Israeli Government Pushes National Biometric Database With Claims Of Security Superiority Nobody Thinks Are True

from the painting-a-target dept

There has been something of a push in recent years in different countries to build biometric databases of varying degrees. These efforts are typically marred by pushback and controversy, with countries like Argentina using these databases in order to have law enforcement chill its citizenry from protests in the streets, with our very own FBI rolling out its own biometric database that lacked the promised privacy oversight with which it had been billed. Despite the fact that you can nearly set your watch to the speed with which such lists will be abused, these previous efforts at least paid lip-service to the notion that the databases would focus only on criminals in their respective countries.

That isn't the case for the decree made by Israeli Interior Minister Aryeh Deri about the plans for a new compulsory biometric database for all Israeli citizens.

Interior Minister Aryeh Deri sparked controversy Wednesday when he announced that all Israelis must join the national biometric database. Deri said everyone would be required to upgrade their ID cards and passports to "smart cards" embedded with their personal biometric characteristics, including fingerprints. The pilot biometric database was launched about three years ago and caused a public uproar, with many said they would refuse to be included.

It's amazing how things can change. The Israeli government really ought to know better than to create a database of its citizens. One might refer to it as a registration of Jewish people with the government, in a way. I seem to recall others in history creating lists of Jews and it didn't work out all that well.

Now, nobody would suggest that the Israeli government would want to persecute its own people a la Nazi Germany. Nor do we need to Godwin ourselves in this post so readily. The problem is that creating this database is akin to painting a target on the backs of the Jewish people, a people already in the crosshairs of many of their neighbors. To this, Deri and his office have responded with claims of how necessary the database is and how sure they are that they can secure it against outside hacking by terrorist groups. Few are buying the latter claim.

The Digital Rights Movement, which has been waging a campaign against the database since its inception, announced that it will file a High Court of Justice petition against the move. The group has launched a crowdfunding campaign to finance the legal battle.

"Only in Israel will it become possible to collect the fingerprints of every citizen," the group said in a statement. "Contrary to the opinions of 74 of the best information security and encryption experts in Israel, the interior minister is spinning a tall tale about how secure the database is and that it cannot be hacked -- but he is wrong. It is not for nothing that 70% of the public has refused to be included in this database."

Dr. Tehilla Shwartz Altshuler of the Israel Democracy Institute warned that "this is a problematic decision that subjects highly sensitive information to danger. Having any kind of biometric database endangers our privacy as a whole. Studies in Israel and abroad have proved unequivocally that such a database will be breached and that officials with access to it will abuse it."

Whatever use law enforcement might have in such a database surely is mitigated by the potential danger from both outside groups getting access to it or by internal abuse within the Israeli government. As the quote aboves suggests, these sorts of lists are practically begging to be abused and/or targeted. Again, I would think the goverment of Israel would be especially sensitive to the dangers here. Its citizens certainly are.

Filed Under: biometrics, israel, security

Not Even Your Light Bulbs Are Safe From Shitty Internet Of Things Security

from the apocalypse-in-a-box dept

We've discussed at length how the rush to market by Internet of Things companies and evangelists with nary a thought toward security has left us all immeasurably less safe. Whether it's smart door locks that are easily bypassed, smart vehicles that can be remotely controlled, or smart electrical outlets being used as the cornerstone of nasty new botnets, we're effectively all living in a barely-believable dystopian novel at this point. And as we've noted repeatedly, this would all be kind of funny if it weren't for the fact that inevitably, these vulnerabilities are going to result in very real, and potentially massive human deaths.

And each week it seems like we're bearing witness to a new, deeper and uglier chapter in the saga of the internet of not-remotely-secure things. This week, it's the revelation by hackers that they've found another way to exploit a weakness in the Touchlink aspect of the ZigBee Light Link system at the heart of Phillips' Hue "smart" light bulbs. More specifically, hackers have demonstrated a way to control every smart bulb in your home by pushing malicious firmware updates, without setting a foot inside of the residence:

"The researchers focused on the Philips Hue smart light bulb and found that the wireless flaw could allow hackers to take control of the light bulbs, according to researchers at the Weizmann Institute of Science near Tel Aviv and Dalhousie University in Halifax, Canada. That may not sound like a big deal. But imagine thousands or even hundreds of thousands of internet-connected devices in close proximity. Malware created by hackers could be spread like a pathogen among the devices by compromising just one of them."

As we've been noting, these compromised devices are then being used in some of the biggest and most potent denial-of-service attacks we've ever seen. According to the full research paper (pdf), the attack can be launched either via war driving (sitting in a vehicle) or by drone (in their test demonstration they were 70 meters, or 229.7 feet, away). More frighteningly, perhaps, the researchers posit that they could damage entire cities via this method using "readily available equipment costing a few hundred dollars" to forge "lightbulb worms":

"In this paper we describe a new type of threat in which adjacent IoT devices will infect each other with a worm that will spread explosively over large areas in a kind of nuclear chain reaction, provided that the density of compatible IoT devices exceeds a certain critical mass. In particular, we developed and verified such an infection using the popular Philips Hue smart lamps as a platform. The worm spreads by jumping directly from one lamp to its neighbors, using only their built-in ZigBee wireless connectivity and their physical proximity. The attack can start by plugging in a single infected bulb anywhere in the city, and then catastrophically spread everywhere within minutes, enabling the attacker to turn all the city lights on or off, permanently brick them, or exploit them in a massive DDOS attack"

Comforting. The report notes that the attack is thanks, in part, to the fact that while the ZLL Touchlink Commission protocol does use encryption to encode the "Master ZLL Key" sent to new devices joining the network, this key is shared among all devices and was leaked online last year. They're also quick to note that once a lightbulb has been infected with the worm, there's no way to reverse this short of replacing the light bulb:

"An important observation is that unlike computers or smart phones, this kind of attack is irreversible. There is no way to re-flash the Philips Hue lights firmware to get rid of our worm, and the only possible solution is to replace the lightbulb with a new one. Note that in order to prevent the new lightbulb from being infected in the same manner, the user must wait for a software patch to be available from the manufacturer before installing it."

So yes, you left the store with a "smart" lightbulb thinking you'd just have some sexy mood lighting, but were shocked to find a mini-apocalypse in a box once you got your purchase home. Thanks, internet of broken things!

Filed Under: hue, iot, lightbulbs, security, smart lightbulbs
Companies: phillips

If You Want To Believe This Country Is Falling Apart, Just Ask Those Who Are Supposed To Be Keeping It Together

from the lies,-damn-lies,-and-statistical-fuckery dept

If you really want to believe the nation is unsafe and under threat from foreigners of all kinds, the government entities in charge of ensuring your safety are more than happy to oblige your dark fantasies.

No one should be surprised that the [Texas] Department of Public Safety overstated the number of "high risk" arrests they made as part of the border surge, as AP's Paul Weber ably reported last week. "Among the 'high-threat' incidents was a trailer that unlatched from an RV and rolled into oncoming traffic, killing another driver in a town more than 150 miles from the border. Other crimes lumped in with suspected killers and human traffickers were speeding teenagers and hit-and-runs that caused no serious injuries."

Nothing sells like fear. And the Department of Public Safety is in need of some sales. There's $800 million in border security dollars at stake. At least. The DPS would like $300 million more this year because it's just damn unsafe to share a border with a foreign country.

If securing that money requires portraying any influx of Mexican citizens as an apocalyptic crimewave, the DPS can certainly do that. There are no limits to its statistical manipulations. Grits for Breakfast points to the Corpus-Christi Caller's derisive editorial detailing the DPS's bullshittery.

The DPS classified 1,800 arrests as high-threat. And apparently many of them actually were. But, according to an Associated Press analysis, many of these arrests turned out to be for drunken driving, failure to pay child support and minor drug possession. The DPS didn't bother to differentiate user amounts from smuggler amounts in its statistics. It also considered 60 counties to be border-region, which undoubtedly would tax the imaginations of even our best and brightest middle school geography teachers.

It's not just a border thing. The same number are used to nail down Drug War dollars. The DPS says "high threat" traffickers, conveniently obscuring the fact that nearly 30% of the busts it references were for less than a gram of cocaine or marijuana.

The DPS responded to the AP investigation with the rather astounding claim that the numbers it was inflating to obtain more border security dollars weren't being misrepresented to obtain more funding.

In response to the AP's findings, the Department of Public Safety said it will recommend removing child support evaders from the list and signaled a willingness to stop classifying other arrests as "high threat." However, it defended the data overall, saying it isn't intended to measure border security, even though the figures are included in briefings to lawmakers.

Whatever. Lawmakers certainly believed the DPS was making border security "measurements" with its twisted facts. That's all that matters. While there are some disbelievers, like Rep. Terry Canales ("It's deceptive to say the least..."), there were certainly far more who bought into the "fear for your safety" narrative.

And why wouldn't they? Using illegal immigrants to gather tax dollars is a longstanding Texas tradition. If the DPS feels comfortable calling deadbeat dads "high threats," it's only because its role models -- a long string of indistinguishable governors (Rick Perry, Greg Abbott) and alleged serial killer Sen. Ted Cruz -- have built sustainable political careers by capitalizing on a fearful narrative not actually backed up by numbers. And if it's not Mexican immigrants, it's ISIS setting up franchises right over the fence.

So, yeah... this:

It's not just a Texas thing. The federal government does the same thing and has for years. The Drug War hasn't resulted in any less funding over the past forty years despite steep drops in crime rates and legalization efforts in multiple states. The existential threat of terrorism makes sure everyone from the DHS to local PDs have plenty of grant money to buy surveillance tech to hunt down amateur photographers and fast food thieves.

Donald Trump's speeches have portrayed America as a war zone populated by criminals, sounding for all the world like he still believes it's the mid-80s and everyone's just now hearing about crack. Clinton is little better, willing to sacrifice encryption in the name of national security and put boots on the ground in response to state-sponsored hacking efforts.

The truth is America has never been safer. Crime rates have generally remained at historic lows for much of this decade. For all the talk about a "war on cops," officers are safer than they've been in fifty years. Law enforcement wants us to belive sex trafficking is an epidemic, but long, well-funded investigations routinely fail to turn up any evidence of this. Any number of law enforcement and parenting groups portray every passing vehicle and pseudonymous social media account as potential child molesters, but the pedo playground they believe the internet is simply doesn't exist.

All these histrionics have almost nothing to do with safety or any government agency's concern about the wellbeing of those putting money in their pockets. It's about the money. It always has been. The primary goal of any government agency is to secure the same amount of funding as last year, if not a little more. Whatever it takes to achieve that goal is deemed acceptable, even if it means using stats to lie to those controlling the purse strings.

Filed Under: department of public safety, hyperbole, law enforcement, national security, overhype, safety, security, texas

FBI Investigating New Information Regarding Hillary Clinton... Because Of The Anthony Weiner Sexting Investigation

from the never-email dept

Hillary Clinton's use of a private email server (at times kept in her own basement...) has obviously been a big story during this campaign -- and for a variety of obvious, yet stupid, reasons, the discussion has become ridiculously partisan. What people should be able to admit on all sides of the debate is that Clinton's use of a private email server was incredibly stupid and, at the very least, calls into serious question the judgment of whoever told her this was okay. It also, almost certainly, put serious information at risk of being exposed through hacks. But, earlier this year, the FBI came out and said that it didn't actually break the law. There was a bit of the old "high court, low court" to this whole setup, because you could see how someone with much less fame or status would be nailed to the wall by the DOJ if they wanted to put that person away.

Either way, the surprise of today is the new announcement by James Comey that the FBI is investigating some new emails that were apparently discovered in an "unrelated case" on "a device." There were a couple of hours of speculation on this, with gradual denials -- not the Wikileaks investigation, not the Clinton Foundation investigation -- until it was revealed that it was from the investigation into Anthony Weiner's sexting. Law enforcement seized devices belonging to both Weiner and his then wife (they've since filed for divorce), Huma Abedin, who is a close Clinton aide (and who also had an email account on the private Clinton server). Other reports have noted that the emails aren't ones that were withheld from the original investigation, so it's not an issue of withholding info, but could potentially reveal issues about the motivations and setup of the private server.

In political circles this is raising eyebrows, coming just 11 days before the election, in a campaign where Clinton's opponent, Donald Trump, has repeatedly pointed to her use of an email server as a reason that she should be in jail, and even promising to appoint a special prosecutor to go after her for this (which, uh, actually isn't how the President is supposed to use that power, but...). Comey's letter doesn't go into much detail, though reporters have been getting more and more details. The letter was sent to a variety of people in Congress, on key committees, including the heads of the Intelligence, Judiciary, Oversight and Homeland Security committees.

Dear Messrs Chairmen:

In previous congressional testimony, I referred to the fact that the Federal Bureau of Investigations (FBI) had completed its investigation of former Secretary Clinton's personal email server. Due to recent developments, I am writing to supplement my previous testimony.

In connection with an unrelated case, the FBI has learned of the existence of emails that appear to be pertinent to the investigation. I am writing to inform you that the investigative team briefed me on this yesterday, and I agreed that the FBI should take appropriate investigative steps designed to allow investigators to review these emails to determine whether they contain classified information, as well as to assess their importance to our investigation.

Although the FBI cannot yet assess whether or not this material may be significant, and I cannot predict how long it will take us to complete this additional work, I believe it is important to update your Committees about our efforts in light of my previous testimony.

In a perfect world, this kind of story should lead to open discussions on better email technologies, email etiquette, encryption, over-classification and such. Instead, everyone's going to play political hacky sack with this one, with Clinton supporters arguing it's no big deal (though it is) and Trump supporters either feeling vindicated for earlier claims or arguing that the FBI failed to do its job properly before. This campaign has been nothing if not full of surprises.

Filed Under: anthony weiner, classification, emails, fbi, hillary clinton, huma abedin, james comey, security

Akamai: 12-Year-Old SSH Vulnerability Fueling Internet-Of-Broken-Things DDoS Attacks, And Worse

from the security-as-a-distant-afterthought dept

We've increasingly covered how the "internet of poorly secured things" has contributed to a rise in larger DDoS attacks than ever before. The barely-there security standards implemented by companies more interested in hype than quality meant it didn't take long before hackers were able to incorporate "smart" refrigerators, power outlets, TVs and other IoT devices in the kind of DDoS attacks that recently took down security researchers like Brian Krebs. The end result is DDoS attacks that continue to break records, first 620Gbps in the Krebs attack, then more recently a 1.1 terabits per second attack on a French web host.

But just how bad have things become? A new report by Akamai warns that hackers are using a 12-year-old vulnerability in OpenSSH to funnel malicious network traffic through IoT devices. SSH certainly can be implemented securely, but as with every other security aspect of the IoT, many hardware vendors aren't bothering to do so. Akamai's data indicates roughly 2 million devices have been compromised by this type of hack, which the firm dubs SSHowDowN.

CVE-2004-1653 is a default configuration in old versions of OpenSSH that can be exploited by an attacker to forward ports, letting a hacker route malicious traffic through the device as part of the overall DDoS command and control infrastructure. To pull this off you need the device's admin username and password; certainly not a problem in the IoT space where default logins are often the norm. Akamai notes that many IoT devices not only ship with this vulnerability intact, but with no ability to fix it:

"We’re entering a very interesting time when it comes to DDoS and other web attacks; ‘The Internet of Unpatchable Things’ so to speak,” explained Ory Segal, senior director, Threat Research, Akamai. “New devices are being shipped from the factory not only with this vulnerability exposed, but also without any effective way to fix it. We’ve been hearing for years that it was theoretically possible for IoT devices to attack. That, unfortunately, has now become the reality."

Of course the internet-of-poorly-secured things isn't just useful for DDoS attacks. Brian Krebs has penned a new blog post noting how criminals are often using hacked IoT hardware as proxies to obscure their real location as they engage in tax return fraud and other criminal activity, courtesy of your not-so-smart WiFi-enabled tea kettle or home-automation system. An anonymous researcher tells Krebs he was able to track the various "honeypot" systems he configured as they were traded and sold as malware-infested proxies in exchange for bitcoin.

In short, flimsy Internet of Things security, combined with already often-dubious embedded security in routers, is kind of a throwback to the wild west of the 1990s when the idea of your mom's PC as a botnet participant was kind of novel. Krebs' source puts it this way:

"In a way, this feels like 1995-2000 with computers," my source told me. "Devices were getting online, antivirus wasn’t as prevalent, and people didn’t know an average person’s computer could be enslaved to do something else. The difference now is, the number of vendors and devices has proliferated, and there is an underground ecosystem with the expertise to fuzz, exploit, write the custom software. Plus, what one person does can be easily shared to a small group or to the whole world."

And again, while the abysmal state of IoT security can often be funny, firms like Gartner predict that the population of Internet of Things devices will top 20.8 billion by 2020, up from 6.4 billion or so today. Researchers like Bruce Schneier have been warning for some time that the check is about to come due in the form of attacks that may put human lives at risk at an unprecedented scale, lighting a fire under researchers who believe that automated cyberdefense and self-healing network technologies we haven't invented yet are what stand between us and the not-so-smart device cyber apocalypse.

Filed Under: ddos, iot, security, ssh
Companies: akamai

Verizon Wants $1 Billion Discount After Yahoo Scandals, Still Fancies Itself The New Google

from the we're-innovative-if-we-say-we-are dept

With wireless and fixed-line broadband growth slowing, Verizon has been steadily expanding into new growth territories to try and please insatiable investors. So far, that apparently includes buying failed 90s internet brands like Yahoo and AOL in the belief that it can somehow become a Millennial advertising juggernaut. Except that hasn't been going particularly well, as the stodgy old telco realizes that it's kind of hard to innovate when you've spent the last thirty years bumbling about as a government-pampered telecom monopoly almost solely focused on turf protection.

And things have been going notably worse for Verizon over the last month, as the company has acknolwedged that Yahoo failed to reveal not only the 2014 hack of 500 million user accounts, but also its recently disclosed wholesale e-mail spying for the U.S. government during negotiations. That has prompted rumors that Verizon is looking for a billion-dollar discount off the original $4.8 billion Yahoo asking price:

"In the last day we’ve heard that [AOL boss] Tim [Armstong] is getting cold feet. He’s pretty upset about the lack of disclosure and he’s saying, ‘Can we get out of this or can we reduce the price?’” said a source familiar with Verizon’s thinking. That might just be tough talk to get Yahoo to roll back the price. Verizon had been planning to couple Yahoo with its AOL unit to give it enough scale to be a third force to compete with Google and Facebook for digital ad dollars.

Of course "scale" isn't enough to compete with Facebook and Google when you lack anything resembling disruptive or innovative DNA, though Verizon seems intent on learning this the hard way. Verizon CEO Lowell McAdam says the company has no intention of backing away from the deal, and continues to insist that despite Yahoo being a vicious shitshow, it's the missing link necessary to transform Verizon from stodgy old telco to innovative advertising juggernaut:

"I think, and we’ll see how AOL and Yahoo come together, but I think that entity can be easily one of the top three,” McAdam said at the conference. “I think we can provide the content and applications that will stand up with anything that goes up on the West Coast."

Right. But so far, there's absolutely zero indication that's going to be the case. One of the key cornerstones of Verizon's attack plan has been Go90, a new streaming video service tailored to Millennials. The problem? Those advertising and content partners McAdam claims are so excited about Verizon's entry into the market think the platform is a disaster of colossal proportions:

"Early on, we thought the platform had promise, but it was an absolute dud when it launched,” says one Go90 publishing partner. “We get the sense that unless you’re one of the premier folks they paid piles of money to [for original content], there isn’t much there from a traffic perspective,” said another. “Based on the plan they had originally laid out, it would have been a mid-tier platform for us — millions of views per month, at worst — but it’s turned out to be far, far worse than their projections,” says yet another."

Fancy! So not only did Verizon gobble up a number of underwhelming 90s internet brands in the hopes of striking it rich in content, its own foray into content has been painfully underwhelming (something that should have been apparent to anybody who remembers Verizon's first, brief attempt at original content, SugarString). Combine that with the money Verizon will have to dole out once the lawsuits over the Yahoo hack begin flooding in, and you've got the kind of pivot and metamorphosis that makes Jeff Goldblum's experience in The Fly look arguably pleasant.

Filed Under: hacking, mergers, security, surveillance
Companies: verizon, yahoo

Argentina Not Only Wants To Bring In E-Voting, It Will Make It Illegal To Check The System For Electoral Fraud

from the this-is-fine dept

Earlier this year, we wrote about Australia's refusal to allow researchers to check e-voting software being used in that country. The situation in Argentina seems to be even worse. Access Now provides the background (original in Spanish):

The ruling party in Argentina is driving the adoption of an electronic voting system for national elections. Despite stern warnings from computer security experts about the dangers of the system, the ruling party is persisting with the project and plans to put it to a vote in Congress in the coming weeks.

Techdirt readers hardly need to be reminded about the deeply-flawed nature of e-voting systems, but there's a useful article on Medium (in Spanish) with plenty of links to hispanophone experts from widely-different backgrounds warning against the move.

Imposing an e-voting system may be foolish, but Argentina's plans manage to magnify that folly many times over. A blog post in Spanish by Javier Smaldone explains why:

The proposal provides for imprisonment (1 to 6 years) for conducting activities that are essential in any audit or independent review of the system.

Thus, it is intended to impose the use of computer system in the casting and counting of votes, and as if it were not already extremely difficult for any citizen to be sure how it works (and it is safe), anyone who tries to find out is punished with imprisonment.

It's one thing to bring in an e-voting system that most experts say is a bad idea in theory. But making it effectively illegal to point out flaws that exist in practice is really asking for trouble. Unless this proposed law is changed to allow independent scrutiny of the systems, Argentina will probably find this out the hard way.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: argentina, e-voting, fraud, security, security by obscurity

Johnson & Johnson Warns Insulin Pump Owners They Could Be Killed By Hackers

from the internet-of-broken-things dept

Initially the lack of security on "smart" Internet of Things devices was kind of funny as companies rushed to make a buck and put device security on the back burner. And while hackable tea kettles and refrigerators that leak your Gmail credentials just seem kind of stupid on the surface, people are slowly realizing that at scale -- we're introducing millions of new attack vectors into homes and businesses annually. Worse, compromised devices are now being used as part of massive new DDoS attacks like the one we recently saw launched against Brian Krebs.

Unfortunately, companies that service the medical industry also decided a few years ago that it would be a good idea to connect every-damn-thing to networks without first understanding the security ramifications of the decision. As a result, we're seeing a rise in not only the number of ransomware attacks launched on hospitals, but a spike in hackable devices like pacemakers that could mean life and death for some customers.

Another new case in point: Johnson and Johnson this week had to reach out to owners of the company's insulin pumps to warn them that the devices could be used to kill somebody by overdosing diabetic patients with insulin. According to researchers, the devices were launched with wireless connectivity in 2008 as a means of bringing added convenience for customers, but Johnson and Johnson failed to encrypt the device's wireless traffic:

"The Animas OneTouch Ping, which was launched in 2008, is sold with a wireless remote control that patients can use to order the pump to dose insulin so that they do not need access to the device itself, which is typically worn under clothing and can be awkward to reach. Jay Radcliffe, a diabetic and researcher with cyber security firm Rapid7 Inc, said he had identified ways for a hacker to spoof communications between the remote control and the OneTouch Ping insulin pump, potentially forcing it to deliver unauthorized insulin injections."

As with pacemakers, an attacker needs to be relatively close to make this happen (25 feet), resulting in Johnson and Johnson insisting the overall risk was low:

"The probability of unauthorized access to the OneTouch Ping system is extremely low," the company said in letters sent on Monday to doctors and about 114,000 patients who use the device in the United States and Canada. "It would require technical expertise, sophisticated equipment and proximity to the pump, as the OneTouch Ping system is not connected to the internet or to any external network."

That's not really comforting. While this particular hack was publicized and fixed, there's a growing zero-day exploit market for medical device vulnerabilities that can be used to kill or injure an individual without detection, something that's going to be increasingly attractive to nation state actors and private contractors using the Internet of Things for globally malicious (and in some instances potentially fatal) activity. The rise in hackable medical devices has forced the FDA to issue formal guidance on how medical device makers should handle reports about cyber vulnerabilities.

In this case it appears that Johnson and Johnson was cooperative with Rapid7, but as we've noted previously, the lion's share of internet-of-broken-things companies tends to respond to researcher vulnerability reports with stone-cold silence.

Filed Under: computer security, insulin pumps, iot, security
Companies: johnson & johnson

UK Government Says Smart Meters Can Definitely Be Trusted Because GCHQ Designed Their Security

from the oh,-that's-OK,-then dept

The idea behind smart meters -- that detailed information about how you consume electricity will allow you to use power more efficiently and thus cut your bills and your home's carbon emissions -- is a good one in theory. And yet smart meters are still not used very widely, even in countries like the UK, where the government has a strategy to install millions of them by 2020. Actually, the likely savings by users are small, but smart meters also promise to allow the electricity industry to lower salary costs by carrying out meter readings remotely, which is one reason why it is so keen on the idea. Another is because smart meters make it is easy to cut off someone's supply if they don't pay their bills.

The slow uptake of smart meters seems in part to be due to public concerns about security. People are worried that their smart meter will spy on them, sending back information to electricity companies that might be intercepted and used for targeted burglary when they are away. Similarly, there are fears that if the smart meter control system were compromised, domestic electricity supplies might be at risk on a large scale.

One of UK Parliament's most important committees, the one monitoring science and technology, has just published a report into the UK smart meter roll-out, offering recommendations for ways to speed it up. Security is an issue it discusses, and one of the committee's recommendations is as follows:

We recommend that the Government consider further how to communicate the level of thought that has gone into designing a secure system for smart metering

More about that "level of thought" is found in an appendix to the report, which contains the UK government's evidence on this topic, including the following statement:

The Department of Energy and Climate Change (DECC) has worked with GCHQ since the very early design stage of the rollout, when the programme was initiated. The engagement with GCHQ has been one of partnership, issue discussion and resolution.

Helpfully, GCHQ has written a long and interesting description of its work on smart meters, and how it has tried to make UK smart meters resistant to attack. The post concludes:

We hope that this article has explained the thinking behind the design of the Smart Metering System. DECC, with support from GCHQ (part of which will be become the National Cyber Security Centre) has security right at the top of the list of things it cares about. Of course, no system is completely secure, and nothing is invulnerable. However, we’re confident that the Smart Metering System strikes the best balance between security and business needs, whilst meeting broader policy and national security objectives.

It's interesting that the post mentions national security objectives. As Techdirt has reported, one of the worst features of the UK's Investigatory Powers Bill that is currently wending it way through Parliament is that it creates a legal framework to allow GCHQ and the other intelligence agencies to hack into any kind of equipment in order to carry out surveillance. Of course, that's really rather easy when you were the one who designed its security systems.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: gchq, security, smart meters, surveillance, trust, uk