change. And it appears it's going to be investigative journalists and security researchers applying the pressure through investigations and exposés. Governments need to stop abdicating their responsibilities and allowing private citizens with finite resources and zero power to do their work for them.

Filed Under: ayman nour, dissident, egypt, hacking, malware, pegasus, predator, spyware, surveillance
Companies: cytox, nso group

AI Surveillance Of Prison Calls Scooping Up Millions Of Conversations, Producing Little Actionable Info

from the everything-scales-but-the-effectiveness dept

There's not much privacy in prison. And there's going to be even less. Inmates are warned that all calls are monitored. How often this goal is achieved is impossible to say, but tech advances are making it a reality. Attorney-client privilege is supposed to be respected in prisons, but we've already seen instances where it hasn't been, thanks to automated monitoring equipment.

What's already been a problem is going to get worse. AI is doing the eavesdropping, and it's far from perfect. A new report from Thomson Reuters shows prisons are investing heavily in automation to ensure as many conversations as possible originating from prisoners are recorded, captured, and mined for useful info.

When the sheriff in Suffolk County, New York, requested $700,000 from the U.S. government for an artificial intelligence system to eavesdrop on prison phone conversations, his office called it a key tool in fighting gang-related and violent crime.

But the county jail ended up listening to calls involving a much wider range of subjects - scanning as many as 600,000 minutes per month, according to public records from the county obtained by the Thomson Reuters Foundation.

There's the stated intent: "gang-related and violent crime." Then there's the actual use. Utilizing a scanning system powered by Amazon's speech-to-text tech, Suffolk County jailers utilized keyword searches to flag conversations for further examination. Some keywords were questionable, like the Spanish word "mara," which can refer to a gang or just a group of friends. But it wasn't just serious criminal activity being flagged.

Sheriff's deputies in Suffolk County also circulated a regular intelligence brief of prisoners the system flagged for illegally collecting unemployment benefits while in the jail.

Then there are the seriously concerning keyword scans deployed elsewhere by prisons and jails using similar tech.

Emails and contracts from eight states show the tool is used to scan a wide range of calls, for example conversations involving mention of the Spanish word for lawyer or accusations that detention facilities were covering up COVID-19 outbreaks.

If the conversations including terms for lawyer were flagged as potentially off-limits, then the tech is being used responsibly. If those were flagged for further review, that's a huge problem. So is the flagging of COVID-related conversations, which could indicate prisoners were being flagged for complaints and possibly retaliated against for informing others about unsafe conditions. While some use was related to containing outbreaks (as is detailed in the documents obtained by Reuters), there are also indications that information about prison conditions was gathered for less-than-idealistic reasons.

In Calhoun County, Alabama, prison authorities used Verus to identify phone calls in which prisoners vouched for the cleanliness of the facility, looking for potential ammunition to fight lawsuits, email records show.

Is this really a good use for tech purchased with the stated intent that it would be used to combat criminal activity behind bars? And those flagging calls for complaints about conditions seem intent on thwarting whistleblowers or heading off lawsuits by subjecting complainants to retaliatory activity.

A lot of what's happening here appears to be mission creep. While the systems have shown some effectiveness in obtaining information about criminal activity and identifying prisoners who engaged in self-harm or are suicide risks, a lot of what's being flagged appears to be the result of opportunism. The legal justification is already there: all calls are monitored. If so, why not use the systems to flag anything of interest to prison officials, even if it's far outside of the stated scope of the surveillance?

Why not, indeed. That's how the system used in Suffolk County scooped up 2.5 million phone calls in the space of one year but returned only 96 "actionable intelligence reports." Not every call is worth listening to, but now prison facilities have the luxury of listening to all of them and no reason not to.

Filed Under: attorney-client privilege, phone calls, prisons, recording phone calls, surveillance

Proctorio's Anti-Cheating Software Exposes Students To Hackers Say Dutch Education Officials

from the well-duh-[but-in-Dutch] dept

Spyware is spyware. It doesn't matter who's deploying it. Proctorio -- the snitchware maker that helps schools keep tabs on distance learners -- has made headlines here for abusing the DMCA to silence security researchers who found flaws in the remote surveillance software. Bogus claims were filed and Proctorio is currently being sued by the EFF and one target of its censorial bullshit.

It was only a matter of time before someone took advantage of the omnipresent anti-cheat spyware, which takes control of students' cameras and microphones to keep an eye on them as well as track their internet activity to ensure they aren't searching the internet to find answers to tests. That's a lot of centralized power enabled by expansive, mandatory permissions. It was bound to be exploited sooner or later. And sooner was the most likely outcome, considering Proctorio sometimes seems more interested in silencing critics than addressing the harms its software poses.

RTL News reports that students in the Netherlands may have been working with compromised computers for months, thanks to exploitation of Proctorio's anti-cheat software.

Many tens of thousands of Dutch students have been easily hacked for months because their education forced them to install insecure anti-cheat software. Malicious persons could therefore gain access to their online accounts and peek in with their webcam.

This might jeopardize Proctorio's contract with schools in the country which, all things considered, will harm no one but Proctorio. Pretty tough to find any tears to shed for a company that greets reports of security flaws with DMCA notices and legal threats. But students in the Netherlands aren't happy with the tradeoff educators are making to reduce cheating.

"It is shocking that we were so easily hacked by Proctorio," said Manish Jhinkoe-Rai, president of the student council of the University of Amsterdam (UvA). The National Student Union (LSVb) wants the online privacy and security of students to be better protected: "And that we are no longer forced to use this kind of unsafe software", says LSVb chairperson Ama Boahene.

Well, it's not all that shocking. This was an inevitability. A large user base, software with extensive permissions, students prevented from taking steps to secure their devices due to the demands of school and anti-cheat software, a company that retaliates against security researchers… it's all a malicious hacker's dream come true.

What's not clear from this report is how many students were hacked or what damage hackers may have caused beyond surreptitiously surveilling students and their online activities. But there's a lot that's tempting to hackers. Here's how the setup works when students are taking exams, according to a Netherlands-based computer science Ph.D candidate.

Before you are allowed into the exam, Proctorio will have you enable your webcam and microphone. It closes all open tabs in the browser. It also uses the screen-sharing functionality in Chromium, originally built for video calls, to record your screen. You will have to show a photo ID to the webcam to identify yourself. Following this, you will be asked to take your webcam and film your entire room to prove you are alone, that your desk is clean and that you haven’t stuck sticky notes out of view of the webcam. After this, you can take the exam, during which the microphone and webcam will continue to record you.

Even when Proctorio is not in active use, it still provides an attack vector for malicious hackers.

[The Proctorio hack] is a so-called universal cross-site scripting attack (UXSS). In such an attack, a criminal can execute code on every website you visit and, for example, intercept passwords or modify the recipient of a money transfer. The leak is usually in the browser or a browser plugin you are using.

Experts suggest students uninstall the Proctorio extension when not needed and reinstall prior to tests. But students using school-supplied devices may not have that option, which means the attack vector is always present, even if it isn't currently active.

To its credit, Proctorio has made some efforts to patch reported flaws. But it continues to demand an insane amount of access to students' computers. And for what ends? To ensure a few people won't cheat on tests? The tradeoff in security seems completely out of whack. Hackers could leverage Proctorio to snoop on students' online activities, harvest passwords from accounts, grab photos of their IDs, and engage in surreptitious recordings.

Students in the Netherlands are demanding a return to open book tests using physical books. Due to COVID-related complications, in-person testing is limited. But allowing students to work with offline testing materials would shut down this attack vector. If the end result is a few cheaters getting away with cheating, that would make COVID-affected schooling no different than the schooling that preceded it.

Even if more students would cheat on tests given the opportunity presented by distance learning, what's the loss to society? If the information is important enough students will have trouble proceeding in life after a couple of years of testing. The only losers are the students who failed to learn. If they move through life without difficulty even without mastering this information, it only raises questions about the value of this information, rather than the students' unwillingness to sacrifice time and energy studying information with extremely limited value.

Proctorio is perhaps no more intrusive than it has to be to achieve its stated aims. But that's not a vindication of its demands from users and their devices. It's an indictment. If students can be trusted with distance learning but not distance testing, the educational system needs to do more than allow a third-party to create enticing, hackable holes for malicious people to exploit.

Filed Under: cheating, hacking, spyware, students, surveillance
Companies: proctorio

Facebook Blocks Seven Malware Purveyors, Deletes Hundreds Of Accounts, Notifies 50,000 Potential Hacking Targets

from the move-fast-and-break-oppressors dept

Thanks to the ongoing onslaught of negative press involving malware merchants like Israel's NSO Group, tech companies whose devices and platforms have been used to deploy exploits targeting journalists, activists, and religious leaders are punching back. You're a human rights abuser with high-dollar spyware at your disposal? Too bad. Ask for a refund, I guess.

Apple sued NSO Group for targeting iPhone users a few weeks ago. It also began notifying users who were targeted by NSO spyware, potentially nullifying further surveillance efforts by unfriendly nation-states.

But before Apple got in on the anti-NSO action, Facebook sued the company for using WhatsApp to deploy malware. Both lawsuits contain some troubling implications for the CFAA -- something that could pose future problems for researchers who scrape data and security researchers who search for security flaws. The unintended consequences of this litigation have yet to be seen, but it's enough to justify holding your applause until the lawsuits have run their course.

Denying state actors the fruits of their purchased spyware labor is now the name of the game, something that benefits everyone. Facebook (now Meta) has just thrown a decently-sized tech wrench into the malware works of an unknown number of entities.

Facebook has disrupted the operations of seven different spyware-making companies, blocking their Internet infrastructure, sending cease and desist letters, and banning them from its platform.

"As a result of our months-long investigation, we took action against seven different surveillance-for-hire entities to disrupt their ability to use their digital infrastructure to abuse social media platforms and enable surveillance of people across the internet," said Director of Threat Disruption David Agranovich and Head of Cyber Espionage Investigations Mike Dvilyanski.

"These surveillance providers are based in China, Israel, India, and North Macedonia. They targeted people in over 100 countries around the world on behalf of their clients."

Seven companies. 100 countries. 1,500 Facebook and Instagram accounts. 50,000 potential targets notified. That's going to hurt paying customers of companies like NSO Group and its competition, most of which have yet to obtain the international infamy NSO has.

The full report [PDF] from Meta lists the companies ejected in this surveillance-for-hire purge. And there's a common strain running through the list, one that's going to cause even more problems for a government already dealing with blowback for running interference for a company selling spy tools to a long list of human rights violators.

We removed about 200 accounts which were operated by Cobwebs [Technologies] and its customers worldwide. This firm was founded in Israel with offices in the United States and sells access to its platform that enables reconnaissance across the internet, including Facebook, Instagram, WhatsApp, Twitter, Flickr, public websites and “dark web” sites.

[...]

We removed about 100 accounts on Facebook and Instagram which were linked to Cognyte (formerly known as WebintPro) and its customers. This firm is based in Israel and sells access to its platform which enables managing fake accounts across social media platforms including Facebook, Instagram, Twitter, YouTube, and VKontakte (VK), and other websites to social-engineer people and collect data.

[...]

We removed about 300 Facebook and Instagram accounts linked to Black Cube, an Israeli-based firm with offices in the UK, Israel and Spain. It provides surveillance services that include social engineering and intelligence gathering.

[...]

We removed about 100 Facebook accounts linked to Bluehawk, a firm based in Israel with offices in the UK and the US. We collaborated on this investigation with The Daily Beast who had identified a subset of this activity leading us to uncover the full cluster and who’s behind it earlier this year.

[...]

We removed about 400 Facebook accounts, the vast majority of which were inactive for years, linked to BellTroX and used for reconnaissance, social engineering and to send malicious links. BellTroX is based in India and sells what’s known as “hacking for hire” services…

[...]

We removed about 300 accounts on Facebook and Instagram linked to Cytrox. This North Macedonian company develops exploits and sells surveillance tools and malware that enable its clients to compromise iOS and Android devices…

[...]

We removed about 100 Facebook and Instagram accounts linked to an unidentified entity in China responsible for developing surveillanceware for Android, iOS, Windows, and also Linux, Mac OS X, and Solaris operating systems. It also engaged in reconnaissance and social engineering activity before delivering malicious payload to its targets.

Four of the seven entities identified and blocked call Israel home. Cytrox also has links to Israel as both Citizen Lab and the Times of Israel have reported. Cytrox is now part of a spyware conglomerate that has been criminally charged for human rights violations.

Israel has a malware problem. And the government can't claim it was unaware of these companies and their selling of tools to authoritarians and human rights violators. The government was actively involved in brokering some of these deals.

The customers for these products, however, are far more varied. Cobwebs products were observed "frequently targeting" activists and opposition parties in Hong Kong and Mexico. But its customer base includes entities in Bangladesh, New Zealand, Poland, Saudi Arabia, and… the United States.

The list compiled by Meta shows malware firms are more than happy to sell to governments that like targeting critics and opponents, rather than criminals and terrorists. Serbia, Morocco, Mexico, China, Qatar, Saudi Arabia, Egypt, Oman, the Philippines, and Myanmar make this list.

But it's not just the blocking. It's the notification. And there's plenty of that.

We also alerted around 50,000 people who we believe were targeted by these malicious activities worldwide, using the alert system we launched in 2015. We recently updated it to provide people with more granular details about the types of targeting and the actor behind it so they can take steps to protect their accounts, depending on the phase of the surveillance attack chain we detect in each case.

That's a lot of disrupted surveillance efforts. State actors are paying good money for these exploits and now they're facing more resistance than ever from the private sector being used to transport malware to targets. That's a lot of money and a lot of surveillance being undone. Governments buying exploits won't be happy but so what. There's no reason to assume that just because it's a government agency doing the targeting there's any legitimacy to the hacking efforts. This is the way it should be -- platforms and device makers protecting customers and users against hacking attempts, no matter the origin of the attacks. The world needs more of this because authoritarians and human rights abusers deserve to have their oppressive efforts thwarted.

Filed Under: hacking, malware, surveillance
Companies: facebook

After Weeks Of Reports Of Misuse Of Its Exploits, NSO Group Considering Shutting Down Its Malware Service

from the if-you-can't-beat-'em,-quit dept

RIP NSO Group. Cause of death: investigative reporting.

It's probably too early to celebrate the demise of Israel's most infamous export, but it's looking like NSO is running out of options. The Israeli government recently (and drastically) reduced the number of approved governments NSO could sell its powerful Pegasus malware to, trimming down the permitted list from 102 countries to 37. That followed blacklisting by the US Commerce Department, which means American tech companies aren't permitted to sell exploits, hardware, or devices to NSO without securing a waiver they're unlikely to receive.

That followed weeks of revelations about how NSO customers were using its Pegasus spyware. According to multiple reports, governments and the occasional king were using NSO tools to target journalists, dissidents, government critics, religious leaders, US State Department employees, an ex-wife, an ex-wife's lawyer, and government officials.

I guess when it's no longer feasible to sell spyware to authoritarians and human rights violators, the only option is to default on your debts and shut down your most toxic product.

The NSO Group, the controversial technology company recently blacklisted by the United States over the illegal use of its spyware, is reportedly considering shutting down its Pegasus operation and selling the entire company to an American investment fund, Bloomberg reported on Monday.

The report, citing officials involved in the talks, said that there are two potential suitors for the embattled company, who have discussed a potential takeover and the shuttering of Pegasus unit, in exchange for a $200 million injection of capital and a pivot into strictly defensive cybersecurity services.

NSO needs the cash. It has millions in debt and whatever plans it had for paying it back have been severely curtailed with its blacklisting by the US government and its reduced customer base.

The U.S. restrictions put added pressure on NSO, which needs to pay back about $450 million in debt, just two years after a management buyout that valued the company at about $1 billion. Moody’s Investors Service said last month there’s an increasing risk the company will violate the terms of its loans.

The problem with ditching Pegasus is that it's NSO's most valuable product. This premium phone exploit accounts for half of NSO's business. Fifty percent of NSO is worth far less than the $200 million the company is hoping to obtain. Now that it's blacklisted, it can't purchase exploits or devices from the US, which means it will be extremely difficult to develop new hacking tools worth selling. There may be a market for defensive tech, but that's likely to be far less popular with foreign governments than zero-click exploits that can be deployed remotely.

Here's how it looks for NSO on the home front, as reported by Israeli newspaper Haaretz:

Defense officials think the sanctions could soon bring about the company’s collapse and a shutdown of its operations. The company depends upon constant innovation: It’s one Apple or Android cellphone update away from the failure of its products. If it doesn’t manage to hold onto the best personnel in the world, the kind who would continue to find vulnerabilities in the operating systems, they won’t have a product.

Senior officials have told Haaretz that the move by the United States has totally paralyzed the company’s future operations. “They’re not able to buy a pen at a Walmart store,” the officials quipped. If an American company wants to sell them products, it needs a special permit.

According to this report, the Israeli government believes its local tech companies are being unfairly targeted by US sanctions. The country is home to 19 companies developing offensive exploits, but so far the US has only blacklisted NSO Group and Candiru. The government appears to have been caught off guard by the sanctions handed down by the Biden Administration after having received much more support and cooperation from the previous president, Donald Trump.

The Israeli government may be reeling a bit from the last few months of negative press targeting NSO, but it really can't blame anyone else for the mess the company is in or the sanctions that have greeted the steady stream of reporting about misuse of its Pegasus spyware. It was directly involved with the sale of the malware to a number of known human rights abusers.

[I]n Israel it is acknowledged that oversight of contracts NSO entered into was too lax. The Netanyahu government gladly traded in spyware, with the Mossad reportedly assisting in the initial mediation of the transactions.

[...]

The company’s sales momentum over the past decade is closely linked to the diplomatic and intelligence-related steps that Netanyahu took, which improved relations with countries in various parts of the world, and where NSO’s technology often served as an asset that brought Israel to the table for the improvement of ties. In the past, Netanyahu ordered the defense establishment to advance offensive cybertechnology deals, and it appears he preferred that overly energetic oversight not be imposed on the deals or the parties to them.

Welp. The shitbirds have come home to roost, as the saying goes.

And if the Israeli government thinks the US Commerce Department overreacted, it won't be pleased with the latest demands from members of the federal government.

More than a dozen Democratic lawmakers have called on the Biden administration to sanction four cyber surveillance firms for "enabling human rights abuses" by "selling powerful surveillance technology to authoritarian governments."

The letter, led by Sen. Ron Wyden of Oregon and House Intelligence Chairman Adam Schiff of California, asks the Treasury Department to sanction Israeli spyware vendor NSO Group, Emirati cybersecurity firm DarkMatter and European surveillance firms Nexa Technologies and Trovicor -- as well as the firms' top executives.

This would go beyond the blacklisting already in place. The Global Magnitsky Human Rights Accountability Act allows the US president to sanction people and companies for human rights abuses. In this case, the abuses would have been aided and abetted by NSO, rather than participated in directly by NSO execs or employees. While it normally is used to sanction government officials, it has been used in the past to sanction private parties with ties to human rights abusers.

Whether or not sanctions ever arrive, it appears NSO's days are numbered. But there are still plenty of malware purveyors out there. And there are plenty of authoritarians willing to pay top dollar for spy tech that enables them to more efficiently oppress their countries' populations. The exploit market will remain lively. It just may be that one of the most recognizable names in the business will no longer be in business.

Filed Under: exploits, malware, pegasus, spyware, surveillance
Companies: nso group

How China Uses Western Influencers As Pawns In Its Propaganda War

from the chaos-and-suspicion dept

China's efforts to subdue the turkic-speaking Uyghurs in the Xinjiang region will be familiar to Techdirt readers. International awareness is increasing, too, not least thanks to the diplomatic boycott of the Beijing Winter Olympics that the US and other countries have announced. That presents an interesting challenge to the Chinese authorities: how to counter the growing evidence of pervasive surveillance and large-scale arrests of the Uyghurs. Using official outlets like China's Global Times is one way, but its articles are easily dismissed as crude propaganda. Much more interesting is the approach described by the New York Times, which looks at how China is helping Western YouTubers to report on the country:

The videos have a casual, homespun feel. But on the other side of the camera often stands a large apparatus of government organizers, state-controlled news media and other official amplifiers -- all part of the Chinese government's widening attempts to spread pro-Beijing messages around the planet.

State-run news outlets and local governments have organized and funded pro-Beijing influencers' travel, according to government documents and the creators themselves. They have paid or offered to pay the creators. They have generated lucrative traffic for the influencers by sharing videos with millions of followers on YouTube, Twitter and Facebook.

Typically, the Chinese government support comes in the form of free organized trips around China, particularly in Xinjiang. By showing the influencers a carefully sanitized image of life in the country, the authorities don't need to worry about negative stories. They simply make it easy for the YouTubers to present images of jolly peasants and happy city-dwellers, because that's all they are allowed to see.

One of the authors of the New York Times piece, Paul Mozur, noted on Twitter another important way that the authorities are able to help their influencer guests. Once produced, the China-friendly videos are boosted massively by state media and diplomatic Facebook and Twitter accounts:

One video by Israeli influencer Raz Gal-Or portraying Xinjiang as "totally normal" was shared by 35 government connected accounts with a total of 400 million followers. Many were Chinese embassy Facebook accounts, which posted about the video in numerous languages.

A new report from the Australian Strategic Policy Institute, "Borrowing mouths to speak on Xinjiang", has some more statistics on this practice:

Our data collection has found that, between January 2020 and August 2021, 156 Chinese state-controlled accounts on US-based social media platforms have published at least 546 Facebook posts, Twitter posts and shared articles from [China Global Television Network], Global Times, Xinhua or China Daily websites that have amplified Xinjiang-related social media content from 13 influencer accounts. More than 50% of that activity occurred on Facebook.

Mozur says that the use of Western influencers in this way also allows employees of Beijing-controlled media, like the journalist Li Jingjing, to present themselves as independent YouTubers. On Twitter, however, she is labeled as "China state-affiliated media". The Australian Strategic Policy Institute sees this as part of a larger problem (pdf):

labelling schemes adopted by some video-sharing and social media platforms to identify state-affiliated accounts are inconsistently applied to media outlets and journalists working for those outlets. In addition, few platforms appear to have clear policies on content from online influencers or vloggers whose content may be facilitated by state-affiliated media, through sponsored trips, for example.

According to Mozur, China's state broadcaster is actively looking for more influencers, offering bonuses and publicity for those who sign up. In the US, China's consulate general is paying $300,000 to a firm to recruit influencers for the Winter Olympics, ranging from Celebrity Influencers with millions of Instagram or TikTok followers, to Nano Influencers, with merely a few thousand. The ultimate goal of deploying these alternative voices is not to disprove negative stories appearing in Western media, but something arguably worse, as the New York Times report explains:

"China is the new super-abuser that has arrived in global social media," said Eric Liu, a former content moderator for Chinese social media. "The goal is not to win, but to cause chaos and suspicion until there is no real truth."

As if we needed any more of that…

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: china, influencers, propaganda, social media, surveillance, uyghurs