Negotiating with Hackers

Reuters has a story today on the Association of Southeast Asian Nations (ASEAN) negotiating with Russia to stop its hacking of their members.  Singapore has had some high profile cases of late, including the theft of a government database with 1.5 million health records.  What is odd about this is nobody has named Russia in the hacking of these records.  It seems like something China would do before the Russians would do it, but since they are keeping quiet about the source of the hacking, it will be awhile before anyone knows. 

Do we have any confidence that negotiating your way out of hacking will actually do any good?  Only Russia and China have come to agreement on how this might benefit one another and actually signed agreements which they seem to have kept.  It seems like one precedent must be political and strategic benefit to both parties.  Please tell me what that benefit would be to Russia in an agreement with the ASEAN states.  In my experience, negotiating with hackers is like negotiating with terrorists.  The agreement works as long as the parties are both satisfied with compliance by one another. 

Russia can't hack the whole world, though they have certainly tried on occasion.   There is not much evidence of hacking by Russian hackers in the ASEAN states, so they are not giving up very much in agreeing to cooperate on cyber security.  We can be sure they will not violate their agreements with China and would not cooperate in rooting out Chinese hackers.   So, they are agreeing to do something they are not doing anyway.  Do we actually believe that Russia would sign that agreement and keep it?  No.  Both the Russians and Chinese will sign agreements to almost anything but their signatures are usually not worth the paper they appear on.  The UN is a clear example of where they both sign agreements which they violate, often before the ink is dry.  But, if the ASEAN wants to feel good about signing an agreement that means nothing and won't be honored by Russia, have at it. 

The Fleeting Trillion Dollar Valuation

I had never seen a company go to a valuation of a trillion dollars, so I watched the progress of Apple on Fox Business.  It was entertaining as it closed in, then went down, then back up - several times before it hit the magic number.  For an article on how this valuation is computed, see the Wall Street Journal. 

When it hit, I looked up to see how quickly it would go up after that.  It was already down two points off the high, in something like a couple of seconds.  This is the miracle of electronic trading.   I hope these people who trade like that make lots of money, because for a human they seem to have taken all the fun out of it.  Nobody gets to enjoy the moment anymore because trading is so fast, the moment is gone before you realize it was ever there. 

China's Growth Engine is Stealing Tech

In an endless stream of persons caught by law enforcement, another Chinese engineer is caught stealing technology on power turbines at GE.  This one shows some tradecraft involved, i.e. the FBI indicated there were electronic devices that allowed this person to hide what he was stealing and conveying to his friends in China.  The kind of devices allowed the use of steganography, putting the data in the electronic gaps of images, then sending those images to the recipient.  This is the type of stuff spies do. 

What is even more interesting is the FBI also seized a handbook that explains “the type of resources the government of China will give to individuals or entities who can provide certain technologies,” 
So, this guy had a list of things the Chinese were willing to pay for, and how much they would be willing to provide.  That no doubt included the specialized equipment that allowed the engineer to hide what he was doing.  The Chinese are upping their game to steal more technology while the US is still trying to figure out how to stop it. 

The odd part of this was the length of time this person was known to be taking proprietary files from GE.  Security at GE discovered this the first time in 2014, and the second time in 2017.  In the latter incident, he was using encryption not used at GE.  After that, they started close surveillance.

The court allowed bail in this case, to a person with companies in China.  Didn't anyone think he might be a flight risk?