Tag Archives: surveillance industry

Fear of the Enemy Within: Unrestricted Surveillance

Leave a reply

The Supreme Court declined to hear a constitutional challenge to a secretive government surveillance program, dealing a setback to privacy groups including the American Civil Liberties Union ahead of a looming debate in Congress over whether to renew the law that authorizes the intelligence tool.

In a brief order issued on February 2023, the high court said it wouldn’t hear arguments challenging the legality of the National Security Agency program known as “Upstream,” in which the intelligence agency collects and monitors internet communications without obtaining search warrants. Classified details about the program were among those exposed a decade ago by former intelligence contractor Edward Snowden, who has been charged with theft of government property and violating espionage laws and lives in Russia.

The legal challenge was brought by Wikimedia, the nonprofit owner of the Wikipedia online encyclopedia. Wikimedia was represented by lawyers at the ACLU, Cooley LLP and the Knight First Amendment Institute at Columbia University. Wikimedia’s lawyers urged the high court to rein in the “state secrets privilege,” a legal doctrine that allows the government to shut down lawsuits that could jeopardize sensitive national-security information. 

“The Supreme Court’s refusal to grant our petition strikes a blow against an individual’s right to privacy and freedom of expression—two cornerstones of our society and the building blocks of Wikipedia,” said James Buatti, Wikimedia’s legal director, in a statement.

Excerpts from  Jan Wolfe  and Dustin Volz, Justices Won’t Hear Challenged to NSA Surveillance, Feb. 22, 2023

The Chinese Balloon and the American Psyche

Leave a reply

The U.S. blacklisted six Chinese companies on February 10, 2023  that it said were involved in Beijing’s surveillance-balloon program, in a move taken in retaliation for the suspected spy balloon that traversed the U.S. The companies blacklisted are Beijing Nanjiang Aerospace Technology; China Electronics Technology Group Corporation 48th Research Institute; Dongguan Lingkong Remote Sensing Technology; Eagles Men Aviation Science & Technology Group; Guangzhou Tian-Hai-Xiang Aviation Technology; and Shanxi Eagles Men Aviation Science & Technology Group.

The Commerce Department’s Bureau of Industry and Security said the Chinese entities were added over their support for the People’s Liberation Army’s aerospace programs, including airships and balloons and related materials and components.  “The PLA is utilizing High Altitude Balloons (HAB) for intelligence and reconnaissance activities,” it said….  While many national-security analysts have been sounding the alarm about China’s surveillance practices in recent years, the balloon offered the American public a visible picture of the Chinese threat as it crossed much of the nation.

The newly formed House Select Committee on the Strategic Competition Between the U.S. and the Chinese Communist Party is likely to press for tougher U.S. measures to slow China’s advance, said Emily Benson, a senior fellow at the Center for Strategic and International Studies. “This is a really concrete example of an issue that Washington has so far not succeeded in penetrating the American public’s mind,” Ms. Benson said. “This could be kind of a pivotal moment for the American psyche to really start to realize that China is important and that this is a policy area they should be tuning in to.”

Excerpts from Ian Talley and Vivian Salama, U.S. Blacklists Chinese Companies It Links to Balloon Program, WSJ, Feb. 11, 2023

Everybody and their Watch Box: State Surveillance

Leave a reply

Aerial surveillance can reach backwards in time, by the expedient of indiscriminately recording everything that is going on in a particular neighborhood, and then looking for useful patterns in the resulting footage. This technique, called wide-area motion imagery (Wami), has been around since 2006. But improvements in both the recording equipment used and the means by which the images are analysed are making it more and more valuable.

Wami was first employed by American forces in Iraq to track down those placing roadside bombs. When such a bomb went off, it was possible to run the relevant footage in reverse and trace the events that led up to the explosion. That often allowed the bombers to be identified and dealt with…Wami began with an aircraft-borne system called Constant Hawk, which was developed by Lawrence Livermore National Laboratory, in California. Constant Hawk’s success in Iraq begat more powerful versions. Gorgon Stare, carried by drone, was designed by the armed forces themselves…

But there is a problem. Explosions are easy to see. For many tasks, however, an awful lot of staring at screens looking for things that are out-of-the-ordinary is involved. People are bad at this…So AI is here to help…. Chips called graphic-processing units, borrowed from the video-game industry, are helping. So is machine learning, the basis of much modern artificial intelligence. .

l3Harris, a company in Florida, sells Wami sensors for use as automatic sentries. Their software monitors the coming and going of vehicles and pedestrians into and out of so-called watch boxes. These are protected areas surrounded by virtual trip wires, the triggering of which will cause a vehicle or individual of interest to be tracked…This approach can detect immediate threats. It can also, working over a longer period, carry out “pattern of life” analysis by building up a picture of what normal daily traffic looks like in an area. That permits the identification of anomalies which might signal hostile agents whose movements would otherwise be masked by the hurly-burly around them.

The sensors themselves are getting better, too….The latest version includes a so-called hyperspectral sensor, which sees simultaneously across many different wavelengths, including infrared and ultraviolet. It is thus able to distinguish things which the naked eye cannot, such as the difference between camouflage and vegetation. This approach’s real power, however, lies in software which automatically passes data between sensors…Future multi-sensor pods may include other instruments, such as signals-intelligence receivers. These are bits of equipment which can detect radio-frequency communicators like mobile phones and walkie-talkies, enabling particular devices to be identified and located. That would permit the individual carrying the phone, and also those he or she came into contact with, to be tracked and photographed. 

So far, the costs and complexity of Wami have kept it as a predominantly military technology. But that is starting to change. Smaller and more affordable versions are now within the reach of police, fire services and other non-military users…The most famous examples were in Baltimore, where the local cops experimented with the idea twice—first in 2016 and then in 2020. The second time around they made the mistake of monitoring a political protest as well as looking for crimes such as vehicle theft. 

Excerpts from Aerial Surveillance: The Spies in the Sky that See Backwards in Time, Economist, May 7, 2022

Who Cares? Clicking Away Privacy Rights

Leave a reply

The latest developments in a high-profile criminal probe by  US special counsel John Durham show the extent to which the world’s internet traffic is being monitored by a coterie of network researchers and security experts inside and outside the US government. The monitoring is made possible by little-scrutinized partnerships, both informal and formal, among cybersecurity companies, telecommunications providers and government agencies.

The U.S. government is obtaining bulk data about network usage, according to federal contracting documents and people familiar with the matter, and has fought disclosure about such activities. Academic and independent researchers are sometimes tapped to look at data and share any findings with the government without warrants or judicial authorization…

Unlike the disclosures by former intelligence contractor Edward Snowden from nearly a decade ago, which revealed U.S. intelligence programs that relied on covert access to private data streams, the sharing of internet records highlighted by Mr. Durham’s probe concerns commercial information that is often being shared with or sold to the government in bulk. Such data sets can possess enormous intelligence value, according to current and former government officials and cybersecurity experts, especially as the power of computers to derive insights from massive data sets has grown in recent years.

Such network data can help governments and companies detect and counter cyberattacks. But that capability also has privacy implications, despite assurances from researchers that most of the data can’t be traced back to individuals or organizations.

At issue are several kinds of internet logs showing the connections between computers, typically collected on networking devices such as switches or routers. They are the rough internet equivalent of logs of phone calls—showing which computers are connecting and when, but not necessarily revealing anything about the content of the transmissions. Modern smartphones and computers generate thousands of such logs a day just by browsing the web or using consumer apps…

“A question worth asking is: Who has access to large pools of telecommunications metadata, such as DNS records, and under what circumstances can those be shared with the government?…Surveillance takes the path of least resistance…,” according to Julian Sanchez, a senior fellow at the Cato Institute.

Excerpts from Byron Tau et al., Probe Reveals Unregulated Access to Data Streams, WSJ, Feb.. 28, 2022

How to Spy on Your Own Country for $1.25 per day

Leave a reply

San Francisco-based Premise Data Corp. pays users, many of them in the developing world, to complete basic tasks for small payments. Typical assignments involve snapping photos, filling out surveys or doing other basic data collection or observational reporting such as counting ATMs or reporting on the price of consumer goods like food.

About half of the company’s clients are private businesses seeking commercial information, Premise says. That can involve assignments like gathering market information on the footprint of competitors, scouting locations and other basic, public observational tasks. Premise in recent years has also started working with the U.S. military and foreign governments, marketing the capability of its flexible, global, gig-based workforce to do basic reconnaissance and gauge public opinion.

Premise is one of a growing number of companies that straddle the divide between consumer services and government surveillance and rely on the proliferation of mobile phones as a way to turn billions of devices into sensors that gather open-source information useful to government security services around the world.

Premise launched in 2013,, As of 2019, the company’s marketing materials said it has 600,000 contributors operating in 43 countries, including global hot spots such as Iraq, Afghanistan, Syria and Yemen. According to federal spending records, Premise has received at least $5 million since 2017 on military projects—including from contracts with the Air Force and the Army and as a subcontractor to other defense entities. In one pitch on its technology, prepared in 2019 for Combined Joint Special Operations Task Force-Afghanistan, Premise proposed three potential uses that could be carried out in a way that is “responsive to commander’s information requirements”: gauge the effectiveness of U.S. information operations; scout and map out key social structures such as mosques, banks and internet cafes; and covertly monitor cell-tower and Wi-Fi signals in a 100-square-kilometer area. The presentation said tasks needed to be designed to “safeguard true intent”—meaning contributors wouldn’t necessarily be aware they were participating in a government operation…

 Another Premise document says the company can design “proxy activities” such as counting bus stops, electricity lines or ATMs to provide incentives for contributors to move around as background data is gathered. Data from Wi-Fi networks, cell towers and mobile devices can be valuable to the military for situational awareness, target tracking and other intelligence purposes. There is also tracking potential in having a distributed network of phones acting as sensors, and knowing the signal strength of nearby cell towers and Wi-Fi access points can be useful when trying to jam communications during military operations. Nearby wireless-network names can also help identify where a device is, even if the GPS is off, communications experts say.

Mr. Blackman said gathering open-source data of that nature doesn’t constitute intelligence work. “Such data is available to anyone who has a cellphone,” he said. “It is not unique or secret.” Premise submitted a document last July to the British government describing its capabilities, saying it can capture more than 100 types of metadata from its contributors’ phones and provide them to paying customers—including the phone’s location, type, battery level and installed apps. 

Users of the Premise app aren’t told which entity has contracted with the company for the information they are tasked with gathering. The company’s privacy policy discloses that some clients may be governments and that it may collect certain types of data from the phone, according to a spokesman…Currently the app assigns about five tasks a day to its users in Afghanistan, according to interviews with users there, including taking photos of ATMs, money-exchange shops, supermarkets and hospitals. One user in Afghanistan said he and others there are typically paid 20 Afghani per task, or about 25 cents—income for phone and internet services. A few months ago, some of the tasks on the site struck him as potentially concerning. He said the app posted several tasks of identifying and photographing Shiite mosques in a part of western Kabul populated largely by members of the ethnic Hazara Shiite minority. The neighborhood was attacked several times by Islamic State over the past five years…. Because of the nature and location of the tasks in a hot spot for terrorism, the user said he thought those tasks could involve spying and didn’t take them on.

Excerpt from Byron Tau, App Users Unwittingly Collect Intelligence, WSJ,  June 25, 2010

The Repressive Digital Technologies of the West

Leave a reply

A growing, multi-billion-dollar industry exports “intrusion software” designed to snoop on smartphones, desktop computers and servers. There is compelling evidence that such software is being used by oppressive regimes to spy on and harass their critics. The same tools could also proliferate and be turned back against the West. Governments need to ensure that this new kind of arms export does not slip through the net.

A recent lawsuit brought by WhatsApp, for instance, alleges that more than 1,400 users of its messaging app were targeted using software made by NSO Group, an Israeli firm. Many of the alleged victims were lawyers, journalists and campaigners. (NSO denies the allegations and says its technology is not designed or licensed for use against human-rights activists and journalists.) Other firms’ hacking tools were used by the blood-soaked regime of Omar al-Bashir in Sudan. These technologies can be used across borders. Some victims of oppressive governments have been dissidents or lawyers living as exiles in rich countries.

Western governments should tighten the rules for moral, economic and strategic reasons. The moral case is obvious. It makes no sense for rich democracies to complain about China’s export of repressive digital technologies if Western tools can be used to the same ends. The economic case is clear, too: unlike conventional arms sales, a reduction in spyware exports would not lead to big manufacturing-job losses at home.

The strategic case revolves around the risk of proliferation. Software can be reverse-engineered, copied indefinitely and—potentially—used to attack anyone in the world…. There is a risk that oppressive regimes acquire capabilities that can then be used against not just their own citizens, but Western citizens, firms and allies, too. It would be in the West’s collective self-interest to limit the spread of such technology.

A starting-point would be to enforce existing export-licensing more tightly… Rich countries should make it harder for ex-spooks to pursue second careers as digital mercenaries in the service of autocrats. The arms trade used to be about rifles, explosives and jets. Now it is about software and information, too. Time for the regime governing the export of weapons to catch up

The spying business: Western firms should not sell spyware to tyrants, Economist, Dec. 14, 2019

Dodging the Camera: How to Beat the Surveillance State in its Own Game

Leave a reply

Powered by advances in artificial intelligence (AI), face-recognition systems are spreading like knotweed. Facebook, a social network, uses the technology to label people in uploaded photographs. Modern smartphones can be unlocked with it… America’s Department of Homeland Security reckons face recognition will scrutinise 97% of outbound airline passengers by 2023. Networks of face-recognition cameras are part of the police state China has built in Xinjiang, in the country’s far west. And a number of British police forces have tested the technology as a tool of mass surveillance in trials designed to spot criminals on the street.  A backlash, though, is brewing.

Refuseniks can also take matters into their own hands by trying to hide their faces from the cameras or, as has happened recently during protests in Hong Kong, by pointing hand-held lasers at cctv cameras. to dazzle them. Meanwhile, a small but growing group of privacy campaigners and academics are looking at ways to subvert the underlying technology directly…

Laser Pointers Used to Blind CCTV cameras during the Hong Kong Protests 2019

In 2010… an American researcher and artist named Adam Harvey created “cv [computer vision] Dazzle”, a style of make-up designed to fool face recognisers. It uses bright colours, high contrast, graded shading and asymmetric stylings to confound an algorithm’s assumptions about what a face looks like. To a human being, the result is still clearly a face. But a computer—or, at least, the specific algorithm Mr Harvey was aiming at—is baffled….

Modern Make-Up to Hide from CCTV cameras

HyperFace is a newer project of Mr Harvey’s. Where cv Dazzle aims to alter faces, HyperFace aims to hide them among dozens of fakes. It uses blocky, semi-abstract and comparatively innocent-looking patterns that are designed to appeal as strongly as possible to face classifiers. The idea is to disguise the real thing among a sea of false positives. Clothes with the pattern, which features lines and sets of dark spots vaguely reminiscent of mouths and pairs of eyes are available…

Hyperface Clothing for Camouflage

 Even in China, says Mr Harvey, only a fraction of cctv cameras collect pictures sharp enough for face recognition to work. Low-tech approaches can help, too. “Even small things like wearing turtlenecks, wearing sunglasses, looking at your phone [and therefore not at the cameras]—together these have some protective effect”. 

Excerpts from As face-recognition technology spreads, so do ideas for subverting it: Fooling Big Brother,  Economist, Aug. 17, 2019

Surveillance: Private Web Spiders

Leave a reply

With so many cheap or free tools out there, it is easy for anyone to set up their own NSA-esque operations and collect data. Though breaching systems and taking data without authorisation is against the law, it is possible to do a decent amount of surveillance entirely legally using open-source intelligence (OSINT) tools…. Daniel Cuthbert, chief operating officer of security consultancy Sensepost, has been happily using OSINT tool Maltego (its open-source version is charmingly called Poortego) [pdf] to track a number of people online.

Over a few days this summer, he was “stalking” a Twitter user who appeared to be working at the Central Intelligence Agency. Maltego allowed him to collect all social media messages sent out into the internet ether in the area around the CIA’s base in Langley, Virginia. He then picked up on the location of further tweets from the same user, which appeared to show her travelling between her own home and a friend or partner’s house. Not long after Cuthbert started mapping her influence, her account disappeared.

But Cuthbert has been retrieving far more illuminating data by running social network accounts related to Islamic State through Maltego. By simply adding names to the OSINT software and asking it to find links between accounts using commands known as “transforms”, Maltego draws up real-time maps showing how users are related to each other and then uncovers links between their followers. It is possible to gauge their level of influence and which accounts are bots rather than real people. Where GPS data is available, location can be ascertained too, though it is rare to find accounts leaking this – only about 2% of tweets have the feature enabled, says Cuthbert.

He has been trying, with mixed results thanks to Twitter’s deletion of accounts spreading Isis propaganda, to determine how tech savvy its members are and how they operate online. Over the past month, Cuthbert has looked at links between a number of pro-Isis users, including one with the handle @AbuHussain104, who has only tweeted 28 times, yet has more than 1,300 followers already. The prominent pro-sharia law Islamic activist Anjem Choudary has been a keen retweeter of Hussain’s words.  The London-based professional hacker has noted the group’s ability to attract followers online; his research shows how a handful of Isis-affiliated accounts have myriad links and wide influence.

Cuthbert is now on the lookout for slipups that reveal the true identity or location of the tweeter. “This is a concern for high-ranking Isis leaders, so much so, they issued a guide on using social media,” he notes, referring to reports of an as-yet unconfirmed document.,,,

Metagoofil, which runs on Linux or Mac machines, is an ideal software for uncovering data businesses have mistakenly leaked onto the internet. Running this free tool in a Linux distribution, hackers can command it to hunt for files related to a particular domain, specifying how many Google searches to look through and how many documents to download. It will then extract whatever metadata the user is looking for and store it all in a file for perusal later on.

For those who want instant visual results, the Shodan search tool is a remarkable piece of work. Simple searches can reveal miraculous details. For instance, type “IP camera” into the search bar and more than 1.3m internet-connected IP cameras show up from across the world. Add “country:gb” and you’ll be shown more than 54,000 based in Great Britain. You could specify a manufacturer too, such as Samsung. That provides just 13 results. From there, it’s a matter of clicking on the IP addresses to see which ones allow you to view live footage either with or without a password (if you guess the password, even if it’s a default one such as “admin”, it will mean you are likely to have broken the Computer Misuse Act).  Either way, it is very easy to find poorly secured cameras – many have a username of “admin” and no password whatsoever, according to previous research. It is that straightforward: no coding skills required….

“The tools are mostly for reconnaissance,” says Christian Martorella, creator of Metagoofil and theHarvester, another OSINT software that pentesters – or “ethical hackers” – use to map their clients’ internet footprint. “This helps the pentester to have as much information as possible about the targets and plan the attacks. This phase is very important but … pentesters usually overlook this phase or dedicate little time, while attackers seem to spend more time in this phase.”

Privacy-conscious folk can also benefit from OSINT. While looking into how his internet service provider [ISP] was interfering with his internet connection, in a method similar to that used by Verizon for its controversial “permacookie” tracking software, researcher Lee Brotherston last month used Shodan to find servers that intercepted his traffic. The wide range of Perftech servers he found were based across the world, and though his ISP was simply using a “man-in-the-middle” technique to add a warning banner to a website he visited, … But what if the ISP was coerced by a government and dropped malware onto people’s machines as they tried to access websites? The much-maligned surveillance tool FinSpy is used for just for that purpose: it is placed into the data centres of ISPs and intercepts traffic to force surreptitious downloads of surveillance software. Instead of dropping banners, as Brotherston’s ISP did, it injects malicious JavaScript.  “When you hear about repressive governments that start installing malware on activists’ machines and then arresting them… it’s the same technique. They’re injecting data into a webpage,” says Brotherston, a Canada-based Brit. “If you’re injecting this, you may have a valid business case for doing, it but someone could break in and start dropping malware on people’s machines.”

A number of developers, inspired by the success of Shodan creator John Matherly, have drawn up search sites for hackable systems. Perhaps the most useful for security professionals, whether of the blackhat or whitehat variety, is the Kickstarter-funded PunkSPIDER, a web app vulnerability search engine, which issues an alert as soon as the visitor arrives: “Please do not use this site for malicious purposes … use it wisely or we’ll have to take it away”. It’s remarkably simple. Type or paste in a URL and it will reveal what vulnerabilities have been documented for the related site.

Such is the openness of the web, and such is the carelessness of so many web denizens, any determined citizen can gather up reams of sensitive information on others and collect enough data to create a decent picture of who they are, where they are and what they are doing. The tools are now accessible for the typical web user.

Excerpts fromTom, Fox-Brewster, Tracking Isis, stalking the CIA: how anyone can be big brother online, Guardian, Nov. 12, 2014