The new 2015 Report to Congress from the U.S. China Economic and Security Review Commission is out and it starts with some interesting analysis of how the Chinese dealt with a crisis in their 2015 economy. We deal with these kinds of things all the time and that is why the Fed plays an important role in managing the money supply across our country. China, for all its protestations to the contrary, is not like us.
The Commission report begins by outlining a simple truth: "...the Chinese government responded to the collapse with a heavy hand: ordering brokerages to buy shares, forbidding large shareholders from selling, sending police to root out 'malicious sellers, ordering state-owned companies and pension funds to invest in equities, and halting trading in many companies. The government also censored information, punished journalists for focusing on the bad news, and warned people about spreading 'rumors' about the stock market rout."
The next time someone says Chinese businesses are "just like us", remind them of the kinds of things the Chinese government does to its businesses to make sure things go the way they want. Many government officials wish we could do similar things, but we don't because we are not like them.
Monday, November 30, 2015
How Little of Syria is Syria
Take a look at the map and see how little of Syria is actually in the government's hands. Aljazerra posted this map today and almost all of Syria looks like it is in someone else's' hands, and all of that is under Assad's control is in the western part of the country. The article is one of the first to blame the Russians for civilian casualities who are collateral damage in the fight against ISIS.
http://www.aljazeera.com/news/2015/11/20-killed-russian-air-strike-syrian-market-151129082103978.html
So, if you thought about why Russia has decided to help Assad stay in power, this would give us reason to see why it was so important. Syria is not in Assad's control and the situation was clearly getting worse. Territorially, Assad was not in power. More important, if you go directly west from Homs, you come to Tartus, where the Russians have their naval base. https://www.google.com/maps/place/Tartus+Port,+Tartus%E2%80%8E,+Syria/@34.9070499,35.9100339,15z/data=!4m2!3m1!1s0x15217c34ee5576c5:0x6c526abef67faf1c?hl=en-US
If they waited too much longer, their port would have been at risk of falling into the hands of somebody less favorable than Assad. Further north, the Russian airfields are at Latakia, also on the coast. According to the Moscow Times, the Russians are planning on building a larger air capability in Syria and unifying the forces there [http://www.themoscowtimes.com/business/article/russia-to-build-unified-military-base-in-syria-general-says/539407.html ] The Russians were certainly interested in maintaining those bases which are the only ones they have in the Middle East. What they are having to do to maintain them is put more boots on the ground and more planes in the air. They must need those places badly to risk that kind of exposure.
http://www.aljazeera.com/news/2015/11/20-killed-russian-air-strike-syrian-market-151129082103978.html
So, if you thought about why Russia has decided to help Assad stay in power, this would give us reason to see why it was so important. Syria is not in Assad's control and the situation was clearly getting worse. Territorially, Assad was not in power. More important, if you go directly west from Homs, you come to Tartus, where the Russians have their naval base. https://www.google.com/maps/place/Tartus+Port,+Tartus%E2%80%8E,+Syria/@34.9070499,35.9100339,15z/data=!4m2!3m1!1s0x15217c34ee5576c5:0x6c526abef67faf1c?hl=en-US
If they waited too much longer, their port would have been at risk of falling into the hands of somebody less favorable than Assad. Further north, the Russian airfields are at Latakia, also on the coast. According to the Moscow Times, the Russians are planning on building a larger air capability in Syria and unifying the forces there [http://www.themoscowtimes.com/business/article/russia-to-build-unified-military-base-in-syria-general-says/539407.html ] The Russians were certainly interested in maintaining those bases which are the only ones they have in the Middle East. What they are having to do to maintain them is put more boots on the ground and more planes in the air. They must need those places badly to risk that kind of exposure.
Sunday, November 29, 2015
Russian Military Hardware in Syria
The Russians have moved some IL-20 surveillance aircraft, Krasukha-4 jammers into Syria to complement the AN 400 anti-aircraft missiles. [see the articles by Elias Groll at http://foreignpolicy.com/2015/10/06/spy-planes-signal-jammers-and-putins-high-tech-war-in-syria/ and Sputnik's article at http://inserbia.info/today/2015/10/russian-electronic-warfare-systems-spotted-in-syria/ ]. If, as the Foreign Policy article says, using it to fight ISIS, it is a little overkill. ISIS has no Air Force.
Russia must have something else in mind, dragging this kind of hardware into a war zone where the enemy has tanks and truck-mounted artillary at the high end of their arsenal. The IL-20s could certainly listen to ISIS traffic and maybe even friendly troops of other nations in the area, but something like jammers and anti-aircraft systems are aimed at other flyers in the area. That would be an alliance of countries now bombing ISIS, and Turkey's F-16s that shot down a Russian fighter-bomber. Jammers and anti-aircraft missiles will make that kind of strike a little more interesting. For the Russians, these kinds of gadgets are big targets. The Turkmen already showed they can blow up a big target when they fired a missile at a Russian helicopter sitting on the ground. Jammers have to stop to set up their antenna. Let's see how long they last in that hostile environment.
Russia must have something else in mind, dragging this kind of hardware into a war zone where the enemy has tanks and truck-mounted artillary at the high end of their arsenal. The IL-20s could certainly listen to ISIS traffic and maybe even friendly troops of other nations in the area, but something like jammers and anti-aircraft systems are aimed at other flyers in the area. That would be an alliance of countries now bombing ISIS, and Turkey's F-16s that shot down a Russian fighter-bomber. Jammers and anti-aircraft missiles will make that kind of strike a little more interesting. For the Russians, these kinds of gadgets are big targets. The Turkmen already showed they can blow up a big target when they fired a missile at a Russian helicopter sitting on the ground. Jammers have to stop to set up their antenna. Let's see how long they last in that hostile environment.
Tuesday, November 24, 2015
Facts are not Required
Today's downing of a Russian SU-24 fighter shows the "facts" in any international incident are quickly established by both sides. The Russians say it was over Syrian airspace; the Turks say it was over Turkish airspace and was warned 10 times in 5 minutes. The Turks say it was shot down by a Turkish Air Force plane. Some news reports are saying it might have been a shoulder fired missile, or something bigger. BBC says last week the Turks warned the Russians to stop bombing the Turkmen in this part of Syria. Everyone agrees this is a serious international incident.
The location of the jet is not hard to determine. It is a question of fact. There are probably 10 radars around that place that caught the jet coming into the airspace. Lots of people know where it was and what it was bombing, because many governments are watching. If the jet was bombing someone, they all know where it was dropping the ordinance. The people on the ground where it was falling probably know who was bombing them. Somebody made a cellphone video of the whole thing, so that will have enough information to figure out where the plane was when it was hit.
When a country controls its press like Russia we expect to see a series of stories supporting the Russian view of these events. In the long run, the facts will be established the same way they always are, but the domestic audience in Russia will already believe whatever stories they manage to get out quickly. The facts will not influence them very much, because most of them will be papered over by an endless stream of their version of events. It goes to credibility.
We will know in a day or two which version of the event was the correct one. If the Turks are right, the Russians will continue to publish the same stories over and over in different forms, even though the rest of the world finds them incredible. That belief that the Russian press is incredible will not go away. If the Russians are right, they will have lots of help from the rest of the world's press to blast that message to anyone who can read. We are anxious to see what the truth turns out to be..
The location of the jet is not hard to determine. It is a question of fact. There are probably 10 radars around that place that caught the jet coming into the airspace. Lots of people know where it was and what it was bombing, because many governments are watching. If the jet was bombing someone, they all know where it was dropping the ordinance. The people on the ground where it was falling probably know who was bombing them. Somebody made a cellphone video of the whole thing, so that will have enough information to figure out where the plane was when it was hit.
When a country controls its press like Russia we expect to see a series of stories supporting the Russian view of these events. In the long run, the facts will be established the same way they always are, but the domestic audience in Russia will already believe whatever stories they manage to get out quickly. The facts will not influence them very much, because most of them will be papered over by an endless stream of their version of events. It goes to credibility.
We will know in a day or two which version of the event was the correct one. If the Turks are right, the Russians will continue to publish the same stories over and over in different forms, even though the rest of the world finds them incredible. That belief that the Russian press is incredible will not go away. If the Russians are right, they will have lots of help from the rest of the world's press to blast that message to anyone who can read. We are anxious to see what the truth turns out to be..
Sunday, November 22, 2015
China's Press & Terrorists
China has found itstelf in a peculiar position of having to convince the rest of the world that they have a problem with terrorists in their country. There is a certain justice to this.
China has rigidly controlled its press and only allowed it to comment using pre-scripted statements about terrorist attacks by Muslims in the Northwest of their country. Doing research on some of these events is difficult, especially if you don't do it right after the event. After that, the stories start disappearing. In Friday's Independent [http://www.independent.co.uk/news/world/asia/as-china-joins-the-anti-isis-brigade-must-we-keep-quiet-about-the-uighurs-a6742641.html ] there is good example, citing the killing of 28 terrorists by China's government.
You would think that the killing of 16 miners would attract some of the world's press. It was nearly the same number as were killed in Mali. Yet, we have nothing of this story on any of our news outlets - no videos, no interviews with grieving family members, no statements by government officials promising revenge or retaliation. Maybe killing the 28 was both, but we don't know.
"First and foremost, it hopes to get the West to shut up about the Uighurs. Today, state media reported the killing of 28 “terrorists”, allegedly members of a group that was said to have killed 16 people at a coalmine in Xinjiang, the huge, sparsely populated region in the far-west of China where the largely Muslim Uighurs, a 10 million-strong Turkic race, are concentrated. " The Uighurs have been killing people at regular intervals without using a lot of automatic weapons or explosives. They terrorize by using knives and meat cleavers, something ISIS has tried now and again. I had several of these stories in The Chinese Information War and they are gruesome tales that included killing children in cold blood in broad daylight in a public train station. Reports on that are few and far between.
So now, the Chinese want us to see that they have terrorists too. They live by the coverup and now find it difficult to uncover what they spent so much times and effort plowing under. If there is justice in the world, this is it.
China has rigidly controlled its press and only allowed it to comment using pre-scripted statements about terrorist attacks by Muslims in the Northwest of their country. Doing research on some of these events is difficult, especially if you don't do it right after the event. After that, the stories start disappearing. In Friday's Independent [http://www.independent.co.uk/news/world/asia/as-china-joins-the-anti-isis-brigade-must-we-keep-quiet-about-the-uighurs-a6742641.html ] there is good example, citing the killing of 28 terrorists by China's government.
You would think that the killing of 16 miners would attract some of the world's press. It was nearly the same number as were killed in Mali. Yet, we have nothing of this story on any of our news outlets - no videos, no interviews with grieving family members, no statements by government officials promising revenge or retaliation. Maybe killing the 28 was both, but we don't know.
"First and foremost, it hopes to get the West to shut up about the Uighurs. Today, state media reported the killing of 28 “terrorists”, allegedly members of a group that was said to have killed 16 people at a coalmine in Xinjiang, the huge, sparsely populated region in the far-west of China where the largely Muslim Uighurs, a 10 million-strong Turkic race, are concentrated. " The Uighurs have been killing people at regular intervals without using a lot of automatic weapons or explosives. They terrorize by using knives and meat cleavers, something ISIS has tried now and again. I had several of these stories in The Chinese Information War and they are gruesome tales that included killing children in cold blood in broad daylight in a public train station. Reports on that are few and far between.
So now, the Chinese want us to see that they have terrorists too. They live by the coverup and now find it difficult to uncover what they spent so much times and effort plowing under. If there is justice in the world, this is it.
Friday, November 20, 2015
Encryption Flip Side
The Intelligence services and law enforcement agencies of our country have a job to do and we can all understand why they need to be able to do it. But, from time to time, we might want to look at what that job is. Part of it is staying ahead of technology and coming up with ways to defeat whatever protections terrorists and spies can come up with.
For all of my government life, I heard the encryption argument from the people who want to be able to get into another person's mail or files and discover what they have been up to. They have good reasons for doing it, of course, like counter terrorism or undoing spies who are trying to do us harm. Most of the time, that argument was self-serving, even if it was made for the right reasons.
In 1991, Phil Zimmermann introduced an idea he called Pretty Good Privacy (PGP). He was investigated as a criminal for publishing the code in a book, and harassed for several years before the code was finally accepted. Anyone can have PGP now. What Zimmermann had to go through was the same type of thing our own technical industries are facing now with the discussion of making back doors to code to allow government access to the internal communications of anyone using their products. Apple, Google and the rest, built encryption in and they cannot get at the communications of users of products using that kind of protection. Even under a warrant, Apple and Google say they cannot get anything that is not encrypted and thus not very useful.
The natural reaction is to say "give us a back door". We promise we will protect it and make sure nobody can use it but us. We will only use it when it is required for some good purpose. That is the wrong approach to take. What Apple and Google did was the right thing. They are protecting our data from interception by anyone, good guy or bad, because so many bad guys were stealing almost everything they could get their hands on. It was about time they did something about it. We should be glad they did. The unintended consequence is that bad guys can use the same encryption to continue their work.
I don't like terrorists very much and would like to see them caught or killed. But, what the governments of the world should be focused on is finding the technology that allows them to keep up, not undoing the technology we have to protect our own information. That confusing bit of logic that allows them to make the argument that the industry should give them an easy way out is symptomatic of something else - laziness. Find a way, and do your job.
For all of my government life, I heard the encryption argument from the people who want to be able to get into another person's mail or files and discover what they have been up to. They have good reasons for doing it, of course, like counter terrorism or undoing spies who are trying to do us harm. Most of the time, that argument was self-serving, even if it was made for the right reasons.
In 1991, Phil Zimmermann introduced an idea he called Pretty Good Privacy (PGP). He was investigated as a criminal for publishing the code in a book, and harassed for several years before the code was finally accepted. Anyone can have PGP now. What Zimmermann had to go through was the same type of thing our own technical industries are facing now with the discussion of making back doors to code to allow government access to the internal communications of anyone using their products. Apple, Google and the rest, built encryption in and they cannot get at the communications of users of products using that kind of protection. Even under a warrant, Apple and Google say they cannot get anything that is not encrypted and thus not very useful.
The natural reaction is to say "give us a back door". We promise we will protect it and make sure nobody can use it but us. We will only use it when it is required for some good purpose. That is the wrong approach to take. What Apple and Google did was the right thing. They are protecting our data from interception by anyone, good guy or bad, because so many bad guys were stealing almost everything they could get their hands on. It was about time they did something about it. We should be glad they did. The unintended consequence is that bad guys can use the same encryption to continue their work.
I don't like terrorists very much and would like to see them caught or killed. But, what the governments of the world should be focused on is finding the technology that allows them to keep up, not undoing the technology we have to protect our own information. That confusing bit of logic that allows them to make the argument that the industry should give them an easy way out is symptomatic of something else - laziness. Find a way, and do your job.
Thursday, November 19, 2015
Anonymous After ISIS
For Anonymous it was not unusual. Thepress frequently refers to them as anarchists. A few news outlets [ e.g. http://www.independent.co.uk/life-style/gadgets-and-tech/news/paris-attacks-anonymous-operation-isis-activists-begin-leaking-details-of-suspected-extremist-a6737291.html] picked up the story of this unusual group of hackers as they tried to make information about ISIS Twitter accounts public. Anonymous went after Assad in Syria long before anyone seemed to take an interest in what he was doing to his own people.
When I worked for the government, it was generally not good to say anything favorable about Anonymous. They were, after all, hackers and hackers were bad. The real reason we didn't favor them was they weren't our hackers. They are hard to control and they sometimes get things wrong as they did in Ferguson. Stuff happens. We should forgive them for their sins and move on. At least they are trying to do something to respond to ISIS.
Twitter has been in the middle of this for a few years, as has Facebook. Various governments come to them and try to gets accounts closed because of "terrorist activity". In those circumstances, it is hard for the social media sites to say no. However, not everyone's terrorist is equal. In Russia those terrorists can be someone who disagrees with the government. In China they can be a religious group. There are quite a few ISIS friends in all parts of the Middle East, as we found when theTurks interrupted a moment of silence for the French dead with catcalls and whistles. Some of those folks are probably on Twitter too.
Disrupting ISIS recruiting is a good thing, but not something governments generally favor,, and Twitter would be hard-pressed to do. This is where Anonymous is at its best - doing things that governments don't favor but need to be done. Maybe they can start posting the names of holders of these accounts and the people they are communicating with. I'm sure we all would like to know if our neighbor is being recruited by ISIS. We can take them off our Friends list,, bump them out of the carpool, and call the FBI.
When I worked for the government, it was generally not good to say anything favorable about Anonymous. They were, after all, hackers and hackers were bad. The real reason we didn't favor them was they weren't our hackers. They are hard to control and they sometimes get things wrong as they did in Ferguson. Stuff happens. We should forgive them for their sins and move on. At least they are trying to do something to respond to ISIS.
Twitter has been in the middle of this for a few years, as has Facebook. Various governments come to them and try to gets accounts closed because of "terrorist activity". In those circumstances, it is hard for the social media sites to say no. However, not everyone's terrorist is equal. In Russia those terrorists can be someone who disagrees with the government. In China they can be a religious group. There are quite a few ISIS friends in all parts of the Middle East, as we found when theTurks interrupted a moment of silence for the French dead with catcalls and whistles. Some of those folks are probably on Twitter too.
Disrupting ISIS recruiting is a good thing, but not something governments generally favor,, and Twitter would be hard-pressed to do. This is where Anonymous is at its best - doing things that governments don't favor but need to be done. Maybe they can start posting the names of holders of these accounts and the people they are communicating with. I'm sure we all would like to know if our neighbor is being recruited by ISIS. We can take them off our Friends list,, bump them out of the carpool, and call the FBI.
Wednesday, November 18, 2015
Stupid is as Stupid does Again
The title is, of course, from Forrest Gump and summarizes a basic tenent of computer security. You cannot engineer out stupid. I don't know how many of you read the November FISMA report from OPM, but when I looked at it, I had to check the date. I thought it was the report from a couple of years before the Chinese took all of our security clearance records. Too bad it wasn't. Really? Two factor authentication is still not being used? Multiple systems still haven't been approved? They still haven't identified deficiencies and set dates for correcting all the problems. Maybe they are still too busy sending out those notices that your records have been stolen and offering some Credit monitoring, which is absolutely worthless. Then too, they know it is only a year until they are going to be gone, and someone new will be taking over. Maybe this kind of thing will escape the public notice until then. Give the security clearance data back to DoD and get these idiots out of the business.
These are a few of the other things that we tend to forget:
These are a few of the other things that we tend to forget:
-
In June 2015, the Office of Personnel Management reported that an
intrusion into its systems affected the personnel records of about 4.2
million current and former federal employees. The Director stated that
a separate but related incident involved the agency’s background
investigation systems and compromised background investigation
files for 21.5 million individuals.
-
In June 2015, the Commissioner of the Internal Revenue Service
testified that unauthorized third parties had gained access to taxpayer
information from its “Get Transcript” application. According to officials,
criminals used taxpayer-specific data acquired from non-department
sources to gain unauthorized access to information on approximately
100,000 tax accounts. This data included Social Security information,
dates of birth, and street addresses. In an August 2015 update, the
agency reported this number to be about 114,000 and that an
additional 220,000 accounts had been inappropriately accessed,
which brings the total to about 330,000 accounts.
-
In April 2015, the Department of Veterans Affairs’ Office of Inspector
General reported that two contractors had improperly accessed the
agency’s network from foreign countries using personally owned
equipment.5
-
In February 2015, the Director of National Intelligence stated that
unauthorized computer intrusions were detected in 2014 on the
networks of the Office of Personnel Management and two of its
contractors. The two contractors were involved in processing sensitive
PII related to national security clearances for federal employees.6
-
In September 2014, a cyber intrusion into the United States Postal
Service’s information systems may have compromised PII for more than 800,000 of its employees.
• In October 2013, a wide-scale cybersecurity breach involving a U.S. Food and Drug Administration system occurred that exposed the PII of 14,000 user accounts.8
We could say this was indicative of a poor management situation, but it is more than that. This stream of data thefts is just the current ones and clearly indicates we have no oversight of computer security in any of the Federal agencies.
The report goes on to document the basic things every computer security program should have, but cites them as identified deficiencies of our Federal agencies. Policy is not the issue here. We have federal CIOs and CISOs who clearly don't have the initiative to fix what has been identified as deficient conditions. They give excuses, lay blame on everyone else, and talk a good deal but never get the job done. Why do we pay people to do these jobs and then ignore them if they don't? This is our data these people are losing. Can't we find a way to get their attention. GAO's reporting is an insight into the borader problem of getting managers to follow even basic policies that require that data to be secured.
ISIS Money
I had a section in my last book about funding for terrorist groups, especially ISIS. There are a lot of myths about where that money comes from, including the best one about the bank in Mosul, where ISIS was said to abscond with several hundred million dollars, even though the Iraqis and the bank deny it today. Even selling oil, which this week got some attention when tankers and oil transport trucks were on the target list being bombed. A CNN report on this said $40 million a month went to ISIS from this kind of activity. But, we are avoiding the real question about ISIS to believe that it is self-sustaining.
A government that refuses to say "Islamic extremists" is odd to say the least. Few people understand this kind of ignorance, but this odd combination also keeps them from saying who is really funding ISIS. We should remember that Al Qaeda and Hezbollah are still on our list of terrorist organizations. ISIL is just current because of Paris, but the others have not gone away. They are not shy about who their targets will be. The Administration talks about oil, selling artifacts, and extortion to keep from talking about the politically sensitive question of how ISIS got going and how they perpetuate themselves in an environment where everyone says they hate them and bomb them regularly. They get money from other sources and the press should focus on those. Shutting them off is important to disbanding and destroying this "JV Team" of terrorists.
In 2015, the Congress put together a couple of studies on terrorism financing and I used the COMMITTEE ON FINANCIAL SERVICES U.S. HOUSE OF REPRESENTATIVES from testimony on 22 April. You can read the whole thing here http://financialservices.house.gov/uploadedfiles/114-15.pdf
Oil going to Turkey and Iran can be cut off, as we are seeing now. The question, of course, was why it took a mass execution in Paris to act on it when it has been known as a source of terrorist financing for years. But the real problem of terrorist financing is not just oil.
A government that refuses to say "Islamic extremists" is odd to say the least. Few people understand this kind of ignorance, but this odd combination also keeps them from saying who is really funding ISIS. We should remember that Al Qaeda and Hezbollah are still on our list of terrorist organizations. ISIL is just current because of Paris, but the others have not gone away. They are not shy about who their targets will be. The Administration talks about oil, selling artifacts, and extortion to keep from talking about the politically sensitive question of how ISIS got going and how they perpetuate themselves in an environment where everyone says they hate them and bomb them regularly. They get money from other sources and the press should focus on those. Shutting them off is important to disbanding and destroying this "JV Team" of terrorists.
In 2015, the Congress put together a couple of studies on terrorism financing and I used the COMMITTEE ON FINANCIAL SERVICES U.S. HOUSE OF REPRESENTATIVES from testimony on 22 April. You can read the whole thing here http://financialservices.house.gov/uploadedfiles/114-15.pdf
Oil going to Turkey and Iran can be cut off, as we are seeing now. The question, of course, was why it took a mass execution in Paris to act on it when it has been known as a source of terrorist financing for years. But the real problem of terrorist financing is not just oil.
"Mr. SCHANZER. Yes. I would agree with just about everything
that Juan has just stated, but I think I would note two things. One
thing that has not changed at all is the challenge of deep pocket
donors in the Gulf states. We knew that this was a problem in the
immediate aftermath of 9/11, and when you look at the statements
that have come out of the Treasury Department, we continue to see
challenges out of Saudi Arabia, Kuwait, Qatar, et cetera. This is an
issue that we have not fully tackled yet. There has been better co-operation in some cases, but in some cases we continue to see these
intransigent countries where they are not cracking down enough.
I am thinking of Qatar in particular. It is an incredibly problematic
jurisdiction." (page 15)
The Middle East is full of people who finance operations that will do harm to Western countries. We know they will do that because they make videos and publish articles saying so. Turkey and Iran buy oil from ISIL, proving only that oil makes strange bedfellows. The Turks facilitate the sale of antiquities from areas ISIL has seized. Guys trying to make a buck, no doubt. What ISIL did in Paris is remind the rest of the world that there are enemies worse than each other. The kind that looks you in the eye and lies about how much your friendship means to them.
The Middle East is full of people who finance operations that will do harm to Western countries. We know they will do that because they make videos and publish articles saying so. Turkey and Iran buy oil from ISIL, proving only that oil makes strange bedfellows. The Turks facilitate the sale of antiquities from areas ISIL has seized. Guys trying to make a buck, no doubt. What ISIL did in Paris is remind the rest of the world that there are enemies worse than each other. The kind that looks you in the eye and lies about how much your friendship means to them.
Wednesday, November 11, 2015
When Regulators Don't
We have had two cases this week that show clearly what regulators really do with their time.
The first is the fiasco of Russian athletes using enhancements to improve their performance. Several news outlets have said this was intentional, state sponsored, and the FSB participated. OF course there is already someone who is supposed to be looking into this kind of thing, and taking blood samples of athletes before and after they participate. The regulation of that kind of thing does not seem to have gone well, because nobody in that chain of people found anything worth bringing up.
The second is the purchase of airtime by companies tethered to China which then broadcast news using the Chinese version of stories. The FCC is supposed to looking at things like that, but didn't seem to notice [until a reporter pointed it out] that it was going on. The Russian news story was broken by journalists in Germany last summer.
Both of these stories illustrate why China and Russia want to control their press. These kinds of stories disrupt the harmony in the universe. The Russians say the versions of stories coming out are "confusing" and prove nothing. The Chinese say the same about the Reuters investigation that prompted FCC to finally open up a probe. This is bad for the world, causing people to have to worry about things that should not be of notice to a public at ease with their situation and happy with their government.
When you start looking into it, regulators seldom do. They publish reports, engage in a few of their responsibilities, and take home a paycheck that makes all of us feel cheated. Government regulators do a lousy job and still get paid for it. We saw the same with the VA giving bonuses to all those people who engaged in dubious behavior. Nobody is paying attention.
The first is the fiasco of Russian athletes using enhancements to improve their performance. Several news outlets have said this was intentional, state sponsored, and the FSB participated. OF course there is already someone who is supposed to be looking into this kind of thing, and taking blood samples of athletes before and after they participate. The regulation of that kind of thing does not seem to have gone well, because nobody in that chain of people found anything worth bringing up.
The second is the purchase of airtime by companies tethered to China which then broadcast news using the Chinese version of stories. The FCC is supposed to looking at things like that, but didn't seem to notice [until a reporter pointed it out] that it was going on. The Russian news story was broken by journalists in Germany last summer.
Both of these stories illustrate why China and Russia want to control their press. These kinds of stories disrupt the harmony in the universe. The Russians say the versions of stories coming out are "confusing" and prove nothing. The Chinese say the same about the Reuters investigation that prompted FCC to finally open up a probe. This is bad for the world, causing people to have to worry about things that should not be of notice to a public at ease with their situation and happy with their government.
When you start looking into it, regulators seldom do. They publish reports, engage in a few of their responsibilities, and take home a paycheck that makes all of us feel cheated. Government regulators do a lousy job and still get paid for it. We saw the same with the VA giving bonuses to all those people who engaged in dubious behavior. Nobody is paying attention.
ALIBABA'S COUNTERFEITS
We might be looking a little too close to Alibaba's counterfeits, and not looking at the broader issue of counterfeits being sold on the web. Kathy Chu [Alibaba Revamps Fake-Goods Procedures, The Wall Street Journal, 11 November 2015] shows how thin the changes are to the policies Alibaba has made: " Under the new rules, global brands that have been highly accurate in flagging fake goods on Alibaba’s Tmall and Taobao will have their complaints reviewed in one to three working days, compared with five to seven days previously. Brands that sign up for the program will also have a dedicated representative to deal with their complaints, according to the Chinese company. Alibaba hasn't disclosed how many brands have enrolled in its “good-faith takedown” program, which took effect April 1st." We probably should not expect more from the world's largest counterfeiters of goods. There is almost nothing the Chinese don't counterfeit, but Chu's example is insightful.
The Chinese also counterfeit their own goods, as illustrated by the example of counterfeit Huawai phones being sold on the Alibaba outlet. I have mentioned other stories before about China's ability and willingness to counterfeit anything. Chief among the reports was a 60 Minutes segment that outlined the counterfeiting of almost everything from wine to golf clubs. It is part of their culture to counterfeit. Copyright and trademark be damned. Of course, when they start counterfeiting airplane parts and airbags (both were done) we are inclined to be more concerned, but still not very engaged with China.
We don't do very much to discourage this kind of behavior. As I mentioned in a prior post, Amazon continues to see a class of goods called "generic". They don't want to know where they are manufactured and rely on a distributor to verify the authenticity. This behavior is not much different than Alibaba. Amazon does take these devices back if you don't approve of the, but avoiding them is a better plan
Counterfeit electronic devices are not good things to have in the U.S. infrastructure because goods in China are manufactured under different rules. We can end up with source code that has been tampered with by the Chinese government or surveillance equipment required in China but not anywhere else, being included in the manufacturing process. The thieves are blind to this kind of thing. We shouldn''t be.
The Chinese also counterfeit their own goods, as illustrated by the example of counterfeit Huawai phones being sold on the Alibaba outlet. I have mentioned other stories before about China's ability and willingness to counterfeit anything. Chief among the reports was a 60 Minutes segment that outlined the counterfeiting of almost everything from wine to golf clubs. It is part of their culture to counterfeit. Copyright and trademark be damned. Of course, when they start counterfeiting airplane parts and airbags (both were done) we are inclined to be more concerned, but still not very engaged with China.
We don't do very much to discourage this kind of behavior. As I mentioned in a prior post, Amazon continues to see a class of goods called "generic". They don't want to know where they are manufactured and rely on a distributor to verify the authenticity. This behavior is not much different than Alibaba. Amazon does take these devices back if you don't approve of the, but avoiding them is a better plan
Counterfeit electronic devices are not good things to have in the U.S. infrastructure because goods in China are manufactured under different rules. We can end up with source code that has been tampered with by the Chinese government or surveillance equipment required in China but not anywhere else, being included in the manufacturing process. The thieves are blind to this kind of thing. We shouldn''t be.
Tuesday, November 10, 2015
Footdragging on Cybersecurity
Both The Hill and Washington Times expressed similar views of the new Cybersecurity Information Sharing Act, without expressing them the same way. Andrea Castillo in the Times has the most interesting view on this, describing the CISA as something only a politician could love. [http://www.washingtontimes.com/news/2015/nov/9/andrea-castillo-cisa-a-cybersecurity-bill-only-a-p/ ] As a note: This website is almost impossible to read, being filled with ads and internal references, so email yourself the article before attempting to read it.
The real forces at work here are the IT Industry and Special Interest groups like some of us who would actually like to see government do something more aligned with security of computer systems. The IT Industry is on the other side of this, and for a good reason. If we actually can get something passed and people start reporting things they find when they are hacked, you can be sure they will find more zero day exploits that were designed in, fielded without proper testing, and ignored even after someone told those responsible that it needed to be fixed. The IT Industry thinks this can get them into trouble and has fought tooth and nail to water down any provisions of any bill that Congress tries to enact. They are deathly afraid that any bill to share information will result in work for their developers. They are right about that.
I don't necessarily believe that it is the Microsoft-Cisco cooperation in fighting this legislation means they are leading it. There are thousands of software developers, integrators, and cloud services who don't want to be seen as fighting something they know their customers would see as counter to what they are promising in the way of security. They are two-faced about it. They would like to see a couple of big companies represent them and stay out of the limelight. Actually, there isn't a whole lot of limelight on this anyway, since the legislation was around when I was on the President's Critical Infrastructure Protection Committee - that was 10 years ago. They have managed to slow-roll this and will continue to poke and prode their elected representatives to make this bill suit their own needs. The U.S. Chamber of Commerce was right out front the last time this issue came up, and we have yet to see much public comment by them this time around. They have gone underground with a lot of the others.
The real forces at work here are the IT Industry and Special Interest groups like some of us who would actually like to see government do something more aligned with security of computer systems. The IT Industry is on the other side of this, and for a good reason. If we actually can get something passed and people start reporting things they find when they are hacked, you can be sure they will find more zero day exploits that were designed in, fielded without proper testing, and ignored even after someone told those responsible that it needed to be fixed. The IT Industry thinks this can get them into trouble and has fought tooth and nail to water down any provisions of any bill that Congress tries to enact. They are deathly afraid that any bill to share information will result in work for their developers. They are right about that.
I don't necessarily believe that it is the Microsoft-Cisco cooperation in fighting this legislation means they are leading it. There are thousands of software developers, integrators, and cloud services who don't want to be seen as fighting something they know their customers would see as counter to what they are promising in the way of security. They are two-faced about it. They would like to see a couple of big companies represent them and stay out of the limelight. Actually, there isn't a whole lot of limelight on this anyway, since the legislation was around when I was on the President's Critical Infrastructure Protection Committee - that was 10 years ago. They have managed to slow-roll this and will continue to poke and prode their elected representatives to make this bill suit their own needs. The U.S. Chamber of Commerce was right out front the last time this issue came up, and we have yet to see much public comment by them this time around. They have gone underground with a lot of the others.
Russia's Cyberwar with Ukraine
In today's Wall Street Journal, Margaret Coker and Paul Sonne, [Ukraine, Cyberwar's Hottest Front] updates (in great detail) a story I told in The New Cyberwar, my latest book. This particular incident involved the hacking the Ukraine Central Election Commission, attempting to disrupt the establishment of an official tally for the final election results. They missed the point of the espionage software that was found in Ukraine's computers, and failed to mention that it was also found in Latvia, the next rung on Putin's ladder.
Espionage is the initial purpose. Collecting and analyzing information about what leaders think. There were only 38 occurences one popular method that was used, making it harder to detect and less strenuous to analyze. It targeted leaders in more than Ukraine. The Chinese and Russians listen more than they try to hack for the purpose of disruption.
They were on target with a discussion of the reliance on an old infrastructure that has a history of being pirated software that came from old Russian equipment managed by Russian companies. Unlike the Russians who went into Crimea, the government of Ukraine didn't replace its infrastructure with new equipment that it controlled. The Russians knew the importance of that because they were using the equipment for their own benefit.
Espionage is the initial purpose. Collecting and analyzing information about what leaders think. There were only 38 occurences one popular method that was used, making it harder to detect and less strenuous to analyze. It targeted leaders in more than Ukraine. The Chinese and Russians listen more than they try to hack for the purpose of disruption.
They were on target with a discussion of the reliance on an old infrastructure that has a history of being pirated software that came from old Russian equipment managed by Russian companies. Unlike the Russians who went into Crimea, the government of Ukraine didn't replace its infrastructure with new equipment that it controlled. The Russians knew the importance of that because they were using the equipment for their own benefit.
Monday, November 9, 2015
China Buys U.S. News Outlets
According to two sources of news last week, China purchased a U.S. company G&E Studio which, in turn, leased stations and airtime in Washington D.C.,Philadelphia, San Francisco and Boston. [ The Reuters Investigation, SPECIAL REPORT-Exposed: Beijing's covert global radio network is at http://www.reuters.com/investigates/special-report/china-radio/ and has much more detail ]Those are big markets where the news has a lot of competition, but these stations carried stories China wanted to slant their own way. Gordon Crowitz at the Wall Street Journal, wrote an opinion piece today about it [China's Soft Power Exposed]
Key to all of this, from my viewpoint, is the Chinese are not just willing to control their own press in their own country; they want to control ours too - and a few outside the U.S. The Reuters article includes this statement:
C&E Studio produces shows in Chinese and English and is one of 33 stations purchased covertly by
China Radio International. It coverage extends from the western suburbs of Washington to the Chinese embassy. That includes where I live.
Funny that Reuters had to tell the FCC that this was going on.
Key to all of this, from my viewpoint, is the Chinese are not just willing to control their own press in their own country; they want to control ours too - and a few outside the U.S. The Reuters article includes this statement:
Chinese President Xi Jinping, who has chafed at a world order he sees as dominated by the United States and its allies, is aware that China struggles to project its views in the international arena.
“We should increase China’s soft power, give a good Chinese narrative and better communicate China’s message to the world,” Xi said in a policy address in November last year, according to Xinhua.
C&E Studio produces shows in Chinese and English and is one of 33 stations purchased covertly by
China Radio International. It coverage extends from the western suburbs of Washington to the Chinese embassy. That includes where I live.
Funny that Reuters had to tell the FCC that this was going on.
Cuba & Russia in Syria
Last month, we heard from Fox News and the Daily Beast that Cuba had sent forces to Syria. Since then, almost nobody talks about it. What is odd about that is while the U.S. encourages businesses to run into Cuba to prop up the regime, that same regime is sending troops into Syria to fight along side the Russians who actually transported them to fight there. We have to wonder if the State Department, the Department of Commerce, and the White House talk. They can get in the same room long enough to cancel the Keystone Pipeline, but can't seem to coordinate a strategy on Cuba that makes sense, given their involvement in Syria. We sanction Russians for what they do in the Ukraine, but Syria is OK.
Russia and Cuba have been cooperating a long time in collecting intelligence on the U.S. and it goes back a long way. Everyone has heard of Lourdes. That SIGINT base was closed in 2001, and according to a Global Security report at http://www.globalsecurity.org/intell/world/cuba/lourdes.htm
the Russians said they reopened it in July 2014. Putin denies doing any such thing, and since he controls the press, we must wonder how they managed to publish this agreement between Russia and Cuba to open it back up. Stuff happens.
When ABC News went to Cuba to show what new international relations would do, they had the nerve to want to go aboard a Russian spy ship tied up at the same dock where the TV cameras disembarked. Stuff happens. The Russians pretended to be looking for a place to hide but were too late. I somehow don't think that was an accident. It is Putin's in-your-face style of diplomacy, which seems to work for him. Now Cubans are in Syria fighting alongside their Russian friends.
Let's not be friends with the friends of our enemy.
Russia and Cuba have been cooperating a long time in collecting intelligence on the U.S. and it goes back a long way. Everyone has heard of Lourdes. That SIGINT base was closed in 2001, and according to a Global Security report at http://www.globalsecurity.org/intell/world/cuba/lourdes.htm
the Russians said they reopened it in July 2014. Putin denies doing any such thing, and since he controls the press, we must wonder how they managed to publish this agreement between Russia and Cuba to open it back up. Stuff happens.
When ABC News went to Cuba to show what new international relations would do, they had the nerve to want to go aboard a Russian spy ship tied up at the same dock where the TV cameras disembarked. Stuff happens. The Russians pretended to be looking for a place to hide but were too late. I somehow don't think that was an accident. It is Putin's in-your-face style of diplomacy, which seems to work for him. Now Cubans are in Syria fighting alongside their Russian friends.
Let's not be friends with the friends of our enemy.
Thursday, November 5, 2015
Anonymous Back in Town
There was piece yesterday in The Hill [Cory Bennett and Katie Williams, Anonymous poised to unmask alleged KKK members] that will try to repair damage done by an erroneous list of KKK members circulated by someone claiming to represent Anonymous. Anonymous has to deal with this from time to time and it has caused them damage to their reputation, but they still do good things now and again. They were hacking Syria long before the war got to the point it is today and have done good work with ISIS recruiting on social media.
This time they will release 1000 names. Anonymous, according to a continuation of the story in today's The Hill, got started in racial issues after Furgeson and named the wrong police officer as the shooter. It caused them, and him, a lot of trouble. The article claims they are trying to recover from that with this current release. You can bet there will be some surprises there, just as there were in Ashley Madison. It gets increasingly hard to hide much of anything in a world where information about almost everyone is being stolen every day.
This time they will release 1000 names. Anonymous, according to a continuation of the story in today's The Hill, got started in racial issues after Furgeson and named the wrong police officer as the shooter. It caused them, and him, a lot of trouble. The article claims they are trying to recover from that with this current release. You can bet there will be some surprises there, just as there were in Ashley Madison. It gets increasingly hard to hide much of anything in a world where information about almost everyone is being stolen every day.
Russia Trains Iran's Hackers
Jay Solomon has an interesting article in today's Wall Street Journal [Iranian Hacking Surges in U.S.] which says Iran's hackers are being trained by the Russians. His source was an "administration official" which usually means anyone within a stone's throw of the White House, but in this case it appears to be someone in the State Department. Ironically, the State Department email systems were said to be hacked last year by the Russians. They probably know where to look. Apparently, according to this article, several administration officials there have been hacked in recent weeks.
It is unlikely that Iran has stopped hacking long enough to start back up on something like the arrest of an energy executive living in Iran. They have been at it since they hacked into Linkedin and other social media sites looking for friends of their enemies. That was years ago. Unless they want us to know that they are stepping up these efforts, they don't have a lot of reasons to be so clumsy.
The idea that Iran is getting training from the Russians is certainly interesting. It looks like Russia is going the way of China in getting proxies to do their work for them. The proxies allow them to say, "It wasn't us." That makes attribution harder. It makes retaliation harder. Since the U.S. is doing little to nothing about people hacking us anyway, it hardly matters.
It is unlikely that Iran has stopped hacking long enough to start back up on something like the arrest of an energy executive living in Iran. They have been at it since they hacked into Linkedin and other social media sites looking for friends of their enemies. That was years ago. Unless they want us to know that they are stepping up these efforts, they don't have a lot of reasons to be so clumsy.
The idea that Iran is getting training from the Russians is certainly interesting. It looks like Russia is going the way of China in getting proxies to do their work for them. The proxies allow them to say, "It wasn't us." That makes attribution harder. It makes retaliation harder. Since the U.S. is doing little to nothing about people hacking us anyway, it hardly matters.
Tuesday, November 3, 2015
Russian Soldiers in Syria
I had to look up the size of the Russian military in the CIA Factbook but it wasn't there. The BBC came through with the fact that the overall size is classified [see Russia boosts military might despite sanctions from May] but revealed that the loss of manufacturing capability in the Ukraine was hurting them and about 90-100,000 men was all they could put into the Ukraine, even if they were to invade. That is a lot of people, but nobody around there can match it. We will see if they can fight a war in Ukraine and Syria at the same time. That might prove more difficult.
The CIA Factbook says roughly 10% of the military is of draft age, which is compulsory. Conscripts can be sent to combat zones after 6 months of training, though military will remain in the Reserves until they are age 50. In 2014, half of Russian males got legal deferments. Reuters Most of Russia’s military still ‘rubbish’ despite Ukraine, Syria deployments speculates that, in spite of deployments of Russian troops to the Ukraine and Syria, the quality of the Russian military is not very good. We might be skeptical of that claim.
The Russians showed off their cruise missiles and their fighter-bomber aircraft, some of which are very capable platforms. The maintenance trail of these kinds of hardware is long, but they seemed to be maintained well. The airplanes are flying multiple missions and not dropping out of the sky. They seemed to have slowed down their use of cruise missiles, so they either ran out or they didn't find them very effective against the targets. That puts more burden on the aircraft and crews.
Sometimes it amazes me to see an aircraft carrier launching aircraft into a war zone and bringing them home in all kinds of weather, far from home. The Navy seems to do it effortlessly, but it takes an army of Navy people to do it. Ordnance, aircraft technicians, mission planners, cooks, logistics managers, et al go into an area and stay there until relieved by another aircraft carrier. It must be scary to see us do that.
We don't want to underestimate what the Russian soldier can do, because they have done quite a bit, with very little, for a long time. Now Putin is building up his forces and giving them modern weapons, increasing his cyber capabilities, and using that force to occupy territories in Eastern Europe and the Middle East. He isn't sitting around waiting for some ragtag bunch of fighters to join in his wish for how political events will unfold. Russia's military may be more formidable than we think.
The CIA Factbook says roughly 10% of the military is of draft age, which is compulsory. Conscripts can be sent to combat zones after 6 months of training, though military will remain in the Reserves until they are age 50. In 2014, half of Russian males got legal deferments. Reuters Most of Russia’s military still ‘rubbish’ despite Ukraine, Syria deployments speculates that, in spite of deployments of Russian troops to the Ukraine and Syria, the quality of the Russian military is not very good. We might be skeptical of that claim.
The Russians showed off their cruise missiles and their fighter-bomber aircraft, some of which are very capable platforms. The maintenance trail of these kinds of hardware is long, but they seemed to be maintained well. The airplanes are flying multiple missions and not dropping out of the sky. They seemed to have slowed down their use of cruise missiles, so they either ran out or they didn't find them very effective against the targets. That puts more burden on the aircraft and crews.
Sometimes it amazes me to see an aircraft carrier launching aircraft into a war zone and bringing them home in all kinds of weather, far from home. The Navy seems to do it effortlessly, but it takes an army of Navy people to do it. Ordnance, aircraft technicians, mission planners, cooks, logistics managers, et al go into an area and stay there until relieved by another aircraft carrier. It must be scary to see us do that.
We don't want to underestimate what the Russian soldier can do, because they have done quite a bit, with very little, for a long time. Now Putin is building up his forces and giving them modern weapons, increasing his cyber capabilities, and using that force to occupy territories in Eastern Europe and the Middle East. He isn't sitting around waiting for some ragtag bunch of fighters to join in his wish for how political events will unfold. Russia's military may be more formidable than we think.
Monday, November 2, 2015
Cutting Journalists Throats for ISIS
Over the weekend, there were two assasinations of publishers in Bangladesh, which is so far away that we forget anyone lives there. [see Ellen Barry, 2 Publishers Stabbed in Bangladesh as Attacks Rise, New York Times, 1 Nov. 2015]. This is how ISIS operates and one of the reasons hundreds of thousands run away from places they occupy. There is no freedom of the press, ala Charlie Hebdo. The penalty for publishing things they don't like is severe.
The two publishers had republished works of Avijit Roy, killed eight months ago, because they didn't like his denouncement of religious extremism. How anyone could be killed because reprinted works of someone else is far beyond us, yet it is consistent with controlling information disseminated by the world's publishers. We should never forget Salman Rushdie, a modern day example, along with these two men trying to do their job.
These radical Muslims are not acting alone when they kill someone thousands of miles away, because of his written words. This isn't just about religious extremism. The Russians do the same thing by beating up reporters who don't follow guidance. The Chinese use social and political jabs, or jail if those don't work. The Iranians, Turks, Saudis, Pakistanis and Egyptians have all had go-arounds with their press and local publishers. They control what is said about a variety of different subjects, especially about the performance of specific government representatives.
This is a way to keep power by controlling what people hear about a government or group. In the Internet age, the Chinese started this with censorship of Google. They wanted Google to control search results in China, but they also wanted them to control it in the U.S. where they had no business melding. Google backed away and declared a principle few countries recognize - the free and open exchange of ideas between individuals in many countries. There are no religious affiliations that matter to this. ISIS learns how to do it by watching the leaders of the countries around them, who are far more subtle, using the tools of the Internet to find and silence their critics. The methods are different but the results are the same.
The two publishers had republished works of Avijit Roy, killed eight months ago, because they didn't like his denouncement of religious extremism. How anyone could be killed because reprinted works of someone else is far beyond us, yet it is consistent with controlling information disseminated by the world's publishers. We should never forget Salman Rushdie, a modern day example, along with these two men trying to do their job.
These radical Muslims are not acting alone when they kill someone thousands of miles away, because of his written words. This isn't just about religious extremism. The Russians do the same thing by beating up reporters who don't follow guidance. The Chinese use social and political jabs, or jail if those don't work. The Iranians, Turks, Saudis, Pakistanis and Egyptians have all had go-arounds with their press and local publishers. They control what is said about a variety of different subjects, especially about the performance of specific government representatives.
This is a way to keep power by controlling what people hear about a government or group. In the Internet age, the Chinese started this with censorship of Google. They wanted Google to control search results in China, but they also wanted them to control it in the U.S. where they had no business melding. Google backed away and declared a principle few countries recognize - the free and open exchange of ideas between individuals in many countries. There are no religious affiliations that matter to this. ISIS learns how to do it by watching the leaders of the countries around them, who are far more subtle, using the tools of the Internet to find and silence their critics. The methods are different but the results are the same.
Subscribe to:
Posts (Atom)