Crypto-Gram

December 15, 2014

by Bruce Schneier
CTO, Co3 Systems, Inc.
schneier@schneier.com
http://www.schneier.com

A free monthly newsletter providing summaries, analyses, insights, and commentaries on security: computer and otherwise.

For back issues, or to subscribe, visit <http://www.schneier.com/crypto-gram.html>.

You can read this issue on the web at <http://www.schneier.com/crypto-gram-1412.html>. These same essays and news items appear in the “Schneier on Security” blog at <http://www.schneier.com/>, along with a lively and intelligent comment section. An RSS feed is available.

In this issue:

Regin

Last month, we learned about a striking piece of malware called Regin that has been infecting computer networks worldwide since 2008. It’s more sophisticated than any known criminal malware, and everyone believes a government is behind it. No country has taken credit for Regin, but there’s substantial evidence that it was built and operated by the United States.

This isn’t the first government malware discovered. GhostNet is believed to be Chinese. Red October and Turla are believed to be Russian. The Mask is probably Spanish. Stuxnet and Flame are probably from the U.S. All these were discovered in the past five years, and named by researchers who inferred their creators from clues such as who the malware targeted.

I dislike the “cyberwar” metaphor for espionage and hacking, but there is a war of sorts going on in cyberspace. Countries are using these weapons against each other. This affects all of us not just because we might be citizens of one of these countries, but because we are all potentially collateral damage. Most of the varieties of malware listed above have been used against nongovernment targets, such as national infrastructure, corporations, and NGOs. Sometimes these attacks are accidental, but often they are deliberate.

For their defense, civilian networks must rely on commercial security products and services. We largely rely on antivirus products from companies such as Symantec, Kaspersky, and F-Secure. These products continuously scan our computers, looking for malware, deleting it, and alerting us as they find it. We expect these companies to act in our interests, and never deliberately fail to protect us from a known threat.

This is why the recent disclosure of Regin is so disquieting. The first public announcement of Regin was from Symantec, on November 23. The company said that its researchers had been studying it for about a year, and announced its existence because they knew of another source that was going to announce it. That source was a news site, the Intercept, which described Regin and its U.S. connections the following day. Both Kaspersky and F-Secure soon published their own findings. Both stated that they had been tracking Regin for years. All three of the antivirus companies were able to find samples of it in their files since 2008 or 2009.

So why did these companies all keep Regin a secret for so long? And why did they leave us vulnerable for all this time?

To get an answer, we have to disentangle two things. Near as we can tell, all the companies had added signatures for Regin to their detection database long before last month. The VirusTotal website has a signature for Regin as of 2011. Both Microsoft security and F-Secure started detecting and removing it that year as well. Symantec has protected its users against Regin since 2013, although it certainly added the VirusTotal signature in 2011.

Entirely separately and seemingly independently, all of these companies decided not to publicly discuss Regin’s existence until after Symantec and the Intercept did so. Reasons given vary. Mikko Hyponnen of F-Secure said that specific customers asked him not to discuss the malware that had been found on their networks. Fox IT, which was hired to remove Regin from the Belgian phone company Belgacom’s website, didn’t say anything about what it discovered because it “didn’t want to interfere with NSA/GCHQ operations.”

My guess is that none of the companies wanted to go public with an incomplete picture. Unlike criminal malware, government-grade malware can be hard to figure out. It’s much more elusive and complicated. It is constantly updated. Regin is made up of multiple modules—Fox IT called it “a full framework of a lot of species of malware”—making it even harder to figure out what’s going on. Regin has also been used sparingly, against only a select few targets, making it hard to get samples. When you make a press splash by identifying a piece of malware, you want to have the whole story. Apparently, no one felt they had that with Regin.

That is not a good enough excuse, though. As nation-state malware becomes more common, we will often lack the whole story. And as long as countries are battling it out in cyberspace, some of us will be targets and the rest of us might be unlucky enough to be sitting in the blast radius. Military-grade malware will continue to be elusive.

Right now, antivirus companies are probably sitting on incomplete stories about a dozen more varieties of government-grade malware. But they shouldn’t. We want, and need, our antivirus companies to tell us everything they can about these threats as soon as they know them, and not wait until the release of a political story makes it impossible for them to remain silent.

This essay previously appeared in the “MIT Technology Review.”
http://www.technologyreview.com/view/533136/…

Regin:
https://en.wikipedia.org/wiki/Regin_%28malware%29

Evidence the the NSA/GCHQ is behind it:
http://www.scmagazineuk.com/…

GhostNet:
http://www.infowar-monitor.net/ghostnet

Red October:
http://arstechnica.com/security/2013/01/…

Turla:
http://www.reuters.com/article/2014/03/07/…

The Mask:
http://www.securelist.com/en/downloads/vlpdfs/…

Stuxnet:
http://spectrum.ieee.org/telecom/security/…
http://www.darkreading.com/attacks-and-breaches/…

Flame:
http://www.washingtonpost.com/world/…

NGOs targeted By government malware:
https://targetedthreats.net/

China attacking US corporate networks:
http://www.reuters.com/article/2014/11/20/…

https://firstlook.org/theintercept/2014/11/24/…
http://www.symantec.com/connect/s/…
https://securelist.com//research/67741/…
https://www.f-secure.com/weblog/archives/00002766.html

Microsoft security detects Regin:
http://www.microsoft.com/security/portal/threat/…

F-Secure on detecting Regin:
https://twitter.com/mikko/status/536959936476221440
https://twitter.com/mikko/status/536942825292959744
https://twitter.com/mikko/status/536944050361073664

Norton on detecting Regin:
http://il.norton.com/regin/

Fox-IT on detecting Regin:
http://mashable.com/2014/11/25/…

FBI Agents Pose as Repairmen to Bypass Warrant Process

This is a creepy story. The FBI wanted access to a hotel guest’s room without a warrant. So agents broke his Internet connection, and then posed as Internet technicians to gain access to his hotel room without a warrant.

From the motion to suppress:

The next time you call for assistance because the internet service in your home is not working, the “technician” who comes to your door may actually be an undercover government agent. He will have secretly disconnected the service, knowing that you will naturally call for help and—when he shows up at your door, impersonating a technician—let him in. He will walk through each room of your house, claiming to diagnose the problem. Actually, he will be videotaping everything (and everyone) inside. He will have no reason to suspect you have broken the law, much less probable cause to obtain a search warrant. But that makes no difference, because by letting him in, you will have “consented” to an intrusive search of your home.

Basically, the agents snooped around the hotel room, and gathered evidence that they submitted to a magistrate to get a warrant. Of course, they never told the judge that they had engineered the whole outage and planted the fake technicians.

This feels like an important case to me. We constantly allow repair technicians into our homes to fix this or that technological thingy. If we can’t be sure they are not government agents in disguise, then we’ve lost quite a lot of our freedom and liberty.

The motion to suppress:
http://ia902307.us.archive.org/34/items/…

Another article:
http://hasbrouck.org/blog/archives/002158.html

News

New article on the NSA’s efforts to control academic cryptographic research in the 1970s. It includes new interviews with public-key cryptography inventor Martin Hellman and then NSA-director Bobby Inman.
https://medium.com/stanford-select/…

The NSA recently declassified a snarky report on the Eurocrypt ’92 conference. Honestly, I share some of the writer’s opinions on the more theoretical parts of academic cryptography. I know it’s important, but it’s not something I care all that much about.
http://www.scottaaronson.com/blog/?p=2059

Whatsapp is now offering end-to-end message encryption: “Whatsapp will integrate the open-source software Textsecure, created by privacy-focused non-profit Open Whisper Systems, which scrambles messages with a cryptographic key that only the user can access and never leaves his or her device.” I don’t know the details, but the article talks about perfect forward secrecy. Moxie Marlinspike is involved, which gives me some confidence that it’s a robust implementation. This is a big deal: Wattsapp has 600 million active users.
http://www.wired.com/2014/11/…
http://yro.slashdot.org/story/14/11/20/1421216/…

Announcing Let’s Encrypt, a new free certificate authority. This is a joint project of EFF, Mozilla, Cisco, Akamai, and the University of Michigan.
https://www.schneier.com/blog/archives/2014/11/…
This is an absolutely fantastic idea.
https://www.eff.org/deeplinks/2014/11/…
https://letsencrypt.org/2014/11/18/…
http://it.slashdot.org/story/14/11/18/1830229/…
https://news.ycombinator.com/item?id=8624160
https://freedom-to-tinker.com//jhalderm/…

Citadel is the first piece of malware I know of that specifically steals master passwords from password managers. Note that my own Password Safe is a target.
http://arstechnica.com/security/2014/11/…

AP is reporting that in 2009, several senior NSA officials objected to the NSA call-records collection program.
http://bigstory.ap.org/article/…
https://news.ycombinator.com/item?id=8633304

Jim Sanborn has given the world another clue to the fourth cyphertext in his Kryptos sculpture at the CIA headquarters.
http://www.wired.com/2014/11/second-kryptos-clue/
Older posts on Kryptos.
https://www.schneier.com/blog/archives/2006/04/…
https://www.schneier.com/blog/archives/2013/06/…
https://www.schneier.com/blog/archives/2013/07/…

Nice article on some of the security assumptions we rely on in cryptographic algorithms.
http://www.ams.org/notices/201003/rtx100300357p.pdf

Regin is another military-grade surveillance malware. It seems to have been in operation between 2008 and 2011. The “Intercept” has linked it to NSA/GCHQ operations, although I am still skeptical of the NSA/GCHQ hacking Belgian cryptographer Jean-Jacques Quisquater.
http://arstechnica.com/security/2014/11/…
https://firstlook.org/theintercept/2014/11/24/…
http://www.wired.com/2014/11/…
http://www.zdnet.com/…
http://recode.net/2014/11/24/…
http://www.symantec.com/connect/s/…
https://securelist.com/files/2014/11/…
http://www.spiegel.de/netzwelt/netzpolitik/…

A new story based on the Snowden documents and published in the German newspaper “Suddeutsche Zeitung” shows how the GCHQ worked with Cable & Wireless—acquired by Vodafone in 2012—to eavesdrop on Internet and telecommunications traffic.
http://international.sueddeutsche.de/post/…
https://drive.google.com/file/d/…
http://arstechnica.com/tech-policy/2014/11/…
http://news.slashdot.org/story/14/11/26/0125238/…

This is an interesting paper—the full version is behind a paywall—about how we as humans can motivate people to cooperate with future generations.
http://www.nature.com/nature/journal/v511/n7508/…
Low-res version of the entire article here:
http://tinypic.com/r/2hr397r/8
http://tinypic.com/r/2epm61z/8
http://tinypic.com/r/swr01z/8
http://tinypic.com/r/zx5e13/8
Here’s a Q&A with and essay by the author.
http://isps.yale.edu/news//2014/06/…
http://.practicalethics.ox.ac.uk/2014/10/…
Article on the research.
http://www.sciencedaily.com/releases/2014/06/…

Interesting paper: “Security Collapse of the HTTPS Market.”
https://dl.acm.org/citation.cfm?id=2673311

This is a really good analysis of how the NSA/GCHQ spying programs actually work. It’s nice that we finally have enough documents public that we can start putting together the complete pictures.
http://electrospaces.blogspot.com/2014/11/…

Interesting essay on the future of speech recognition, microphone miniaturization, and the future ubiquity of auditory surveillance.
http://www.defenseone.com/technology/2014/12/…

This talk (and paper) describe a lattice-based public-key algorithm called Soliloquy developed by GCHQ, and a quantum-computer attack on it.
http://docbox.etsi.org/Workshop/2014/201410_CRYPTO/…
http://docbox.etsi.org/Workshop/2014/201410_CRYPTO/…
News article:
http://www.theregister.co.uk/2014/12/03/…

The Denver police are using olfactometers to measure the concentration of cannabis in the air. I haven’t found any technical information about these devices, their sensitivity, range, etc.
http://www.telegraph.co.uk/news/worldnews/…

Surveillance cartoon.
http://www.smbc-comics.com/index.php?…

There’s a government surplus Rapiscan full-body scanner for sale on eBay for $8000.
http://www.ebay.com/itm/111519265986
Note that this device has been analyzed before.
https://radsec.org

Interesting article: “How terrorism fears are transforming America’s public space.”
http://theweek.com/article/index/272147/…
I am reminded of my essay from four years ago: “Close the Washington Monument.”
https://www.schneier.com/blog/archives/2010/12/…

This article is reporting that the demand for Chief Information Security Officers far exceeds supply:
http://www.usatoday.com/story/tech/2014/12/02/…
I’m not surprised, really. This is a tough job: never enough budget, and you’re the one blamed when the inevitable attacks occur. And it’s a tough skill set: enough technical ability to understand cybersecurity, and sufficient management skill to navigate senior management. I would never want a job like that in a million years.

Here’s a tip: if you want to make your CISO happy, here’s her holiday wish list.
http://www.cio.com/article/2855136/security0/…

Remember last winter when President Obama called for an end to the NSA’s telephone metadata collection program? He didn’t actually call for an end to it; he just wanted it moved from an NSA database to some commercial database. Anyway, the Director of National Intelligence solicited companies who might be interested and capable of storing all this data. Here’s the list of companies that expressed interest. Note that Oracle is on the list—the only company I’ve heard of. Also note that many of these companies are just intermediaries that register for all sorts of things.
https://www.fbo.gov/?…
https://www.documentcloud.org/documents/…
I still think this is a bad idea, and that having the companies store it is worse than having the government store it.
http://www.slate.com/articles/technology/…

NSA Hacking of Cell Phone Networks

The “Intercept” has published an article—based on the Snowden documents—about AURORAGOLD, an NSA surveillance operation against cell phone network operators and standards bodies worldwide. This is not a typical NSA surveillance operation where agents identify the bad guys and spy on them. This is an operation where the NSA spies on people designing and building a general communications infrastructure, looking for weaknesses and vulnerabilities that will allow it to spy on the bad guys at some later date.

In that way, AURORAGOLD is similar to the NSA’s program to hack sysadmins around the world, just in case that access will be useful at some later date; and to the GCHQ’s hacking of the Belgian phone company Belgacom. In both cases, the NSA/GCHQ is finding general vulnerabilities in systems that are protecting many innocent people, and exploiting them instead of fixing them.

It is unclear from the documents exactly what cell phone vulnerabilities the NSA is exploiting. Remember that cell phone calls go through the regular phone network, and are as vulnerable there as non-cell calls. (GSM encryption only protects calls from the handset to the tower, not within the phone operators’ networks.) For the NSA to target cell phone networks particularly rather than phone networks in general means that it is interested in information specific to the cell phone network: location is the most obvious. We already know that the NSA can eavesdrop on most of the world’s cell phone networks, and that it tracks location data.

I’m not sure what to make of the NSA’s cryptanalysis efforts against GSM encryption. The GSM cellular network uses three different encryption schemes: A5/1, which has been badly broken in the academic world for over a decade (a previous Snowden document said the NSA could process A5/1 in real time—and so can everyone else); A5/2, which was designed deliberately weak and is even more easily broken; and A5/3 (aka KASUMI), which is generally believed to be secure. There are additional attacks against all A5 ciphers as they are used in the GSM system known in the academic world. Almost certainly the NSA has operationalized all of these attacks, and probably others as well. Two documents published by the “Intercept” mention attacks against A5/3—OPULENT PUP and WOLFRAMITE—although there is no detail, and thus no way to know how much of these attacks consist of cryptanalysis of A5/3, attacks against the GSM protocols, or attacks based on exfiltrating keys. For example, GSM carriers know their users’ A5 keys and store them in databases. It would be much easier for the NSA’s TAO group to steal those keys and use them for real-time decryption than it would be to apply mathematics and computing resources against the encrypted traffic.

The “Intercept” points to these documents as an example of the NSA deliberately introducing flaws into global communications standards, but I don’t really see the evidence here. Yes, the NSA is spying on industry organizations like the GSM Association in an effort to learn about new GSM standards as early as possible, but I don’t see evidence of it influencing those standards. The one relevant sentence is in a presentation about the “SIGINT Planning Cycle”: “How do we introduce vulnerabilities where they do not yet exist?” That’s pretty damning in general, but it feels more aspirational than a statement of practical intent. Already there are lots of pressures on the GSM Association to allow for “lawful surveillance” on users from countries around the world. That surveillance is generally with the assistance of the cell phone companies, which is why hacking them is such a priority. My guess is that the NSA just sits back and lets other countries weaken cell phone standards, then exploits those weaknesses.

Other countries do as well. There are many vulnerabilities in the cell phone system, and it’s folly to believe that only the NSA and GCHQ exploits them. And countries that can’t afford their own research and development organization can buy the capability from cyberweapons arms manufacturers. And remember that technology flows downhill: today’s top-secret NSA programs become tomorrow’s PhD theses and the next day’s hacker tools.

For example, the US company Verint sells cell phone tracking systems to both corporations and governments worldwide. The company’s website says that it’s “a global leader in Actionable Intelligence solutions for customer engagement optimization, security intelligence, and fraud, risk and compliance,” with clients in “more than 10,000 organizations in over 180 countries.” The UK company Cobham sells a system that allows someone to send a “blind” call to a phone—one that doesn’t ring, and isn’t detectable. The blind call forces the phone to transmit on a certain frequency, allowing the sender to track that phone to within one meter. The company boasts government customers in Algeria, Brunei, Ghana, Pakistan, Saudi Arabia, Singapore, and the United States. Defentek, a company mysteriously registered in Panama, sells a system that can “locate and track any phone number in the world…undetected and unknown by the network, carrier, or the target.” It’s not an idle boast; telecommunications researcher Tobias Engel demonstrated the same capability at a hacker conference in 2008. Criminals can purchase illicit products to let them do the same today.

As I keep saying, we no longer live in a world where technology allows us to separate communications we want to protect from communications we want to exploit. Assume that anything we learn about what the NSA does today is a preview of what cybercriminals are going to do in six months to two years. That the NSA chooses to exploit the vulnerabilities it finds, rather than fix them, puts us all at risk.

This essay has previously appeared on the Lawfare blog.
http://www.lawfareblog.com/2014/12/…

https://firstlook.org/theintercept/2014/12/04/…

NSA hacking sysadmins:
https://firstlook.org/theintercept/2014/03/20/…

GCHQ hacking Belgicom:
http://www.spiegel.de/international/europe/…

Previous article on the NSA eavesdropping cell phone networks:
http://www.washingtonpost.com/business/technology/…

How the NSA tracks cell phone location data:
http://www.washingtonpost.com/world/…
http://www.washingtonpost.com/s/the-switch/wp/…

The A5 algorithms:
https://en.wikipedia.org/wiki/A5/1
https://en.wikipedia.org/wiki/A5/2
https://en.wikipedia.org/wiki/KASUMI
http://www.cs.technion.ac.il/users/wwwb/cgi-bin/…

OPULENT PUP:
https://firstlook.org/theintercept/document/2014/12/…

WOLFRAMITE:
https://firstlook.org/theintercept/document/2014/12/…

Verint and Defentek:
http://www.washingtonpost.com/business/technology/…

Verint:
http://www.verint.com/about

Cobham:
https://www.privacyinternational.org/sii/cobham
https://s3.amazonaws.com/s3.documentcloud.org/…

Tobiad Engel’s demonstration:
http://berlin.ccc.de/~tobias/…

My previous essay on balancing security with surveillance:
http://www.theatlantic.com/technology/archive/2014/…

Comments on the Sony Hack

I don’t have a lot to say about the Sony hack, which seems to still be ongoing. I want to highlight a few points, though.

* At this point, the attacks seem to be a few hackers and not the North Korean government. (My guess is that it’s not an insider, either.) That we live in the world where we aren’t sure if any given cyberattack is the work of a foreign government or a couple of guys should be scary to us all.

* Sony is a company that hackers have loved to hate for years now. (Remember their rootkit from 2005?) We’ve learned previously that putting yourself in this position can be disastrous. (Remember HBGary.) We’re learning that again.

* I don’t see how Sony launching a DDoS attack against the attackers is going to help at all.

* The most sensitive information that’s being leaked as a result of this attack isn’t the unreleased movies, the executive emails, or the celebrity gossip. It’s the minutiae from random employees. From a Gizmodo article:

The most painful stuff in the Sony cache is a doctor shopping for Ritalin. It’s an email about trying to get pregnant. It’s shit-talking coworkers behind their backs, and people’s credit card log-ins. It’s literally thousands of Social Security numbers laid bare. It’s even the harmless, mundane, trivial stuff that makes up any day’s email load that suddenly feels ugly and raw out in the open, a digital Babadook brought to life by a scorched earth cyberattack.

These people didn’t have anything to hide. They aren’t public figures. Their details aren’t going to be news anywhere in the world. But their privacy has been violated, and there are literally thousands of personal tragedies unfolding right now as these people deal with their friends and relatives who have searched and read this stuff.

These are people who did nothing wrong. They didn’t click on phishing links, or use dumb passwords (or even if they did, they didn’t cause this). They just showed up. They sent the same banal workplace emails you send every day, some personal, some not, some thoughtful, some dumb. Even if they didn’t have the expectation of full privacy, at most they may have assumed that an IT creeper might flip through their inbox, or that it was being crunched in an NSA server somewhere. For better or worse, we’ve become inured to small, anonymous violations. What happened to Sony Pictures employees, though, is public. And it is total.

Gizmodo got this 100% correct. And this is why privacy is so important for everyone.

I’m sure there’ll be more information as this continues to unfold.

http://www.engadget.com/2014/12/10/…
http://www.theguardian.com/technology/2014/dec/10/…
http://www.hollywoodreporter.com/news/…

Why hackers hate Sony:
http://gizmodo.com/…

The 2005 Sony rootkit story:
https://en.wikipedia.org/wiki/…

HBGary:
http://www.wired.com/2011/02/anonymous-hacks-hbgary/

Sony launching a DDoS attack against its hackers:
http://www.engadget.com/2014/12/10/…

Random embarrassing things from Sony:
http://time.com/3625392/…

Gizmodo’s take:
http://gizmodo.com/…

Schneier News

I was interviewed on Alternative Radio about surveillance and the NSA:
http://www.alternativeradio.org/products/shnb001

I was named an industry pioneer by “SC Magazine.”
http://www.scmagazine.com/…

BetaBoston wrote about a talk I gave earlier this month:
https://www.schneier.com/news/archives/2014/12/…

On 12/18 I’ll be part of a Co3 webinar where we examine incident-response trends of 2014 and look ahead to 2015. I tend not to do these, but this is an exception. Please sign up if you’re interested.
https://attendee.gotowebinar.com/register/…

Over 700 Million People Taking Steps to Avoid NSA Surveillance

There’s a new international survey on Internet security and trust, of “23,376 Internet users in 24 countries,” including “Australia, Brazil, Canada, China, Egypt, France, Germany, Great Britain, Hong Kong, India, Indonesia, Italy, Japan, Kenya, Mexico, Nigeria, Pakistan, Poland, South Africa, South Korea, Sweden, Tunisia, Turkey and the United States.” Amongst the findings, 60% of Internet users have heard of Edward Snowden, and 39% of those “have taken steps to protect their online privacy and security as a result of his revelations.”

The press is mostly spinning this as evidence that Snowden has not had an effect: “merely 39%,” “only 39%,” and so on. (Note that these articles are completely misunderstanding the data. It’s not 39% of people who are taking steps to protect their privacy post-Snowden, it’s 39% of the 60% of Internet users—which is not everybody—who have heard of him. So it’s much less than 39%.)

Even so, I disagree with the “Edward Snowden Revelations Not Having Much Impact on Internet Users” headline. He’s having an enormous impact. I ran the actual numbers country by country, combining “data on Internet penetration with data from this survey. Multiplying everything out, I calculate that *706 million people* have changed their behavior on the Internet because of what the NSA and GCHQ are doing. (For example, 17% of Indonesians use the Internet, 64% of them have heard of Snowden and 62% of them have taken steps to protect their privacy, which equals 17 million people out of its total 250-million population.)

Note that the countries in this survey only cover 4.7 billion out of a total 7 billion world population. Taking the conservative estimates that 20% of the remaining population uses the Internet, 40% of them have heard of Snowden, and 25% of those have done something about it, that’s an additional 46 million people around the world.

It’s certainly true that most of those people took steps that didn’t make any appreciable difference against an NSA level of surveillance, and probably not even against the even more pervasive corporate variety of surveillance. It’s probably even true that some of those people didn’t take steps at all, and just wish they did or wish they knew what to do. But it is absolutely extraordinary that *750 million people* are disturbed enough about their online privacy that they would represent to a survey taker that they did something about it.

Name another issue that has caused over ten percent of the world’s population to change their behavior in the past year? Cory Doctorow is right: we have reached “peak indifference to surveillance.” From now on, this issue is going to matter more and more, and policymakers around the world need to start paying attention.

https://www.cigionline.org/internet-survey

Press mentions:
http://www.ibtimes.co.uk/…
http://www.theguardian.com/technology/2014/nov/25/…

Internet penetration by country:
http://www.internetlivestats.com/…

Cory Docorow:
http://boingboing.net/2014/11/12/…

Related: a recent Pew Research Internet Project survey on Americans’ perceptions of privacy, commented on by Ben Wittes.
http://www.pewinternet.org/2014/11/12/…
http://www.lawfareblog.com/2014/11/…

Corporations Misusing Our Data

In the Internet age, we have no choice but to entrust our data with private companies: e-mail providers, service providers, retailers, and so on.

We realize that this data is at risk from hackers. But there’s another risk as well: the employees of the companies who are holding our data for us.

In the early years of Facebook, employees had a master password that enabled them to view anything they wanted in any account. NSA employees occasionally snoop on their friends and partners. The agency even has a name for it: LOVEINT. And well before the Internet, people with access to police or medical records occasionally used that power to look up either famous people or people they knew.

The latest company accused of allowing this sort of thing is Uber, the Internet car-ride service. The company is under investigation for spying on riders without their permission. Called the “god view,” some Uber employees are able to see who is using the service and where they’re going—and used this at least once in 2011 as a party trick to show off the service. A senior executive also suggested the company should hire people to dig up dirt on their critics, making their database of people’s rides even more “useful.”

None of us wants to be stalked—whether it’s from looking at our location data, our medical data, our emails and texts, or anything else—by friends or strangers who have access due to their jobs. Unfortunately, there are few rules protecting us.

Government employees are prohibited from looking at our data, although none of the NSA LOVEINT creeps were ever prosecuted. The HIPAA law protects the privacy of our medical records, but we have nothing to protect most of our other information.

Your Facebook and Uber data are only protected by company culture. There’s nothing in their license agreements that you clicked “agree” to but didn’t read that prevents those companies from violating your privacy.

This needs to change. Corporate databases containing our data should be secured from everyone who doesn’t need access for their work. Voyeurs who peek at our data without a legitimate reason should be punished.

There are audit technologies that can detect this sort of thing, and they should be required. As long as we have to give our data to companies and government agencies, we need assurances that our privacy will be protected.

This essay previously appeared on CNN.com.
http://www.cnn.com/2014/12/04/opinion/…

http://www.cnet.com/news/…
http://www.forbes.com/sites/kashmirhill/2014/10/03/…
http://www.nytimes.com/2014/11/19/technology/…

Snooping NSA employees:
http://www.washingtonpost.com/s/the-switch/wp/…

Since 1998, CRYPTO-GRAM has been a free monthly newsletter providing summaries, analyses, insights, and commentaries on security: computer and otherwise. You can subscribe, unsubscribe, or change your address on the Web at <http://www.schneier.com/crypto-gram.html>. Back issues are also available at that URL.

Please feel free to forward CRYPTO-GRAM, in whole or in part, to colleagues and friends who will find it valuable. Permission is also granted to reprint CRYPTO-GRAM, as long as it is reprinted in its entirety.

CRYPTO-GRAM is written by Bruce Schneier. Bruce Schneier is an internationally renowned security technologist, called a “security guru” by The Economist. He is the author of 12 books—including “Liars and Outliers: Enabling the Trust Society Needs to Survive”—as well as hundreds of articles, essays, and academic papers. His influential newsletter “Crypto-Gram” and his blog “Schneier on Security” are read by over 250,000 people. He has testified before Congress, is a frequent guest on television and radio, has served on several government committees, and is regularly quoted in the press. Schneier is a fellow at the Berkman Center for Internet and Society at Harvard Law School, a program fellow at the New America Foundation’s Open Technology Institute, a board member of the Electronic Frontier Foundation, an Advisory Board Member of the Electronic Privacy Information Center, and the Chief Technology Officer at Co3 Systems, Inc. See <http://www.schneier.com>.

Crypto-Gram is a personal newsletter. Opinions expressed are not necessarily those of Co3 Systems, Inc.

Copyright (c) 2014 by Bruce Schneier.

Sidebar photo of Bruce Schneier by Joe MacInnis.