It Happened Again: Antipiracy Outfit Asks Google To Delist 127.0.0.1 On Behalf Of Ukrainian TV Station

from the where-the-piracy-is dept

We've made this point before, but the moment you attempt to scale up copyright enforcement, you run into problems. Collateral damage from automated systems mistaking non-infringing content for infringing, the possibility of fraud and abuse, the blind eye towards Fair Use all become problems. But sometimes those problems are so silly that they expose what a pure fiasco this has become. Several years back, we discussed Universal Pictures asking Google to delist a bunch of supposedly infringing sites, listing one of them as 127.0.0.1. Depending on how computer savvy you are, you may recognize that this IP address is how a computer or system refers to itself. In other words, it essentially means "home."

And, yet, despite how silly this all is, it just keeps happening. Most recently, the anti-piracy outfit used by a Ukrainian television broadcaster may have outed its own client by also asking Google to delist 127.0.0.1.

Ukrainian TV channel TRK has sent a rather bizarre takedown request to Google. The company's anti-piracy partner Vindex asked the search engine to remove a search result that points to 127.0.0.1. Tech-savvy people will immediately recognize that the anti-piracy company apparently found copyright-infringing content on its own server.

The request was sent by TKR’s anti-piracy partner Vindex, which essentially flagged a file on its own machine. The ‘infringing’ link is 127.0.0.1:6878/ace/manifest.m3u. This points to a playlist file, possibly for the P2P streaming platform Ace Stream that’s often used to pirate content.

Now, a number of things here should be unsurprising to our regular readers. That an antipiracy outfit sucks at identifying proper sites for delisting is no surprise. Likewise, the idea that a company that is crying about copyright infringement might be guilty of infringement itself also fails to shock the mind. But what is surprising is that the antipiracy outfit may have accidentally outed its own client through its own stupidity as a party infringing copyrights so thoroughly.

Google obviously cannot delist the IP address, as there is nothing to delist. And, frankly, Vindex is known to suck at its one job.

Since 127.0.0.1 refers to the host computer, Google is technically asked to remove a file from its servers. A file that doesn’t exist. Needless to say, Google hasn’t taken any action in response.

The above suggests that Vindex may want to take a good look at its takedown bots. The company doesn’t have a stellar reputation when it comes to DMCA notices. Of all the links that were reported to Google, little more than 10% were removed by the search engine.

Adding to it that you imagine there are some uncomfortable conversations being had between Vindex and its client today and you're left with the impression that there is a ton of egg on its face right now.

Filed Under: 127.0.0.1, antipiracy, copyright, home, ip addresses, piracy, ukraine
Companies: google, trk

Amazon Tells Ukraine Publication To Alter Its Article After It Links The Company To Ring's Problematic Ukraine Branch

from the burnt-by-your-own-source dept

An extremely-problematic wing of an extremely-problematic company is back in the news. Ring's Ukraine division made headlines last fall when the presence of a "Head of Facial Recognition Tech" in the Ukraine office appeared to contradict Ring's claims it was not interested in adding facial recognition to its cameras.

More disturbing news surfaced earlier this month, when it was discovered this office had allowed its employees to view Ring camera footage uploaded by users. Ring doesn't just produce doorbell cameras. It also sells in-home cameras, making this revelation particularly worrying.

Beginning in 2016, according to one source, Ring provided its Ukraine-based research and development team virtually unfettered access to a folder on Amazon’s S3 cloud storage service that contained every video created by every Ring camera around the world. This would amount to an enormous list of highly sensitive files that could be easily browsed and viewed. Downloading and sharing these customer video files would have required little more than a click. The Information, which has aggressively covered Ring’s security lapses, reported on these practices last month.

Not only did the R&D team have complete access to customers' recordings, so did Ring's US-based engineers and executives. And who knows how many other people have accessed these recordings illicitly? When this access was granted to an untold number of Ring employees, Ring did not encrypt uploaded recordings. The company apparently felt encryption was too expensive to implement and would possibly limit revenue opportunities for the company as it aggressively moved into the home security market.

It turns out the company was using customers' footage to train its AI to recognize faces and other objects. This would be the same facial recognition Ring swears it isn't going to be implementing anytime soon.

Apparently, this abuse of trust has resulted in growth opportunities for Ring-Ukraine. A recent article by Ukranian publication Vector stated the office would be lending its expertise to other Amazon products, which possibly includes Rekognition, Amazon's homegrown facial recognition program.

But that story was buried by Amazon PR shortly after it appeared, according to Sam Biddle of The Intercept.

I asked multiple Amazon representatives and Ring’s head of communications about the Vector article, including specifically what were the “many other Amazon projects” Ring’s Ukrainian staff now worked on.

Although Amazon ignored repeated requests for comment and Ring refused to discuss the subject on the record, it seems that the company did take action: Within hours of my inquiries, the text of the Vector piece was quietly edited to remove references to Amazon. Most notably, the entire quoted sentence about the “many other Amazon projects” the Kyiv office was working on was excised.

The author of the story told The Intercept he had nothing to do with the belated deletion. In fact, he was not aware of any editing until The Intercept brought it to his attention. An email from Vector's editor-in-chief explained the situation, although not all that satisfactorily.

We published a news about rebranding, later pr-manager of Ring Ukraine called me and asked to take Amazon mention out from the article. Since I had a good relationship with manager, the article got just several dozens of views and I understood that everyone know that Ring is part of Amazon anyway, I didn’t even asked questions, said ok and took Amazon part out

It appears Amazon doesn't want people to know it has given a problematic division even more responsibility. It also may be trying to head off another Ring-related PR nightmare by removing any text that might suggest Ring customer recordings are being used to train facial recognition software used by government agencies.

But it's too late to change public perception. The scrubbing may keep Amazon from being linked to unfettered access to Ring camera recordings in search results, but there's no separating Amazon from Ring. And there's nothing here that suggests either company is moving away from leveraging user-generated content to fine-tune AI for the customers they really want: law enforcement agencies.

Filed Under: journalism, ring, ukraine
Companies: amazon, ring

As Devin Nunes Threatens More SLAPP Suits, He May Have To Explain Why Cows Can Type In His First SLAPP Suit

from the cows-that-type dept

It has become abundantly clear that Devin Nunes, who once co-sponsored the "Discouraging Frivolous Lawsuits Act," has decided that the best strategy to all of his critics and any reporting that calls him out is to file completely bullshit SLAPP suits against those critics. It started with the lawsuit against a satirical cow and has continued with more lawsuits against reporters, political researchers, newspapers and political strategists. Given that he's gone on all in with that strategy, it's no surprise that he says he's going to sue CNN and the Daily Beast this week, both of whom reported on stories about Nunes that look pretty bad for him.

Because it seems clear that Nunes really doesn't want you to read these stories, you should probably know that the Daily Beast story quotes indicted Rudy Giuliani associate Lev Parnas's lawyer Ed MacMahon saying that Parnas "helped arrange meetings and calls in Europe" for Nunes when he visited there last year, while CNN quoted a different Parnas lawyer saying that, among the meetings set up, was one between Nunes and disgraced former Ukrainian prosecutor Victor Shokin. Let's be clear, if these reports are false, then it's possible Nunes would have a claim against Parnas (or potentially Parnas' lawyers,), but not the news orgs reporting what he said. And it seems telling that when asked whether or not the story was true, Nunes did not deny it:

On Sunday, Bartiromo asked Nunes a very straightforward question — “Were you in Vienna with Shokin?” — but instead of answering, Nunes railed against the media and threatened to get litigious.

“I really want to answer all of these questions ... but because there is criminal activity here, we’re working with the appropriate law enforcement agencies, we’re gonna file all this — everyone is gonna know the truth, everyone is gonna know all the facts — but I think you can understand that I can’t compete by trying to debate this out with the public media, when 90 percent of the media are totally corrupt,” Nunes said.

He continued: “And because this is criminal in nature, and because it’s so bad, it’s so slanderous, we’ve got all the facts on our side, and we’re going to file in federal court, because I’m not gonna sit here and try to compete against the media that I have no chance of winning with. I will win in court, and they’ll have a chance to cooperate, and they’ll have to show how they work with someone who has been indicted, which is likely conspiring to obstruct justice.”

Just to be clear, this is all utter and complete nonsense. Their reporting isn't criminal. It's certainly not "slanderous." This is Nunes throwing shit at the wall rather than responding to a serious journalist's question.

Somewhat hilariously, Nunes also claims that when he sues both media properties, he doesn't think they'll show up in court and he'll have to chase them down.

In that video, talking to Sean Hannity, Nunes says:

I have a bet for you Sean: CNN and the Daily Beast are going to run for cover. They're going to fight this. They're not going to show up in court. They're not going to accept service. But at the end of the day I'm going to track them down, and I'm going to hold them accountable.

If I were Sean Hannity, I'd take that bet and double down. I'd bet a decent sum of money that assuming Nunes actually moves forward with this very dumb legal strategy, that not only will those two media companies accept service and show up in court, they'll show up with lawyers eager to blast these cases to smithereens and make Nunes look like the petty frivolous SLAPP-suit filing loser he is. I'd also imagine that both media operations might actually be willing to jump straight to the discovery process, as I'm sure they'd actually love to let their lawyers depose Nunes.

Meanwhile, back in that very first case, against the satirical Twitter cow, you may recall that Nunes himself admitted that these lawsuits were really fishing expeditions to find out who various journalist sources were, a claim that was made even more obvious in that case when his discovery demands were made public.

Part of the fishing expedition is a subpoena to Adam Parkomenko, a Democratic political strategist, who Nunes appears to think is somehow connected to the satirical accounts. Parkomenko hired lawyer Scott Surovell, who filed one of the most fun legal documents you'll ever read in support of his motion to quash the subpoena. There's the technical stuff -- claiming various process and rules violations regarding how the subpoena was issued, but that's not what has gotten the internet all excited. But then, the memorandum has some fun in explaining why the entire lawsuit is frivolous nonsense, including highlighting the lack of opposable digits from cows:

Both of these anonymous Twitter accounts are blatant parody accounts. No reasonable person would believe that Devin Nunes' cow actually has a Twitter account, or that the hyperbole, satire and cow-related jokes it posts are serious facts. It is self-evident that cows are domesticated livestock animals and do not have the intelligence, language, or opposable digits needed to operate a Twitter account. Moreover, by purporting to be from a cow, with the excessive use ofcow puns and cow imagery, it is plainly evident that it is not a serious news outlet. Defendant "Devin Nunes' Mom" likewise posts satirical patronizing, nagging, mothering comments which ostensibly treat Mr. Nunes as a misbehaving child. In light of the content, a reasonable person, reading the accounts in context, would not take Defendant "Devin Nunes' Cow" or Defendant "Devin Nunes' Mom" to be serious accounts imparting actual facts about Plaintiff. They are parody accounts. As such, the statements at issue in this case lack the defamatory sting necessary to state a cause of action.

Clearly, Mr. Surovell is unfamiliar with the popular children's book Click Clack, Moo; Cows That Type (which is actually a lot of fun), but maybe he doesn't have young kids. I don't think it would change the argument much, either way.

And, of course, all this has really done is opened up yet another opportunity for people to dunk on Nunes and call out questions about his actions. Indeed, Parkhomenko is now raising some questions about who is funding Nunes' legal spree:

If Nunes thought these lawsuits would create chilling effects and silence journalists and his critics, it appears he may be mistaken.

Filed Under: 1st amendment, adam parkomenko, defamation, devin nunes, devin's cow, devincow, free speech, intimidation, lev parnas, slapp, ukraine
Companies: cnn, daily beast

Former Devin Nunes' Aide Uses Nunes' Lawyer To File SLAPP Suit Against Politico

from the it's-spreading dept

Steven Biss is the lawyer who filed Devin Nunes' SLAPP suit against a satirical cow on Twitter (and against Twitter and political consultant Liz Mair), as well as Nunes' various other lawsuits against a variety of journalists and critics.

It appears that a former Nunes aide is now using Biss for similar purposes. Earlier this week, Biss, representing White House staffer and former Nunes' aide, Kashyap "Kash" Patel, sued Politico and reporter Natasha Bertrand, along with Politico publisher Robert Allbritton, in yet another SLAPP suit in Virginia (hey, Virginia, time to improve your anti-SLAPP laws, please). The lawsuit is silly and performative, rather than serious. It is filed about a Politico article by Bertrand, that reports Fiona Hill, the former senior advisor on the National Security Council, testified during the impeachment hearings that Patel passed questionable information about Ukraine on to Trump, and a later article that Trump (incorrectly) may have believed that Patel was the NSC's expert on Ukraine. The article is carefully reported.

The defamation complaint is... not. To understand just how silly and performative it is, you only need to read the opening paragraph. This is not how you file a lawsuit if you wish to convince a judge. It's how you file a lawsuit if you wish to get cheered on by the Trump-supporting media:

We live in the era of weaponized media. The days of the mild-mannered reporter – covering a beat, gathering facts and truthfully reporting about “the news that’s fit to print” – are over. The venerable “Fourth Estate” has been replaced by partisan hacks and character assassins who work to advance the interests and agendas of dark money. One of the very worst offenders in the business is “Politico”.

Notably, the complaint does not indicate what is factually false in the various statements it highlights. It just quotes various statements in the articles and says that they are either "false statements" or have "defamatory implications." But most of the statements are clearly reporting on the statements that others made, or are clearly not false statements of fact or defamatory. For example, this is the one of the statements that Biss/Patel claim is defamatory:

“Kashyap Patel, a longtime Nunes staffer who joined the White House in February, was so involved in the issue that at one point Trump thought he was in charge of Ukraine policy for the National Security Council, according to congressional testimony by Fiona Hill”;

That's reporting on what Hill had to say. If Hill did not say that, then it would likely be Hill, not Patel, who would have a claim here. But the complaint doesn't suggest that Hill didn't say that. Just that what Hill said was false. But even so, it's hard to see how anything here could possibly be defamatory. Whether or not Trump believed something, according to someone else, is not something that Patel can actually sue over. That's not how any of this works.

Much later in the complaint, in a footnote, Biss actually admits that Hill did say this, but claims that she fabricated the claim:

If Politico, Bertrand and Allbritton had bothered to wait for the transcript, they would have learned that Hill completely fabricated the story that Kash had provided “materials on Ukraine” to the President.

If that were true, then perhaps Patel would have a claim against Hill. But the complaint fails to actually show that Hill "completely fabricated" the information. All it says is that Rep. Adam Schiff "spoon-fed Hill grossly leading questions in a clear effort to fabricate a narrative about Kash." That is not the same as showing that the claims were falsified.

Other statements that are claimed to be defamatory would have anyone scratching their heads. How is the following defamatory, even if it wasn't true (and it appears to be true):

“Patel joined the National Security Council’s International Organizations and Alliances directorate in February and was promoted to a senior counterterrorism role around the same time as Trump’s fateful call with Ukrainian President Volodymyr Zelensky, in which he urged the newly elected leader to investigate Biden and ‘get to the bottom of’ Ukrainian interference in the 2016 election”;

The only statement of fact there about Patel is that he joined the NSC in February and was later promoted. Even if that's false (and there's no indication that it is), how is that defamatory? Or how about this statement:

“Patel’s name has been brought up in several recent depositions, according to another person with direct knowledge of the interviews, in connection with the shadow foreign policy campaign Trump allegedly directed in an effort to extract political favors from the newly elected Zelensky”;

That article is revealing what a "person with direct knowledge of the interviews" said. Nowhere in the complaint do they dispute that.

The whole thing appears to be a blatant SLAPP suit. It even has nonsense like the following:

Schiff conducted the interviews like a Star Chamber or Kangaroo Court, and, in so doing, stripped the witnesses of any privilege or immunity from defamation that they may have enjoyed.

That entire sentence is nonsense. Conducting closed door interviews is perfectly reasonable as part of an investigation and has nothing to do with any privilege or immunity questions. I could go on and on, but actually, I'm just going to point people to Wonkette's story about this lawsuit because it details over and over again why this "isn't a real lawsuit." Here's just a snippet, but I suggest reading the whole thing:

You know this isn't a real lawsuit because it claims that Fiona Hill and Alex Vindman's transcripts prove that "Defendants' reporting was categorically and knowingly false," when in fact Hill testified that someone in the Executive Secretary's Office told her, "Oh, the President wants to talk to your Ukraine director ... to talk about some of the materials ... so we might be reaching out to Kash." Which reasonably led her to believe that Patel had been presenting himself to the president as the Ukraine director, because there aren't that many guys named Kash on the NSC, exactly as reported in Bertrand's story and ours and the New York Times's, which was published the same day as Politico's and had multiple NSC sources.

You know this isn't a real lawsuit because there is no way on God's Green Earth that Patel will subject himself to discovery about whatever insane cowfarts he may or may not have printed off 8chan to feed to President Babyfingers.

You know this isn't a real lawsuit because, GAWDALMIGHTY, what the hell does this have to do with actual law? "Defendants chose to manufacture and publish false and scandalous statements and use insulting words that were unnecessarily strong and that constitute violent, abusive and hateful language, disproportionate to the occasion, in order to undermine public confidence in Kash and smear Congressman Nunes and the President. The words chosen by the Defendants evince their ill-will, spite and actual malice."

You know this isn't isn't a real lawsuit because Patel just got promoted and remains in his post, and yet somehow claims "actual damages, including, but not limited to, insult, pain, embarrassment, humiliation, mental suffering, injury to his reputation, special damages, costs, and other out-of-pocket expenses, in the sum of $25,000,000.00" for the calumnious accusation that Patel, a presidential aide ... provided information to the president

As that last one notes, the lawsuit is seeking a hilarious $25 million in damages, along with an additional $350,000 in "punitive damages" because why not?

Virginia needs a better anti-SLAPP law and we need a federal anti-SLAPP law. These nonsense lawsuits need to stop.

Filed Under: 1st amendment, anti-slapp, devin nunes, free speech, impeachment, kash patel, natasha bertrand, nsc, robert allbritton, slapp, steven biss, ukraine, virginia
Companies: politico

Report: Devin Nunes' Aide Going Around Leaking Ukraine Call Whistleblower's Name

from the proper-channels dept

We've been highlighting lately how the situation with the whistleblower, who first tried to ring the alarm bells about President Trump's now confirmed quid pro quo call with Ukraine to dig up dirt on a political opponent, showed why the "official channels" are useless for whistleblowers. Some suggested that we were premature in making that claim. However, since then, we've seen the President himself repeatedly try to attack the whistleblower while repeatedly demanding that the whistleblower be revealed. Now come reports that a staffer for Rep. Devin Nunes is going around revealing the name of the whistleblower:

A top aide to Rep. Devin Nunes has been providing conservative politicians and journalists with information—and misinformation—about the anonymous whistleblower who triggered the biggest crisis of Donald Trump’s presidency, two knowledgeable sources tell The Daily Beast.

Derek Harvey, who works for Nunes, the ranking Republican on the House intelligence committee, has provided notes for House Republicans identifying the whistleblower’s name ahead of the high-profile depositions of Trump administration appointees and civil servants in the impeachment inquiry. The purpose of the notes, one source said, is to get the whistleblower’s name into the record of the proceedings, which committee chairman Adam Schiff has pledged to eventually release. In other words: it’s an attempt to out the anonymous official who helped trigger the impeachment inquiry.

Nunes, of course, has a bit of a history pushing mis- and dis-information in support of President Trump, so this seems par for the course. In the Daily Beast link above, one of the lawyers for the whistleblower, Mark Zaid, notes that revealing the name only serves to put the whistleblower in danger and seems to aim to "deter future whistleblowers from coming forward."

So, once again, it highlights exactly what we've been saying. Even in this case, where the whistleblower tried to use the "proper channels," everything is designed to go against the whistleblower, starting with the failure to turn over the complaint to Congress, as required by the law. The fact that a Nunes staffer is now apparently putting that whistleblower "at risk of harm" (according to Zaid) highlights just how ill-prepared our government is to deal with whistleblowers at a time when we need more, not fewer, whistleblowers.

Filed Under: cia, derek harvey, devin nunes, leaks, proper channels, ukraine, whistleblower

The Best People: White House Emailed Talking Points Meant For Surrogates To Dems, Tried To Recall Email Afterwards

from the heads-up-everyone dept

At the time of this writing, I'll go ahead and assume that anyone reading this is now fully immersed in Ukraine-Call-Gate or whatever we're calling this potentially impeachment-inducing scandal Donald Trump has managed to build for himself. What started as a murky story surrounding the administration flatly ignoring the law in handling a mysterious whistle-blower complaint has since been clarified in the extreme. What happened essentially is that the whistle-blower raised alarms over several occurrences, one of which was a call that occurred between Trump and the recently elected Ukrainian President in which Trump reportedly pushed his counterpart to investigate Hunter Biden, the son of his potential 2020 rival. Then, for reasons that are beyond me, Trump released an unredacted "rough" transcript of the call, which demonstrates that he did that very thing. You're going to hear a great deal of obfuscation over the next days and weeks about what the transcript shows. Go read it for yourself. Trump asked Ukraine, while withholding aid money at the time, to investigate the Bidens.

In the wake of the outrage over the transcript, the White House obviously went into damage control. That's to be expected. As part of any scandal, talking points are developed for surrogates to use when talking on any of the insanely stupid 24 hour news channels. That's also to be expected. But once those talking points are in written format, it's not customary to send them out to the opposing party's Congressional members.

The White House on Wednesday sent out talking points on how to spin the release of a summary of President Trump’s phone call to his counterpart in Ukraine — but emailed them to House Democrats, apparently by mistake.

Here's the goods, should you want to see them for yourself.

Now, look, I've made this mistake in my own professional life. That said, I'm not one of the "very best people" working for a White House embroiled in a full on scandal of its own making, so there's that. When you're trying to sow confusion and intrigue around what appears for all the world to be a really simple example of abuse of Presidential power, you really have to be careful about who is in that "To:" field.

And, even when I have made this mistake, I was smart enough not to frantically send out one of those useless "recall email" requests to those very same rivals I had accidentally emailed.

Now, I know some of you are thinking that this really isn't a laughing matter. And you're right, but you're also wrong, because this is fucking hilarious. One is forced to imagine Stephen Miller himself furiously sending out recall requests to Nancy Pelosi having just realized what he's done.

Will this inadvertent transparency matter? Probably not. If you're the sort that spends any calories watching cable news, this will all probably fly right over your head. Meanwhile, partisanship has so infested Washington that one of the truest things Donald Trump has ever said is probably that he could shoot someone on 5th Avenue without consequence. So at least we can have a laugh at the very best people's use of email, instead.

Filed Under: donald trump, hunter biden, impeachment, nancy pelosi, recall, talking points, transcript, ukraine, white house

As A New Wave Of Cyberattacks Rolls Out, Rep. Ted Lieu Asks What The NSA's Going To Do About It

from the ETERNALPWNAGE dept

Leaked NSA exploits have now been the basis for two massive cyberattacks. The first -- Wannacry -- caught hospitals and other critical infrastructure across several nations in the crossfire, using a tool built on the NSA's ETERNALBLUE exploit backbone. The second seems to be targeting Ukraine, causing the same sort of havoc but with a couple of particularly nasty twists.

This one, called Petya, demanded ransom from victims. Things went from bad to worse when email provider Posteo shut down the attacker's account. Doing so prevented affected users from receiving decryption keys, even if they paid the ransom.

It soon became apparent it didn't matter what Posteo did, no matter how clueless or ill-advised. There was no retrieving files even if ransoms were paid. Two separate sets of security researchers examined the so-called ransomware and discovered Petya is actually a wiper. Once infected, victims' files are as good as gone. No amount of bitcoin is going to reverse the inevitable. The ransomware notices were only there to draw attention to the infection and away from the malware's true purpose.

Both cases are considered to be attacks by nation states. Inconsistently-applied patches -- most of them released with zero information by Microsoft -- have led to an insane amount of damage.

Through it all, the NSA -- whose tools were leaked -- has remained consistently silent. There's been no indication if the agency is working to mitigate the ongoing threat or whether it's far more concerned with discovering who left behind the malware toolkit first exposed by the ShadowBrokers.

It's unlikely we'll hear much being said publicly by the agency, but Rep. Ted Lieu has sent a letter to NSA chief Mike Rogers demanding answers. The letter [PDF] points out both attacks have been based on NSA exploits (ETERNALBLUE and ETERNALROMANCE). Lieu also states he fears the attacks seen in the past few weeks are only the "tip of the iceberg." The agency's refusal to discuss the attacks apparently isn't going to fly anymore.

Lieu makes two requests: the first is for the agency to see if it has some sort of magic "OFF" switch just laying around.

My first and urgent request is that if the NSA knows how to stop this global malware attack, or has information that can help step the attack, NSA should immediately disclose it. If the NSA has a kill switch for this new malware attack, the NSA should deploy it now.

It's far more likely the NSA has information it would rather not share than it is the agency has a way to shut down this attack, much less prevent future variations on its ETERNAL theme. But that's directly related to the second part of Lieu's request: work with companies whose software is being exploited to prevent further attacks. If the NSA still has security holes it's hoping won't be patched anytime soon, the current situation would seem to call for a rethink of its exploit-hoarding M.O.

What may be in order is the NSA stepping up and playing defense. It has stated a desire to be a larger cog in the US cyberwar machinery, but often seems more interested in playing offense than pitching in to help on the defensive end. That may need to change quickly if the NSA isn't going to be seen as more of a problem than a solution.

Filed Under: attacks, cyberattacks, exploits, leaks, nsa, ransomware, russia, ted lieu, ukraine, vulnerabilities, warfare

Russian Military Apparently Using Cell Tower Spoofers To Send Propaganda Directly To Ukrainian Soldiers' Phones

from the phrase-'phone's-blowing-up'-just-got-a-bit-darker dept

We've often discussed the darker side of the repurposed war tech that's made its way into the hands of local law enforcement. Much like backdoored encryption (something some in law enforcement would like to see), rebranded war surveillance gear like Stingrays may sound great when touted by good guys, but we should never forget bad guys have access to the same equipment.

The seldom-discussed capabilities of Stingray devices are on full display in other countries. So far, we haven't seen US law enforcement use Stingrays to intercept communications or purposefully disrupt them. (A lack of public evidence doesn't mean it hasn't happened, however.) The power is there, though. Stingrays act as faux cell towers and force all phones in the area to route their communications through them. This has the potential to be more than merely disruptive to cell service. The devices carry the capability to act as roving wiretaps. They also have the power to act as very frightening purveyors of government propaganda.

Television journalist Julia Kirienko was sheltering with Ukrainian soldiers and medics two miles (three kilometers) from the front when their cellphones began buzzing over the noise of the shelling. Everyone got the same text message at the same time.

“Ukrainian soldiers,” it warned, “they’ll find your bodies when the snow melts.”

Text messages like the one Kirienko received have been sent periodically to Ukrainian forces fighting pro-Russian separatists in the eastern part of the country. The threats and disinformation represent a new form of information warfare, the 21st-century equivalent of dropping leaflets on the battlefield.

The messages -- sent to cell phones presumably by Russian government operatives -- contain a mixture of propaganda and threats, warning recipients they're not much use to their children dead, or attempting to portray Ukrainian forces as being in disarray and on the run.

Multiple investigations have pinpointed the source of these communications: Russian LEER-3 electronic warfare systems feature drone-mounted cell site simulators launched from communications trucks for more effective cell communication interception/disruption. Russia is waging a mobile war of words with enemy combatants.

A 2015 article in Russia’s Military Review magazine said the LEER-3 has a cell site simulator built into a drone that is capable of acting over a 6-kilometer-wide area and hijacking up to 2,000 cellphone connections at once. That makes it a “pretty plausible” source for the rogue texts in Ukraine, said Hardman, the former signals analyst.

What isn't mentioned in the AP story is this: if the Russian military is dropping propaganda text bombs on opposing forces, it's definitely intercepting their communications as well. The devices do both and the nearby communications truck provides a mobile base for harvesting, snooping, and analysis. That this version is still on the battlefield rather than in the hands of Russian police (although it's surely there as well) doesn't offer much comfort to citizens not currently in war zones but still likely considered to be "enemies" by other governments.

The devices are also scary cheap -- at least in terms of cost/benefit ratio. A half-million dollars gives governments the power to disrupt communications in multiple ways. It can spew propaganda directly into captive phones, pick up communications from these phones on the fly, track cell phone users, and, if nothing else, simply make it impossible for anyone to communicate with anyone else in the immediate area.

Filed Under: imsi catcher, messages, russia, soldiers, stingray, ukraine

Corporate Sovereignty Used To Bully Ukraine, Colombia And Italy For Protecting Public Health And The Environment

from the profits-before-people dept

Corporate sovereignty provisions in investment treaties have become much better known than they were when Techdirt first wrote about them in 2012. Despite that growing awareness, and widespread outrage at the idea that corporations can request secret supra-national tribunals to make awards of hundreds of millions or even billions of dollars paid from public funds, companies continue to use the system to bully governments into changing their policies. For example, here is the US pharmaceutical company Gilead successfully deploying corporate sovereignty against the Ukrainian government, as originally reported by Investment Arbitration Reporter:

The dispute with Gilead, which Ukraine's Ministry of Justice had characterized as an $800 million dispute, relates to the drug sofosbuvir (sold by Gilead as Sovaldi). Sovaldi, a highly effective treatment for chronic hepatitis C, has been available in Ukraine -- a country reportedly home to over 2 million people infected with hepatitis C -- since 2015, but the company has lately been locked in a struggle over the ability of generic companies to market cheaper versions of the drug in Ukraine.

According to details of the settlement released by Ukraine's Ministries of Justice and Health, the settlement sees Gilead refrain from pursuing its damages claims against the country, and will see the company offer Sovaldi (and a combination therapy called Harvoni) at a reduced price.

Also, following the settlement, a generic competitor of Gilead has seen its own competing drug de-registered by authorities.

By de-registering the generic competitor to Gilead, the Ukrainian government is allowing the US company's to maintain its monopoly on the drug. In Colombia, the Swiss drug company Novartis also used the threat of a corporate sovereignty lawsuit, in this case to put pressure on the government there to stop it from issuing a compulsory license for a key anti-cancer drug, which would allow low-cost generics to be produced:

Leaked letters (PDF) to the Ministry of Trade and Industry show how Novartis threatened to resort to international investment arbitration for an alleged violation of the Swiss-Colombian bilateral investment treaty (BIT), which was signed by both countries in 2006. This undemocratic procedural mechanism, better known as Investor-State dispute settlement (ISDS), forms part of many trade agreements and allows an investor from one country to bring a case directly against the country in which they have invested before a private international arbitration tribunal, without going through local courts first. This threat has undoubtedly influenced the decision of the Colombian health authorities to stop short of pursuing a compulsory license, focusing only on a price reduction.

It's not just drug companies that try to use ISDS litigation to force governments to reverse their policies. Here's an oil and gas exploration company that is unhappy with a decision by the Italian parliament to ban new exploration and production activity within 12 nautical miles of the coast because of concerns for the environment and the high risk of earthquakes:

Rockhopper Exploration is fighting for compensation from Italy after it banned offshore drilling, leaving the company unable to develop one of its oil and gas fields.

The Aim-listed explorer said that it had begun international arbitration against the country for "very significant monetary damages" over the loss of future profits from its Ombrina Mare field.

Since Rockhopper is an oil exploration company, it must have carried out detailed studies on the geology of the field before deciding to drill for oil and gas. Either its geologists were negligent in not spotting that there was a risk of earthquakes which made the area unsuitable for exploitation, or the company knew about the dangers, and decided to continue with its plans anyway. In any case, it's ridiculous that Rockhopper thinks the Italian government owes it money for "lost future profits" that clearly never existed anywhere other than in the company's fantasies.

This is a general problem with corporate sovereignty claims: they often invoke some mythical "future profits" as if those were indisputable and guaranteed. But business is based on rewarding calculated risk-taking, and that includes the risk that hoped-for profits never materialize. ISDS is an attempt to remove the risk of investment from companies, and place it squarely on the public's shoulders, without any quid pro quo.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: colombia, corporate sovereignty, environment, health, isds, italy, ukraine

Yeah, Russia Probably Forged A Weapons Cache Supposedly From The US Using A Video Game To Model The Weapons

from the fake-it-til-you-make-it dept

Video games are starting to get realistic. Like, crazy realistic. Between what graphics look like on the latest hardware to the unbelievable committment to authenticity many of the latest games have, it's starting to get hard to tell game footage apart from video footage. So hard, in fact, that it appears the pro-Russian groups had an "oopsie!" moment while trying to accuse America of arming Ukrainian rebels with Stinger missiles.

A video from Ukrainian pro-Russian separatists...shows the rebels storming an underground compound and dusting off a wooden case with a "US army" inscription, where a the MANPADS Stinger 92 surface-to-air missile is stored.

Here's a screenshot from the video, showing the Stinger missile in question.
Notice anything strange? Unless you're familiar with American military equipment, you might have missed the lettering at the bottom of the device that reads "TRACKING RAINER." You probably also aren't aware that the actual American Stinger missiles have that same lettering, except that it's supposed to read "TRACKING TRAINER" instead. Between that and several other translation errors in the video, the general consensus is that the whole thing was cooked up by pro-Russians trying to make it look like America is sending weapons to the Ukraine (which we still might be) by creating mockups of the weapons and passing them off as the real thing. The next obvious question is what caused the pro-Russian groups to make the translation mistake on the Stinger missile in their video and what they used as a basis to model their mockup after? The answer is, of course, video games.

The most significant mistake is found in the inscription on the Stinger weapon itself, which reads "tracking rainer" instead of "tracking trainer". Video games blogger Anton Logvinov noted on his website that the same typo occurs in the EA first-person shooter game Battlefield 3, leading him to believe that the Stinger 'discovered' in Lugansk is likely fake.

Russian propaganda: so good it very nearly fooled a video game blogger! We will, as always, welcome our friends from the Putin internet propaganda brigade in our comments section.

Filed Under: battlefield 3, propaganda, russia, stinger missiles, ukraine, video games, weapons cache