Court Filings Show NSO Group Ran Malware Attacks Through Servers Located In California

from the not-immune-from-its-own-carelessness dept

Things are getting even more interesting in Facebook's lawsuit against Israeli malware merchant, NSO Group. Facebook was getting pretty tired of NSO using WhatsApp as an attack vector for malware delivery, which resulted in the company having to do a lot more upkeep to ensure users were protected when utilizing the app.

Unfortunately, Facebook wants a court to find that violating an app's terms of service also violates the CFAA -- something most of us really don't want, even if it would keep NSO and its customers from exploiting messaging services to target criminals, terrorists… and, for some reason, lots of journalists, dissidents, and activists.

NSO finally responded to Facebook's lawsuit by saying it could not be sued over the actions of its customers. Its customer base is mainly government agencies -- including some especially sketchy governments. NSO claims all it does is sell the stuff. What the end users do with it is between the end users and their surveillance targets. Since its customers are governments, sovereign immunity applies… which would dead-end this lawsuit (wrong defendant) and any future lawsuits against governments by Facebook (the sovereign immunity).

NSO's claims it can't be touched by this lawsuit are falling apart. Citizen Lab researcher John Scott-Railton pointed out on Twitter that Facebook's latest filings point to NSO operating its malware servers from inside the United States -- apparently doing far more than simply selling malware to government customers and letting them handle the deployment details.

Facebook's answer to NSO's attempt to dismiss the lawsuit concedes NSO's point: it is not its customers. But that's precisely why it can be sued. From Facebook's response [PDF]:

A flawed premise runs through the motion to dismiss (“MTD”). Defendants contend that they cannot be held responsible for designing and marketing spyware and then deploying it using WhatsApp’s U.S.-based servers, including in California, to hack into WhatsApp users’ devices. Instead, Defendants pin blame on unidentified foreign sovereigns. That argument fails at every turn: Defendants cannot cloak themselves in their putative clients’ immunity; they are accountable for suit in a California court; and the Complaint states valid claims for relief based on Defendants’ unauthorized access to and hijacking of WhatsApp’s servers.

[...]

The statute confers immunity only on foreign states—not private companies who develop and operate their own technology and then claim to act on a foreign state’s behalf.

The claim that NSO Group operates from California (making this venue appropriate for the lawsuit) isn't some distended stretch where malware briefly passed through WhatsApp servers in the US on its way to its targets. Declarations [PDF] by Facebook's expert witnesses show NSO is routing malware deliveries through California data centers. This is only a small part of the list of IP addresses linked to NSO deployments Facebook has uncovered.

Attached as Exhibit 1 is a true and accurate screenshot from IP2Location.com obtained on April 22, 2020, for IP address 104.223.76.220. Exhibit 1 shows that IP address 104.223.76.220 is currently located in Los Angeles, California, and is owned by QuadraNet Enterprises LLC.

According to historical IP address location information from Maxmind.com for IP address 104.223.76.220 obtained through the website archive.org, IP address 104.223.76.220 was located in Los Angeles, California, and owned by QuadraNet Enterprises LLC as of May 28, 2019. Attached as Exhibit 2 is a true and accurate screenshot of the Maxmind.com csv.zip file available for download at archive.org that contains historical IP location information. Attached as Exhibit 3 is a true and accurate screenshot of the unzipped Maxmind.com csv.zip file showing the date of the files as May 28, 2019. Attached as Exhibits 4a, 4b, and 4c are true and accurate screenshots of the netblock for IP address 104.223.76.220 showing the location and ownership of IP address 104.223.76.220 as of May 28, 2019.

This is the upshot of Facebook's investigation of NSO's WhatApp-based efforts:

NSO used QuadraNet’s California-based server more than 700 times during the attack to direct NSO’s malware to WhatsApp user devices in April and May 2019.

These filings appear to show something very different than what NSO Group has claimed. It is not a blind provider of malware to government agencies. This indicates NSO is purchasing and operating servers stateside that its customers use to deploy malware. And if it runs these servers, then it quite possibly knows who its customers are targeting. This is far more involved than its sworn statements have said. The plausible deniability it's trying to project just isn't that plausible.

Facebook's response points out the logical leap NSO is demanding from the court.

The Complaint alleges targeting of 1,400 separate devices, Compl. ¶ 42, and NSO does not specify who it was working for in each attack. Instead, NSO relies on a conclusory declaration from its CEO Shalev Hulio stating that “NSO markets and licenses its Pegasus technology exclusively to sovereign governments and authorized agencies,” and those sovereigns—not NSO—“operate [the] Pegasus technology.” Hulio Decl. ¶¶ 9, 14-15. But Hulio fails to identify any specific foreign sovereign for whom NSO worked—let alone cite a single contract or any evidence establishing NSO’s purportedly limited operational role.

NSO's options are all unappealing at the moment. It can't hope to settle since its customers aren't going to be willing to give up exploitation of an encrypted messaging app used by millions of people around the world. It also can't be looking forward to continued litigation since that's only going to mean more exposure of its actions and inner workings as the lawsuit drags on. But these are the risks you take when your favored attack vector is another company's service and your payload deliveries route themselves through rented/purchased servers located in the United States.

NSO turned itself into a villain by selling its products to governments wanting to target dissidents, journalists, activists, and attorneys. A little more judiciousness would have gone a long way. Running attacks through services owned by one of the most powerful tech companies in the world may have provided NSO's customers with a broad user base to attack, but it also ensured it would find itself in court facing a well-funded and well-equipped adversary.

Filed Under: cfaa, hacking, jurisdiction, spying, surveillance
Companies: facebook, nso group, whatsapp

The FBI Says Your TV Is Probably Spying On You

from the watching-you-watching-me dept

Like most of the infamous "internet of things," (IOT) smart TVs are a security and privacy dumpster fire. Numerous set vendors have already been caught hoovering up private conversations or transmitting private user data unencrypted to the cloud. One study in 2017 surmised that around 90% of smart televisions can be hacked remotely, something intelligence agencies, private contractors and other hackers are clearly eager to take full advantage of.

This week, the FBI, that bastion of sage privacy and security advice, issued a blog post out of its Portland field office warning cyber Monday shoppers that their smart TV is a little too smart, and likely watches you as much as you watch it. The post is filled with some handy tips to help you protect your privacy:

"Know exactly what features your TV has and how to control those features. Do a basic Internet search with your model number and the words “microphone,” “camera,” and “privacy.”

Don’t depend on the default security settings. Change passwords if you can – and know how to turn off the microphones, cameras, and collection of personal information if possible. If you can’t turn them off, consider whether you are willing to take the risk of buying that model or using that service.

If you can’t turn off a camera but want to, a simple piece of black tape over the camera eye is a back-to-basics option.

Check the manufacturer’s ability to update your device with security patches. Can they do this? Have they done it in the past?

Check the privacy policy for the TV manufacturer and the streaming services you use. Confirm what data they collect, how they store that data, and what they do with it."

Granted such tips don't really do much to fix a broken sector where privacy and security remains an afterthought. A Consumer Reports study from last year found that things aren't really improving in the space. Government hasn't done much to pass any meaningful privacy law for the internet era. Gadget obsessed consumers are historically oblivious or apathetic to the problem. And product makers are too busy worrying about margins and the next big product launch to spend money to upgrade past sets or improve their privacy and security practices (at least not until there's another major scandal).

And if you've shopped for a TV recently, you may have noticed that it's largely impossible to just buy a "dumb" TV set without all of the "smart" internals. More specifically, most TV vendors don't want to sell you a bare-bones set because they want you to use their streaming services. Even more specifically, they want you to buy their sets with their specific streaming functionality because they want to spy on you and monetize your usage data.

So yeah, the FBI's tips are great and all, but they don't really get to the root of the market dysfunction that's plaguing the IOT space. There are plenty of fractured entities trying to help (like Consumer Reports' efforts to integrate an open source privacy and security standard in hardware reviews, or efforts at Princeton to make it clear what devices are actually doing on the network), but in terms of any kind of cohesive solution to the problem, there's little to nothing on the horizon.

Filed Under: fbi, privacy, smart tv, snooping, spying

Insider Threats: DOJ Says Twitter Employees Spied On User Accounts For Saudi Arabia

from the internal-controls-matter dept

We live in interesting times. A year ago, the NY Times had reported that the Kingdom of Saudi Arabia was aggressively using Twitter to keep tabs on and harass critics of the government. As part of that story, it also claimed that the Saudis might have a "mole" within the company in the form of Ali Alzabarah, who had risen through the engineering ranks to a point where he could access information on people the Saudi government was interested in. That story only noted that Western intelligence agencies had alerted the company that the Saudis were "grooming" Alzabarah. Now, the DOJ has charged two former Twitter employees, including Alzabarah, along with a third individual who worked in social media marketing, with spying for the Saudis. The complaint is worth reading.

It shows how officials appeared to groom the Twitter employees, starting with Ahmad Abouammo, who was (for a time) a marketing manager at Twitter, but who left the company in 2015. It describes how Saudi officials built up a relationship with him, setting up a tour of Twitter's headquarters, and then later providing gifts, such as an expensive watch. Soon after, Abouammo is accused of accessing information on Saudi critics and dissidents;

Within one week of ABOUAMMO's meeting in London with Foreign Official-1, ABOUAMMO began access private Twitter user information of interest to Foreign Official-1 and the Saudi Royal Family.

On December 12, 2014, ABOUAMMO accessed Twitter User-1's email address through Twitter's computer systems. Based on the FBI's review of Twitter User-1's public postings, Twitter User-1 was a prominent critic of the Kingdom of Saudi Arabia and the Royal Family with over 1,000,000 Twitter followers. ABOUAMMO accessed Twitter User-1's email address again on January 5, 2015, January 27, 2015, February 4, 2015, February 7, 2015, February 18, 2015, and February 24, 2015.

On or about January 17, 2015, Foreign Official-1 began communicating with ABOUAMMO on ABOUAMMO's personal email in addition to his Twitter email account. On January 17, 2015, Foreign Official-1 emailed ABOUAMMO at ABOUAMMO's personal email and stated only "as we discussed in london..." Foreign Offical-1 attached to the email a document that discussed how Twitter User-1 had violated both Twitter policy and Saudi laws. On January 20, 2015, Foreign Official-1 called ABOUAMMO twice (the calls lasting 19 seconds and 51 seconds, respectively). On January 22, 2015, Foreign Official-1 called ABOUAMMO seven times (no answer, 6 seconds, 5 seconds, 3 seconds, 4 minutes 37 sections, 3 minutes 36 seconds, and 39 seconds, respectively). ABOUAMMO also accessed the email address provided by user @KingSalman the same day. The handle @KingSalman was the Twitter Account for Saudi King Salman bin Abdulaziz Al Saud. Foreign Official-1 called ABOUAMMO on January 23, 24, and twice on January 25, 2015 (1 minute 57 seconds, no answer, 1 minute 57 seconds, and 6 seconds, respectively). On January 27, 2015, ABOUAMMO accessed Twitter User-1's user email address again. The next day, Foreign Official-1 called ABOUAMMO three times (11 seconds, 5 seconds, and no answer).

It goes on like this with the Saudi official sending "reports" about different accounts claiming they violate Twitter's policies -- which had nothing to do with Abouammo's role in marketing. And then comes this:

On February 19, 2015, ABOUAMMO created an online user ID and password to access the Bank Audi Account his close relative opened in Lebanon on February 3, 2015. On February 24, 2015, ABOUAMMO accessed Twitter User-1's email address and phone number. On the same day, a $9,963 wire transfer was sent from the Lebanon Bank Audi Account to ABOUAMMO's Bank of America account...

There are a few more such transactions. Even after Abouammo quits Twitter (to go to Amazon) he apparently continues to receive money, and would reach out to former colleagues at Twitter to try to access the information the Saudis were seeking. Also, according to the DOJ, Abouammo lied to the FBI (not a good idea), then tried to "alter" documents he gave to the FBI (a very, very bad idea). Indeed, the DOJ's complaint suggests that while the FBI was talking to him, he asked to go use his computer without them present, and then presented them with what they believe to be a doctored invoice.

During the interview, ABOUAMMO offered to obtain a copy of the consulting contract from a desktop computer that he claimed was in his bedroom, and requested that the Agents not follow him to the bedroom. A few minutes later, ABOUAMMO emailed an undated invoice to the email address of a Palo Alto, California based FBI Special Agent.

I believe that ABOUAMMO created the invoice in his residence on a computer while Agents were waiting for ABOUAMMO to provide them with the invoice that was discussed. The address on the invoice for services ABOUAMMO said were rendered in 2015 and 2016 was ABOUAMMO's current address, however, public records show that the property was built in 2017 and ABOUAMMO did not purchase it until August 2017, and the metadata properties associated with the file emailed to the FBI indicates that the file was created on the date of the interview (i.e., October 20, 2018)....

Yeah, don't do that.

As for Alzabarah, the DOJ has details of him flying to DC to meet with various Saudi officials, and then upon returning to work getting pretty damn busy getting info on Twitter users critical of the Saudi government.

Within one week of returning to San Francisco, ALZABARAH began to access without authorization private data of Twitter users en masse. Specifically, although ALZABARAH had not access the private user data of any Twitter Accounts since February 24, 2015, starting on May 21, 2015, through November 18, 2015, ALZABARAH accessed without authorization through Twitter's computer systems the Twitter user data of over 6,000 Twitter users, including at least 33 usernames for which Saudi Arabian law enforcement had submitted emergency disclosure requests to Twitter. A Twitter Security Engineer informed the FBI that, although ALZABARAH may have had grandfathered access to view user information through an internal Twitter tool called "Profile Viewer," ALZABARAH had no legitimate business purpose as a Site Reliability Engineer to access user accounts. ALZABARAH's job was to help keep the site up and running, which did not involve accessing individual user accounts.

The DOJ then notes that the Saudi official had email notes detailing the locations of some of the key Twitter users that Alzabarah was looking up for them. Alzabarah also created notes for himself about whether or not he was eligible for reward money the Saudi government was offering for information on certain "terrorists." There are also notes about "secur[ing]" his "future and my family's." Alzabarah later fled the US and apparently resigned from Twitter via email after his flight took off from LA.

This is all kind of fascinating. For all the concerns about outside hacking, insider attacks are still considered a much bigger threat and much harder to detect or prevent. While it does sound like there were some lax controls in place to prevent people who shouldn't have access to certain information from getting to that info, that's not all that unexpected in Silicon Valley (and an area that many companies need to significantly improve in). The complaint does suggest that Alzabarah made "unauthorized" access to this information, even though he was allowed to access a tool. That certainly suggests criminal CFAA charges, and some aspects of that seem problematic. While it does appear that there are other laws Alzabarah broke, arguing it's a CFAA violation to use tools he was granted access to seems like a stretch. And, of course, there are broader questions with Abouammo and why he even had access to any of this data at all.

If anything, hopefully these charges wake up many Silicon Valley companies to the value and importance of better internal controls on how data is made accessible. In the rush to build up companies, insider controls are often one of the last things companies care about (if no one uses a service, who cares, and if a service is growing like gangbusters, then there are many other, more important issues to focus on). But companies need to recognize that when these services are used as broadly as they are, they become an attack vector, and employees are often targeted by governments to try to access information. Of course, it's always going to be impossible to stop all access to information -- hell, even the NSA has had to deal with poor controls and "insider" attempts to access information (see: Snowden, Ed). But it does seem increasingly important for companies to be aware of how valuable their data might be to governments, and do more to protect it.

Filed Under: ahmad abouammo, ali alzabarah, cfaa, controls, employee access, espionage, insider threats, saudi arabia, spying
Companies: twitter

The Newest Growth Market For License Plate Readers Is Those Assholes Running The Local Homeowners Association

from the 'we-feel-people-don't-hate-us-enough-already' dept

Everyone loves surveillance creep. Well, by everyone, I mean the government and the vendors that sell to them. Automatic license plate readers have made their way from police cruisers to malls, as has facial recognition tech that very often fails to actually recognize people.

The "everyone" may now include the near-fascist organizations turning neighborhoods into glittering shrines of conformity. I'm talking about homeowners' associations -- the anal-retentive busybodies who want to make sure your grass is cut to the correct length and that no one's offending passersby with creative mailboxes.

The Denver Post reports the newest customers for surveillance tech is HOAs and gated communities.

License plate readers posted at both entrances to an upscale Aurora neighborhood snapped pictures of passing cars Wednesday, recording the type, color and license plate number of each vehicle and inputting that information into a database.

Such technology used to be relegated to law enforcement. But these cameras were purchased by the local homeowner association in January after a few burglaries of cars and a home in the neighborhood. Red signs near the cameras warn passersby of “24/7 Video Recording.”

“It’s going to keep us safer,” said Richard Warshaw, president of the Bel-Aire Estates Owners Association.

I don't want to make too many assumptions, but click through to take a look at Richard Warshaw, who appears to be exactly the way I'd expect him to look.

Anyway, this is the growth market for vendors with surveillance tech to sell. Spy gadgets have gone from military to police to business owners to bitter busybodies who want to know everything about everyone who passes through their carefully -- and forcefully -- curated neighborhoods.

Flock Safety appears to be one of the bigger players in the HOA ALPR business. Its site makes a handful of dubious claims in the space of a single splash box, including the audacious assertion that only its product prevents crime.

I attempted to discuss this claim with the FlockBot, but only got asked for my email address and phone number so the company could pitch some of its camera "solutions" that *squints at screenshots* "capture vehicle lice plates."

This only raises my confidence in the quality of Flock's products.

Back at the Denver HOA, it appears the private surveillance approval process isn't that much different than the public surveillance approval process. In other words, input from the general public is ignored.

Warshaw said the five-person board of the homeowner association decided to add the three cameras and use money from the neighborhood’s dues to pay for it. The entire 75-home neighborhood did not vote on the decision, but Warshaw said he hadn’t heard any negative feedback.

Following government precedent, the HOA's deployment of ALPRs is also pretty much unjustifiable.

Warshaw, who has lived in the neighborhood since 2005, admitted that one home burglary in 15 years is not exactly a rash of crime.

Warshaw insists the product makes residents "feel safer." This is a really curious [pronounced "bullshit"] claim, considering residents don't appear to have been asked their opinion, before or after the purchase.

I guess the only opinion that matters is that of the "leadership," whether it's a city council approving the tech behind closed doors or HOAs doing the same thing. As the Denver Post points out, surveillance tech deployment continues to increase while crime rates continue to decline. These declines preceded the mass rollout of ALPRs, Stingrays, and facial recognition tech, strongly suggesting law enforcement agencies (and HOAs!) had ways to deal with criminal activity that didn't involve pointing invasive tech in the direction of non-criminals.

Finally, Flock Safety -- the preferred provider of HOA surveillance tech -- makes a completely incongruous, if not completely impossible, claim on its website. Whoever approved this copy should be forced to stand naked in front of the nearest CCTV camera until I get tired of mocking them.

Please explain to me how "privacy" is being "protected" by giving law enforcement instant access to license plate photos. The FlockBot remains silent on the issue, but really really really wants to annoy you with emails and sales rep calls.

Filed Under: authoritarians, hoa, home owners associations, license plate readers, neighbors, privacy, spying, surveillance
Companies: flock safety

Australian Home Affairs Minister Says Government Still Considering Spying On Its Own Citizens

from the be-part-of-the-open-book-experience dept

Nothing's too much to sacrifice for the greater good of Australia. Not even Australians.

A series of police raids on journalists has raised questions about how far the government will go to control what Australian citizens know about their government's activities. Three separate raids targeted leaks that revealed, among other things, possible war crimes committed by Australian soldiers and the government's plans to place its own citizens under surveillance by expanding the power allotted to the Australian Signals Directorate.

The unintentional side effect of government raids designed to discourage further reporting on government secrets is the government is now confirming one of the leaks it targeted.

Peter Dutton has confirmed that a plan to create new powers to spy on Australians – which sparked police raids at the centre of the press freedom row – is still on the table.

On Sunday the home affairs minister claimed it was “complete nonsense” that the government supported spying on Australians but, in the next breath, called for a “sensible discussion” about whether the Australian Signals Directorate should gain such powers, which he argued could help disrupt paedophile networks and stop cyber-attacks.

Ah, the old "we're not going to spy on you, unless..." National security takes a backseat to child porn purveyors in Dutton's directly contradictory statements, but it's still the same tired argument. Domestic surveillance makes it easier for the government to catch bad guys and efficiency should always take precedence over rights and liberties.

This followed other statements from Dutton, most of which followed the same pattern: deny the government wants to spy on Australians, followed by reasons why the government should be allowed to spy on Australians.

“We don’t support spying on Australians,” he said. “That was a complete nonsense."

“But where you’ve got a paedophile network that operates out of Manila that live-streams children being abused, there might be an ability for an Australian agency to try and shut that server down.

“If that same server was operating in Fitzroy, here in Melbourne, then there would be very limited capacity in certain circumstances where it was masked or it was rerouted and … we weren’t able to shut that paedophile network down."

Well, I guess if the ends justify the means… Like others angling for greater surveillance capabilities at the expense of the public's freedoms, Dutton claims Australians are only a "sensible discussion" away from accepting additional government intrusion.

That this "discussion" remains on the table despite Australians' opposition to it just shows how essential it is that Australian journalists remain free to publish leaked documents without fear of government reprisal. Dutton has tipped his hand, though, suggesting neither Australians nor the country's journalists will be as free in the future. He has refused to condemn the raids on journalists and is openly pitching a surveillance program whose unauthorized publication was greeted with a show of force.

Filed Under: australia, peter dutton, privacy, spying, surveillance

Mexican Government Pitched In To Help The CBP Spy On Journalists, Activists, And Lawyers

from the odd-coupling dept

The CBP has an unlikely partner in its surveillance of journalists, activists, and lawyers: the Mexican government. It's not going to pay for The Wall™, but it's apparently willing to help out in other ways.

A government review of how journalists, attorneys, immigration advocates, and activists were monitored and tracked by U.S. border agencies confirms the Mexican government had a major role in the controversial tracking program.

In a letter dated May 9, 2019, Randy Howe, Executive Director of Field Operations for U.S. Customs and Border Protection (CBP) notes that “...CBP partnered with the Government of Mexico [to] address developing threats…” posed by the Central American Migrant caravan.

“A number of journalists and photographers were identified by Mexican Federal Police as possibly assisting migrants in crossing the border illegally and/or as having some level of participation in the violent incursion events,” CBP’s letter states.

Mexican government officials originally stated the government was not involved in this controversial surveillance. These assertions have been undercut by a statement written in response to a letter from a coalition of press outfits and rights groups demanding to know why the CBP and DHS were adding First Amendment violations to their long list of Fourth and Fifth Amendment violations.

Here's the Mexican government's original statement, which has suddenly aged very badly.

“The government of Mexico disapproves of all acts of illegal espionage against any person, domestic or foreign. The Mexican government does not conduct illegal surveillance on anyone, for any type or category of activity,” a statement read.

I guess it all depends on how you define "illegal." Or "surveillance." Maybe the federal police limited themselves to adding people to the CBP's watchlist. Perhaps this sort of surveillance isn't illegal in Mexico. But it's definitely on the illegal side here in the United States. If it's not a legal issue on the other side of the border, then the CBP and DHS are basically using a foreign government to engage in surveillance they're not allowed to perform on this side of the fence.

It doesn't appear the CBP and DHS are all that concerned about the possible Constitutional violations they're engaged in themselves. The letter the CVP sent says the agency was only trying to round up people trying to assist migrants in crossing the border illegally, which somehow included journalists covering the border caravans and immigration lawyers trying to help people through the asylum process.

The CBP does admit it will periodically violate Constitutional rights, but it claims these violations are only minor speed bumps on the road of American life.

Occasionally, CBP may inconvenience law-abiding persons in our effort to detect, deter, and mitigate threats to our homeland.

Well, I'm glad that's all cleared up. The CBP does not engage in illegal surveillance (except when it does) and does not target protected First Amendment activities (except those occurring near the border) and only in the interest of national security does it ignore rights guaranteed by the Constitution of the United States. And it's doing all this with a foreign government's help -- a government that denied it had anything to do with this surveillance when first asked about its involvement.

Filed Under: activists, cbp, journalists, mexico, spying, surveillance

After Five-Year Legal Battle, Top Judges Rule That The UK's Spying Activities Can Be Challenged In Ordinary Courts

from the if-at-first-you-don't-succeed dept

The digital rights group Privacy International has won a major victory against UK government surveillance after a five-year legal battle. One of the many shocking revelations of Edward Snowden was that the UK security and intelligence services break into computers and mobile phones on a massive scale. Privacy International challenged this "bulk" surveillance at the UK's Investigatory Powers Tribunal (IPT), the "judicial body which operates independently of government to provide a right of redress for anyone who believes they have been a victim of unlawful action by a public authority using covert investigative techniques". In February 2016, the IPT dismissed Privacy International's challenge, ruling that:

the UK government may use sweeping 'general warrants' to engage in computer hacking of thousands or even millions of devices, without any approval from by a judge or reasonable grounds for suspicion. The Government argued that it would be lawful in principle to use a single warrant signed off by a Minister (not a judge) to hack every mobile phone in a UK city -- and the IPT agreed with the Government.

In May 2016, Privacy International challenged the IPT's decision in the UK High Court, which agreed with the UK government's position that Tribunal decisions were not subject to judicial review. So Privacy International turned to the Court of Appeal, in February 2017. In November 2017, the Court of Appeal dismissed the move, finding in favor of the UK government once more. Undeterred, the digital rights group applied for and was granted permission to appeal to the UK's Supreme Court, which has now ruled that IPT decisions can indeed be challenged in the courts (pdf). Caroline Wilson Palow, Privacy International's General Counsel, explains why that's important:

Today's judgment is a historic victory for the rule of law. It ensures that the UK intelligence agencies are subject to oversight by the ordinary UK courts. Countries around the world are currently grappling with serious questions regarding what power should reside in each branch of government. Today's ruling is a welcome precedent for all of those countries, striking a reasonable balance between executive, legislative and judicial power.

The hope is that other countries will take note of the UK Supreme Court ruling, and follow suit by allowing judicial oversight of national surveillance activities. Privacy International intends to take advantage of the new judgment immediately to tackle the UK's bulk surveillance revealed by Snowden:

Today's ruling paves the way for Privacy International's challenge to the UK Government's use of bulk computer hacking warrants. Our challenge has been delayed for years by the Government's persistent attempt to protect the IPT's decisions from scrutiny. We are heartened that our case will now go forward.

As well as a welcome result in itself, Privacy International's ultimate victory after a string of legal defeats is a useful reminder that persistence and patience are important virtues for activists.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: courts, ed snowden, privacy, spying, surveillance, uk
Companies: privacy international

US Huawei Blackballing Efforts Stall Due To Lack Of 'Actual Facts'

from the ill-communication dept

During the Trump era, the US government has dramatically ramped up claims that Chinese hardware vendor Huawei is a nefarious spy for the Chinese government, blackballing it from the U.S. telecom market. From pressuring U.S. carriers to drop plans to sell Huawei phones to the FCC's decision to ban companies from using Huawei gear if they want to receive federal subsidies, this effort hasn't been subtle.

While Huawei should never be confused with a saint (what telecom company would be?) there's several problems with the effort. The biggest being that despite a decade of hand-wringing and one eighteen month investigation by the US government, there's still no public evidence Huawei uses its network gear to spy on Americans. That's not sitting well with countries we've asked to join along in the fun.

The UK, for example, recently noted that while some Huawei products can pose risks by nature of simply being low quality, they've yet to see any threat posed by Huawei that necessitates a global ban. That position has since been repeated by other allies who have been pointing out how despite years of bluster on this subject, they've yet to see the US government release the slightest bit of evidence supporting the allegation:

"European and Asian officials have complained privately that recent American intelligence briefings for allies did not share any sort of classified information that clearly demonstrated how the Chinese government used Huawei to steal information, according to people familiar with the discussions. European officials have told counterparts that if the United States has evidence the Chinese government has used its companies to do so, they should disclose it.

One senior European telecommunications executive said that no American officials had presented “actual facts” about China’s abuse of Huawei networks.

Of course this is all hidden behind claims that this information is classified. But how hard is it to redact and provide at least some information proving your point? These allegations have also been bubbling up in fits and starts for over a decade now, and not a single security expert or any government official has been able to provide any evidence whatsoever to prove their point. While it's certainly not impossible that Huawei helps the Chinese government spy, evidence is important. Can you imagine the hysteria on countless fronts if a US company like AT&T was banned from other countries without any supporting data?

Unmentioned in coverage of this hand-wringing about Huawei has been the fact that much of the hysteria on this front has been drummed up by US networking companies, who simply don't want to compete with cheaper Chinese gear. With countless global gear makers rushing toward the trough as wireless carriers build next-generation 5G wireless networks, these efforts have only intensified. US gearmakers and their favorite lawmakers have a good schtick going: profess China must be banned from all global telecom markets based on claims of spying, then hide behind national security when anybody asks for proof.

Also ignored is that all of the hysteria about Huawei obfuscates a larger security threat (much of it originating in China): the lack of security in shitty internet of things gear. At this point you don't really need Huawei to spy on Americans, since we're connecting millions of poorly secured devices to our home and business networks annually voluntarily. Gear that often lacks any sensible security countermeasures whatsoever.

Similarly ignored is the fact that the US has engaged in most of the behavior we accuse Huawei of, including having broken into Huawei to spy on company executives. You'll often see stories like this one highlighting China's nefarious attempts to tap into undersea cables. But the press ignores that the US has been engaged in its own undersea cable and satellite communications wiretapping efforts for decades. Many of these efforts began decades ago (like Echelon), and were ridiculed as tin-foil-hat fantasy until the Snowden documents were revealed.

Again, none of this is to defend China's actual abuses, or to suggest that Huawei hasn't engaged in bad behavior. But imposing a global ban on a telecom giant for spying based on no actual evidence remains a shaky proposition, and it's something countless supporters of the blackballing effort would be screaming about incessantly were the shoe on the other foot.

Filed Under: blackballing, china, competition, fear mongering, spying, telco equipment, us
Companies: huawei

UK Suggests US Worries About Huawei Spying Are Being Overblown

from the protectionism-by-another-name dept

So, while there's really no denying that Chinese smartphone and network gearmaker Huawei engages in some clearly sketchy behavior, it's not anything that can't be matched by our own, home-grown sketchy telecom companies. And while the Trump administration has been engaged in a widespread effort to blackball Huawei gear from the American market based on allegations of spying on Americans, nobody's been able to provide a shred of public evidence that this actually occurs. At the same time, we tend to ignore the fact that the United States broke into Huawei to steal code and implant backdoors as early as 2007.

In short, this subject is more complicated that the blindly-nationalistic U.S. press coverage tends to indicate, and a not-insubstantial portion of this hand-wringing is driven by good old-fashioned protectionism.

Throughout this whole thing, Huawei executives have been right to note that in the decade-plus of these allegations and hand-wringing, you'd think some security researcher would have been able to prove that Huawei gear is spying on Americans wholesale. And last week, as news emerged that the Trump administration was finally considering a full domestic ban on using Huawei gear, our closest surveillance allies in the UK made it clear that the Huawei threat is likely being overstated by the United States:

The United Kingdom could undermine an American-led campaign to keep Chinese tech company Huawei out of super-fast 5G mobile networks around the world. The National Cyber Security Centre, part of the UK intelligence service, has concluded that there are ways to limit the risks of using Huawei to build next-generation wireless networks, according to a report by the Financial Times.

The report reiterated past concerns that while some Huwei gear may pose a security threat, it's likely because the products can sometimes be shitty, but not because they're being intentionally backdoored by the Chinese government:

If anybody knows just how Huawei works and the threat it might pose to the UK's security, it is the National Cyber Security Centre.

This arm of GCHQ has been in charge of an annual examination of the Chinese telecoms giant's equipment, and expressed concerns in its most recent report - not about secret backdoors, but sloppy cyber-security practices.

That's of course pretty common with most hardware coming out of China (especially in the internet of things space), which sort of makes the point that the Chinese don't need backdoors in Huawei gear to spy on Americans, since we're willfully putting a wide variety of shitty, half-baked IOT gear on our networks, providing industrious hackers and intelligence agencies an entire universe of attack vectors into millions of U.S. homes and businesses. Still, the solution for this is to only install gear you know to be secure, not by banning an entire company from doing business (something we aren't all that keen on when it happens to us).

If you've paid attention, U.S. gearmakers have been ginning up Huawei security fears for years, simply because they don't want to have to compete with cheaper gear. The Trump administration appears pretty happy to play along, dressing up simple protectionism as national security. And because the U.S. tech press often can't see past its own patriotism, it's coming along for the ride. Again, none of this is to say that Huawei doesn't engage in sketchy shit, just that if we're going to blackball a company for spying--providing some actual evidence of said spying is a pretty important first step.

Filed Under: china, spying, telco equipment, uk, us
Companies: huawei