The U.S. and Global Security Review - Blog by Michael Novakhov

September 09, 2015

Today's Headlines and Commentaryby Elina Saxena, Cody M. Poplin
Wednesday September 9th, 2015 at 2:41 PM

Lawfare - Hard National Security Choices

Earlier today, the Russian Foreign Ministry confirmed Russian military presence in Syria, claiming that military experts were assisting in the delivery of arms shipments aimed at combatting terrorism in the country. Following intelligence reports that disclosed suspected Russian preparations to deploy personnel to the Syrian city of Latakia, the United States has stepped up efforts to impede Russia's actions in Syria. The New York Times reports that the White House has appealed to both Greece and Bulgaria to block Russian transport planes from entering into their airspace---a request with which Bulgaria has reportedly complied. Even so. the AFP notes that at least three Russian transport planes have already landed in Latakia.

For their part, Russian officials defended the blocked shipments as part of routine humanitarian and military aid, denying rumors of personnel deployment or military buildup in war-torn Syria. However,Foreign Policy details a report by investigative journalist Ruslan Leviev who has followed the social media trail left by Russian troops supposedly journeying to Syria. According to Leviev, Russian troops can’t get enough of themselves, sending an assortment of selfies that point to an increased Russian troop presence in the naval facility at Tartus and potentially in other parts of Syria. Secretary of State John Kerry expressed concern that further Russian involvement in the Syrian conflict could exacerbate violence.

In the face of domestic criticism, the British government has doubled down on its support for drone strikes in Syria. The New York Times reports on the debate that is taking place in Britain between those who view targeted drone strikes as illegal and unauthorized versus those who view them as necessary to prevent potentially imminent attacks. The Times suggests that the British government is expected to ask lawmakers to revisit the subject of air strike authorization as “it is illogical to keep attacking the group in Iraq but not in Syria.”

Spencer Ackerman of the Guardian writes that the recent strike highlights the legacy left by the Obama Administration’s approach to counterterrorism. With both Pakistan and the U.K. following in Obama’s example, critics worry that the targeted killings open up a potentially concerning legal precedent that has become increasingly accepted by American allies.

A briefing from the Centre for the Response to Radicalisation and Terrorism (CRT) describes the legal basis for targeted airstrikes against British citizens involved with the Islamic State. The report cites the a state's right to use force in self-defense against imminent attack and discusses the threat posed by the Islamic State by its continued recruitment of Western citizens. Apropos, Lawfare'sAshley Deeks takes a look at the use of the principles associated with a state's right of self defense,which both France and Australia appear prepared to invoke as they launch new missions in Syria.

Under these legal interpretations, the U.S. and its allies are deepening their commitment to targeting the Islamic State in Syria. According to an AP report, Australia is expected to launch airstrikes in Syria in the coming days, with Prime Minister Tony Abbott declaring that "there can be no stability and no end to the persecution and suffering in the Middle East until the Daesh (Islamic State) death cult is degraded and ultimately destroyed."

Amid spiraling unrest caused by a series of bombings that killed 15 Turkish police officers and a separate Turkish air strike hit on the PKK, Turkish Prime Minister Ahmet Davutoglu called for calm in Turkey. His appeal comes after angered crowds attacked media institutions and the offices of a Pro-Kurdish party.

The Guardian reports on an Egyptian operation against the Islamic State affiliate in the Sinai Peninsula. Over the course of two days, the Egyptian army claims to have killed 56 jihadis and arrested more than 150 members of the militia. The ISIS-affiliate has been linked to a series of attacks in the area, including several roadside bombs responsible for injuring multiple peacekeepers.

With an increasing amount of European states reconsidering their position on Syrian refugees, the United States may also be considering accepting a greater number of people fleeing the conflict.Having accepted only 1,300 Syrians since January, the United States has been scrutinized by various humanitarian groups and European leaders. The United States has also contributed a total of $4 billion towards the improvement of refugee conditions in Europe, but various groups have called for it to increase its leadership in combatting the refugee crisis.

Despite Germany’s recent announcement that it will accept 500,000 Syrians annually, European plans to accept refugees are facing intense opposition from various member countries. The New York Times describes the “divisive proposal” to accept 160,000 refugees into Europe. Formulated by Jean-Claude Juncker, the President of the European Commission, the plan is not guaranteed to be accepted by European leaders, causing Juncker to remark upon the “lack of union in this European Union.”

A special report from Der Spiegel describes the dangers posed by the Islamic State's presence in Libya, detailing the clash between ISIS forces and Salafist militias that have torn apart the city of Derna. The report features a diary of a Derna resident who portrays the terror imposed on the city caught between the two radical forces.

President Barack Obama has secured the support of 42 Democratic senators for the Iran nuclear deal, crossing the threshold necessary to potentially avoid having to veto a resolution of disapproval from Congress. The Journal notes that the debate in Congress has now largely shifted to a negotiating over how the Iran deal will be handled procedurally. Senate Minority Leader Harry Reid (D-NV) proposed allowing a vote on the resolution of disapproval at a 60-vote threshold. Such a move would avoid a Democratic filibuster, allowing Congress to register its voice on the accord but preventing it from actually passing the resolution. Already though, Senate Majority Leader Mitch McConnell (R-KY) has rejected the option, viewing the filibuster as a potentially very costly political move for Democrats. Many Democrats agree, with Senator Joe Manchin (D-WV) suggesting that he would not support a filibuster, even though he supports the deal.

And today, former Secretary of State Hillary Clinton announced her support for the Iran deal in a speech at the Brookings Institution. Clinton endorsed the deal, saying that “diplomacy is not the pursuit of perfection, it is the balancing of risk,” but she also called for a “larger strategy toward Iran” that would counter any benefits Tehran gains as part of the agreement. At the Wall Street Journal, Jay Solomon and Laura Meckler describe how, when she was Secretary of State, Hillary Clinton softened her opposition to allowing Tehran to enrich uranium, opening the door for a shift in U.S. policy.

Finally, Defense One, in a new report, provides evidence that Iranian IEDs may have killed fewer Americans in Iraq than previously thought. Newly declassified Pentagon documents claim that the ordinances killed 196 Americans and injured 861 over a five-and-a-half-year period, a number that is less than half as many deaths as lawmakers have claimed in recent years. A spokesman for Senator Ted Cruz (R-TX), who had previously endorsed the higher number, responded to the report, saying “whether the number is 500 or 196 is immaterial; the fact remains that General [Qassem] Soleimani---a man responsible for the deaths of hundreds of american service members---will receive sanctions relief to the tune of millions of dollars” under the Iran deal.

The Washington Post reports that according to recently released Pakistani government statistics,terrorist attacks in that country are down 70 percent, boosting Pakistani public confidenc. According to the Post, Pakistan’s Prime Minister Nawaz Sharif is using the moment of peace to do something that leaders of his country have struggled to do for decades: implement a plan for a “peaceful, stable Pakistan.”

Across the Durand Line in Afghanistan, Pajhwok News confirms that an operation in the province of Paktika has left 51 Taliban fighters and six Afghan security personnel dead over two days of operations. Police officials in the province said that an additional 80 fighters had been wounded.

News from Bangkok today suggests that the bombers responsible for the deaths of 20 people outside a Thai shrine planned the attack using the popular messaging service Whatsapp. Whatsapp offers seamless end-to-end encryption to many of its users, allowing them to share text messages that cannot be intercepted or deciphered by outside actors. According to Thai media reports, the attackers never actually met in person while planning the attack.

Apropos of the security and privacy battle surrounding end-to-end encryption apps, Wired writes thatit is likely that Apple actually could wiretap iMessage, “because it does not allow users to verify encryption keys when writing or receiving messages.” Yesterday, the New York Times reported that Apple has refused a Court order demanding that it provide iMessages to the Department of Justice on the grounds that it could not technically execute the order. Wired’s explainer challenges that claim, noting a previous Lawfare piece asserting that iMessage is “backdoor enabled” by design.

A new United Nations report claims that nearly 8,000 people have died and almost 18,000 have been injured in the conflict in eastern Ukraine. The report also blamed Russia for the continuing flow of fighters and weaponry into the region, naming those actions as the major obstacle to securing peace. The New York Times has more.

The Obama administration is poised to indict Chinese hackers involved in hacking American companies. The Daily Beast highlights the Administration's traditionally passive handling of Chinese cyber espionage in order to avoid confrontation even as it suggests that it is considering pressing formal charges against those involved in stealing U.S. trade secrets. Any threat of retaliation is not without risk, however, and experts suggest that the Obama administration may be using the threat of sanctions itself as a deterrent for future Chinese attacks.

Even so, the New York Times discloses that Beijing is organizing a tech forum in the lead up to President Xi Jinping's visit to Washington later this month in order to demonstrate China’s “sway over the American tech industry.” Highlighting what they term "a sort of technological Cold War" between the U.S. and China, the Times sheds light on the issues that have divided the two countries regarding the management of the internet.

Speaking of those divisions, NextGov reports that NSA Director Michael Rogers said yesterday that the NSA eventually did step in to defend the Office of Personnel Management when it fell under cyber attack, but only after OPM had detected the intrusion. According to Rogers, the NSA provided “a significant amount of people and expertise to OPM to try to help them identify what had happened, how it happened and how we should structure the network for the future.”

At the same event, Admiral Rogers said that the cyberattack on the Pentagon, in which an unclassified network of the Joint Chiefs was infiltrated, was preceded by a failed attack the week before, that then morphed into a persistent and quickly evolving breach. Russian hackers are believed to have been behind the breach and Rogers noted that “the campaign went against dozens of networks, segments of the network within the network,” and was able to “achieve that level of penetration one time.”

Dustin Volz of the National Journal reports that U.S. and European officials have secured a deal regulating how personal information will be protected when shared between law-enforcement agencies across the Atlantic during criminal and terrorism investigations. However, the accord comes with one hang-up---the U.S. Congress must pass a bill that grants E.U. citizens the right to sue in U.S. courts if they think American authorities have misused their personal data.

A new book published by former high-ranking CIA officials, including George J. Tenet, Michael Hayden, and Porter Goss, defends the Agency against the Senate Intelligence Committee’s report on enhanced interrogation techniques released last year. According to the Washington Post, the book paints the Senate investigation “as a partisan attack that maligned agency employees and dismissed the value of intelligence gained” from the EITs used during the Bush administration. The book, entitled Rebuttal, is set to be released today by the U.S. Naval Institute.

The forever prison remains: Defense One reports that the White House has---wait for it---delayed its plan to close Guantanamo Bay as it searches for an alternative site to house the remaining detainees. Pentagon officials say they are still on “step one” of the plan, which is a far cry from the White House’s line that they are in the “final stages” of drafting a plan. Molly O’Toole has more on the complications the Administration faces in its drive to close the detention facility.

The Washington Post brings us news that the Marine Corps’ recent women-in-combat experiment produced “mixed results.” Over the last nine months, the Marines tested a gender-integrated task force, placing roughly two dozen women in a variety of combat roles including infantry, artillery, and armored divisions. Only two women were left at the experiment’s conclusion, while both men and women in the task force reported a breakdown in unit cohesion. It is not clear how the experiment will affect the Marine Corps’ position on integrated combat units.

Parting Shot: The folks over at War is Boring provide the interesting history of how the United States attempted to ground the Ayatollah’s American-made F-14 Tomcats, 40 of which still operate in the skies above Iran.

ICYMI: Yesterday, on Lawfare

We began the day back from August recess with a piece from Dustin Lewis, Naz Modirzadeh, and Gabriella Blum on “Medical Care in Armed Conflict: IHL and State Responses to Terrorism.”

Cody shared the latest Guantanamo Bay detainee recidivism report, in which 10 more former detainees are suspected of reengaging in terrorism.

Paul Rosenzweig asked readers for their thoughts on a possible breach of the TrueCrypt encryption program.

Cody also linked to last night’s Brookings Debate, in which Senator John McCain (R-AZ) and Senior Fellow Leon Wieseltier faced off against Senior Fellows Suzanne Maloney and Bruce Riedel over how Congress should vote on the Iran nuclear deal.

Email the Roundup Team noteworthy law and security-related articles to include, and follow us onTwitter and Facebook for additional commentary on these issues. Sign up to receive Lawfare in your inbox. Visit our Events Calendar to learn about upcoming national security events, and check out relevant job openings on our Job Board.

Read the whole story

· · · · · · · · ·

Official: US beefing up protection for Sinai peacekeepers
Wednesday September 9th, 2015 at 2:40 PM

Stars And Stripes

A Pentagon official says the U.S. is sending extra troops and support equipment to improve protection for U.S. peacekeepers in the northern Sinai Peninsula, in the aftermath of a roadside bomb attack last week that wounded four U.S. soldiers.

Agents say just 40 percent of U.S.-Mexico border under controlby Stephen Dinan
Wednesday September 9th, 2015 at 2:34 PM

Www.Washingtontimes.Com Stories: Security

Less than half of the U.S.-Mexico border is under "operational control" at this point, the chief of the Border Patrol agents testified to Congress Thursday, detailing the porous situation and violent conditions in the southwest.

Brandon Judd, president of the National Border Patrol Council, also said one out of every ...

Britain to UN: Syrian drone strike was in self-defense
Wednesday September 9th, 2015 at 2:34 PM

Www.Washingtontimes.Com Stories: Security

UNITED NATIONS (AP) - The United Kingdom has written to the U.N. Security Council president to say its drone strike over Syria in August that killed three Islamic State fighters, including two Britons, was done in self-defense.

The letter dated Monday from Britain's U.N. ambassador invokes Article 51 of the ...

OPM, email hacking, phishing scams can be avoided, intel officials warn by Andrea Noble
Wednesday September 9th, 2015 at 2:33 PM

Www.Washingtontimes.Com Stories: Security

More than 90 percent of significant data breaches in the last few years started when someone opened a malicious link or attachment sent via email, intelligence officials stressed Wednesday as they rolled out a new campaign meant to increase awareness of attempts targeted at government workers.

The new campaign, announced ...

Retired Air Force General: Iran Nuclear Deal Could Encourage Allies to Align With Russia, China
Wednesday September 9th, 2015 at 2:24 PM

Washington Free Beacon

John Kerry / AP

BY: Morgan Chalfant

The chair of a council of prominent military leaders argued in testimony on Capitol Hill Wednesday that the Iranian nuclear deal could encourage U.S. allies in the Middle East to align themselves with other world powers such as Russia or China.

Retired Air Force Gen. Chuck Wald, who co-chairs the Iran Strategy Council at the Jewish Institute for National Security Affairs, testified before the House Committee on Foreign Affairs on the implications of the nuclear agreement being pushed by the Obama administration.

Wald, who served as deputy commander of United States European Command, explained that the agreement “undermines U.S. credibility” from the perspective of both allies and enemies in the Middle East by making U.S. commitment to alliances appear “weakened.”

This in turn, Wald said, could prompt allies to “seek protection elsewhere” and enemies to “feel emboldened” against the United States.

“Some U.S. allies have made clear they believe this deal will not prevent a nuclear Iran and, that by proceeding with the [agreement], the United States is disrupting the regional balance of power and endangering them,” Wald said. “Other regional partners have noted that the deal empowers Iran to redouble its destabilizing regional activities, making the Middle East a more dangerous place. ”

“There is anger—even a sense of betrayal—among U.S. allies in the region,” the retired general added, pointing to expressions of concern about the deal from Israel and other allies.

Wald said that giving the impression that the United States was faltering in its commitment was “dangerous,” suggesting that it could encourage America’s allies to act alone against Iran or to seek help from Russia or China.

“This could mean taking matters into their own hands, as Israel previously has done or Saudi Arabia decided to do earlier this year by unilaterally launching an air campaign against Iranian-backed rebels in Yemen. Such actions, if not backed by the overwhelming force of the U.S. military, could spark reprisals that spiral into wider regional conflict,” Wald told House lawmakers.

“Alternatively, our regional allies might seek other guarantors of their security,” he continued. “Whether this means accepting Iranian hegemony or allying with other powers—such as Russia or China—the result would be detrimental to U.S. influence and interests in the region.”

Wald said that allies could decide to terminate cooperation with the United States, making it impossible for the United States to “project power in the Middle East.”

“Basing and overflight rights are critical to maintaining and deploying a deterrent force,” Wald said. “The perception that we are no longer committed to our allies’ security could risk the revocation of those rights and spark a vicious cycle of destabilization.”

Wald also suggested that U.S. credibility has already been undermined by defense cuts under the Obama administration over the last several years. The U.S. Army plans to cut 40,000 more troops over the next two years, losses that would become even more dramatic under sequestration.

Wald testified alongside another member of the Iran Strategy Council, retired Adm. John Bird, both of them spotlighting a recent report from the council indicating that the nuclear deal would make war more likely.

In contrast, the Obama administration has insisted that the nuclear deal is an alternative to military conflict with Iran.

The retired military officials’ testimony comes as congressional lawmakers make their final decisions regarding the nuclear agreement. Congress is expected to vote on the JCPOA sometime beforeSept. 17.

While multiple Democrats have voiced opposition to the deal, President Obama on Tuesday managed to recruit enough support to avoid having to veto a resolution rejecting the agreement.

The deal remains unpopular with the public. Only 21 percent of Americans support it, according toPew Research Center data released Tuesday.

Read the whole story

· · · ·

Next Page of Stories

Loading...

Page 2

James Clapper: Islamic State could infiltrate U.S., West through migrants fleeing from Syria by Guy Taylor
Wednesday September 9th, 2015 at 2:08 PM

Www.Washingtontimes.Com Stories: Security

America's top spy said Wednesday that U.S. intelligence officials have a "huge concern" about Islamic State's ability to infiltrate waves of Syrian war refugees flowing into Europe and potentially the United States as pressure mounts on Western nations to take in a growing number of people fleeing the conflict in ...

Clinton: Putin’s Ability to Say ‘I Will Be Your Next President’ Has a ‘Certain Attraction To It’ by David Rutz
Wednesday September 9th, 2015 at 2:07 PM

Washington Free Beacon

Hillary Clinton joked that Russian president Vladimir Putin’s ability to effectively decide when he was in office had a “certain attraction to it” during a question-and-answer session Wednesday at the Brookings Institution.

“I don’t admire very much about Mr. Putin, but the idea you could stand up and say, ‘I will be your next president,’ that does have a certain attraction to it,” Clinton said, drawing laughter from the audience.

Clinton leads Democratic polls in her second bid for the presidency, but in the wake of the private email scandal she just apologized for, she has seen her standing slip. Sen. Bernie Sanders (I., Vt.) has surged in the key early states of Iowa and New Hampshire and Vice President Joe Biden is strongly considering jumping into the race.

Clinton’s quip about Putin called to mind the Saturday Night Live impersonation of her as a power-hungry politician who insisted to “citizens” that “you will elect me, I will be your leader.”

Clinton made the remarks after her speech defending the Iran nuclear deal at Brookings. Part of the discussion delved into the “reset” she oversaw while secretary of state, which has been seen as a failure with the collapse of U.S.-Russian relations since President Obama took office. Besides the joke about Putin’s hold on power, she also spoke more seriously about Russia, according to Politico:

On a more serious note, Clinton said that she is “in the category of people who wanted to do more in reaction to the annexation of Crimea” last year. Russia’s objective “is to stymie, to confront, to undermine American power whenever and wherever they can,” she added in response to how the United States could control Putin’s aggression on the European continent.

The post Clinton: Putin’s Ability to Say ‘I Will Be Your Next President’ Has a ‘Certain Attraction To It’appeared first on Washington Free Beacon.

Read the whole story

· · ·

In Defense of Bulk Surveillance: It Works by Nicholas Weaver
Wednesday September 9th, 2015 at 2:07 PM

Lawfare - Hard National Security Choices

I personally believe the NSA's systems for bulk surveillance represent a direct attack on the Internet and everyone who uses it. The mere presence of these systems is a threat to democracy, only mitigated by the intense level of professionalism demonstrated by the NSA (a subject for a future essay).

But at the same time, if I was in charge of the NSA I would have, without hesitation, built the same systems. These systems are reasonably easy to understand, as the underlying technology of Internet Surveillance is effectively equivalent to both Network Intrusion Detection (NIDS) and Chinese-style Internet censorship.

Why would I build them? For, simply put, this approach works for the NSA's objectives.

The idea behind Internet surveillance is not about looking for "needles in a haystack" but rather providing a capability to "pull threads": starting with some initial piece of interest, such as a phone number, a name, a keyword, a webpage visit, or a hunch, the analyst then seeks to follow the digital history. But for this flow to work, the systems must already bulk record all the history that may possibly matter.

The primary systems start with an initial filter, either performed by the cooperating ISP or the NSA's own equipment. This filter eliminates the large, uninteresting bulk flows, such as streaming videos, which occupy a huge amount of the network traffic but provide effectively no actionable intelligence. The rest gets ingested into the primary acquisition systems.

The data feed then goes into a load balancer, which spreads the traffic across a cluster of computers, with probably 10 machines for each 10 Gbps network connection. These systems perform an initial reassembly and decide whether it is another uninteresting bulk flow or deserves further analysis. Everything that passes this filter is both recorded (with a retention time of roughly 5 days) and passed through a "metadata" analysis pass.

The term "metadata" is both precise and misleading. It is misleading if one thinks of metadata underSmith v Maryland (the court decision that says phone metadata has less privacy protection because it is information freely given to the phone company): there is no expectation that the network would record or even care about this information. Instead, it is "content derived metadata", small pieces of information extracted from the network flow itself such as the subject of an email or who is the author of a Word document. Calling it "metadata" is only correct from a technical, not legal perspective.

The metadata-extraction process begins by reassembling the network traffic and applying code to generate metadata "fingerprints” . Some metadata is generic, such as "request is for this URL", "all HTTP headers in a request", "sender of an email", "this request is from an iPhone", or "this is avBulletin Private Message". Such fingerprints define generally useful information which may or may not be relevant for an analyst.

But the fingerprints can be more powerful, such as "does the email body contain one of these predefined keywords", "what is the username embedded in this particular website", "is there a reference to a .onion URL", "is there a message body encrypted with 'Mojahaden Secrets'?". The results of all these fingerprints goes into a MySQL database on the wiretap system.

In order to access this data, an analyst has a "federated search” interface: on a central site, the analyst specifies a query to run over the metadata stored on some or all of the wiretaps. This approach handles the "flood of data" problem, instead of moving all the data to the analyst, the analyst's searches go to the data.

Some data still ends up centralized. When the taps see particular tracking cookies (from advertisements or social networks), the presence seems to be recorded in a central "big data"datastore that retains data for a year. Another analysis process looks at usernames embedded in web pages, creating a mapping of "login cookie to user" for various sites. Finally this datastore also includes "cookie correlation", linking tracking and login cookies: if two different cookies (such as ones from Yahoo and Double-click) are seen from the same system as part of the same pageview, the database records that the two tracking cookies refer to the same browser. This database effectively acts as a global identification and tracking system: for every user, what IPs did they use at what time and what are their tracking cookies.

Finally, the NSA systems supports "attack by name". The analyst can specify a target's tracking cookies and, when a different wiretap sees a request, this special tap arranges for another computer to "shoot" an exploit into the target's traffic, directly compromising the target.

This approach works. For example, finding all Jihobbiests is a single-query away: "Show all vBulletin private messages with a Mojahaden Secrets encrypted payload". The analyst can then access the "full take" for any given address to understand a target's activity, such as retrieving email sent from the target’s computer or viewing his web surfing. This can also help find an associated tracking cookie, which is a thread of information which reveals the target’s address usage history. If the target failed to use a VPN, this now gives the target’s movements around the world.

Perhaps the most powerful option is for the analyst to create another fingerprint rule, which the analyst can apply to both future traffic and all previously recoded traffic. So, for example, extract all Microsoft Office documents authored by the target, no matter where they were seen in the world.

The uses extend way beyond terrorism. It was this basic flow, used to identify and then exploit network administrators, that enabled the NSA and GCHQ to penetrate Belgacom. The same flow, with a fingerprint for trade related keywords in email bodies, allowed New Zealand's GCSB tointercept WTO vote-related emails. And it enabled a chat-room intercept of an Anonymous member, indicating a URL visit, to identify that person, find their Facebook account, and map their online activities. On a more theoretical level, it almost certainly enabled the NSA to know the perpetrators behind the Sony hack, and offers a unique ability to analyze communication networks encrypted with PGP.

From a pure effectiveness viewpoint, I can’t think of a better concept. It enables attributing traffic to individuals, efficiently isolating any items of interest, following threads of information, retrospective analysis, and targeted exploitation. The biggest problem from an effectiveness standpoint is probably secrecy. The NSA's flow could easily support many more US government interests if this flow (and therefore effectively all derived data) wasn't segregated into TS//SCI compartments.

Unfortunately, there exists a huge flaw: it is not particularly difficult to implement. Any foreign power that can install a tap can run this style of analysis. In my next article, I'll discuss my own experience building a hobby version of an NSA-style surveillance suite, and thus why the US needs to take the lead in "going dark": protecting network traffic against bulk surveillance and targeted attack. For others can do unto us as we have already done unto them.

Read the whole story

· · · ·

Why Are Universities Hacked? by Carrie Cordero
Wednesday September 9th, 2015 at 2:06 PM

Lawfare - Hard National Security Choices

The Los Angeles Times reports that information concerning 80,000 students across eight Cal State campuses who took a mandatory online course on sexual harassment, which was provided by an outside vendor, was allegedly hacked. According to the report:

Information such as passwords used to log into the class, as well as sign-in names, campus-issued email addresses, gender, race, relationship status and sexual identity were exposed.

Personally identifying information such as Social Security, credit card and driver's license numbers was not compromised…[.]

Cal State is not alone in being a major university targeted by hackers. Not even close. Earlier this summer I started keeping track of universities that had been victims of cyberattack and/or experienced data breaches. According to my unofficial, very preliminary (and still in progress) accounting based on press reports, over 40 colleges and universities have suffered breaches of confidential information in the past three years. The true number is likely much, much higher. The data stolen, and in some cases publicly exposed, includes information belonging to students, faculty, employees and even applicants.

The Cal State case highlights risks faced by academic institutions and nearly any other largeorganization that relies on vendors to provide services.

A few other recent examples demonstrate the variety and breadth of exposure that universities face:

Penn State has been the victim of multiple sophisticated cyberattacks. According to a May 2015message from the university president that describes two attacks directed at its School of Engineering, Penn State was first notified by the FBI, and press reports attribute the attacks to China. The university’s College of Liberal Arts has also been targeted. The clean-up efforts involved disruption to campus technology services.
Harvard has also experienced “an intrusion” on its systems, although attribution and the details of whether personal information has been exposed are unclear. Harvard was also one of many schools that were targeted by hacktivist group Team Ghostshell in 2012, which released student and employee data.
Auburn experienced a particularly unusual data breach, apparently a result of a technical problem, not a malicious hack. Auburn had purchased the standardized test scores of high school students for marketing and outreach purposes. Personal information regarding those individuals – over 360,000 - was inadvertently publicly exposed on the university’s website.

So why are universities targeted or otherwise at risk for inadvertent data breaches? I think there are at least a few reasons:

One, universities collect and retain a lot of data about a lot of people: personally identifying information such as social security numbers, addresses, and email addresses. Student information also includes education information that is protected by federal statute. For employees, perhaps additional financial information such as retirement account numbers and bank account numbers. Perhaps student and employee health information. And for universities that operate medical and hospital systems, all of the accompanying personal health information that goes with that territory and is subject to a heightened regulatory environment.

Universities also do research. Some of that research may be U.S. government-funded. It may even be classified. Some of it may be scientific, cutting-edge, or otherwise interesting to foreign nations from an economic, intellectual property or international relations perspective.

Two, their information technology infrastructure and leadership structure may be university-centered, lessening the accountability for leaders and managers in the individual colleges, campuses or schools. If a school’s information technology system is controlled by and managed at the university level, then the individual information management and school leadership is likely to have both lessvisibility, as well as less responsibility for the protection of information for their particular student, faculty, employee and applicant information. Because of their decentralized leadership structure, as well as, in many academic environments, a tradition that includes governance by committees, I believe that universities face particular challenges in taking charge of evaluating their cybersecurity exposure and plans.

Three, universities are extremely budget conscious. Higher education is pinched by continually expanding costs and the need to control tuition. Universities at the higher end of academic standards for admission compete for qualified students, including students who can afford tuition that is out of reach of many students and families. Spending money on outside consulting, legal and technical support to put in place appropriate detection systems and meaningful incident response plans is often not a priority. There is likely a perception that not many young adults are really going to decide where to go to college based on the quality of a school’s information technology security and privacy practices.

Then again, maybe that's not so outrageous a suggestion after all. It goes without saying that today’s college and graduate students are sophisticated users of technology. And while perhaps they may not make a decision to enroll based on the quality of a school’s incident response plan and information technology practices, they may very well factor in a school’s technological sophistication and use of technology in teaching and learning in deciding where to enroll. A school that experiences a significant data breach may be forced to significantly interrupt faculty and student use of technology systems such as e-mail, data storage and course websites, while it cleans up the mess. When put in the context of the disruption that data breach may cause to the daily business of learning and teaching, universities might consider becoming more proactive in their approach to preventing, detecting and responding to data breaches.

Read the whole story

· · · ·

Retired Air Force General: Iran Nuclear Deal Could Encourage Allies to Align With Russia, China by Morgan Chalfant
Wednesday September 9th, 2015 at 2:06 PM