Putin Poking on Thin Ice

We have today the interesting story of FIFA leaders being indicted by the U.S. Justice Department for (again) taking bribes that influenced their selection of sites for the World Cup.  [See among many, Paul Sonne, Vladimir Putin Says U.S. Is Overstepping With FIFA Probe, The Wall Street Journal, 29 May 2015. ]  What makes this story more interesting than some of the others that focus on the football aspect, "corruption of the game", this one focuses on one of the beneficiaries, Russia, and its defense of the poor FIFA President, Seth Blatter.  He hasn't been accused of doing anything, but is up for reelection this next week.

The Russian President blames the U.S. for everything so this is no different, saying they have no right to prosecute people who aren't U.S. citizens and committed no crimes in the U.S.  This is also a favorite tactic of Columbian and Mexican drug cartel leaders, who forget that their transactions go through U.S. banks.  On occasion, bribes do too.

Then Putin added something odd.  He said this was not much different than the treatment of Edward Snowden (deprived of a place to go by pressure from the U.S. on its allies who might take him in) and Julian Assange (persecuted for snitching on the U.S. Army).  This is a bizarre comparison with bribery for locating a sporting event.

Then Sonnes' story went on to say this, "Russian Sports Minister Vitaly Mutko has defended the transparency of Russia’s bid. 'Russia is an open and democratic country,' Mr. Mutko told Russian journalists on Wednesday in Zurich, according to Russian state news agency TASS. 'Our bid campaign was conducted honestly. Russia isn’t involved in corruption, everything with us is honest. There are no problems.' "  That little bit reminded me of something.

Before this case first opened, I recorded some concerns that Russia had hacked the bids for these kinds of events to get a leg up on the competition.  The FBI said it was investigating allegations.  At the time, I thought they might have done it here too, but nobody in Russia has been charged with anything - bribery or hacking - yet.

Fraud and Incident Response

Years ago, I used to manage an intrusion detection program and saw how some government agencies treat intrusion attempts.  The typical response to notificaiton that we had gotten an attack from someone's server was "Did they get anything?"  The indicator was often that if they didn't, it wasn't anything to be worried about.  Now we know that all of those attempts are followed by success because hackers learn from their experiences and get better.  They may not have been trying to "get anything" that a single individual can relate to.  Sometimes they were just mapping the networks and checking for vulnerabilities.  They will be back later.  

But this week I have seen a new variation of the same thing, only this time it is with healthcare information. I got a call from a guy who gave me his name and telephone number and wanted my enrollment information for a visit I had done to a local hospital.  I told him I had given that information when I checked in and was not going to give it to him.  He gave me the "transaction number" for my visit and said, "This is the visit number for that treatment and we need to verify the enrollment information.  You can call this number to verify it."  I went back to my bill which was already paid by this time and the number on it was nothing like the one he had given.  The bill had already been paid.  So, I called the fraud number at Blue Cross, but it turns out Blue Cross has had so many cases because of Anthem, they hired a company to help them.  Their first question was "Did you tell him anything?"  

I said no, and they said, "That's good."  

Wouldn't you like to know the name and number he gave me?  The same question for a question, "Did you give him anything?"  

This circle was getting tighter but nobody was interested in what might be going on in the bigger scheme of things, only that I had not given him anything he might use.  He already had my phone number and knew I had been to the hospital.  So I asked, "Aren't you concerned that he got that information from somewhere inside your own organization?"  Silence.  "We don't have any evidence of that."  I hung up and called Blue Cross directly and got the same reaction from them, though they did seem to be more interested in the broader application of what was only one person who didn't given any information to the person.  They didn't ask for the phone number, name or the transaction number.  They were also happy that I hadn't given him any information.  They were willing to sign me up for credit monitoring for two years, free.  That was nice.  I'm sure some people must think that is worthwhile, but it didn't make me more comfortable about how these massive thefts are being attended to at our health providers.  Somebody else must be looking into that.  

Chinese Professors at U.S. Universities

We have the usual suspects again, this time stealing from a company in Colorado, Avago Technologies.  However, this one is a little different.  The two Chinese charged by the Justice Department show what is wrong with a system to allows the Chinese to come to the U.S. and work on sensitive technologies inside U.S. Universities, and then work for businesses who use that technology. How we can have a Chinese PhD working on technologies for DARPA is another question I would ask of the Industrial Security people in DSS.  In my early days, I spent a lot of time finding out which Universities were hiring and using foreign nationals to work on sensitive contracts that did not allow foreign nationals to work on them.  In the 1970s there were several people who should not have been, that were.  That is an industrial security matter, both in how these are contracted and how the people selected to work on those contracts are vetted.  They failed on both counts on this one.  Here are the rest of the details from the Justice press release today:

According to the indictment, PRC nationals Wei Pang and Hao Zhang met at a U.S. university in Southern California during their doctoral studies in electrical engineering.  While there, Pang and Zhang conducted research and development on thin-film bulk acoustic resonator (FBAR) technology under funding from U.S. Defense Advanced Research Projects Agency (DARPA).  After earning their doctorate in approximately 2005, Pang accepted employment as an FBAR engineer with Avago Technologies (Avago) in Colorado and Zhang accepted employment as an FBAR engineer with Skyworks Solutions Inc. (Skyworks) in Massachusetts.  The stolen trade secrets alleged in the indictment belong to Avago or Skyworks.

Avago is a designer, developer and global supplier of FBAR technology, which is a specific type of radio frequency (RF) filter.  Throughout Zhang’s employment, Skyworks was also a designer and developer of FBAR technology.  FBAR technology is primarily used in mobile devices like cellular telephones, tablets and GPS devices.  FBAR technology filters incoming and outgoing wireless signals so that a user only receives and transmits the specific communications intended by the user.  Apart from consumer applications, FBAR technology has numerous applications for a variety of military and defense communications technologies.

According to the indictment, in 2006 and 2007, Pang, Zhang and other co-conspirators prepared a business plan and began soliciting PRC universities and others, seeking opportunities to start manufacturing FBAR technology in China.  Through efforts outlined in the superseding indictment, Pang, Zhang and others established relationships with officials from Tianjin University.  Tianjin University is a leading PRC Ministry of Education University located in the PRC and one of the oldest universities in China.

As set forth in the indictment, in 2008, officials from Tianjin University flew to San Jose, California, to meet with Pang, Zhang and other co-conspirators.  Shortly thereafter, Tianjin University agreed to support Pang, Zhang and others in establishing an FBAR fabrication facility in the PRC.  Pang and Zhang continued to work for Avago and Skyworks in close coordination with Tianjin University.  In mid-2009, both Pang and Zhang simultaneously resigned from the U.S. companies and accepted positions as full professors at Tianjin University.  Tianjin University later formed a joint venture with Pang, Zhang and others under the company name ROFS Microsystem intending to mass produce FBARs.

The indictment alleges that Pang, Zhang and other co-conspirators stole recipes, source code, specifications, presentations, design layouts and other documents marked as confidential and proprietary from the victim companies and shared the information with one another and with individuals working for Tianjin University.

This is one our own government shouild be looking at.  We train the Chinese, employ them, work with them so they can steal that technology and manufacture it in China.  Our own policies need to be looked at again.  We don't have industrial security anymore if we have this kind of thing going on.