ITU: Not Even Good At Not Being Transparent, Accidentally Releases Deep Packet Inspection Standard

from the look-at-that dept

Earlier this week, we wrote about how the ITU had secretly approved a standard for deep packet inspection behind closed doors. This was troubling on a number of different levels, including the idea that they're even trying to standardize such a thing, and that they're doing so in secret. However, after the news came out, Asher Wolf decided to tweet a simple question, asking if anyone had access to documents about the DPI standard. And a funny thing happened: Toby Johnson, a PR/communications guy for the ITU, responded and offered to send the documents. Which he did. And then, five hours later, after Asher had spoken about them publicly and sent them around to a bunch of journalists, she got an email saying that the documents were for her eyes only, and not to publish or share them "in part or in whole."

Yes, the ITU is so incompetent that they can't even do secrecy right.

Richard Chirgwin has a pretty good rundown on how ridiculous the DPI standard is, but perhaps more bizarre, as Wolf points out, the documents show that the ITU didn't think it was worth studying the impact of such a standard before implementing one -- which would suggest (yet again) that the ITU appears to go about things backwards.

Filed Under: dpi, itu, leaks

Senator Wyden Puts Hold On Intelligence Authorization Act Over Free Speech Concerns

from the good-for-him dept

Once again, Senator Ron Wyden seems like one of a very small number of people in Congress actually willing to stand up against bad bills that are pushed forward with fear mongering. Earlier this year, we noted just how absolutely ridiculous it was that Senator Dianne Feinstein seemed a hell of a lot more concerned about punishing whoever blew the whistle on questionable US activities like Stuxnet, then about the questionable activities themselves. In response, she put forth some legislation that was designed to punish government whistleblowers, rather than understand why they were blowing the whistle. This bill got dumped into a key appropriations bill, the Intelligence Authorization Act for Fiscal Year 2013. In other words, Feinstein basically said that if we are to fund intelligence activities we have to crack down on whistleblowers. Shameful stuff.

Thankfully, Senator Wyden has now put a hold on the bill, noting his concern about how it would impact free speech issues, especially as it pertained to the media reporting on national security:

"I think Congress should be extremely skeptical of any anti-leaks bills that threaten to encroach upon the freedom of the press, or that would reduce access to information that the public has a right to know," Wyden said in a floor statement publicly announcing his hold. "Without transparent and informed public debate on foreign policy and national security topics, American voters would be ill-equipped to elect the policymakers who make important decisions in these areas."

Of course, part of the issue here is that Feinstein sees any form of whistleblowing or commentary as "leaks," while Wyden properly recognizes that a functioning democracy means allowing the press to report on questionable behavior by the government.

Filed Under: dianne feinstein, hold, intelligence authorization act, leaks, ron wyden, whistleblowing

Cisco VP Threatens To Stalk Memo Leaker... Driving More Attention Than Original Memo

from the yeah,-not-smart dept

Internal memos from large companies leak all the time. It happens. Companies don't like it, but most learn to deal with it. Sometimes, they go a bit nuts. For example, you may remember the spying scandal at HP, in which the board tried to stop leaks by spying on phone records and other info, including trying to spy on various journalists. Apparently some companies just go a bit nutty when they think they have someone to track down, where execs suddenly think they can act like they're in some sort of spy movie. Apparently this is now happening at Cisco as well. A few weeks ago, Network World reported on Cal State's decision to use Alcatel-Lucent instead of Cisco, claiming that it saved the university $100 million. As is fairly typical at companies when such bad news is in the press, an internal memo was sent around on how to respond to questions about this story. And... as is fairly typical at such companies, the internal memo leaked to bloggers who posted it. The memo itself is fairly tame and about what you'd expect given the situation.

But... then, apparently, a VP at Cisco, Mike Quinn, got upset about the leak... and proceeded to send out an angry email telling the leaker to resign, and saying if he doesn't resign, that "finding you is now my hobby." And, of course, that new letter leaked to the same sources:

This is an open response to the person(s) that sent our internal confidential memo regarding the RFP response noted in the Subject line. I want to advise you that no matter the color of your badge (blue or red), the years of service and or your CPC rating you have decided to violate the Code of Business Conduct. The company in response to a number of requests to share internally what our RFP contained once again is insulted by the lack of respect for the business and "family" internal to Cisco. The person or persons whom felt it was cool or correct to share this internal memo should now have the intestinal fortitude to stand up and admit that they did this, then resign.

I want you to remember that Cisco puts the groceries on your table every two weeks, not Brad Reese or other Slander Sheet Journalists. That you disrespected everyone else at Cisco. Now I know you do not have it in you to stand up and admit what you did, so I will now make you my "hobby." Ask around you will find out that I like to work on my hobbies.

Mike Quinn Vice President - Services Cisco Systems

And, if that doesn't sound quite threatening enough, people quickly pointed out that in the distant past, Quinn worked for the CIA.

The amazing thing about all of this is that all it's done is call much more attention to the whole thing. If they'd just let that initial leak go, it would have been mostly forgotten in a few days and people would have moved on. But now because someone went on a power trip, it's right back in the news again.

Filed Under: leaks, memos, stalking
Companies: cisco

Bulgarian Banks Try To Silence Web Site That Called Them 'Bad Apples'

from the give-those-people-a-medal dept

Whatever your views on the value of Wikileaks, one of its useful side-effects has been the appearance of other sites that have tried to do a similar job of calling the powerful to account using leaked information, but at a more local level. One of the most successful of these is BalkanLeaks, created by the Bulgarian investigative journalists Atanas Tchobanov and Assen Yordanov. In fact, it's been rather too successful for some, and is now on the receiving end of some legal threats, as a column in Forbes explains:

Earlier this month, Tchobanov and Yordanov’s news outlet Bivol.bg, which publishes documents from their WikiLeaks-like leak site BalkanLeaks, received a letter from Bulgaria's central bank threatening to fine the news organization for publishing "false information and circumstances" that undermine the "reputation and credibility" of four Bulgarian banks that filed the complaint with the government -- a violation could carry as much 150,000 Bulgarian lev ($100,000) in penalties.

As Reporters without Borders notes, the "false information and circumstances" originated in a US embassy cable obtained by WikiLeaks, which was published by Bivol.bg back in June:

The article consisted of an analysis of a US embassy cable published by WikiLeaks about "bad apples" in the Bulgarian banking system, but it corroborated the US ambassador's comments with information from its own sources.

It's some of those alleged "bad apples" that have complained to the Bulgarian National Bank (BNB), accusing the news site of violating Bulgaria's Credit Institutions Act. But as Reporters Without Borders comments:

"The Credit Institutions Act concerns only the banking world and cannot be used against the media or to defy the constitution, which guarantees media freedom. Moreover, the BNB has no jurisdiction over media law and cannot be allowed to impose heavy fines on news outlets."

This seems likely a clear case of bullying, using banking laws and the threat of a big fine to silence a small news organization. As the Forbes article points out, this isn't the first time that the Bivol.org journalists have chosen to take on extremely powerful groups:

Using the same anonymity tools as WikiLeaks, the group has obtained leaked documents exposing judicial bribery, former members of the Soviet-tied secret police, and blackmailing between Bulgarian prosecutors. After obtaining and publishing a State Department cable on Bulgarian organized crime the group received from rogue WikiLeaks ex-associate Israel Shamir last summer, Bivol partnered with WikiLeaks to release the rest of the Bulgaria-related cables. One accused Bulgarian prime minister Boyko Borisov of close mafia ties, a claim he vigorously dismissed in a Bulgarian TV interview as "yellow journalism."

At a time when many people are wondering whether WikiLeaks is a spent force, it's heartening to see BalkanLeaks and Bivol.org continuing to expose wrongs through the use of leaked information, despite the very clear risks.

Follow me @glynmoody on Twitter or identi.ca, and on Google+

Filed Under: balkanleaks, bivol.bl, bulgaria, censorship, leaks

Publishing Company Admits That Anonymous' UDID Data Leak Was Actually Taken From Their Database

from the the-plot-thickens dept

Last week, there was a big story in which AntiSec, a part of Anonymous, claimed to have downloaded personal info on about 12 million Apple device users from an FBI agent's computer. They released about a million UDIDs to "prove" it, claiming they had a lot more information as well. The FBI quickly denied that the evidence came from them, and Apple later insisted that it had not shared such info with the FBI either. Now, a Florida company, Blue Toad, has told NBC that an analysis of the leaked data and its own data set has made it almost certain that the data actually originated from Blue Toad's servers (whether or not it eventually got onto an FBI machine is a separate issue):

"That's 100 percent confidence level, it's our data," [Blue Toad CEO Paul] DeHart said. "As soon as we found out we were involved and victimized, we approached the appropriate law enforcement officials, and we began to take steps to come forward, clear the record and take responsibility for this.”

Apparently, Blue Toad's technology is used by tons of app publishers to help them build their own digital editions and apps -- which is why it would have access to all of this information.

The researcher who figured out that the data came from Blue Toad, David Schuetz, has pointed out that he can't say for certain if the FBI later got the same data, or where Anonymous got the data, but he does suggest that people should be skeptical of claims like that:

“It does raise questions,” he said. “I think people need to question what they see online, whether it comes from Anonymous or from a news organization or from a politician or from a corporation. You need to not take things at face value right away and jump straight to what you think it says. Somebody says, ‘Oh, this came from the FBI, everybody believes it. Well, let’s think about (it).”

Good advice.

Filed Under: anonymous, antisec, data, fbi, leaks
Companies: blue toad

With Wikileaks Releasing Syrian Emails, Will People Realize It's Not Just Targeting The US?

from the radical-transparency dept

One of the bizarre issues that came out after Wikileaks began releasing its treasure trove of US State Department cables, was this suggestion from the US government that Wikileaks was clearly an anti-US organization. However, as has been pointed out time and time again, it's not: it's an anti-secrecy organization. You can agree or disagree with that position, but the various attempts to brand Wikileaks and Julian Assange as particularly anti-American (and to even look to use Espionage Act claims against them) always seemed misguided. With the latest release of millions of Syrian government emails, it makes you wonder if those same people who were complaining about the organization being anti-American are now also complaining about it being "anti-Syrian."

Randomly, this can't be particularly surprising when, as we noted a few months ago, some hackers had worked out that a large number of high level government officials in Syria used 12345 as their email password.

Filed Under: julian assange, leaks, state department, syria
Companies: wikileaks

Transparency Double Standard: UK Public Inquiry Requests Info From Wikileaks

from the feeding-the-hand-that-bites dept

Well, this is interesting. Given the general condemnation of Wikileaks by governments, all the ongoing controversy and reputation problems faced by the organization, you wouldn't expect them to be approached with any official requests for leaked information. But it seems just that has happened in the UK, where the Leveson Inquiry into media ethics has requested and received a dossier from Wikileaks on corruption in the British press.

On the surface this is pretty hypocritical, and more than a little ironic: in the past, the UK government asked media outlets to brief them on government secrets they received from Wikileaks before publishing them. Now, a government-run inquiry is asking Wikileaks to hand over information on UK media outlets. Apparently they don't hate leaks as long as they flow in the right direction.

Hopefully this represents another step towards governments recognizing that Wikileaks isn't pure evil, even if there are questionable things about the operation. Though there are risks, bringing sensitive information to light is often in the public's best interest—indeed, that's the whole spirit behind public inquiries. The Leveson Inquiry was convened when the News of the World phone-hacking scandal pointed to a secret culture of corruption in the press, and now Wikileaks is helping to expose it further. If governments attempt to maintain secret cultures of their own, they too will be exposed.

Filed Under: corruption, hypocrisy, leaks, uk, wikileaks

Pro Tip: Even If Someone Has Faked A Damaging Memo About Your Organization, Don't Threaten To Sue Anyone Who 'Comments' On It

from the this-first-amendment-thing... dept

You may have heard that the Heartland Institute had some internal documents leaked recently, and noted the irony of the situation. If you don't know, Heartland is well-known in certain circles for its efforts to disprove that smoking causes any harm, as well as its efforts to deny climate change. The "think tank" also has done some telco policy issues, more or less supporting anything that involves not regulating telcos. The irony bit comes from the fact that a couple of years back, when there were some leaks of emails between scientists involved in climate change research, Heartland was one of the leading cheerleaders to push for misreading what was said in those emails to condemn climate change science.

Heartland is insisting that at least one document -- the one that's received the most attention and supposedly outlines the organization's dastardly plans -- is faked. Some observers have made compelling arguments that the document in question is, in fact, faked (and that's from someone who disagrees with Heartland Institute on the key issue of climate change).

I'm not going to comment on the leak or what's in the documents (either real or fake) because that's really not the kind of thing I care about that much. But, I will comment about one key thing Heartland said in its press release about the whole situation... where it effectively threatens to take legal action against anyone who comments on what's in the documents:

The individuals who have commented so far on these documents did not wait for Heartland to confirm or deny the authenticity of the documents. We believe their actions constitute civil and possibly criminal offenses for which we plan to pursue charges and collect payment for damages, including damages to our reputation. We ask them in particular to immediately remove these documents and all statements about them from the blogs, Web sites, and publications, and to publish retractions.

Now, I don't care what you think of Heartland, climate change or anything along those lines. Whether you think it's a wonderful organization or an evil organization... one thing I would hope we could agree on is that threatening people for "commenting" on documents with legal action, even if the documents later turn out to be fake, is not a good idea. I can certainly understand the temptation to try to get people not to comment, but the threat is pretty clearly bogus. The documents -- and the leak of the documents -- even if faked or altered, are still a public interest issue, and it's hard to see how there's any law broken in commenting about what's in the documents. There may be legal issues for whoever leaked the documents, but those who are commenting on them? Sorry, that's just silly.

Filed Under: climate change, defamation, leaks, threats
Companies: heartland institute

Remember: Actors And 'Pirates' Can Be The Same People

from the it's-not-an-either-or dept

Ron Rezendes points us to a story about how a Screen Actors Guild (SAG) member is pleading guilty to a single count of criminal copyright infringement for uploading screener copies of some movies that he only had access to because he was a SAG member. I still think it's a little silly that this is a criminal complaint rather than a civil complaint, but that's an issue with the law itself. What strikes me as a more important point concerning this story is the simple fact that it's a SAG actor doing the leaking. This is a lot more common than people realize. The MPAA keeps insisting that there are "evil pirates" out there trying to harm actors and others in the industry. But what that ignores is that time and time again studies have shown that a large percentage of these leaks come from actors or others in the industry. Insider leaks are a key source of such content. This doesn't make it right, or legal, or anything like that. I'm merely pointing out the whole "us vs. them" mentality pushed by the MPAA is inaccurate and misleading. Very often the "them" the MPAA wants to blame are the very people they claim they're trying to help.

Filed Under: actors, leaks, movies, piracy

Wasn't The Real Security Problem The Initial Leak Of State Dept. Cables Rather Than The Latest Leak Of Those Same Cables?

from the playing-the-blame-game dept

One of the myths around Wikileaks' original release of State Department cables was that the organization simply dumped all the cables unredacted and let everyone sort it out. That's simply not true. Wikileaks released only small batches of documents at a time, mostly in conjunction with newspaper reporters, and redacted sensitive info. While Wikileaks just did a big dump of additional cables, the big news that people are focused on is how a German newspaper found an encrypted file of all the cables that apparently has no redactions at all, and has a password that is easy to find. While the details aren't entirely clear, most of the evidence seems to suggest some sort of human error, in placing the encrypted file online and then, later, accidentally releasing the password to the file.

While it does seem like there's a fair bit of bad security and bad process on the part of Wikileaks, it does seem to be a little odd to pin the full blame on Wikileaks and various hacker groups as Paul Carr does here in his story on the new file:

In truth, it almost doesn’t matter who is responsible: the eventual release of the unredacted cables was inevitable. The message of Wikileaks — and the amoral cult of leaking for lulz that came in its wake — has always been one of callous contempt for the human cost of “free information”. From Assange’s well-publicised remarks to Guardian reporters that “if [informants] get killed, they’ve got it coming to them. They deserve it.”, to LulSec [sic] and Anonymous’ willingness to publish the personal details of anyone even tangentially associated with their ‘enemies’, what we see time and time again from mass-leakers is a sociopath’s disregard for individuals, combined with a Hollywood serial killer’s hunger for attention. Sooner of later — for attention, to make some misguided political point, for the lulz — someone was bound to obtain and leak the raw documents.

But all of this ignores where these documents came from originally. These cables were apparently available to hundreds of thousands -- if not millions -- of people within the government if they wanted to look at them. At that level of accessibility, it's not hard to realize that lots of people had these documents, and there's a fair likelihood that those working for foreign interests were able to get their hands on these documents long ago. The only folks who didn't have them were the public.

Now, I do disagree with the tactics that Anonymous and LulzSec tend to take (and, honestly, am still surprised that their attacks have been so effective). But, that's mainly because I just don't think such things legitimately move issues forward. Instead, they focus the discussion on the hacks, rather than the content of the hacks, and get people focused on what they believe to be a bunch of script kiddies (whether it's true or not).

But I think it's a bit silly to blame their attitude and hackings for this release. The documents and their details were almost certainly "available" to various foreign parties long before anyone leaked them to Wikleaks. While this latest release certainly shows some serious process problems with Wikileaks (no surprise there), it's kind of amazing that people aren't pointing out that the much bigger security/process problem was at the beginning of the chain, in which the documents were available to so many different people without much security or protection in the first place.

Filed Under: leaks, state department cables, wikileaks
Companies: wikileaks