Mreža

Massive ransomware cyber-attack hits 74 countries around the world
More than 45,000 attacks recorded in countries including the UK, Russia, India and China may have originated with theft of ‘cyber weapons’ from the NSA

The attack hit England’s National Health Service (NHS) on Friday, locking staff out of their computers and forcing some hospitals to divert patients.

Julia Carrie Wong and Olivia Solon in San Francisco
Friday 12 May 2017 20.57 BST Last modified on Friday 12 May 2017 23.16 BST



A ransomware cyber-attack that may have originated from the theft of “cyber weapons” linked to the US government has hobbled hospitals in England and spread to countries across the world.

Security researchers with Kasperksy Lab have recorded more than 45,000 attacks in 74 countries, including the UK, Russia, Ukraine, India, China, Italy, and Egypt. In Spain, major companies including telecommunications firm Telefonica were infected.

By Friday evening, the ransomware had spread to the United States and South America, though Europe and Russia remained the hardest hit, according to security researchers Malware Hunter Team. The Russian interior ministry says about 1,000 computers have been affected.

Markus Jakobsson, chief scientist with security firm Agari, said that the attack was “scattershot” rather than targeted.

“It’s a very broad spread,” Jakobsson said, noting that the ransom demand is “relatively small”.

“This is not an attack that was meant for large institutions. It was meant for anyone who got it.”

MalwareHunterTeam @malwrhunterteam
Fresh IDR based heatmap for WanaCrypt0r 2.0 ransomware (WCry/WannaCry).
Also follow @MalwareTechBlog's tracker: https://intel.malwaretech.com/botnet/wcrypt
8:07 PM - 12 May 2017
 296 296 Retweets   157 157 likes

The malware was made available online on 14 April through a dump by a group called Shadow Brokers, which claimed last year to have stolen a cache of “cyber weapons” from the National Security Agency (NSA). At the time, there was skepticism about whether the group was exaggerating the scale of its hack.

On Twitter, whistleblower Edward Snowden blamed the NSA.

“If @NSAGov had privately disclosed the flaw used to attack hospitals when they *found* it, not when they lost it, this may not have happened,” he said.

“It’s very easy for someone to say that, but the reality is the US government isn’t the only one that has a stockpile of exploits they are leveraging to protect the nation,” said Jay Kaplan, CEO of Synack, who formerly worked at the NSA.

“It’s this constant tug of war. Do you let intelligence agencies continue to take advantage of vulnerabilities to fight terrorists or do you give it to the vendors and fix them?”

The NSA is among many government agencies around the world to collect cyber weapons and vulnerabilities in popular operating systems and software so they can use them to carry out intelligence gathering or engage in cyberwarfare. The agency did not immediately respond to a request for comment.

Ransomware is a type of malware that encrypts a user’s data, then demands payment in exchange for unlocking the data. This attack was caused by a bug called “WanaCrypt0r 2.0” or WannaCry, that exploits a vulnerability in Windows. Microsoft released a patch (a software update that fixes the problem) for the flaw in March, but computers that have not installed the security update remain vulnerable.

“This was eminently predictable in lots of ways,” said Ryan Kalember from cybersecurity firm Proofpoint. “As soon as the Shadow Brokers dump came out everyone [in the security industry] realized that a lot of people wouldn’t be able to install a patch, especially if they used an operating system like Windows XP [which many NHS computers still use], for which there is no patch.”

The ransomware demands users pay $300 worth of cryptocurrency Bitcoin to retrieve their files, though it warns that the “payment will be raised” after a certain amount of time. Translations of the ransom message in 28 languages are included. The malware spreads through email.

“Attacks with language support show a progressive increase of the threat level,” Jakobsson said.

The attack hit England’s National Health Service (NHS) on Friday, locking staff out of their computers and forcing some hospitals to divert patients.

“The attack against the NHS demonstrates that cyber-attacks can quite literally have life and death consequences,” said Mike Viscuso, chief techology officer of security firm Carbon Black. “When patients’ lives are at stake, there is no time for finger pointing but this attack serves as an additional clarion call that healthcare organizations must make cybersecurity a priority, lest they encounter a scenario where lives are risked.”

Ransomware attacks are on the rise. Security company SonicWall, which studies cyberthreats, saw ransomware attacks rise 167 times in 2016 compared to 2015.

“Ransomware attacks everyone, but industry verticals that rely on legacy systems are especially vulnerable,” said Dmitriy Ayrapetov, executive director at SonicWall.

A Los Angeles hospital paid $17,000 in bitcoin to ransomware hackers last year, after a cyber-attack locked doctors and nurses out of their computer system for days.

Jakub Kroustek @JakubKroustek
36,000 detections of #WannaCry (aka #WanaCypt0r aka #WCry) #ransomware so far. Russia, Ukraine, and Taiwan leading. This is huge.
4:56 PM - 12 May 2017
 1,324 1,324 Retweets   473 473 likes

Jakobsson said that the concentration of the attack in Russia suggested that the attack originated in Russia. Since the malware spreads by email, the level of penetration in Russia could be a sign that the criminals had access to a large database of Russian email addresses.

However, Jakobsson warned that the origin of the attack remains unconfirmed.

https://www.theguardian.com/technology/2017/may/12/global-cyber-attack-ransomware-nsa-uk-nhs

Malware, described in leaked NSA documents, cripples computers worldwide


A cyberattack hit at least 16 hospitals or doctors’ offices across England, May 12, the same day Spanish officials said a ransomware attack hit several companies in their country. (Sarah Parnass/The Washington Post)

By Craig Timberg, Griff Witte, Ellen Nakashima and Todd C. Frankel May 12 at 5:04 PM 



Malicious software that blocks access to computers is spreading swiftly across the world, snarling critical systems in hospitals, telecommunications and corporate offices with the help of a software vulnerability originally discovered by the National Security Agency.

The reports of the malware spread began in Britain, where the National Health Service (NHS) described serious problems throughout Friday. But government officials and cybersecurity experts later described a far more extensive problem growing across the Internet, with tens of thousands of computers in dozens of nations affected. Europe, Asia and Latin America were especially hard hit.

“This is not targeted at the NHS,” British Prime Minister Theresa May told reporters. “It’s an international attack, and a number of countries and organizations have been affected.”

In Moscow, the Russian Interior Ministry reported Friday that it, too, was under attack. The ministry, which administers the country’s police, told the Interfax news agency that about 1,000 of its computers were blocked.

Cybersecurity experts said the malicious software works by exploiting a flaw in Microsoft software that was described in NSA documents stolen from the agency and leaked publicly in April by a criminal group called Shadow Brokers.

Microsoft released a “critical” patch fixing the flaw in March, before the NSA documents were publicly released, but the patch was apparently applied inconsistently, with many computers continuing to be unprotected. The malicious software — called “ransomware” because it encrypts systems and threatens to destroy data if a ransom is not paid — is spreading among computers that have not been patched, experts said.

The NSA did not respond to requests for comment.

So-called “phishing” attacks are delivering the malicious software by tricking email recipients to open misleading links that take over computers. Such attacks have become increasingly common in recent years because they are simple to execute and lucrative for attackers.

But the speed and scale of the spread of the malicious software startled experts.

“It’s one of the first times we’ve seen a large international global campaign,” said Chris Camacho, chief strategy officer for Flashpoint, a cyber-intelligence company.

This ransomware program has hit companies including FedEx and the Spanish telecommunications giant Telefonica.

“Like many other companies, FedEx is experiencing interference with some of our Windows-based systems caused by malware. We are implementing remediation steps as quickly as possible. We regret any inconvenience to our customers,” FedEx said in a statement Friday.

A representative of the Russian Interior Ministry said that although computers were blocked, the attack has been “contained.” An unidentified source cited by Interfax, which is regularly used as a clearinghouse for news from Russian law enforcement agencies, said there was “no leak of information.” That report could not immediately be confirmed.

The Moscow-based Internet security company Kaspersky Lab said Friday evening that its security software has “detected and successfully blocked a large number of ransomware attacks around the world,” in which the data is encrypted using the extension .WCRY in the file names.

The company said it detected “more than 45,000 attacks of the WannaCry ransomware in 74 countries around the world, mostly in Russia.” Kaspersky noted that the actual number of attacks may be far higher. WannaCry is shorthand for the ransomware’s name.

The ransomware, once opened by a single user on a computer network, is able to spread to many other machines on that network, vastly expanding the reach of the attack.

The program is called Wanna Decrypt0r 2.0 and appears to support 28 different languages, underscoring the global ambitions of its creators

The ransomware locks computers and then launches a ransom note in a text file, according to researchers at the Avast security software company in the Czech Republic. The note says that “you need to pay service fees for the decryption” and asks for $300 worth of bitcoin to be sent electronically to an address.

It was not clear who would receive the funds, nor the group or individual behind the attack.

A sum of $300 is a fairly low ransom when compared to some previous attacks, such as last June at the University of Calgary, which agreed to pay nearly $16,000 in bitcoin currency to an unknown group of hackers.

The WannaCry ransom note also says, dryly: “Don’t worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users.”

In a statement Friday, Microsoft said: “Today our engineers added detection and protection against new malicious software known as Ransom:Win32.WannaCrypt. In March, we provided a security update which provides additional protections against this potential attack. Those who are running our free antivirus software and have Windows Update enabled, are protected. We are working with customers to provide additional assistance.”

A group cryptically calling itself Shadow Brokers began in August to release virtually NSA’s entire library of powerful hacking tools. The releases continued throughout the fall and into the spring.

The U.S. government reportedly has still not developed full confidence on the identity of the hackers. Suspicion has fallen on the Russian government, but in October the FBI arrested a Maryland man who worked for Booz Allen Hamilton and had previously worked at the NSA’s Tailored Access Operations, a unit that carries out hacking operations around the world to obtain foreign intelligence on spies, terrorists and other targets.

The firm’s former employee, Harold T. Martin III, has been charged with theft of government property and violating the Espionage Act by retaining classified material. He pleaded not guilty in February and awaits trial.

Though the software vulnerability used by the ransomware attack relies on a computer flaw discovered by the NSA, some experts said responsibility for the wide spread of Friday’s problems lies with the failure of many institutions to keep their computers updated.

Peter Eckersley, technology projects director for the Electronic Frontier Foundation, a San Francisco-based civil liberties group that has sharply criticized the NSA for its aggressive surveillance, said, “In this case, it’s a little unfair to blame the NSA. They could have been following the best possible defensive practices, and this probably would have gone down the same way.”

The ACLU, another frequent NSA critic, however, said in a statement, “These attacks underscore the fact that vulnerabilities will be exploited not just by our security agencies, but by hackers and criminals around the world.”

In Britain, the BBC broadcast a screen shot of a message apparently sent to National Health Service medical facilities demanding payments for unlocking computer files that had been “encrypted” by the attack. 

Officials made no public comment on the possible source of the hack, which touched off havoc and confusion across the state-run health system. Operations were canceled, emergency room services were scaled down, and medical personnel went back to using handwritten notes.

Health officials offered no indication of when services might return to normal, or whether patient records could be permanently lost to the attack.

“The most exploitable industry in the world is the health-care sector,” said Tom Kellerman, chief executive of Strategic Cyber Ventures. He said the industry is chronically hobbled by regulation and insufficient investment in computer security.

A statement from NHS Digital — the computer services arm of the health service — said at least 16 hospitals or doctor’s offices were directly affected by the attack. Officials later acknowledged the number was rising, though they did not give a precise figure.

Other health-care centers, meanwhile, turned off their computers to avoid potential infiltration. NHS Digital said it did “not have any evidence that patient data has been accessed.”

There also was no immediate evidence to suggest disruptions to medical procedures that use high-tech tools. But the basic business of hospitals was being thrown into turmoil. 

The style of attack that appeared to be on display Friday has become increasingly common in recent years, said Cornell University computer science professor Emin Gun Sirer. . The attackers typically demand payment be made in bitcoins because “there are no take-backs. Once a transfer has been made, it’s final.”

Sirer said ransomware has become a lucrative business for criminal syndicates that can make millions of dollars a day from such attacks. Once a victim has been successfully attacked, their choices are limited. 

“Undoing the hack is going to be just about impossible,” he said. “The only options are to wipe the machines and move on or to pay the ransom.” 

Nigel Inkster, former director of operations and intelligence for MI6, told Sky News that one of the reasons the NHS in particular was vulnerable was its outdated software system. “A lot of hospital trusts in the U.K. — 40-plus last time I checked — are running their systems on Windows XP software, which hasn’t been supported by Microsoft for two or three years,” he said. “In other words, Microsoft is no longer looking for and seeking to repair vulnerabilities in the system.” 
Attacks on health-care systems can also be especially high-stakes, creating potential life-or-death situations and raising the chances that the victim will ultimately pay. 

Across England on Friday, as well as at a handful of facilities in Scotland, internal tech systems were down in hospitals ranging from the center of London to rural parts of the country’s south and north. 

The attack affected emergency services in some locations, and patients were urged to avoid visits to the emergency room unless absolutely necessary.

NHS Digital said it would be working with Britain’s National Cyber Security Center in efforts to resolve the outage. It soon became clear that the assault extended far beyond Britain’s health service. 

“This attack was not specifically targeted at the NHS and is affecting organizations from across a range of sectors,” NHS Digital said in its statement without giving details.

The attack came as Spain’s National Cryptologic Center announced a “massive ransomware attack” against Spanish companies. The statement said the attackers were demanding a ransom payment in bitcoins. 

The attack in Britain had immediate impacts in hospitals across the country. 

Richard Harvey, 50, was just about to undergo surgery Friday afternoon on his leg following a motorcycle accident when a nurse told him that the procedure had been canceled due to a cyberattack. 

“I’m a bit of a nervous person and had to get settled about the operation, which I was. Now I had to go through that again,” said Harvey, a former hospital porter who had been fasting since the previous evening in preparation for the operation at Royal London Hospital in east London. “A cyberattack? That doesn’t happen every day.”
Stephen Hirst, a doctor in the northern English town of Preston, told the BBC that the first sign of the infiltration was an error message warning that “we’d have to pay money to unlock the computer because it’s been encrypted.

“It’s compromising having to open files and complete prescriptions. It’s interfering with day-to-day functioning,” Hirst said.

Doctors were using pen and paper as the National Health Service struggled to get computers back online. Routine appointments were being canceled.

The BBC reported that a list of affected locations included London, Blackburn, Nottingham, Cumbria and Hertfordshire. 

Cybersecurity has been high on the agenda of many high-level gatherings of Western military and political leaders.

A report issued Wednesday by the European Commission called for greater attention to cyberthreats as the world becomes “more vulnerable to cyberattacks, with security breaches causing significant damage.” It said the commission plans a full review of European Union cybersecurity measures by September.


https://www.washingtonpost.com/world/hospitals-across-england-report-it-failure-amid-suspected-major-cyber-attack/2017/05/12/84e3dc5e-3723-11e7-b373-418f6849a004_story.html?hpid=hp_hp-top-table-main_britain-240pm%3Ahomepage%2Fstory

http://www.ecfr.eu/article/commentary_the_macron_leak_that_wasnt_7285


The Macron leak that wasn't

Commentary
Stefan Soesanto 


So stark is the absence of interesting information that one could conclude that the Macronleak was a false flag operation designed to point the finger at Russia.

Now that the French presidential election is over, it is time to reflect on the strange cyber incident that roiled the campaign’s final weekend. 

...


Numerous analysts, aware that the data had been tampered with, warned the press that they should be wary of forged documents within the data.  The same sentiment was echoed in En Marche’s official statement, which asserted that the leak included “numerous false documents intended to sow doubt and disinformation.”
The way the leak was spread is also strange. The Atlantic Council’s Digital Forensic Research Lab tracked the source of #MacronLeaks campaign to the Twitter account of Jack Posobiec, the Washington DC Bureau Chief of an obscure, alt-right website, theRebelMedia. Furthermore, the dump was published on 4Chan, an anonymous internet bulletin board, which is often a source of false information. Wikileaks, an outlet often associated with Russian hacks, acted very cautiously and tweeted that it “could be a 4chan practical joke.”

Gigabytes of Nothingness

The only thing the Macronleak seemed to reveal is what a clean operation the Macron campaign was.  So stark is the absence of interesting information that one could conclude that the Macronleak was a false flag operation designed to point the finger at the Kremlin and, by implication, Marine Le Pen. Trend Micro noted that, despite certain similarities with previous attacks, they could not attribute this attack to APT 28 or any other group. 
The false flag theory is just that - a theory. What is clear is that the Macronleak is not the “massive and coordinated” hacking operation that En Marche portrays. Overall, it is amateurish, chaotic, disorganized, and has little substance to it. If it was the Russians, their tradecraft has suffered considerably of late. If it was some other, non-state actor, the purpose remains unclear.  Overall, it seems to have had little effect on the French election, but it will contribute to the overall view that hacking and leaks are a clear and present threat to all democracies.

http://time.com/4783932/inside-russia-social-media-war-america/?xid=tcoshare

Inside Russia’s Social Media War on America
Massimo Calabresi
Updated: May 18, 2017 3:48 PM ET

On March 2, a disturbing report hit the desks of U.S. counterintelligence officials in Washington. For months, American spy hunters had scrambled to uncover details of Russia's influence operation against the 2016 presidential election. In offices in both D.C. and suburban Virginia, they had created massive wall charts to track the different players in Russia's multipronged scheme. But the report in early March was something new.

It described how Russia had already moved on from the rudimentary email hacks against politicians it had used in 2016. Now the Russians were running a more sophisticated hack on Twitter. The report said the Russians had sent expertly tailored messages carrying malware to more than 10,000 Twitter users in the Defense Department. Depending on the interests of the targets, the messages offered links to stories on recent sporting events or the Oscars, which had taken place the previous weekend. When clicked, the links took users to a Russian-controlled server that downloaded a program allowing Moscow's hackers to take control of the victim's phone or computer--and Twitter account.

As they scrambled to contain the damage from the hack and regain control of any compromised devices, the spy hunters realized they faced a new kind of threat. In 2016, Russia had used thousands of covert human agents and robot computer programs to spread disinformation referencing the stolen campaign emails of Hillary Clinton, amplifying their effect. Now counterintelligence officials wondered: What chaos could Moscow unleash with thousands of Twitter handles that spoke in real time with the authority of the armed forces of the United States? At any given moment, perhaps during a natural disaster or a terrorist attack, Pentagon Twitter accounts might send out false information. As each tweet corroborated another, and covert Russian agents amplified the messages even further afield, the result could be panic and confusion.

...

As they tweet and like and upvote their way through social media, Americans generate a vast trove of data on what they think and how they respond to ideas and arguments--literally thousands of expressions of belief every second on Twitter, Facebook, Reddit and Google. All of those digitized convictions are collected and stored, and much of that data is available commercially to anyone with sufficient computing power to take advantage of it.

That's where the algorithms come in. American researchers have found they can use mathematical formulas to segment huge populations into thousands of subgroups according to defining characteristics like religion and political beliefs or taste in TV shows and music. Other algorithms can determine those groups' hot-button issues and identify "followers" among them, pinpointing those most susceptible to suggestion. Propagandists can then manually craft messages to influence them, deploying covert provocateurs, either humans or automated computer programs known as bots, in hopes of altering their behavior.

That is what Moscow is doing, more than a dozen senior intelligence officials and others investigating Russia's influence operations tell TIME. The Russians "target you and see what you like, what you click on, and see if you're sympathetic or not sympathetic," says a senior intelligence official. Whether and how much they have actually been able to change Americans' behavior is hard to say. But as they have investigated the Russian 2016 operation, intelligence and other officials have found that Moscow has developed sophisticated tactics.

In one case last year, senior intelligence officials tell TIME, a Russian soldier based in Ukraine successfully infiltrated a U.S. social media group by pretending to be a 42-year-old American housewife and weighing in on political debates with specially tailored messages. In another case, officials say, Russia created a fake Facebook account to spread stories on political issues like refugee resettlement to targeted reporters they believed were susceptible to influence.

...

a more sophisticated hack on Twitter

a Russian soldier based in Ukraine successfully infiltrated a U.S. social media group by pretending to be a 42-year-old American housewife

Republican Data-Mining Firm Exposed Personal Information for Virtually Every American Voter


The GOP’s 2016 presidential upset wasn’t surprising just because it put Donald Trump in the White House; it also proved the party had vastly improved its ability to exploit data, including precision ad targeting campaigns on Facebook. Now comes the fallout of all that information hoarding: A California-based security researcher says Republican-linked election databases were inadvertently exposed to the entire internet, sans password, potentially violating the privacy of almost every single registered voter in the United States.

...

The leak was discovered by Chris Vickery, an analyst at the U.S. cybersecurity firm UpGuard, who last year discovered an enormous breach of Mexican voter data and in 2015 a 300GB leak of records of 191 million voters. This new incident is more extensive, according the analysis, written by UpGuard:

   * UpGuard’s Cyber Risk Team can now confirm that unsecured databases containing the sensitive personal details of over 198 million American voters was left exposed to the internet. The data, which was stored in a publicly accessible cloud server owned by Republican data firm Deep Root Analytics, included 1.1 terabytes of entirely unsecured personal information compiled by DRA and at least two other contractors, TargetPoint Consulting, Inc. and Data Trust. In total, the personal information of nearly all of America’s 200 million registered voters was exposed, including their names, dates of birth, home addresses, phone numbers, and voter registration details, as well as voter ethnicities and religions as “modeled” by the firms’ data scientists.


(DRA, TargetPoint, and Data Trust were not immediately available for comment.)

Two of the firms linked to the database, Deep Root Analytics and Target Point, were among three firms hired by the RNC to do most of its data modeling and voter scoring in 2016, according to a December Ad Age story, with a mandate to shore up unconvinced Trump-leaning voters, sway weak Hillary Clinton supporters, and capture undecided voters.

What UpGuard appears to have discovered, sitting on an Amazon cloud storage drive with no password or username required for access by anyone on the internet, was terabytes of the data used to map the voter proclivities and demographics key to finding voters in those buckets. Beyond personal information like religion, age, and probable ethnicity, certain database files among those made public include individual scores for nearly 50 different beliefs, according to UpGuard’s analysis:

    Each of fields under each of the forty-eight columns signifies the potential voter’s modeled likelihood of supporting the policy, political candidate, or belief listed at the top of the column, with zero indicating very unlikely, and one indicating very likely.




    Calculated for 198 million potential voters, this adds up to a spreadsheet of 9.5 billion modeled probabilities, for questions ranging from how likely it is the individual voted for Obama in 2012, whether the agree with the Trump foreign policy of “America First,” and how likely they are to be concerned with auto manufacturing as an issue, among others.
...

https://theintercept.com/2017/06/19/republican-data-mining-firm-exposed-personal-information-for-virtually-every-american-voter/

Germany vs. Twitter
[Jochen Bittner]

Jochen Bittner JUNE 21, 2017


Hamburg, Germany — Heiko Maas may be about to learn where the road being paved with his good intentions will lead. A Social Democrat and the current federal justice minister, he has announced ambitious plans to rid the internet of abusive and offensive language. His plans have incited concern in the German offices of Twitter and Facebook and may ensure that he goes into history books as the politician who brought the curtain down on free speech on social media in Germany.

Mr. Maas’s plans, which center on legislation allowing legal actions against online insults, libel and sedition, take aim at several real problems, including a sharp increase in hate crimes against more than one million new migrants and refugees to Germany and the spread of “fake news” that, in his view, helped Donald Trump win the American election. And they come after his own failed attempt to get social media companies operating in Germany to agree to self-regulation. Despite promises by Facebook to crack down on harmful speech, Mr. Maas says Facebook still deletes only 39 percent of punishable content, and Twitter only 1 percent. After years of negotiations the minister, quite understandably, has run out of patience.

Recently he proposed a law obliging social media to erase “obviously illegal” content within 24 hours after a complaint. In less obvious cases, the deadline is one week. If the networks don’t comply, they face fines of up to 50 million euros, or $55 million. The law is expected to be ratified by Parliament before it goes on its summer break. But even as a proposal, its chilling effect on freedom of expression can already be felt; Twitter is now blocking accounts in Germany that have even the slightest whiff of hate speech.

One such account is called @einzelfallinfos — roughly, “individual case reports.” The account’s name mocks the mainstream narrative in Germany that crimes committed by refugees and migrants are “individual cases” — something the account’s operators clearly dispute. Instead, they see a “recurring pattern” of sexual assaults against women perpetrated by young men of mostly Arab origin. So they persistently post official police reports about, as they put it, “crimes committed by refugees, migrants, and presumed migrants.”

As of May 15, the @einzelfallinfos account is no longer accessible in Germany. When I asked Twitter why it was being blocked, and how many other accounts are being blocked in Germany, a press officer said, “We do not comment on individual accounts for privacy and security reasons.” What were these privacy and security reasons, I asked? “Longstanding company policy — nothing further to add.”

Of course, as a private company, Twitter isn’t obliged to give any reasons for blocking users from its platform. In theory, it could do so because it doesn’t like someone’s face. But for a business that thrives on giving a voice to as many people as possible, such arbitrariness and opacity may be self-defeating.

Though narrower than in the United States, freedom of speech in postwar Germany has been broadly interpreted by the courts. In 2009, the Constitutional Court, Germany’s highest legal body, ruled that disseminating radical-right-wing and Nazi views is not per se unconstitutional. On the contrary, the judges ruled that the Constitution “relies on the power of free confrontation as the most effective weapon” against “totalitarian and inhuman ideologies.”

Twitter is less sure. Faced with the threat of being held responsible for offensive and illegal content, the company instead relies on the power of the algorithm. In March, the service announced that it had updated its software to restrict accounts that engage in “abusive behavior.” We don’t know how Twitter reaches these decisions, because it doesn’t disclose the process.

One possibility is that after an account attracts a certain number of complaints, algorithms intervene to silence it. That’s bad news for Twitter, as users are likely to flock to alternative platforms like gab.ai. And it’s bad for the rest of us, because it creates yet another bubble in our already filtered public discourse.

The truth about free speech in Germany is that its limits depend heavily on context, in ways that are far too complex for any algorithm to sort out, let alone to discern “obvious illegality.” An utterance that is punishable as an insult in a normal exchange can be perfectly legitimate if done in a satirical context.

So what is Twitter supposed to do when caught between its users’ interests in a broad debate and an ambitious leftist minister with ideological guidelines that, if in doubt, rule against free speech?

Rather than pull up the drawbridge, or fall back on algorithms, Twitter should hire a corps of well-trained personnel to deal with hundreds of thousands of contested cases. There will always be public courts to turn to as a last resort. But if Twitter wants to maintain its unique position as a leading marketplace for opinions and ideas, it needs to invest in the personnel to keep it there. Only then can it offer the most orderly and open debate possible.


https://www.nytimes.com/2017/06/21/opinion/twitter-germany-free-speech.html

Google Critic Ousted From Think Tank Funded by the Tech Giant
By KENNETH P. VOGEL AUG. 30, 2017


WASHINGTON — In the hours after European antitrust regulators levied a record $2.7 billion fine against Google in late June, an influential Washington think tank learned what can happen when a tech giant that shapes public policy debates with its enormous wealth is criticized.

The New America Foundation has received more than $21 million from Google; its parent company’s executive chairman, Eric Schmidt; and his family’s foundation since the think tank’s founding in 1999. That money helped to establish New America as an elite voice in policy debates on the American left.

But not long after one of New America’s scholars posted a statement on the think tank’s website praising the European Union’s penalty against Google, Mr. Schmidt, who had chaired New America until 2016, communicated his displeasure with the statement to the group’s president, Anne-Marie Slaughter, according to the scholar.

The statement disappeared from New America’s website, only to be reposted without explanation a few hours later. But word of Mr. Schmidt’s displeasure rippled through New America, which employs more than 200 people, including dozens of researchers, writers and scholars, most of whom work in sleek Washington offices where the main conference room is called the “Eric Schmidt Ideas Lab.” The episode left some people concerned that Google intended to discontinue funding, while others worried whether the think tank could truly be independent if it had to worry about offending its donors.

Those worries seemed to be substantiated a couple of days later, when Ms. Slaughter summoned the scholar who wrote the critical statement, Barry Lynn, to her office. He ran a New America initiative called Open Markets that has led a growing chorus of liberal criticism of the market dominance of telecom and tech giants, including Google, which is now part of a larger corporate entity known as Alphabet, for which Mr. Schmidt serves as executive chairman.

Ms. Slaughter told Mr. Lynn that “the time has come for Open Markets and New America to part ways,” according to an email from Ms. Slaughter to Mr. Lynn. The email suggested that the entire Open Markets team — nearly 10 full-time employees and unpaid fellows — would be exiled from New America.

While she asserted in the email, which was reviewed by The New York Times, that the decision was “in no way based on the content of your work,” Ms. Slaughter accused Mr. Lynn of “imperiling the institution as a whole.”

Mr. Lynn, in an interview, charged that Ms. Slaughter caved to pressure from Mr. Schmidt and Google, and, in so doing, set the desires of a donor over the think tank’s intellectual integrity.

“Google is very aggressive in throwing its money around Washington and Brussels, and then pulling the strings,” Mr. Lynn said. “People are so afraid of Google now.”

Google rejected any suggestion that it played a role in New America’s split with Open Markets. Riva Sciuto, a Google spokeswoman, pointed out that the company supports a wide range of think tanks and other nonprofits focused on information access and internet regulation. “We don’t agree with every group 100 percent of the time, and while we sometimes respectfully disagree, we respect each group’s independence, personnel decisions and policy perspectives.”
New America’s executive vice president, Tyra Mariani, said it was “a mutual decision for Barry to spin out his Open Markets program,” and that the move was not in any way influenced by Google or Mr. Schmidt.

“New America financial supporters have no influence or control over the research design, methodology, analysis or findings of New America research projects, nor do they have influence or control over the content of educational programs and communications efforts,” Ms. Mariani said. She added that Mr. Lynn’s statement praising the European Union’s sanctions against Google had been temporarily removed from New America’s website because of “an unintentional internal issue” unrelated to Google or Mr. Schmidt.

Ms. Mariani and Ms. Sciuto said Google is continuing to fund New America.

It is difficult to overstate Mr. Lynn’s influence in raising concerns about the market dominance of Google, as well as of other tech companies such as Amazon and Facebook. His Open Markets initiative organized a 2016 conference at which a range of influential figures — including Senator Elizabeth Warren of Massachusetts — warned of damaging effects from market consolidation in tech.

In the run-up to that conference, Ms. Slaughter and New America’s lead fund-raiser in emails to Mr. Lynn indicated that Google was concerned that its positions were not going to be represented, and that it was not given advanced notice of the event.

“We are in the process of trying to expand our relationship with Google on some absolutely key points,” Ms. Slaughter wrote in an email to Mr. Lynn, urging him to “just THINK about how you are imperiling funding for others.”

Mr. Lynn is now in the process of starting a stand-alone nonprofit with the same team to continue Open Markets’s work. The new group, which does not yet have a name, has funding commitments, though clearly is not expecting any money from Google. It has launched a website called Citizens Against Monopoly that accuses Google of “trying to censor journalists and researchers who fight dangerous monopolies.” The website vows, “We are going to make sure Google doesn’t get away with this.”

After initially eschewing Washington public policy debates, which were seen in Silicon Valley as pay-to-play politics, Google has developed an influence operation that is arguably more muscular and sophisticated than that of any other American company. It spent $9.5 million on lobbying through the first half of this year — more than almost any other company. It helped organize conferences at which key regulators overseeing investigations into the company were presented with pro-Google arguments, sometimes without disclosure of Google’s role.

Among the most effective — if little examined — tools in Google’s public policy toolbox has been its funding of nonprofit groups from across the political spectrum. This year, it has donated to 170 such groups, according to Google’s voluntary disclosures on Google’s website. While Google does not indicate how much cash was donated, the number of beneficiaries has grown exponentially since it started disclosing its donations in 2010, when it gave to 45 groups.

Some tech lobbyists, think tank officials and scholars argue that the efforts help explain why Google has mostly avoided damaging regulatory and enforcement decisions in the United States of the sort levied by the European Union in late June.

But Google’s Washington alliances could be tested in the coming months. Google emerged as a flash point in the latest skirmish of the culture wars this month after one of its male engineers posted a critique of the company’s efforts to diversify. And its data collection continues fueling questions about its commitment to privacy.

Then there are the mounting concerns about the market dominance of Google, which handles an overwhelming majority of all internet searches globally and dominates internet advertising. Its alleged tilting of search results to favor its services over those offered by competitors led to the European Union’s $2.7 billion antitrust penalty in June.

The Open Markets’ statement that drew Mr. Schmidt’s ire praised the fine, and called on United States regulators to more aggressively enforce antitrust rules against Google, Amazon and “other dominant platform monopolists.”

Last month, Democratic congressional leaders rolled out a policy platform that included a pledge to dismantle monopolies, including in cable and internet service, which some read as a direct challenge to Google in particular. That sentiment — which appears to have some support from populist elements of President Trump’s base — diverges sharply from the approach that had been taken by most Democrats until recently.

Google’s willingness to spread cash around the think tanks and advocacy groups focused on internet and telecommunications policy has effectively muted, if not silenced, criticism of the company over the past several years, said Marc Rotenberg, the president of the Electronic Privacy Information Center. His group, which does not accept any corporate funding, has played a leading role in calling out Google and other tech companies for alleged privacy violations. But Mr. Rotenberg said it is become increasingly difficult to find partners in that effort as more groups have accepted Google funding.

“There are simply fewer groups that are available to speak up about Google’s activities that threaten online privacy,” Mr. Rotenberg said. “The groups that should be speaking up aren’t.”

Russians Have Hacked Dozens Of US Energy Companies, Researchers Say

A hacking group has grown bolder and gained access to operational controls of US electric companies, according to Symantec researchers.

Posted on September 6, 2017, at 12:01 p.m.



A hacker group linked to the Russian government has acquired an unprecedented level of access to companies that supply power to the US power grid, a cybersecurity firm says.

Symantec, a California-based firm that provides cybersecurity services and worldwide research against online threats, says the group, which it’s nicknamed Dragonfly 2.0, may have compromised more than a dozen American companies in recent months.

Dragonfly – also called Crouching Yeti, or Energetic Bear, depending on which researcher you talk to – was an established hacker group that attacked energy sector targets around the world from at least 2011 until 2014, when it went quiet after its tactics were exposed by public research. Researchers at Symantec have declined to specifically cite Russia as the culprit, though they do say it’s a state-sponsored attack. Researchers at other firms, like CrowdStrike and FireEye, have tied Dragonfly to the Russian government.

“This is the first time we’ve seen this scale, this aggressiveness, and this level of penetration in the US, for sure,” Eric Chien, technical director of Symantec’s Security Technology & Response Division, told BuzzFeed News.

“What we’re seeing is them getting into dozens, as far as we know, likely more, of organizations who are basically energy companies. We’re talking about organizations who are supplying power to the power grid,” Chien said.

It’s not uncommon for nation-state hackers to penetrate administrative and business networks of energy companies in the US or elsewhere. But Dragonfly has gained access to multiple operational networks in the US, Symantec says, an unprecedented level of compromise. Previously, such penetrations are known to have happened only in places like Ukraine, where hackers once remotely turned off circuit breakers, leaving nearly a quarter million people without power; Russians are also suspected in that incident, though there’s no evidence the same attackers are behind Dragonfly.

Attributing attacks to Dragonfly hackers has become harder, Chien said, because the group has taken to using publicly available hacker tools, like phishery or Shellter, to do much of their work. Symantec, however, has a high level of confidence that this latest Dragonfly campaign has accessed “dozens” of energy companies in the US, Switzerland, and Turkey.

Particularly worrying, Chien said, is that Dragonfly’s attacks have largely been aimed at gaining high level credentials for operational systems. “Even after you go in and remove all this malware off your networks,” he said, if a company hasn’t changed their login credentials, “they log into the system, then simply remotely control the system.”

Often such systems run Windows and use software called human machine interfaces, which give a clear picture of the equipment a given computer controls. “You literally can either switch things off or potentially cause something like a power surge into the power grid,” Chien said.

The Department of Homeland Security said it was aware of the intrusions.

“DHS is aware of the report and is reviewing it. At this time there is no indication of a threat to public safety,” DHS spokesperson Scott McConnell told BuzzFeed News.

“As always, DHS supports critical infrastructure asset owners and operators who request assistance with intrusions or potential intrusions to their networks.”

The question arises, then: What will happen to the online information environment in the coming decade? In summer 2017, Pew Research Center and Elon University’s Imagining the Internet Center conducted a large canvassing of technologists, scholars, practitioners, strategic thinkers and others, asking them to react to this framing of the issue:

The rise of “fake news” and the proliferation of doctored narratives that are spread by humans and bots online are challenging publishers and platforms. Those trying to stop the spread of false information are working to design technical and human systems that can weed it out and minimize the ways in which bots and other schemes spread lies and misinformation.

The question: In the next 10 years, will trusted methods emerge to block false narratives and allow the most accurate information to prevail in the overall information ecosystem? Or will the quality and veracity of information online deteriorate due to the spread of unreliable, sometimes even dangerous, socially destabilizing ideas?

Respondents were then asked to choose one of the following answer options:

The information environment will improve – In the next 10 years, on balance, the information environment will be IMPROVED by changes that reduce the spread of lies and other misinformation online.

The information environment will NOT improve – In the next 10 years, on balance, the information environment will NOT BE improved by changes designed to reduce the spread of lies and other misinformation online.

Some 1,116 responded to this nonscientific canvassing: 51% chose the option that the information environment will not improve, and 49% said the information environment will improve. (See “About this canvassing of experts” for details about this sample.) Participants were next asked to explain their answers. This report concentrates on these follow-up responses.

Their reasoning revealed a wide range of opinions about the nature of these threats and the most likely solutions required to resolve them. But the overarching and competing themes were clear: Those who do not think things will improve felt that humans mostly shape technology advances to their own, not-fully-noble purposes and that bad actors with bad motives will thwart the best efforts of technology innovators to remedy today’s problems.

And those who are most hopeful believed that technological fixes can be implemented to bring out the better angels guiding human nature.

More specifically, the 51% of these experts who expect things will not improve generally cited two reasons:

The fake news ecosystem preys on some of our deepest human instincts:Respondents said humans’ primal quest for success and power – their “survival” instinct – will continue to degrade the online information environment in the next decade. They predicted that manipulative actors will use new digital tools to take advantage of humans’ inbred preference for comfort and convenience and their craving for the answers they find in reinforcing echo chambers.

Our brains are not wired to contend with the pace of technological change: These respondents said the rising speed, reach and efficiencies of the internet and emerging online applications will magnify these human tendencies and that technology-based solutions will not be able to overcome them. They predicted a future information landscape in which fake information crowds out reliable information. Some even foresaw a world in which widespread information scams and mass manipulation cause broad swathes of public to simply give up on being informed participants in civic life.

The 49% of these experts who expect things to improve generally inverted that reasoning:

Technology can help fix these problems: These more hopeful experts said the rising speed, reach and efficiencies of the internet, apps and platforms can be harnessed to rein in fake news and misinformation campaigns. Some predicted better methods will arise to create and promote trusted, fact-based news sources.

It is also human nature to come together and fix problems: The hopeful experts in this canvassing took the view that people have always adapted to change and that this current wave of challenges will also be overcome. They noted that misinformation and bad actors have always existed but have eventually been marginalized by smart people and processes. They expect well-meaning actors will work together to find ways to enhance the information environment. They also believe better information literacy among citizens will enable people to judge the veracity of material content and eventually raise the tone of discourse.

The majority of participants in this canvassing wrote detailed elaborations on their views. Some chose to have their names connected to their answers; others opted to respond anonymously. These findings do not represent all possible points of view, but they do reveal a wide range of striking observations.

Respondents collectively articulated several major themes tied to those insights and explained in the sections below the following graphic. Several longer additional sets of responses tied to these themes follow that summary.

The following section presents an overview of the themes found among the written responses, including a small selection of representative quotes supporting each point. Some comments are lightly edited for style or length.