Hongkongers Battle Supporters Of Beijing For The Soul Of The Chinese-Language Wikipedia

from the beyond-edit-wars dept

When Wikipedia was first launched 20 years ago, it was widely derided as an impossible project, bound to fail or, at best, to produce worthless rubbish. And yet today, along with open source software, it is undoubtedly the best demonstration that a distributed team of volunteers can produce work that is not just free but arguably better than anything created for profit using traditional, top-down management approaches. But beyond that, Wikipedia has become something else: a unique repository of validated information and thus, implicitly, a store of "truth" about the past and the present. That has turned many pages of Wikipedia into a battleground, as people with different views fight in sometimes fierce "edit wars" over what counts as "verified". The choice of information and even how things are phrased often have considerable social, economic or political importance. No surprise, then, that there is a struggle taking place over what Wikipedia should say is happening in the contested space of Hong Kong. Back in July, an article in the Hong Kong Free Press explained:

As Hongkongers reckon with the closure of one of the city's mainstream news outlets [Apple Daily], drastic political changes and a sweeping national security law, the city's keyboard warriors on Wikipedia are also coming under pressure.

Battles between competing editors of the crowd-sourced encyclopaedia's articles about Hong Kong political events have been a daily occurrence since the beginning of the 2019 anti-extradition bill protests.

As increasing numbers of mainland Chinese contribute to the Chinese-language version of Wikipedia, those in Hong Kong worry that their perspectives will be lost:

In the war to set narratives using news sources that may have political biases, whether pro-Hong Kong or pro-China, the question of which news outlet gets a seal of "reliability" becomes a key battleground.

Since then, the situation has become so serious that the Wikimedia Foundation, which owns and operates all the different language editions of Wikipedia, has been forced to step in. Maggie Dennis, the Wikimedia Foundation's Vice President of Community Resilience & Sustainability, wrote this week of "infiltration" of Wikimedia systems, "including positions with access to personally identifiable information and elected bodies of influence." Dennis claims that "we know that some users have been physically harmed as a result. With this confirmed, we have no choice but to act swiftly and appropriately in response." The actions were as follows:

We have banned seven users and desysopped [removed administrator privileges from] a further 12 as a result of long and deep investigations into activities around some members of the unrecognized group Wikimedians of Mainland China. We have also reached out to a number of other editors with explanations around canvassing guidelines and doxing policies and requests to modify their behaviors.

Setting the narrative for these politically-sensitive events is so important to the Chinese government that it is unlikely that Wikimedia's moves will put an end to this "infiltration". On the contrary: we can probably expect the organization to come under even more pressure to tell things the way Beijing wants them portrayed, and to hell with Wikipedia's cherished neutral point of view.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: beijing, china, culture, hong kong, shared knowledge, truth
Companies: wikipedia

American Malware Purveyor That Did Nothing To Limit Misuse Now Horrified To Find Gov't Of India Misused Its Products

from the who-could-possibly-have-seen-this-inevitable-outcome dept

Another malware purveyor is shocked, SHOCKED to discover its products have been used to do Very Bad Things. Thomas Brewster has more details for Forbes. Here's the setup:

Earlier this year, researchers at Russian cybersecurity firm Kaspersky witnessed a cyberespionage campaign targeting Microsoft Windows PCs at government and telecom entities in China and Pakistan. They began in June 2020 and continued through to April 2021. What piqued the researchers’ interest was the hacking software used by the digital spies, whom Kaspersky had dubbed Bitter APT, a pseudonym for an unspecified government agency. Aspects of the code looked like some the Moscow antivirus provider had previously seen and attributed to a company it gave the cryptonym “Moses.”

More digging by Kaspersky and others discovered who was actually behind these deployments. And the source wasn't some state-supported hackers or a malware purveyor with a malleable set of morals. No, the exploits -- which were deployed to indiscriminately target people in Pakistan and China -- were sold (in a way) to the government of India by an American firm, Exodus Intelligence.

Operating out of Austin, Texas, Exodus doesn't craft many exploits of its own, but rather provides access to information about known exploits, including where to obtain them, and how they can be utilized and leveraged.

Exodus, when asked by Five Eyes countries (an alliance of intelligence-sharing countries that includes the U.S., U.K., Canada, Australia, and New Zealand) or their allies, will provide both information on a zero-day vulnerability and the software required to exploit it. But its main product is akin to a Facebook news feed of software vulnerabilities, sans exploits, for up to $250,000 a year. It’s marketed primarily as a tool for defenders, but customers can do what they want with the information on those Exodus zero days—ones that typically cover the most popular operating systems, from Windows to Google’s Android and Apple’s iOS.

The government of India chose to leverage this knowledge to indiscriminately assault China and Pakistan entities in hopes of hitting targets of interest. That wasn't what Exodus Intelligence's info feed was designed to do. It's only what it ended up being used for. And now the CEO of Exodus is acting like a parent disappointed a child has exceeded the boundaries he never bothered to set.

That feed is what India bought and likely weaponized, says 37-year-old Exodus CEO and cofounder Logan Brown. He tells Forbes that, after an investigation, he believes India handpicked one of the Windows vulnerabilities from the feed—allowing deep access to Microsoft’s operating system—and Indian government personnel or a contractor adapted it for malicious means. India was subsequently cut off from buying new zero-day research from his company in April, says Brown, and it has worked with Microsoft to patch the vulnerabilities. The Indian use of his company’s research was beyond the pale, though Exodus doesn’t limit what customers do with its findings, Brown says, adding, “You can use it offensively if you want, but not if you’re going to be . . . shotgun blasting Pakistan and China. I don't want any part of that.”

While it's great the CEO doesn't want any part of that, not placing limits on end users is always going to result in things like this. And while it's unlikely writing up a new ToS is going to deter customers from "shotgun blasting" people with the weaponry you've provided, it at least allows you to terminate contracts and access without having to engage in a bunch of costly litigation or fruitless negotiations.

And, if you're going to be in the business of selling exploits (or indirect access to exploits), you need to be way more proactive on the security front.

Brown is also now exploring whether or not its code has been leaked or abused by others. Beyond the two zero days already abused, according to Kaspersky, “at least six vulnerabilities” made by Moses have made it out “into the wild” in the last two years.

Whoops. That doesn't look good. But, in all fairness, even the NSA and CIA have seen their tech tools and exploits leaked, resulting in the infliction of misery worldwide by people a shade more malicious than the entities belatedly bemoaning the unplanned distribution of their digital secrets.

Speaking of belated, here's some regret from the cofounder of Exodus Intelligence, Aaron Portnoy.

[T]oday, the 36-year-old self-taught hacker, who dropped out of Northwestern to carve his own career in cybersecurity, worries that he never knew who had access to his code or how they used it. He now regrets relinquishing control over his zero days to salespeople. “It's almost like I was being taken advantage of . . . It felt very much like I was a tool that was being used for a bigger purpose that I really had no insight into,” says Portnoy, now plying his trade at Randori, a Massachusetts-based cybersecurity firm.

Sure, but not so concerning Portnoy didn't leap from Exodus to defense contract Raytheon, and from there to startup Boldend, which partnered with Raytheon to (and I'm directly quoting here) "accelerate cyber operations with greater force."

While it's great that Exodus has revoked the Indian government's access to its exploit feed, the larger problem remains. American companies are aiding and abetting mass surveillance, targeting of dissidents and activists, and other human rights abuses by not being more selective of who they sell to or placing limits on how their products are used. This puts them in the same shady neighborhood as overseas malware merchants like NSO Group and Hacking Team. Sooner or later, it's going to put them on the wrong end of UN sanctions or DOJ investigations. Until then, it appears it will be risky business as usual, making the United States home to plenty of proxy human rights violators.

Filed Under: china, cybersecurity, india, malware, pakistan, security, zero days
Companies: exodus intelligence

China's Game Controllers Ignore Emergent Order

from the emergent-order-is-important dept

Last week, China restricted children under 18 to three weekend hours of video games per week. If you’re a parent of a Minecraft- or Fortnite-obsessed child, you may be wondering why the U.S. doesn’t do something similar. But China’s move against juvenile gaming is just the Chinese government's latest salvo in their barrage of attempts to control internet technology. Their centralized approach is one that we in the U.S. have historically rejected and should continue to reject.

China’s Great Firewall has long cut off the Chinese people’s access to much of the global internet. But recent actions in China focus on its own tech companies. These moves include passing a stringent new privacy law (which offers no protection from government spying) and tough new antitrust restrictions. China also blocked internet finance company Ant’s I.P.O., fined e-commerce company Alibaba 18.2 billion yuan and has heavily regulated online lenders, rapidly reducing their numbers from 5,000 to six as of September 2020. One prominent financial tycoon was abducted in Hong Kong, taken to China, and is apparently under house arrest while Chinese regulators seize and dismantle his companies. The crackdown expands beyond tech companies to users – Chinese police have arrested social media stars for on-camera eating as part of a campaign against food waste. It is, according to commentary circulated by Chinese state media, a “profound revolution” against “the chaos of big capital” and “a return to the Communist Party of China’s initial aspirations, a return to people as the center, and a return to the essence of socialism.”

In short, China’s leaders are grasping to centralize control. And their method is to label individualism as a vice rather than a virtue.

China’s leaders fear that they are losing control of markets and society, especially in the digital age.

They are right. But as I argue in my forthcoming book, Getting Out of Control: Emergent Leadership in a Complex World, control is overrated – and often it is counterproductive. Complex systems like markets are characterized by emergent order, with robust and productive patterns forming from the interactions of many individual participants following relatively simple rules. These patterns cannot be anticipated or centrally designed, because the knowledge they embody is produced by the individuals grappling with the situations in front of them.

Attempts to centrally control such systems eliminate much of the nuance and knowledge contained within them. The result is a simplistic, centralized system that leaves most participants worse off than they were under the emergent order produced by the complex, decentralized system. Unsurprisingly, those who are better off under centralized systems tend to be those at the center – those in control. Their control comes at the expense of everyone else’s welfare.

I don’t expect this argument to persuade China’s leaders to change their path, although for their citizens’ sake I wish they would. But it might help guide our path here in the U.S. The U.S. character – and our Constitution - would never permit the kind of full-bore government centralization that China has undertaken. Yet the technocratic desire to be in control, especially in times of rapid change, is alive and well here. 

Indeed, many of the ideas China has adopted are floating around U.S. academia and even Capitol Hill. Breaking up big tech, regulating new technologies like blockchain and cryptocurrencies, regulating what kind of speech cannot or must be allowed on social media sites, limiting the use of encryption – these are increasingly common sentiments across the U.S. political spectrum. Sen. Josh Hawley’s proposed bill to ban “infinite scroll” on phone apps would fit in seamlessly with the Chinese government's diktats.

It's as if China is taking the most precautionary policies from US academics, advocates, and lawmakers and implementing them via boot, truncheon, and machine gun. In fact, China’s commercial privacy law – created by a government that surveilles its citizens relentlessly – has drawn praise from some U.S. tech policy leaders who seem to wish we in the U.S. could ram through such onerous laws without the inconveniences of the democratic process.

But America’s strengths include our embrace of individualism, couched appropriately within functioning institutions (themselves artifacts of emergent order), and our willingness to participate in complex systems where no one seems to be in control. These strengths have made the U.S. an economic powerhouse, home to many great innovators in technology and businesses, and the source of creative expression that entertains and educates the world.

As tech analyst Ben Thompson has argued, let’s not do a pale imitation of China's attempt to stamp out individualism and centralize control. Instead, let's double down on freeing the individual to create solutions to the problems they and others face.

Even if that means you, not the government, has to tell your kid to put down the game controller.

Neil Chilson is a senior technology and innovation research fellow at Stand Together and former Chief Technologist at the Federal Trade Commission. His new book, "Getting Out of Control: Emergent Leadership in a Complex World," will be released on September 23.

Filed Under: china, emergent order, internet policy, tech policy, top down, video games

China's New Youth Online Gaming Restrictions Birth Underground Workaround Industry To Defeat It

from the oops dept

It will not be controversial to say that China has always been one of the leaders in the war on the internet and culture alike. Between the Great Firewall of China at the macro level, the almost hilariously Orwellian tactics like forbidding certain karaoke songs, and the full destruction of democracy in Hong Kong, it's clear that Beijing values control over everything else.

But control isn't always so easy to implement. Take China's restrictive new regulation on online gaming among youths, for instance. These rules, implemented in order to combat "video game addiction" for minors, limit online gaming Friday through Sunday and on national holidays to 1 hour a day, 8pm to 9pm. This is achieved by forcing the gaming companies to implement a "real name" account policy. Gamers have to create an account utilizing their real names, which are checked for user age, in order to get into the online games.

Well, you probably already know where this is going. The new rule has given rise to an underground industry for renting gaming accounts that are registered to adults. Adults can also just let their children use their accounts, also defeating the check. In other words, this has all become somewhat pointless.

‘Complying with the new rule isn’t technically difficult because it’s just a matter of writing new [Software Development Kit] codes,’ Zhu told Kotaku. ‘[SDKs are] integrated as part of the login process. What happens is that when new players log in, they are asked to enter their ID number which then verifies their age. Every gamer needs to log in with their real names…[and] every [domestic] game that legally operates in China is required to have that function.’

According to Niko Partners’ [Daniel] Ahmad, parents aren’t barred from giving their unrestricted adult accounts to their children, and there’s a large gray market for adult gaming accounts. If an underage player wanted to, they could circumvent the new restrictions

And they are! Nobody can say for sure how much of this is occurring, but if the lawsuits are flying about you can bet that it is some significant number. And, considering that one of the methods for defeating the restriction is for parents to simply let their kids use parental accounts, this all seems really silly. After all, it should be obvious that the main thrust for China putting these rules in place is some version of Beijing wanting to parent children, only to have those rules defeated by parents and children.

So, does China admit defeat and rescind or rework the new rules? Of course not!

This summer, Tencent rolled out a time-sensitive facial recognition system for sixty games, including Honor of Kings. Dubbed “Midnight Patrol,” it aims to prevent tricksy youngsters from posing as grown-ups between 10pm and 8am. “We will conduct a face screening for accounts registered with real names and that have played for a certain period of time at night,” Tencent Games said at the time (via Sixth Tone). “Anyone who refuses or fails the face verification will be treated as a minor, and as outlined in the anti-addiction supervision of Tencent’s game health system, and kicked offline.”

And you can bet that the facial recognition piece of this will be defeated, too. That is how this sort of thing tends to go, after all. This is something akin to the famous John Gilmore quote that the internet sees censorship as damage and routes around it.

Game on, Chinese youth!

Filed Under: china, restrictions, video games, workaround

China's New Internet Regulations, Building On Western Internet Regulations, Requires Algorithms To 'Vigorously Disseminate Positive Energy'

from the justifying-actual-suppression-of-ideas dept

When the UK announced its rebranded "Online Safety" bill (originally, the "Online Harms" bill) we noted that the mechanism included was effectively identical to the original Great Firewall of China. That is, when China first began censoring its internet, rather than telling websites explicitly what needed to be taken down, it just gave vague policy guidance about what "harmful" information would be a problem if it was found online, and backed that up with a serious threat: if any service provider was found not to have taken down information the government deemed problematic, it would face serious consequences. There was, of course, no such threat for taking down information that should not have been taken down. The end result was clear: when in doubt, take it down.

It remains preposterous to me that all across Western democracies, we've seen them taking the same basic approach -- insisting that platforms need to be much more aggressive in pulling down "bad" information (loosely defined), with significant liability attached to leaving it up (even if the content is legal), and little in the way of punishment for overblocking. And, over and over and over again studies have shown that when you set up a liability regime this way, you get massive overblocking. It seems that some countries see that as a feature, not a bug.

And, of course, with that approach now being picked up in other countries, China has apparently decided to ramp up its own approach. Under the guise of stopping "harmful" information online, China has released a draft of new regulations to punish internet companies that don't remove harmful information:

China kicked off a two-month campaign to crack down on commercial platforms and social media accounts that post finance-related information that’s deemed harmful to its economy.

The initiative will focus on rectifying violations including those that “maliciously” bad-mouth China’s financial markets and falsely interpret domestic policies and economic data, the Cyberspace Administration of China said in a statement late Friday. Those who republish foreign media reports or commentaries that falsely interpret domestic financial topics “without taking a stance or making a judgment” will also be targeted, it added.

Part of this new effort is a set of draft regulations for "algorithmic recommendation" systems. Kendra Schaefer wrote out a detailed Twitter thread analyzing the proposal, and just how far reaching it is.

Among the new rules (as translated by by Stanford's DigiChina center) are some... um... interesting ones.

Algorithmic recommendation service providers shall uphold mainstream value orientations, optimize algorithmic recommendation service mechanisms, vigorously disseminate positive energy, and advance the use of algorithms upwards and in the direction of good.

Algorithmic recommendation service providers may not use algorithmic recommendation services to engage in activities harming national security, upsetting the economic order and social order, infringing the lawful rights and interests of other persons, and other such acts prohibited by laws and administrative regulations. They may not use algorithmic recommendation services to disseminate information prohibited by laws and administrative regulations.

It limits what kinds of keywords can be used. "Harmful" information cannot be used, nor "biased user tags" (whatever that means):

Algorithmic recommendation service providers shall strengthen user model and user tagging management and perfect norms for logging interests in user models. They may not enter unlawful or harmful information as keywords into user interests or make them into user tags to use them as a basis for recommending information content, and may not set up discriminatory or biased user tags.

There are also rules against using algorithms to manipulate systems -- but also to "shield information," which seems to contradict the requirements to block lots of information.

Algorithmic recommendation service providers may not use algorithms to falsely register users, illegally trade accounts, or manipulate user accounts; or for false likes, comments, reshares, web page navigation, etc.; or to carry out flow falsification or flow hijack. They may not use algorithms to shield information, over-recommend, manipulate topic lists or search result rankings, or control hot search terms or selections and other such interventions in information presentation; or to carry out self-preferencing, improper competition, influence on online public opinion, or evasion of supervision and management.

That one about "influencing public opinion" sure is interesting. How do you avoid influencing public opinion?

Like many recent regulatory proposals in the US, Canada, the EU and elsewhere, China leans heavily on "transparency" when it comes to algorithms:

Algorithmic recommendation service providers shall notify users in a clear manner about the situation of the algorithmic recommendation services they provide, and publicize the basic principles, purposes and motives, operational mechanisms, etc., of the algorithmic recommendation services in a suitable manner.

But, of course, viewing this in the Chinese context shows why such mandatory transparency has risks. In this case, China wants this transparency so it can further regulate what information people will see via algorithmic recommendations, and to intimidate/threaten companies not to spread information the government wants suppressed.

Again, similar to various internet regulations in the West, China has a nod towards end-user control and empowerment:

Algorithmic recommendation service providers shall provide users with a choice to not target their individual characteristics, or provide users with a convenient option to switch off algorithmic recommendation services. Where users choose to switch off algorithmic recommendation services, the algorithmic recommendation service provider shall immediately cease providing related services.

Algorithmic recommendation service providers shall provide users with functions to choose, revise, or delete user tags used for algorithmic recommendation services.

Where users believe algorithmic recommendation service providers use algorithms in a manner creating a major influence on their rights and interests, they have the right to require the algorithmic recommendation service provider to give an explanation and adopt related measures to improve or remedy the situation.

But, again, when viewed in the Chinese context, you can easily see how this kind of mandate can be abused heavily.

There is also, a "think of the children" provision, because no internet regulations these days are complete without such a moral panic heart string pull:

Where algorithmic recommendation service providers provide services to minors, they shall fulfill duties for the online protection of minors according to the law, and make it convenient for minors to obtain information content beneficial to their physical and mental health, through developing models suited for use with minors, providing services suited to the specific characteristics of minors, etc.

Algorithmic recommendation service providers may not push information content toward minor users that may incite the minor to imitate unsafe conduct, or acts violating social morals, or lead the minor towards harmful tendencies or may influence minors’ physical and mental health in other ways; and they may not use algorithmic recommendation services to lead minors to online addiction

Also, there's a built in complaint mechanism.

Algorithmic recommendation service providers shall accept social supervision, set up convenient complaints and reporting interfaces, and promptly accept and handle complaints and reports from the public.

Algorithmic recommendation service providers shall establish user appeals channels and mechanisms, to standardize the handling of user appeals and the timely provision of feedback, and realistically ensure the lawful rights and interests of users.

Failing to abide by these rules will get the companies fined (relatively small amounts -- about $1k to $5k -- at first). However, it also opens them up to significant criminal liability as well.

As Schaefer notes, this is China "going beyond" the internet regulations in the EU. But, what's left unsaid is that some of this is enabled by just how far the EU and others have gone in trying to get the internet to paper over the societal problems created by government failures in other realms.

It should be leading us to wonder why it is that China is so eager to embrace and extend this approach to internet regulations, rather than as an endorsement of such an approach.

Filed Under: algorithms, china, intermediary liability, internet regulations, online harms, online safety

Chinese Government Censors Back On Their Karoake Song Banlist Bullshit

from the I'd-like-to-teach-the-world-to-sing-government-approved-songs-only dept

The perpetual motion machine that is the Chinese government's censorship arm rolls on. While China has embraced a particularly state-focused form of capitalism, it still engages in the sort of stuff long associated with the Chinese government, like mass censorship, government corruption, and the mass incarceration of undesirable citizens.

Taking a brief break from its strongarm takeover of Hong Kong -- a project that's running decades ahead of schedule -- the government is (again) imposing its will on presumably drunken participants in the world's worst party game, karaoke. (h/t Sarah McLaughlin)

China is set to ban karaoke songs that contain "illegal content", its Ministry of Culture and Tourism has announced.

Songs that fall under this category include those that endanger national unity, sovereignty or territorial integrity.

Songs that aren't sufficiently celebratory will apparently be whisked away to songwriting camps in order to infuse the lyrics with the appropriately pro-government sentiments.

Those who provide content to karaoke venues have been urged to review the songs and flag up to the ministry those that are potentially harmful.

Actually, it may be karaoke providers being whisked away if they're not providing uplifting melodies celebrating the many triumphs of the Chinese government, each one more triumphant than the last. (But not so triumphant they overshadow past triumphs, lest citizens find themselves not celebrating their historic betters by singing along in a "what have you done for me lately" fashion.)

One of the many, many triumphs of the Chinese government is its past victories over the impetuousness of ineptly-sung versions of popular tunes. No doubt many new songs have been written about the Chinese government's defeat of the old standby [squints at news report] "Fart."

China has banned 120 songs from the Internet after deeming them “harmful” to society.

[...]

The offending titles – all Chinese songs – included “No Money No Friend,” “Don’t Want To Go To School,” and “One Night Stand.”

A popular MC Hotdog song, which includes the line ‘I don’t love Chinese women, I love Taiwanese girls’ was blacklisted, as was a song named “Fart” that included the lyrics: “There are some people in the world who like farting while doing nothing.”

As "Fart" goes, so goes the great nation. The new crackdown shifts culpability to karaoke content providers and away from venue operators. Given the expansive nature of some of these collections (upwards of 100,000 songs), the government felt it more appropriate to fine/jail/beat into submission those holding the songbooks, rather than those hosting the songbook-holders.

Incredibly ironically, the expanded ban targets songs that "incite ethnic hatred." As has been reported multiple times, ethnic hatred is one of the things the Chinese government is really good at, so it seems somewhat self-defeating to discourage people from celebrating one of the government's mainstays: the repeated oppression of its own citizens because of their religious beliefs.

Then there's this, which would be completely comical if it weren't coming from a government that defines the phrase "abuse of power."

A central song list would be created by the ministry for karaoke venues…

It almost sounds like a fun job! The sort of job someone could do in five hours a week while collecting a 40-hour paycheck, troubled only by the occasional "investigative" trip to the local karaoke bar.

If nothing else, the new ban list will provide a bump for artists whose songs have been officially ostracized. Nothing calls attention to "unapproved" music like a list of unapproved songs for citizens to hunt down, listen to, and perhaps belt out into the nearest microphone.

Filed Under: bans, censorship, china, free speech, karaoke

Biden Warns That The Next Kinetic War Will Be The Result Of A Cyberattack, Which Is Stupid

from the stop! dept

The cyberwar hype has been going on for nearly a decade now. And, while it is very much the case that cybersecurity to defend from international actors is very much a real need, it's also true that dangling the threat of cyberwarfare over the public's heads has been purposefully done to excuse governmental power grabs at the military and intelligence agency levels. It's also been true throughout this hype-fest that the US government has been practically begging for there to be a cyberwar in the first place... except that other nations mostly seem to play with this at the most minimal levels. And, in the past, the American government has indicated that real shooting wars may result from cyberwar activities.

Now, none of the above is meant to suggest that there can't be a situation in which a foreign state actor engages in "cyber" actions so egregious that traditional military action would be warranted. Rather, the point is that such scenarios are both so egregious in their nature, and that they certainly haven't occurred to date, that to make threats of shooting wars as a result seems like a massive overreaction.

Unless, of course, you're President Joe Biden, in which case you walk in front of the Office for the Director of National Intelligence and assert with certainty that the next kinetic war will absolutely start as a result of a "cyber breach."

“If we end up in a war, a real shooting war with a major power, it’s going to be as a consequence of a cyber breach,” the president said in a speech at the Office for the Director of National Intelligence, which oversees 18 US intelligence agencies.

Although he did not say who such a war might be fought against, Biden immediately name-checked Russia’s president Vladimir Putin, alleging that Russia was spreading misinformation ahead of the 2022 US midterm elections.

This is quite stupid for a variety of reasons. Let's start with the most obvious: when politicians talk about conflicts between "major powers", you can simply replace "major" with "nuclear" and it's the same message. And if we're talking about suffering a "cyber breach" conducted by a "nuclear power", then proactively escalating the engagement rules into the kinetic warfare realm puts the entire world in a suddenly more dangerous place.

And this doesn't even work from a level of deterrence either. First, nations like Russia and China have generally shown themselves to be largely un-deterrable in the cyberwarfare space. It's not even entirely clear that our intelligence services are fully buttoned up on any given breach when it comes to who the attackers are and what level of state action is involved. For that to result in a kinetic war is, again, very stupid.

The statement also gives full permission to America's rivals throughout the world to put out their own statements in kind. And does anyone seriously doubt that we are engaging in cyber breaches at some level against our rivals ourselves? So, given Biden's stance, would it be morally correct for Russia or China to suspect America of some kind of intrusion... and start shooting? That's really where we want to end up?

Somehow I doubt it. Instead, this appears to be good, old-fashioned American myopic thinking at work. We do entirely too much of this: try to put out deterrence or threats without understanding that the result will be nations throughout the world lobbing those same threats right back at us. And if all of that were to result in warfare, never mind nuclear warfare, that would be abhorrent.

Filed Under: china, cyberattacks, cyberwarfare, joe biden, kinetic war, russia, us

Oversight Report Says Commerce Dept. Investigative Unit Went Rogue, Engaged In Biased, Retaliatory Investigations

from the power-corrupts dept

Years after it was granted too much power, a federal internal investigations unit created during the presidency of George W. Bush is finally having its dirty laundry aired. The Senate Commerce Committee -- years after the fact -- is finally delivering some oversight of an entity created to root out internal threats.

The ITMS (Investigations and Threat Management Service) operated largely under the radar, thanks to its housing within the Commerce Department -- an entity that very rarely raises too many eyebrows. But its reach extended far past the confines of this department. And it was given broad discretion to initiate investigations -- something that led directly to the Justice Department crafting new rules for espionage investigations after a series of failed prosecutions indicated the intel coming from the ITMS was extremely questionable.

It was the ITMS that initiated the investigation of a US citizen of Chinese descent who did nothing more than share publicly-available information with a Chinese government official -- an official who happened to be a friend of Department of Weather Services employee Sherry Chen. Chen's prosecution was just a leading edge indicator of the ITMS's lack of accountability and incredible amount of power.

The report [PDF] released by the Commerce Committee shows the ITMS wasn't as much interested in rooting out internal threats as it was in rooting out government employees of certain nationalities.

Although many investigations targeted legitimate threats, the ITMS appears to have opened cases on a variety of employees for the purpose of exaggerating the unit’s ability to uncover security risks within the civil service. The unit targeted visible employees across the Department, including award-winning professionals whose background investigations had been successfully adjudicated by other agencies. These probes often resulted in suspended or revoked security clearances, although subsequent reviews largely determined that the unit’s allegations lacked merit. The ITMS also broadly targeted departmental divisions with comparably high proportions of Asian-American employees, ostensibly to counter attempts of espionage by individuals with Chinese ancestry. Former and current ITMS employees became subjects as well for challenging the lawfulness of the unit’s practices.

Saying the unit went rogue isn't hyperbole. It's a fact.

Poor management and weak oversight allowed the ITMS to operate outside the norms of the law enforcement community. Deficient policies and procedures outlining the unit’s investigative capabilities led to repeated instances of malfeasance, including the purposeful prolonging of investigations, unauthorized use of secured messaging systems, and overclassification of documents to protect the unit from external scrutiny.

The first bullet point of the report's "Findings" spells it out explicitly.

Investigating threats against the Secretary of Commerce and the Department’s assets without a clearly defined mission ultimately led to the mutation of the ITMS into a rogue, unaccountable police force across multiple presidential administrations.

The ITMS originally had no power of its own. Its power was derived from the US Marshals Service, which provides protection to the Commerce Department and its "critical assets." It's the last term that caused trouble. Authority to protect "critical assets" allowed the ITMS to abuse the poorly-defined term to open investigations and engage in activities that went beyond its original purview, as well as limits placed on the Marshals Service.

This lack of oversight, accountability, and respect for the Constitution led directly to the DOJ dismissing prosecutions originating from ITMS investigations. ITMS investigators engaged in highly-questionable activities, including concealing their identities, seizing government computers and devices to perform warrantless searches, and picking the locks of government offices and personal storage containers owned by government employees. Whenever these tactics were challenged by government employees, these employees soon found themselves subjected to additional ITMS scrutiny.

Tactics the general public never would have condoned were bought and paid for with tax dollars.

Because of inadequate oversight by the Inspector General’s office, the unit’s improper exercises of law enforcement powers likely resulted in preventable violations of civil liberties and other constitutional rights, as well as a gross abuse of taxpayer funds.

In 2005, the ITMS was limited to protecting tangible assets, like federal facilities. This began to morph as it was given discretion to look for threats to intangible "assets," like "U.S. economic advancement" and "Departmental functions." This then expanded to cover anything the ITMS felt was "inadequately protected." As its purview expanded, the ITMS granted itself plenty of new law enforcement powers, despite receiving no permission or direction to do so from Congress, its apparently-absent oversight, or the US Marshals Service.

Once it had expanded its area of coverage to include whatever it wanted to throw resources and Constitutional violations at, the ITMS began doing things like this:

Without a defined meaning of what constituted a critical asset from the Marshals Service, the ITMS conducted investigations typically reserved for domestic law enforcement agencies. Many were conducted in an overzealous manner whereby agents abused steps in the investigative process. In one instance, the ITMS investigated Sherry Chen, an award-winning, Chinese-born hydrologist employed at the Department, on charges of espionage and providing false statements after she allegedly downloaded and distributed unclassified information to a foreign national. Agents reportedly interrogated her for seven hours and told her she could never discuss the interrogation with anyone, including her superiors. In a lawsuit filed against federal officials, Chen said that ITMS agents “ignored exculpatory evidence throughout the interview, reached false conclusions without even a cursory investigation of underlying facts, and reported false results reflecting their racial and ethnic bias.”

And even when the ITMS couldn't find anything substantial to justify its investigations, it still found something to bring to federal prosecutors.

In one document, ITMS officials described to agents a broad range of offenses for which referrals to federal prosecutors could be made. Substantive offenses included racketeering, money laundering, and theft of government property, espionage, economic espionage, and computer fraud. More commonly, however, ITMS agents sought to charge targets of its criminal investigations with offenses such as obstruction, conspiracy, making false statements to federal agents, and resistance to search.

The ITMS went past believing it was a law enforcement agency with zero accountability to believing it was an intelligence agency with a similar lack of accountability. And, like other law enforcement agencies who believe themselves to be intelligence agencies, the ITMS engaged in "investigations" predicated on little more than last names or native language.

Whistleblowers claim, for example, that agents were directed to run ethnic surnames through secure databases even in the absence of evidence suggesting potential risk to national security, indicating that immutable characteristics served as a pre-text for initiating investigations. Documents show that the ITMS also ran broad keyword searches of email accounts using a broad variety of terms and phrases in Mandarin Chinese, such as “state key laboratory,” “overseas expert consultant,” “Ministry of Science and Technology,” “funding support,” “government support,” and “highly secret.” Multiple whistleblowers claimed that the unit worked with officials at the CIA and FBI to devise the list of search terms and review the results.  

[...]

One former senior Commerce Department official described the indiscriminate targeting of Chinese-Americans as a “fine line between extra scrutiny and xenophobia, and one that ITMS regularly crossed.” This official also discovered a case into a Chinese-American employee at the Department left open for four years without any indication of investigative diligence to close the matter, claiming that the ITMS “targeted her purely because of her ethnic Chinese origin.” The official also believes that ITMS leaders directed agents to “launch the investigation for the purpose of raising the heat so high that she became radioactive and would have to leave the Department,” despite no indication that she presented a national security threat after her emails had been pulled and agents surveilled her on Department premises and at her home.

The ITMS also surveilled US citizens who weren't government employees, opening investigations into people associated with foreign visitors to Commerce Department buildings. And it monitored social media accounts that raised questions about the 2020 Census' accuracy, forwarding all flagged posts to the FBI's Foreign Influence Task Force. Most of the accounts flagged had less than 100 followers. No threats were determined to be credible, and yet the investigations into these accountholders remained open all the way through the end of 2020.

Abuse of power, retaliation, unjustified investigations, violated rights, racial profiling… all of this overseen by no one and tracked solely by an Excel spreadsheet that provided no way for investigators to attach documentation or submit findings. With no internal tracking or external oversight, millions of tax dollars were misspent and resources utilized to engage in fruitless, pointless, or retaliatory investigations. In the end, the ITMS was mainly concerned about sustaining its own existence.

One former senior official even described the network as a “vanity project” designed to showcase an unusual volume of open cases rather than facilitate a user-friendly system for agents to use in processing them. The official said leadership of the ITMS is more interested in appearing productive to retain the ability to investigate a wide variety of purported threats with broad discretion––and continue receiving funding from Congress––than processing cases within an acceptable period of time.

The entire report is harrowing, showing how much damage a government entity can do when its purview is nearly unlimited and its oversight nearly nonexistent. This report will hopefully result in the ITMS being brought into check, but Commerce oversight still needs to explain why it allowed the ITMS to run rogue for more than a decade before it finally decided to step in and do something about it.

Filed Under: china, commerce department, investigations, itms, senate commerce committee

MAGA 'Freedom Phone' Targets Rubes With Dubious Promises Of Privacy

from the one-born-every-minute dept

If you hadn't noticed, there's been no shortage of dodgy folks attempting to cash in on the MAGA craze. There's also been no shortage of folks eager to cash in on the generalized animosity against "big tech" driven by bogus claims of "Conservative censorship" (aka: people being held vaguely accountable for being racist assholes on the internet via clumsy Silicon Valley moderation practices that don't work well at scale).

Enter the $500 Freedom phone, a new device being targeted at MAGA devotees promising an "uncensorable App Store," all your favorite right-wing apps preloaded, and promises that users can take "back control" from big 'ole mean big tech.

Amusingly there's no real detail anywhere on the website in terms of specs or build, meaning users have no real idea what they're actually signing up for. But when The Daily Beast had somebody take a closer look at the device, they found it was likely a Chinese-made A9Pro (retail: $120) running a modified version of Google's Android OS dubbed "FreedomOS":

"Freedom Phone appears to be a simple rebranding of a budget phone called the “Umidigi A9 Pro,” made by the Chinese tech company Umidigi. In an interview with The Daily Beast, Finman confirmed that the Freedom Phone was manufactured by Umidigi, but couldn’t say immediately which Umidigi phone it was based on.

The Freedom Phone’s $500 price tag would represent a substantial markup on the Umidigi A9 Pro. That phone is available on Chinese retail giant AliExpress for $120 — less than one quarter of the price of a Freedom Phone."

The phone in question appears to be one of several discounted Android phones with insecure configurations that are vulnerable to a long list of trivial vulnerabilities. The low cost, high-customizability of such phones make them more vulnerable than more expensive options, and less likely to see consistent security updates. In short, the Freedom phone appears to not only be an overpriced version of a fairly underwhelming phone, it potentially makes its customers more vulnerable to the type of spying and government surveillance they're being told they're avoiding.

In a post to Twitter, the phone's creator proclaims the phone is "the first major pushback on the Big Tech companies that attacked us - for just thinking different." Though as several Twitter users were quick to point out, a completely unmoderated or managed app store means it's easy for any random idiot (or government) to launch a bevy of privacy-violating and malware-laden apps designed to hoover up your personal details:

As Gizmodo notes, the ironic part is there's ample resources for folks genuinely interested in freeing themselves from Google and Apple. There's massive online communities designed around letting you bypass the Android/iOS gatekeeper logjam, often for a fraction of the cost of the Freedomphone. The Linux-based Pine phone, for example, offers a significantly cheaper option with greater transparency into what you're actually buying. The /e/ Foundation also sells refurbished and "de-Googled" discount phones that are likely notably more secure at a lower price point (with caveats).

Of course this all assumes that you genuinely care about privacy and aren't just gesticulating wildly based on a bunch of bullshit fed to you by a NYC real estate conman with a terrible combover.

Filed Under: android, censorship, china, erik finman, freedom phone, maga

Tesla Urged Chinese Government To Censor Critics In China

from the good-luck-with-that dept

Outside of the company's unwavering fanboys, it's fairly clear to most folks that the honeymoon phase of the planet's relationship with Tesla is coming to a close. Whether it's regulatory scrutiny of the company's premature and often inaccurate self-driving claims, the loss of significant emissions credits in the US and Europe, frustration at the often stupid shit that comes out of Elon Musks' mouth, legal issues related to the SolarCity acquisition, or major quality headaches related to the company's solar installations and cars alike, the bloom has, as they say, fallen from the rose.

That also extends to China, where Tesla's early successes appear to have hit a bit of a roadblock. Part of that roadblock recently emerged in the form of a massive recall of nearly every Tesla sold in China due to software issues. Responding to bipartisan US aggressiveness (see: TikTok), the Chinese government has also banned all Teslas from being used by government agencies, citing potential privacy natsec concerns. After initially rolling out the red carpet, Chinese officials have sharply shifted their tone over the better part of the last year.

As Bloomberg notes, genuine concerns about Tesla safety, government anger over Tesla hubris, and a souring US/China relationship appear to have fused into one big headache for the company:

"Tesla’s experience is “a warning shot that they need to stay between the lines, and not be so flamboyant in their success,” said Bill Russo, a former Chrysler executive who’s now chief executive officer of Automobility Ltd., a Shanghai-based consultancy. “You can’t be so far up front that you become arrogant in the way you conduct yourself.”...

Signals of a tougher stance toward Tesla came as early as February, when agencies including the State Administration for Market Regulation, China’s most important market watchdog, summoned executives to discuss what they said were quality and safety issues in Tesla vehicles, including reports of abnormal acceleration and battery fires. After the meeting, Tesla issued a statement so apologetic it verged on groveling, declaring it had “sincerely accepted the guidance of government departments” and “deeply reflected on shortcomings."

To counter the shift, Tesla has engaged in a massive new PR push on social platforms, and some newfound groveling at the feet of Chinese authorities. But Bloomberg buries a troubling part of said groveling in a throwaway sentence halfway into the story. Namely the fact that Tesla went so far as to ask the Chinese government to use its immense censorship apparatus to censor company critics online:

Previously focused on state-run media, Tesla is now trying to build relationships with auto-industry publications and influencers on platforms such as Weibo and WeChat, for example by inviting them on factory tours, and conducting group “discussion sessions” with policymakers, consumers, and media outlets. According to people familiar with the matter, it’s also complained to the government over what it sees as unwarranted attacks on social media, and asked Beijing to use its censorship powers to block some of the posts."

Asking the government to censor online criticism of your products isn't likely going to do much to shift public sentiment back in Tesla's favor. Again, Tesla's now facing what's probably a combination of legitimate anger over the company's documented hubris, exaggerated promises, and potential safety issues, fused with China's over-arching policy goal of empowering its own electric car makers (Nio, Xpeng) and countering growing US animosity. Combined, they've resulted in a 50% drop in new Tesla orders in China over just the last few weeks.

I get the sense in the coming year that Tesla (and its unwavering devotees) will focus entirely on the latter (the government is unfairly targeting us for being American!) and less on the obvious need, both overseas and here in the States, for a dramatic fix for the company's product quality issues, ridiculous hype, and less than flattering executive character flaws.

Filed Under: censorship, china, critics, elon musk, great firewall
Companies: tesla