Federal Judge Says FBI Obtained Twitter Employee's Emails Illegally

from the sliding-under-the-low-bar-of-probable-cause dept

In late 2019, the federal government indicted a Twitter employee, accusing him of acting as an agent of Saudi government. The allegations were pretty ugly.

Defendants Ahmad Abouammo, Ali Alzabarah, and Ahmed Almutairi were charged by Indictment on November 19, 2019 for acting as agents of the government of Saudi Arabia without notification to the Attorney General as required by law. Abouammo and Alzabarah, while employees at Twitter, accessed without authorization and provided to officials of the government of Saudi Arabia nonpublic information about Twitter users that were of interest to the government of Saudi Arabia, including dissidents and critics of the government.

No one needs to be helping the Saudi government hunt down dissidents. This is a government that has actually killed a journalist critical of the Saudi prince -- a killing followed by a dismemberment that occurred in the Saudi government's Istanbul consulate.

The accusations were that Abouammo used his position as media partner manager for Twitter's Middle East presence to access information about accounts the Saudi government wanted to spy on. The government has been pursuing a conviction for a couple of years now and has just been hit with a little bad news. It appears the FBI colored outside the constitutional lines while compiling evidence against Abouammo. Here's Nicholas Iovino with more details for Courthouse News Service:

In August 2016, the FBI seized Abouammo’s Google account records, which revealed that a Saudi foreign official had emailed the defendant around the same time Abouammo started suddenly and frequently accessing a prominent Saudi critic’s user account, according to federal prosecutors.

Prosecutors say the email exchange also coincided with Abouammo meeting the Saudi foreign official in London, receiving a $20,000 watch from that same official and having numerous phone conversations with the Saudi representative.

Abouammo asked U.S. District Judge Edward Chen to throw out that evidence, arguing the FBI failed to establish probable cause in a search warrant application before confiscating his personal data.

On Tuesday, Chen partly granted Abouammo’s request.

The ruling [PDF] says the FBI used a bit of guesswork in a warrant affidavit, allowing presuppositions to replace facts. That sort of thing doesn't comply with the Fourth Amendment.

Even assuming a deferential scope of review of the magistrate judge’s determination, see United States v. Wright, 215 F.3d 1020, 1025 (9th Cir. 2000), it is clear there was no probable cause to support the 2016 search. While there was probable cause to believe Defendant Ali Alzabarah accessed Twitter user information without authorization and that it was done at the behest of Foreign Official-1, there was no such probable cause with respect to Defendant Abouammo.

The indictment says one thing, but the affidavit the FBI used to obtain information says another.

There is no allegation that Defendant Abouammo, a U.S. citizen born in Egypt with no personal ties to Saudi Arabia, obtained unauthorized access to Twitter users, much less at the behest of the Saudi government. The circumstantial evidence of communications reveal little more than sporadic unremarkable communications with these subjects which does not fit any pattern with the illicit conduct of Defendant Alzabarah or Official-1.

And there may not even be any conspiracy… or at least none alleged sufficiently in the warrant affidavit seeking information from Google.

Other than being reciprocal Twitter followers, there is no evidence of any communication between Defendant Abouammo and Defendant Alzabarah. Similarly, there is little communication between Defendant Abouammo and Defendant Almutairi cited in the affidavit – i.e., two text messages in December 2014 prior to the alleged unlawful conduct of Defendant Alzabarah which started in January 2015.

From what the judge can see, there's hardly any connective tissue between the allegations made by the government and the justifications it put in its affidavit when seeking a search warrant.

Defendant Abouammo’s emails to other senior Twitter directors who were located in other countries (outside the U.S. and Saudi Arabia) in December 2015 and January and February 2016 also prove nothing. There is no allegation that these directors were involved in any unauthorized access to use accounts or were connected with Official-1 or the Saudi government. Furthermore, the emails were sent to these directors’ Twitter email accounts, hardly a way to solicit participation in an illicit scheme as the government now suggests. That certain Saudi officials (other than Official-1) were brought into conversations in email exchanges with one of the Twitter directors again proves nothing. The sporadic patternless communications described in the affidavit – which include no direct communications with Defendant Alzabarah and two early (2014) text messages with Defendant Almutairi – are insufficient to establish probable cause to believe Defendant Abouammo had accessed without authorization Twitter user accounts at the behest of the Saudi government.

The results of this search will be suppressed. The government simply doesn't have enough to justify this search. And the warrant is so deficient the court doesn't see how the government could say it relied on it in good faith. Everything derived from this search is suppressed.

But that doesn't mean Aboumammo is in the clear. Subsequent searches appear to have turned up other usable evidence and those still stand for the time being. The FBI's 2018 search warrant (and the results of that search) is still in play, even when everything derived from the 2016 search is stripped from the affidavit.

Given what's said in this short suppression order, it appears the FBI turned a hunch into a fishing expedition at Google HQ. If the government wants to prosecute federal crimes, it needs to remember all the rights it said were inalienable. Searches based on speculation aren't acceptable. And hey, FBI: maybe don't be evil.

Filed Under: 4th amendment, ahmad abouammo, ahmed almutairi, ali alzabarah, email, espionage, fbi, probable cause, saudi arabia, warrant
Companies: twitter

The Idea That Banning TikTok Thwarts Chinese Intelligence In Any Way Is Ridiculous

from the sitting-at-the-kid's-table dept

As we've noted a few times, not much about the Trump administration's ban of TikTok makes coherent sense. Most of the biggest TikTok pearl clutchers in the GOP and Trump administration have actively opposed things like basic US privacy laws or even improving election security, and were utterly absent from efforts to shore up other privacy and problems, be it the abuse of cellular location data or our poorly secured telecom infrastructure. It's a bunch of xenophobia, pearl clutching, and performative politics dressed up as serious adult policy that doesn't even get close to fixing any actual problems.

And yet, many reporters and internet experts keep parroting the idea that banning TikTok somehow "protects U.S. consumers" or "prevents the Chinese government from obtaining U.S. consumer data." You're to ignore that Americans install millions of Chinese-made "smart" TVs, fridges, and poorly secured IOT gadgets on home and business networks with reckless abandon. Or that international corporations not only sell access to consumer data to any nitwit with a nickel, they often leave it unencrypted in the cloud. Or that the U.S. has no privacy law for the internet era, and corporations routinely see performative wrist slaps for privacy and security incompetence.

The idea that Chinese intelligence, with zero scruples and an unlimited budget, "needs" TikTok access to spy on Americans' data in this environment is just silly nonsense. Any yet, here we are.

It's all even more absurd when you consider the scope and complexity of global adtech markets. As Gizmodo's Shoshana Wodinsky recently explored, international adtech is a complex, unaccountable monster. This orgy of consumer tracking, behavioral data, and "anonymized" (read: not actually anonymous at all) datasets is so complex, even folks that cover the sector have a hard time understanding it. Thinking we can control what data the Chinese government is gleaning from this tangled web -- or that even selling TikTok to Microsoft somehow "fixes" anything -- is an act of hubris in full context:

"Over time, what’s become very, very clear is that while, say, Google and Facebook and TikTok are ultimately at the whims of local regulators, the same can’t be said about the digital Rube Goldberg machine of platforms, subsidiaries and shady third-parties these companies use to churn our data into massive profits. Our current digital economy, to a certain degree, depends on global ties that are built to run far deeper than any ban or buyout could ever hope to touch.

Or, to put it more bluntly: If Trump’s real concern is keeping the data of our squeaky clean American phones out of the clutches of that dirty, no-good communist adversary China, then Microsoft buying TikTok won’t do shit—our data is making its way from U.S. companies to servers in China constantly, regardless of who owns TikTok."

Thinking a ban of one Chinese teen dancing app addresses any of this is just absurd. Similarly, the idea that our defunded, understaffed, and kneecapped privacy regulators at the FTC can actively track or manage any of this (without serious reform, more staff, and a bigger budget) is equally silly:

As Wodinsky notes, if this market is so large that journalists, experts, and privacy and security regulators can't ferret out where your data winds up and who is actively cashing in on access to it, the idea that banning or selling TikTok is some mystical foil for one of the most powerful intelligence-gathering governments on the planet is a bizarre pipe dream:

"The wonderful world of digital advertising is built on black boxes inside of black boxes inside of black boxes. This means that there’s a good chunk of people who work at these companies who likely can’t tell you exactly where your name, your phone number, your precise location, or other personal data might actually end up."

And yet if you read numerous press reports and analyst insights into the TikTok fracas, they'll fail utterly to include any of this as essential context, which in turn lets the Trump administration pretend that this political tap dance is actually helpful internet policy.

Filed Under: china, data, espionage, surveillance
Companies: tiktok

DOJ's First Attempt To Prosecute Accused Vault 7 Leaker Ends In A Mistrial

from the if-at-first-you-fuck-things-up... dept

The DOJ has taken an open-and-shut espionage case and managed to somehow misplace the back cover. Does this say something about the unintended consequences of charge-stacking? Maybe. Whatever it is, it isn't pretty.

The case against alleged Vault 7 leaker Joshua Schulte seemed pretty air tight, especially when Schulte continued to leak sensitive documents while behind bars, as well as attempting to rope his family into committing contempt of court violations on his behalf.

He also, as Marcy Wheeler pointed out, gave the government pretty much everything it wanted or needed, but the DOJ's prosecutors failed to present evidence in a coherent way, resulting in a whole lot of juror confusion.

According to InnerCity Press (virtually the only press covering the Schulte verdict watch), by end of day today the jurors had sent out 25 notes, most questions but also problems with two of the jurors. At the end of the day they told the Court they “aligned” on two of the charges, but were at an impasse on the other. Given that there’s slam dunk evidence that he committed the least serious crimes (false statements and contempt), that suggests at least some members of the jury have reasonable doubt that the guy who wrote a virtual signed confession to committing the most damaging leak in CIA history actually did so.

The verdict is now in, what there is of it. The case initially involved charges ranging from false statements to CFAA violations to copyright infringement (!) to child porn possession (!!!). Barely any of those charges have survived. A mistrial has been declared with jurors only finding Schulte guilty on the two least serious charges: false statements and contempt. Those won't be enough to keep him in jail since he'll likely be credited with time served. Schulte has been in jail since December of 2018.

This doesn't mean it's over. Marcy Wheeler says the government will very likely take another stab at presenting a coherent case.

The two sides will have a conference on March 26 to decide what to do. The government will certainly push to retry Schulte; Sabrina Shroff [Schulte's lawyer] asked for an extended deadline to file motions. She may try to do something further about the government’s late notice that Michael, a key witness, got put on paid leave last August (though the government has argued compellingly that Michael’s underlying lack of candor has been noticed to the defense throughout). She also may make yet another bid to get more access to the forensics, something I’ve argued that the government should have permitted in the first place.

The mistrial declaration is a credit to Shroff, who performed the unenviable task of shepherding an extremely unhelpful client through a federal espionage prosecution. Facing espionage charges drastically reduces a defendant's options. Drawing additional judicial scrutiny by attempting to leak sensitive material while incarcerated and spending your free time openly insulting the FBI and federal prosecutors isn't a course of action recommended by anyone.

Prosecutors needed to present a case containing a wealth of technical detail to jurors with clarity and conciseness. The twenty questions given to the judge by jurors a few days before the mistrial declaration showed the jury still remained confused about the facts of the case and, in a couple of instances, focused on information that had little to do with the criminal charges they were deliberating.

The government may get more charges to stick the second time around. But this initial failure is an indictment of the prosecution and its apparently misplaced confidence that the evidence spoke for itself. When you have to prove something beyond a reasonable doubt, quantity is no replacement for quality. As for Schulte, he's still at the DOJ's mercy until it exhausts its prosecutorial options. This isn't going to work out well for Schulte who's shown he's unable to quietly bide his time and capitalize on the government's missteps. He seems compelled to make things worse for himself during his unfortunately ample downtime.

Filed Under: doj, espionage, hacking tools, joshua schulte, leaks, mistrial, vault 7

There Is No 'Going Dark:' Always-On Surveillance Posing Risks To US Covert Operations

from the it's-so-dark-we-can-barely-hide-anyone-in-here dept

The FBI and DOJ like to complain everything is "going dark." It isn't. The only thing that's still dark here is the FBI's FISA powers and the true number of encrypted devices in the FBI's possession.

It's the Golden Age of Surveillance. The FBI knows this. The FBI knows this because the federal government as a whole knows this. There is no "going dark." And that's going to hurt the government almost as much as its going to hurt its citizens.

A long report by Jenna McLaughlin and Zach Dorfman details the government's worries about the seeming impossibility of maintaining its own darkness. Between state-sponsored attacks on government databases and the omnipresence of surveillance equipment around the world, it's exceedingly difficult to call anything "covert."

The OPM hack is only the tip of the exposure iceberg. But what a magnificent tip it is.

In one previously unreported incident, around the time of the OPM hack, senior intelligence officials realized that the Kremlin was quickly able to identify new CIA officers in the U.S. Embassy in Moscow — likely based on the differences in pay between diplomats, details on past service in “hardship” posts, speedy promotions and other digital clues, say four former intelligence officials.

Foreign operatives are safer at home and not just for the obvious reason. For all the surveillance creep this country has experienced following the 9/11 attacks in 2001, it still lags far, far behind the efforts deployed elsewhere in the world. The Department of Defense warned against self-inflicted privacy wounds when it sent a letter to service members warning them of the risk of over-the-counter DNA testing kits. But what can the government do to protect the identities of foreign agents who are under constant surveillance the moment they set foot in another country?

Those concerns spread to other places, like London, where CCTV cameras are omnipresent, and the United Arab Emirates, where facial recognition is ubiquitous at the airport. Today there are “about 30 countries” where CIA officers are no longer followed on the way to meetings because local governments no longer see the need, given that surveillance in those countries is so pervasive…

The DHS wants biometric scanning at every airport. Despite recent setbacks, it hasn't lost its desire to add American citizens and US residents to the list of people facing mandatory biometric collection every time they fly. Maybe it just wants to be on even footing with the rest of the world.

Even with the expansion of biometric surveillance, the CIA has ways of working around this. For years, the CIA has formed partnerships with foreign governments that allow the CIA to access the passport system to track people it wants to track while simultaneously allowing it to manipulate the system to "insert" operatives into countries without being hassled by customs officials or being tracked by airport security surveillance systems.

So ubiquitous are cameras and other surveillance efforts in other countries, spies are bringing back the old ways. If everything leaves a digital footprint, perhaps the solution is to stop leaving footprints.

By the early 2010s, Chinese intelligence operatives started adopting old-school Russian-style tradecraft, like dead drops in the woods or “brush passes,” which involve surreptitiously exchanging objects in a public place, says one former senior intelligence official. “It was unheard of for the Chinese,” says this person. “The conclusion was that they felt the world was too digital and traceable.”

Spies are also taking their business to new countries -- formerly seldom-used locations where surveillance isn't as pervasive. Operations still need to be carried out in the country they're targeting, but meeting with sources can take place anywhere. Anywhere with fewer cameras, biometric scanners, and government control of travel-related businesses is a plus.

Entire programs meant to make covert operations function in the digital age feasible have been scrapped. One effort died on the vine, starved to death by CIA resistance and chronic under-funding. Another program tasked with giving FBI agents credible backstories suffered the same fate: choked to death by red tape and apparently compromised by the sloppiness of the same agents and sources it was put in place to protect.

But it's not all bad news -- at least not for the government. Citizens have no (legal) access to these amenities, but the government has all kinds of "backdoors" in systems to try to prevent covert operatives from being immediately discovered.

By midway through the Obama administration, the CIA and FBI were creating “extensive digital legends with increasing sophistication,” as one former senior official puts it, with cooperation from key government agencies like the Social Security Administration, Health and Human Services and the IRS.

U.S. intelligence agencies also work with “friendly digital companies,” like commercially available ancestry databases, to alter personally identifying information, say former officials, and also backdate work histories.

This is how spy craft works now. Everything is online, digitized, and likely to be accessed by agents of enemy states. There's no flying under the digital radar. And if it's true for government employees, it's doubly true for US citizens who don't have the ability to alter/remove collected data or a network of security professionals doing whatever they can to protect them (and their data) from outsiders.

If the FBI (and others) are making this much effort to shield covert personnel from a panopticon constructed by government entities and private companies, it can't honestly say criminals have the upper hand just because of device encryption.

Filed Under: always on surveillance, covert operators, espionage, going dark, surveillance

Alexander Vindman Now Threatens Bogus SLAPP Suit Against Fox News & Laura Ingraham

from the can-we-stop-with-the-slapps dept

SLAPP suits and SLAPP threats are flying back and forth these days. The latest is that Lt. Col. Alex Vindman, who is a key player in the impeachment hearings, is threatening a highly questionable defamation lawsuit against Fox News and Laura Ingraham, because she had on a guest who suggested Vindman was guilty of espionage (he's not). The threat letter was sent by David Pressman, a lawyer who works for Boies Schiller Flexner, a law firm which has a history of sending around bogus threat letters to the media for doing reporting.

Even if you think that Fox News is terrible (it is), that Ingraham is not to be trusted (she's not), and that her guests are fools (they are), this threat is still completely bogus and silly.

During their exchange, Ms. Ingraham said, “Here we have a U.S. national security official who is advising Ukraine, while working inside the White House, apparently against the president’s interest, and usually, they spoke in English. Isn’t that kind of an interesting angle on this story?”

“I found that astounding,” Mr. Yoo replied. “Some people might call that espionage.”

The Mr. Yoo in question is John Yoo, whose biggest claim to fame is writing the legal justifications for torture during the Bush administration. I wouldn't trust him to throw a ball to a dog, let alone opine on matters regarding the administration, but that doesn't mean that what he said was defamatory. As Ken "Popehat" White explained in a Twitter thread, even if everything Yoo and Ingraham said is ridiculous (and it is), there's nothing in there that rises to the level of defamation:

No matter which side of this you stand on, hopefully we can all agree that bogus threats of defamation, and silly cease and desist letters over people stating a (bad and dumb) opinion are not helping anyone.

Filed Under: 1st amendment, alexander vindman, cease and desist, david boies, david pressman, defamation, espionage, free speech, john yoo, lauara ingraham, slapp, threats
Companies: fox news

Insider Threats: DOJ Says Twitter Employees Spied On User Accounts For Saudi Arabia

from the internal-controls-matter dept

We live in interesting times. A year ago, the NY Times had reported that the Kingdom of Saudi Arabia was aggressively using Twitter to keep tabs on and harass critics of the government. As part of that story, it also claimed that the Saudis might have a "mole" within the company in the form of Ali Alzabarah, who had risen through the engineering ranks to a point where he could access information on people the Saudi government was interested in. That story only noted that Western intelligence agencies had alerted the company that the Saudis were "grooming" Alzabarah. Now, the DOJ has charged two former Twitter employees, including Alzabarah, along with a third individual who worked in social media marketing, with spying for the Saudis. The complaint is worth reading.

It shows how officials appeared to groom the Twitter employees, starting with Ahmad Abouammo, who was (for a time) a marketing manager at Twitter, but who left the company in 2015. It describes how Saudi officials built up a relationship with him, setting up a tour of Twitter's headquarters, and then later providing gifts, such as an expensive watch. Soon after, Abouammo is accused of accessing information on Saudi critics and dissidents;

Within one week of ABOUAMMO's meeting in London with Foreign Official-1, ABOUAMMO began access private Twitter user information of interest to Foreign Official-1 and the Saudi Royal Family.

On December 12, 2014, ABOUAMMO accessed Twitter User-1's email address through Twitter's computer systems. Based on the FBI's review of Twitter User-1's public postings, Twitter User-1 was a prominent critic of the Kingdom of Saudi Arabia and the Royal Family with over 1,000,000 Twitter followers. ABOUAMMO accessed Twitter User-1's email address again on January 5, 2015, January 27, 2015, February 4, 2015, February 7, 2015, February 18, 2015, and February 24, 2015.

On or about January 17, 2015, Foreign Official-1 began communicating with ABOUAMMO on ABOUAMMO's personal email in addition to his Twitter email account. On January 17, 2015, Foreign Official-1 emailed ABOUAMMO at ABOUAMMO's personal email and stated only "as we discussed in london..." Foreign Offical-1 attached to the email a document that discussed how Twitter User-1 had violated both Twitter policy and Saudi laws. On January 20, 2015, Foreign Official-1 called ABOUAMMO twice (the calls lasting 19 seconds and 51 seconds, respectively). On January 22, 2015, Foreign Official-1 called ABOUAMMO seven times (no answer, 6 seconds, 5 seconds, 3 seconds, 4 minutes 37 sections, 3 minutes 36 seconds, and 39 seconds, respectively). ABOUAMMO also accessed the email address provided by user @KingSalman the same day. The handle @KingSalman was the Twitter Account for Saudi King Salman bin Abdulaziz Al Saud. Foreign Official-1 called ABOUAMMO on January 23, 24, and twice on January 25, 2015 (1 minute 57 seconds, no answer, 1 minute 57 seconds, and 6 seconds, respectively). On January 27, 2015, ABOUAMMO accessed Twitter User-1's user email address again. The next day, Foreign Official-1 called ABOUAMMO three times (11 seconds, 5 seconds, and no answer).

It goes on like this with the Saudi official sending "reports" about different accounts claiming they violate Twitter's policies -- which had nothing to do with Abouammo's role in marketing. And then comes this:

On February 19, 2015, ABOUAMMO created an online user ID and password to access the Bank Audi Account his close relative opened in Lebanon on February 3, 2015. On February 24, 2015, ABOUAMMO accessed Twitter User-1's email address and phone number. On the same day, a $9,963 wire transfer was sent from the Lebanon Bank Audi Account to ABOUAMMO's Bank of America account...

There are a few more such transactions. Even after Abouammo quits Twitter (to go to Amazon) he apparently continues to receive money, and would reach out to former colleagues at Twitter to try to access the information the Saudis were seeking. Also, according to the DOJ, Abouammo lied to the FBI (not a good idea), then tried to "alter" documents he gave to the FBI (a very, very bad idea). Indeed, the DOJ's complaint suggests that while the FBI was talking to him, he asked to go use his computer without them present, and then presented them with what they believe to be a doctored invoice.

During the interview, ABOUAMMO offered to obtain a copy of the consulting contract from a desktop computer that he claimed was in his bedroom, and requested that the Agents not follow him to the bedroom. A few minutes later, ABOUAMMO emailed an undated invoice to the email address of a Palo Alto, California based FBI Special Agent.

I believe that ABOUAMMO created the invoice in his residence on a computer while Agents were waiting for ABOUAMMO to provide them with the invoice that was discussed. The address on the invoice for services ABOUAMMO said were rendered in 2015 and 2016 was ABOUAMMO's current address, however, public records show that the property was built in 2017 and ABOUAMMO did not purchase it until August 2017, and the metadata properties associated with the file emailed to the FBI indicates that the file was created on the date of the interview (i.e., October 20, 2018)....

Yeah, don't do that.

As for Alzabarah, the DOJ has details of him flying to DC to meet with various Saudi officials, and then upon returning to work getting pretty damn busy getting info on Twitter users critical of the Saudi government.

Within one week of returning to San Francisco, ALZABARAH began to access without authorization private data of Twitter users en masse. Specifically, although ALZABARAH had not access the private user data of any Twitter Accounts since February 24, 2015, starting on May 21, 2015, through November 18, 2015, ALZABARAH accessed without authorization through Twitter's computer systems the Twitter user data of over 6,000 Twitter users, including at least 33 usernames for which Saudi Arabian law enforcement had submitted emergency disclosure requests to Twitter. A Twitter Security Engineer informed the FBI that, although ALZABARAH may have had grandfathered access to view user information through an internal Twitter tool called "Profile Viewer," ALZABARAH had no legitimate business purpose as a Site Reliability Engineer to access user accounts. ALZABARAH's job was to help keep the site up and running, which did not involve accessing individual user accounts.

The DOJ then notes that the Saudi official had email notes detailing the locations of some of the key Twitter users that Alzabarah was looking up for them. Alzabarah also created notes for himself about whether or not he was eligible for reward money the Saudi government was offering for information on certain "terrorists." There are also notes about "secur[ing]" his "future and my family's." Alzabarah later fled the US and apparently resigned from Twitter via email after his flight took off from LA.

This is all kind of fascinating. For all the concerns about outside hacking, insider attacks are still considered a much bigger threat and much harder to detect or prevent. While it does sound like there were some lax controls in place to prevent people who shouldn't have access to certain information from getting to that info, that's not all that unexpected in Silicon Valley (and an area that many companies need to significantly improve in). The complaint does suggest that Alzabarah made "unauthorized" access to this information, even though he was allowed to access a tool. That certainly suggests criminal CFAA charges, and some aspects of that seem problematic. While it does appear that there are other laws Alzabarah broke, arguing it's a CFAA violation to use tools he was granted access to seems like a stretch. And, of course, there are broader questions with Abouammo and why he even had access to any of this data at all.

If anything, hopefully these charges wake up many Silicon Valley companies to the value and importance of better internal controls on how data is made accessible. In the rush to build up companies, insider controls are often one of the last things companies care about (if no one uses a service, who cares, and if a service is growing like gangbusters, then there are many other, more important issues to focus on). But companies need to recognize that when these services are used as broadly as they are, they become an attack vector, and employees are often targeted by governments to try to access information. Of course, it's always going to be impossible to stop all access to information -- hell, even the NSA has had to deal with poor controls and "insider" attempts to access information (see: Snowden, Ed). But it does seem increasingly important for companies to be aware of how valuable their data might be to governments, and do more to protect it.

Filed Under: ahmad abouammo, ali alzabarah, cfaa, controls, employee access, espionage, insider threats, saudi arabia, spying
Companies: twitter

Israeli Exploit Developer Caught Negotiating Spyware Sales With Saudi Government

from the got-'em-right-in-the-optics dept

More ugly news has surfaced about Israeli malware developer NSO Group. Over the past year, investigations have uncovered sales of phone-targeting spyware to countries known mostly for their human rights violations. Even less questionable governments have purchased NSO's software ostensibly for law enforcement purposes only to use it to target activists, journalists, and government critics.

There's no telling how US agencies will deploy this malware, but there's no question federal entities like the DEA think NSO spyware would be a useful addition to their investigative tool kits. The US government doesn't appear to be worried about getting in bed with tech companies willing to sell software to blacklisted countries, so NSO Group is still a viable option.

Haaretz has obtained information showing NSO is willing to sell its exploits to its own enemies. Unfortunately, Haaretz has also decided to paywall its discovery, so we'll be pointing you to the Times of Israel's reporting instead.

An Israeli company that specializes in cyber espionage tools reportedly negotiated a multi-million-dollar deal with Saudi Arabia to sell a technology that allows governments to hack their citizens’ cellphones, and to listen to calls as well as conversations that take place near the phones.

Representatives from the Herzliya-based NSO Group held meetings with Saudi officials in Vienna and, apparently, also in a Gulf State to negotiate a $55 million sale of their Pegasus 3 software, the Haaretz daily reported on Sunday.

These negotiations occurred shortly before Mohammed bin Salman kicked his purge machinery into high gear. Unfortunately, the documents (which surfaced due to a lawsuit filed against NSO by an employee who says the company screwed him on commissions) don't say whether or not the Saudi government chose to purchase this software and/or whether it was used to help MBS hunt down his political opponents.

From what has been seen, NSO tried to play it both ways while negotiating a deal with the Saudis. It refused to identify the person behind an anti-government Twitter account but did offer to demonstrate the effectiveness of tools designed to hijack targets' cellphones.

In response to the recent stream of criticism, NSO Group also tried to have it both ways:

The NSO Group has insisted in the past that it sells its software to clients on the condition that it be used only against crime and terrorism, and has shirked responsibility in cases where it was allegedly used for civil rights abuses.

"We made them promise to only use the tools for good" is a pretty weak defense of sales to countries like Uzbekistan and Kazakhstan. And it certainly doesn't excuse approaching the Saudi government with tools NSO certainly knew would not be used for good. Then again, our president just made it clear no amount of murdered journalists is going to stand in the way of selling weapons to Mohammed bin Salman's government, so there's really no taking the high road in international relations should it be discovered the Saudi government is using Israeli tools to hunt down dissenters… or Israeli natsec personnel.

Filed Under: espionage, exploits, israel, jamal khashoggi, journalists, mohammed bin salman, saudi arabia, spying
Companies: nso group

Apple Demands Retraction Of Bloomberg's Big 'Chip Infiltration' Story; Bloomberg Has Some Explaining To Do

from the not-looking-good dept

A few weeks ago, Bloomberg published a giant story claiming that Chinese spies did a somewhat daring supply chain hack on American big tech firms. The gist of the story was that servers from Super Micro had hidden chips that somehow were then used by Apple and Amazon (not to mention the US government), that allowed someone in China to access certain data. The story was a blockbuster that got everyone talking. But, almost as soon as it came out, a bunch of people started raising questions about the story. While the Bloomberg reporters claimed over a dozen sources, both Apple and Amazon came out with incredibly strong denials. Way stronger than is common in these situations. And while I know some cynical people insist that companies will lie about this stuff all the time, that is not actually true. Some companies may misrepresent things, or try to play down stories, but outright fabrication is not at all common (and the consequences of a company doing it would be severe). And here, both Amazon and Apple's denials were so clear, so specific and so adamant that it raised serious questions about the reporting.

Since there was so much confusion over it all, we held off on writing about it, figuring more information would come out in the days and weeks after the initial story. And so far, nearly all of the "additional info" has only served to raise significantly more questions about Bloomberg's reporting. Various government and intelligence agencies all claimed they had no evidence to support these claims. Again, some will argue that they are lying, and (again) while those agencies may have a history of misrepresenting things, the denials here were clear and unequivocal. The UK's National Cyber Security Centre (a part of GCHQ) said they completely supported Apple and Amazon that no such attack occurred. The US Department of Homeland Security said the same thing. Dan Coats, the US Director of National Intelligence said the US intelligence community has seen no evidence of such an attack, which certainly undermines the Bloomberg story. Some of the folks quoted in the Bloomberg article even questioned the accuracy of the article with one going so far as to say the article that he is named in... "didn't make sense."

Also, as reporter Nicole Perlroth noted, one of the reporters on the Bloomberg story -- Michael Riley -- had also done a story back in 2014 making bold claims that the NSA had exploited the Heartbleed bug, and multiple other reports ripped that story to shreds, with multiple people denying it and no one else confirming it.

Now, with this story, Apple has done something it's never done before: asked Bloomberg for a retraction of the article. That's a pretty big move -- and Bloomberg says it still stands by its reporting (as it did with the Heartbleed story).

However, at this point, Bloomberg has whittled away whatever benefit of the doubt there was left and set fire to the scraps. It's difficult to believe that Bloomberg's story was accurate, and the company and its reporters owe everyone an explanation -- or at least some additional evidence to support the reporting. I don't doubt that there is a kernel of truth in the story -- but given the vehement and thorough response from everyone, it certainly seems likely that the reporters on the Bloomberg piece misunderstood something big, leading to misreporting of things in a way that leads to a very inaccurate picture of what's going on. Bloomberg should, at the very least, appoint someone else to go through the work put in by reporters Michael Riley and Jordan Robertson, and explore whether or not the story really is accurate, and why it is that basically everyone is saying it's not.

Reporters can, and do, make mistakes. How they respond to such mistakes is the real marker of the ethics they and the organizations they work for hold. Considering Bloomberg stood by that Heartbleed story, perhaps we shouldn't expect such a reckoning at the publication -- but, at the very least, it's going to lead plenty of people to write off Bloomberg as a credible source on issues like these, and that's unfortunate, given that there are some really big and important stories having to do with computer security right now. Having one major publication show itself to be untrustworthy in its coverage would be very bad.

Filed Under: espionage, hacked chips, jordan robertson, michael riley, security, supply chain, surveillance
Companies: amazon, apple, bloomberg, super micro

Germany Accuses Chinese Intelligence Services Of Using Fake LinkedIn Profiles To Recruit Informants And Extract Sensitive Information

from the well,-of-course-it's-not-just-Russia dept

Over the last year, the scale of Russia's disinformation activities has become clearer. Its Internet Research Agency has deployed an astonishing range of sophisticated techniques, included accounts on Twitter and Facebook, and hiring activists within the US without the latter being aware they were working for the Russian government. We also now know that the same organization has been buying Facebook ads on a large scale that were seen by over a hundred million US citizens. But it would be naïve to think that Russia is the only foreign power engaged in this kind of activity. In fact, it would be surprising if any intelligence agency worth its salt were not carrying out similar activities around the globe. The first detailed information about China's use of fake social media accounts to recruit informants and extract sensitive information has just been published by the Bundesamt für Verfassungsschutz (BfV), Germany's domestic intelligence service. As Reuters reports:

Nine months of research had found that more than 10,000 German citizens had been contacted on the LinkedIn professional networking site by fake profiles disguised as headhunters, consultants, think-tankers or scholars, the BfV said.

Quartz quotes the BfV's president, Hans-Georg Maaßen, as saying:

"We are dealing with a broad attempt to infiltrate parliaments, ministries and administrations," said Maaßen. “Chinese intelligence services are using new strategies of attack in the digital space."

An interim report on the analysis that appeared on the BfV site in July (original in German) explains how the Chinese operated. The supposed headhunters, scholars and Chinese officials claimed that there were interested in the specialism of the person being approached. They inquired about a possible exchange of professional views on the topic, and spoke of an "important customer" in China:

the Chinese contact persons ask those involved for a curriculum vitae and offered to pay for a trial project. If this was completed satisfactorily, an invitation is made to go to China to meet with the "important customer", with the costs of the stay being covered by the Chinese side. In fact, however, the "important customer" never appears and is not explicitly named. In due course, the persons involved are usually asked regularly to write reports in return for appropriate remuneration, or to pass on internal, sensitive information from the respective work area.

As part of its report, the BfV published a selection of the fake profies. Reuters explains:

Many of the profile pictures show stylish and visually appealing young men and women. The picture of "Laeticia Chen", a manager at the "China Center of International Politics and Economy" was nicked from an online fashion catalogue, an official said.

The Chinese Foreign Ministry spokesman Lu Kang was, of course shocked by the accusations, which he called "baseless":

"We hope the relevant German organizations, particularly government departments, can speak and act more responsibly, and not do things that are not beneficial to the development of bilateral relations," Lu said.

The implicit threat there chimes with two other stories about China that Techdirt published last month. In one of them, the Chinese authorities put pressure on the academic publisher Springer Nature to censor thousands of papers that dealt with topics that showed China in a less than flattering light. Similarly, Allen & Unwin was "persuaded" by the Chinese authorities not to publish a book about China's growing but covert influence in Australia. The row between Australia and China has since escalated further. The latter denounced remarks by Australian politicians as being "full of prejudices against China", and lodged a formal protest. Taken with the latest news of China's attempts to recruit informants using social media, these recent events are evidence of a newly aggressive China on the world scene -- and of what The Economist calls China's "sharp power".

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: china, espionage, fake profiles, germany, surveillance
Companies: linkedin

CCleaner Hack May Have Been A State-Sponsored Attack On 18 Major Tech Companies

from the good-luck-out-there dept

At the beginning of this week, reports emerged that Avast, owner of the popular CCleaner software, had been hacked. Initial investigations by security researchers at Cisco Talos discovered that the intruder not only compromised Avast's servers, but managed to embed both a backdoor and "a multi-stage malware payload" that rode on top of the installation of CCleaner. That infected software -- traditionally designed to help scrub PCs of cookies and other tracking software and malware -- was subsequently distributed by Avast to 700,000 customers (initially, that number was thought to be 2.27 million).

And while that's all notably terrible, it appears initial reports dramatically under-stated both the scope and the damage done by the hack. Initially, news reports and statements by Avast insisted that the hackers weren't able to "do any harm" because the second, multi-stage malware payload was never effectively delivered. But subsequent reports by both Avast and Cisco Talos researchers indicate this payload was effectively delivered -- with the express goal of gaining access to the servers and networks of at least 18 technology giants, including Intel, Google, Microsoft, Akamai, Samsung, Sony, VMware, HTC, Linksys, D-Link and Cisco itself.

Cisco's researchers say they obtained a copy of the hackers' command-and-control server from an unnamed source. That server contained detailed logs of the 700,000 or so computers that had "phoned home" to the hackers earlier this month. Subsequent investigation has concluded that the hackers didn't really care about most of the infected customers, and that this may have been a sophisticated state-sponsored attack specifically designed access and copy internal information and trade secrets from major tech firms:

"That target list presents a new wrinkle in the unfolding analysis of the CCleaner attack, one that shifts it from what might have otherwise been a run-of-the-mill mass cybercrime scheme to a potentially state-sponsored spying operation that cast a wide net, and then filtered it for specific tech-industry victims. Cisco and security firm Kaspersky have both pointed out that the malware element in the tainted version of CCleaner shares some code with a sophisticated hacking group known as Group 72, or Axiom, which security firm Novetta named a Chinese government operation in 2015."

One configuration file on the attackers' server was also set for China's time zone, though of course neither of these are enough solid evidence to definitively conclude state-sponsored involvement... yet. In an updated post to its website, Avast has been forced to concede that their initial claim that the second, multi-staged payload was never delivered was false, and that the total number of compromised machines at these targeted companies is "at least in the order of hundreds":

"First of all, analysis of the data from the CnC server has proven that this was an APT (Advanced Persistent Threat) programmed to deliver the 2nd stage payload to select users. Specifically, the server logs indicated 20 machines in a total of 8 organizations to which the 2nd stage payload was sent, but given that the logs were only collected for little over three days, the actual number of computers that received the 2nd stage payload was likely at least in the order of hundreds. This is a change from our previous statement, in which we said that to the best of our knowledge, the 2nd stage payload never delivered."

Cisco also warned impacted tech companies that deleting the software itself off of infected PCs is no guarantee that the threat has been mitigated, since the payload may have installed a second payload on their networks with its own, still-active command and control server. Like previous attacks of this type, the reported scope of the sophisticated attack is likely to only grow as researchers dig deeper.

As several outlets were quick to correctly note the attack on CCleaner highlights a supply-side security problem at a growing number of software companies like Ukrainian accounting software MeDoc and South Korea-based firm Netsarang, which both passed on malware to trusting clients in the last few months. Traditionally we've comforted ourselves by insisting we're safe if we just avoid untrusted app stores, dubious attachments, or questionable links -- but this attack further up the software supply chain erodes public trust, which could deter users from using or updating essential protection.

Filed Under: ccleaner, corporate espionage, espionage, hacks, malware, piggybacking
Companies: avast, cisco