Category Archives: cyberwar

Who Owns Your Voice? Grabbing Biometric Data

Increasingly sophisticated technology that detects nuances in sound inaudible to humans is capturing clues about people’s likely locations, medical conditions and even physical features.Law-enforcement agencies are turning to those clues from the human voice to help sketch the faces of suspects. Banks are using them to catch scammers trying to imitate their customers on the phone, and doctors are using such data to detect the onset of dementia or depression.  That has… raised fresh privacy concerns, as consumers’ biometric data is harnessed in novel ways.

“People have known that voice carries information for centuries,” said Rita Singh, a voice and machine-learning researcher at Carnegie Mellon University who receives funding from the Department of Homeland Security…Ms. Singh measures dozens of voice-quality features—such as raspiness or tremor—that relate to the inside of a person’s vocal tract and how an individual voice is produced. She detects so-called microvolumes of air that help create the sound waves that make up the human voice. The way they resonate in the vocal tract, along with other voice characteristics, provides clues on a person’s skull structure, height, weight and physical surroundings, she said.

Nuance’s voice-biometric and recognition software is designed to detect the gender, age and linguistic background of callers and whether a voice is synthetic or recorded. It helped one bank determine that a single person was responsible for tens of millions of dollars of theft, or 18% of the fraud the firm encountered in a year, said Brett Beranek, general manager of Nuance’s security and biometrics business.

Audio data from customer-service calls is also combined with information on how consumers typically interact with mobile apps and devices, said Howard Edelstein, chairman of behavioral biometric company Biocatch. The company can detect the cadence and pressure of swipes and taps on a smartphone.  How a person holds a smartphone gives clues about their age, for example, allowing a financial firm to compare the age of the normal account user to the age of the caller…

If such data collected by a company were improperly sold or hacked, some fear recovering from identity theft could be even harder because physical features are innate and irreplaceable.

Sarah Krouse, What Your Voice Reveals About You, WSJ, Aug. 13, 2019

Who is Afraid of Shamoon? How to Wipe a Country Off the Face of the Earth

Suspected Iranian hackers infiltrated critical infrastructure and government computers in the Persian Gulf nation of Bahrain in July-August  2019, raising fears among leaders in the region that Tehran is stepping up its cyberattacks amid growing tensions…Hackers broke into the systems of Bahrain’s National Security Agency—the country’s main criminal investigative authority—as well as the Ministry of Interior and the first deputy prime minister’s office, according to one of the people familiar with the matter.

On July 25, 2019 Bahrain authorities identified intrusions into its Electricity and Water Authority. The hackers shut down several systems in what the authorities believed was a test run of Iran’s capability to disrupt the country, the person said. “They had command and control of some of the systems,” the person said.  The breaches appeared broadly similar to two hacks in 2012 that knocked Qatar’s natural-gas firm RasGas offline and wiped data from computer hard drives belonging to Saudi Arabia’s Aramco national oil company, a devastating attack that relied on a powerful virus known as Shamoon.  Bahrain is the smallest country in the Persian Gulf, but it is strategically important because it’s the permanent home of the U.S. Navy’s Fifth Fleet and Navy Central Command. It is closely allied with its much larger neighbor, Saudi Arabia, a regional rival of Iran.

The Bahrain authorities haven’t definitively attributed the attack to Iran, but they have been provided intelligence by the U.S. and others suggesting Iran is behind it, the people familiar with the matter said….“In the first half of 2019, the Information & eGovernment Authority successfully intercepted over 6 million attacks and over 830,000 malicious emails. The attempted attacks did not result in downtime or disruption of government services,” 

Excerpt from High-Level Cyber Intrusions Hit Bahrain Amid Tensions With Iran, WSJ, Aug. 7, 2019

Why a Dumb Internet is Best

Functional splintering [of the internet] is already happening. When tech companies build “walled gardens”, they decide the rules for what happens inside the walls, and users outside the network are excluded…

Governments are playing catch-up but they will eventually reclaim the regulatory power that has slipped from their grasp. Dictatorships such as China retained control from the start; others, including Russia, are following Beijing. With democracies, too, asserting their jurisdiction over the digital economy, a fragmentation of the internet along national lines is more likely. …The prospect of a “splinternet” has not been lost on governments. To avoid it, Japan’s G20 presidency has pushed for a shared approach to internet governance. In January 2019, prime minister Shinzo Abe called for “data free flow with trust”. The 2019 Osaka summit pledged international co-operation to “encourage the interoperability of different frameworks”.

But Europe is most in the crosshairs of those who warn against fragmentation…US tech giants have not appreciated EU authorities challenging their business model through privacy laws or competition rulings. But more objective commentators, too, fear the EU may cut itself off from the global digital economy. The critics fail to recognise that fragmentation can be the best outcome if values and tastes fundamentally differ…

If Europeans collectively do not want micro-targeted advertising, or artificial intelligence-powered behaviour manipulation, or excessive data collection, then the absence on a European internet of services using such techniques is a gain, not a loss. The price could be to miss out on some services available elsewhere… More probably, non-EU providers will eventually find a way to charge EU users in lieu of monetising their data…Some fear EU rules make it hard to collect the big data sets needed for AI training. But the same point applies. EU consumers may not want AI trained to do intrusive things. In any case, Europe is a big enough market to generate stripped, non-personal data needed for dumber but more tolerable AI, though this may require more harmonised within-EU digital governance. Indeed, even if stricter EU rules splinter the global internet, they also create incentives for more investment into EU-tailored digital products. In the absence of global regulatory agreements, that is a good second best for Europe to aim for.

Excerpts from Martin Sandbu,  Europe Should Not be Afraid of Splinternet,  FT, July 2, 2019

If You Control Space, You Control Everything: Space as War Domain

The North Atlantic Treaty Organization (NATO) is looking to classify space as a domain for warfare in an attempt to deter China’s growing military power.  If NATO’s proposal succeeds, the international alliance could move forward with the development and use of space weapons.  According to NATO diplomats, the international organization is preparing to release an agreement that will officially declare space as a war domain. This means that aside from land, air and sea, space could also be used for military operations during times of war.

Although NATO’s partner countries currently own 65% of the satellites in space, China is reportedly preparing to launch a massive project that involves releasing constellations of satellites in low Earth orbit.  China Aerospace Science and Industry Corp (CASIC)  is planning to put in orbit 150 or more Hongyun satellites by 2023. Some of these satellites will provide commercial services like high-speed internet while others would be controlled by the Chinese military. These militarized satellites can be used to coordinate ground forces and to track approaching missiles.

“You can have warfare exclusively in space, but whoever controls space also controls what happens on land, on the sea and in the air,” according to Jamie Shea, a former NATO official. “If you don’t control space, you don’t control the other domains either.”

Excerpts from Inigo Monzon , NATO Prepares For Space Warfare By Militarizing Low Earth Orbit, International Business Times, June 24, 2019

US v. China: The Slow and Sure Conquest of Internet Infrastructure


A new front has opened in the battle between the U.S. and China over control of global networks that deliver the internet. This one is beneath the ocean. While the U.S. wages a high-profile campaign to exclude China’s Huawei Technologies Co. from next-generation mobile networks over fears of espionage, the company is embedding itself into undersea cable networks that ferry nearly all of the world’s internet data.

About 380 active submarine cables—bundles of fiber-optic lines that travel oceans on the seabed—carry about 95% of intercontinental voice and data traffic, making them critical for the economies and national security of most countries. 

The Huawei Marine’s Undersea Cable Network majority owned by Huawei Technologies, has worked on some 90 projects to build or upgrade submarine cables around the world…US o fficials say the company’s knowledge of and access to undersea cables could allow China to attach devices that divert or monitor data traffic—or, in a conflict, to sever links to entire nations.  Such interference could be done remotely, via Huawei network management software and other equipment at coastal landing stations, where submarine cables join land-based networks, these officials say.

Huawei Marine said in an email that no customer, industry player or government has directly raised security concerns about its products and operations.Joe Kelly, a Huawei spokesman, said the company is privately owned and has never been asked by any government to do anything that would jeopardize its customers or business. “If asked to do so,” he said, “we would refuse.”

The U.S. has sought to block Huawei from its own telecom infrastructure, including undersea cables, since at least 2012. American concerns about subsea links have since deepened—and spread to allies—as China moves to erode U.S. dominance of the world’s internet infrastructure…..Undersea cables are owned mainly by telecom operators and, in recent years, by such content providers as Facebook and Google. Smaller players rent bandwidth.Most users can’t control which cable systems carry their data between continents. A handful of switches typically route traffic along the path considered best, based on available capacity and agreements between cable operators.

In June 2017, Nick Warner, then head of Australia’s Secret Intelligence Service, traveled to the Solomon Islands, a strategically located South Pacific archipelago. His mission, according to people familiar with the visit, was to block a 2016 deal with Huawei Marine to build a 2,500-mile cable connecting Sydney to the Solomons.  Mr. Warner told the Solomons’ prime minister the deal would give China a connection to Australia’s internet grid through a Sydney landing point, creating a cyber risk, these people said. Australia later announced it would finance the cable link and steered the contract to an Australian company.  In another recent clash, the U.S., Australia and Japan tried unsuccessfully in September 2018 to quash an undersea-cable deal between Huawei Marine and Papua New Guinea.

U.S. and allied officials point to China’s record of cyber intrusions, growing Communist Party influence inside Chinese firms and a recent Chinese law requiring companies to assist intelligence operations. Landing stations are more exposed in poorer countries where cyber defenses tend to be weakest, U.S. and allied officials said. And network management systems are generally operated using computer servers at risk of cyber intrusion. Undersea cables are vulnerable, officials said, because large segments lie in international waters, where physical tampering can go undetected. At least one U.S. submarine can hack into seabed cables, defense experts said. In 2013, former National Security Agency contractor Edward Snowden alleged that Britain and the U.S. monitored submarine cable data. The U.S. and its allies now fear such tactics could be used against them. American and British military commanders warned recently that Russian submarines were operating near undersea cables. In 2018, the U.S. sanctioned a Russian company for supplying Russian spies with diving equipment to help tap seabed cables.


The Ionian Sea Submarine Cable Project (Greece) 

China seeks to build a Digital Silk Road, including undersea cables, terrestrial and satellite links, as part of its Belt and Road plan to finance a new global infrastructure network. Chinese government strategy papers on the Digital Silk Road cite the importance of undersea cables, as well as Huawei’s role in them. A research institute attached to China’s Ministry of Industry and Information Technology, in a paper published in September, praised Huawei’s technical prowess in undersea cable transmission and said China was poised to become “one of the world’s most important international submarine cable communication centers within a decade or two.” China’s foreign and technology ministries didn’t respond to requests for comment…

Huawei Marine Networks

Bjarni Thorvardarson, then chief executive of the cable’s Ireland-based operator, said U.S. authorities raised no objections until 2012, when a congressional report declared Huawei Technologies a national security threat. Mr. Thorvardarson wasn’t convinced. “It was camouflaged as a security risk, but it was mostly about a preference for using U.S. technology,” he said. Under pressure, Mr. Thorvardarson dropped Huawei Marine from Project Express in 2013. The older cable network continued to use Huawei equipment.

The company is now the fourth-biggest player in an industry long dominated by U.S.-based SubCom and Finnish-owned Alcatel Submarine Networks. Japan’s NEC Corp is in third place.Huawei Marine is expected to complete 28 cables between 2015 and 2020—nearly a quarter of all those built globally—and it has upgraded many more, according to TeleGeography, a research company.

Excerpts from America’s Undersea Battle With China for Control of the Global Internet Grid , WSJ, Mar. 12, 2019

The Space Rat Race

India, Japan and other space-faring countries are waking up to a harsh reality: Earth’s orbit is becoming a more dangerous place as the U.S., China and Russia compete for control of the final frontier…New Delhi is nervous because China has made no secret of its desire for influence in the Indian Ocean. China set up a naval base in Djibouti, a gateway to the ocean at the Horn of Africa. It secured a 99-year lease to the port of Hambantota in Sri Lanka. It is deeply involved in development projects in Maldives.

India has established itself as a player in the budget satellite business. It even put a probe into orbit around Mars in 2014, in a U.S.-assisted project that cost just $76 million. But it is scurrying to enhance its ability to monitor China’s activities, and the partnership with Japan is part of this.  Another sign that space is becoming a defense focus for India came on Dec. 19, when the country launched its third military communications satellite, the GSAT-7A. The satellite will connect with ground-based radar, bases and military aircraft, along with drone control networks.

China’s success in landing a craft on the far side of the moon on Jan. 3, 2019 came as a fresh reminder of its growing prowess. In late December, China also achieved global coverage with its BeiDou Navigation Satellite System. Only the U.S., Russia and the European Union had that capability.China aims to launch a Mars explorer in 2020 and complete its own Earth-orbiting space station around 2022.  In the back of Indian and Japanese officials’ minds is likely a stunning test China conducted in 2007. Beijing successfully destroyed one of its own weather satellites with a weapon, becoming only the third nation to pull off such a feat, after the Soviet Union and the U.S.

In December 2018, President Donald Trump ordered the Department of Defense to create a Space Command, widely seen as a precursor to a full-fledged Space Force.  There were 1,957 active satellites orbiting Earth as of Nov. 30, 2018 according to the Union of Concerned Scientists, a nonprofit U.S. advocacy group. America had the most by far, with 849, or 43% of the total. China was No. 2, with 284, followed by Russia with 152.  Japan and India had a combined 132 — 75 for the former and 57 for the latter.

Excerpts fromNUPUR SHAW India and Japan awaken to risks of superpower space race, Nikkei Asian Review, Jan. 8, 2019

Devil’s Idea for Tokyo’s End: Fukushima

By late March 2011… after tsunami struck the Fukushima Daiichi plant—it was far from obvious that the accident was under control and the worst was over. Chief Cabinet Secretary Yukio Edano feared that radioactive material releases from the Fukushima Daiichi plant and its sister plant (Fukushima Daini) located some 12 km south could threaten the entire population of eastern Japan: “That was the devil’s scenario that was on my mind. Common sense dictated that, if that came to pass, then it was the end of Tokyo.”

Prime Minister Naoto Kan asked Dr. Shunsuke Kondo, then-chairman of the Japanese Atomic Energy Commission, to prepare a report on worst-case scenarios from the accidenta .  Dr. Kondo led a 3-day study involving other Japanese experts and submitted his report (Kondo, 2011) to the prime minister on March 25, 2011. The existence of the report was initially kept secret because of the frightening nature of the scenarios it described. An article in the Japan Times quoted a senior government official as saying, “The content [of the report] was so shocking that we decided to treat it as if it didn’t exist.” …

One of the scenarios involved a self-sustaining zirconium cladding fire in the Unit 4 spent fuel pool. Radioactive material releases from the fire were estimated to cause extensive contamination of a 50- to 70-km region around the Fukushima Daiichi plant with hotspots significant enough to require evacuations up to 110 km from the plant. Voluntary evacuations were envisioned out to 200 km because of elevated dose levels. If release from other spent fuel pools occurred, then contamination could extend as far as Tokyo,…There was particular concern that the zirconium cladding fire could produce enough heat to melt the stored fuel, allowing it to flow to the bottom of the pool, melt through the pool liner and concrete bottom, and flow into the reactor building.

Lessons Learned from the Fukushima Daiichi Accident for Spent Fuel Storage: The U.S. nuclear industry and its regulator should give additional attention to improving the ability of plant operators to measure real-time conditions in spent fuel pools and maintain adequate cooling of stored spent fuel during severe accidents and terrorist attacks. These improvements should include hardened and redundant physical surveillance systems (e.g., cameras), radiation monitors, pool temperature monitors, pool water-level monitors, and means to deliver pool makeup water or sprays even when physical access to the pools is limited by facility damage or high radiation levels….

[At nuclear power plants there must be…adequate separation of plant safety and  security systems so that security systems can continue to function independently if safety systems are damaged. In particular, security systems need to have independent, redundant, and protected power sources…]

Excerpts from Lessons Learned from the Fukushima Accident for Improving
Safety and Security of U.S. Nuclear Plants: Phase 2, US National Academies, 2016