No Agenda 576 - Mysterious Erratic

Dame Jennifer Charlseton Meetup www.nacharleston.com

Obama Pardons Top Dem Ally Deval Patrick's Crack Dealer Cousin'...

------------------------------------------------

Millions of Target shoppers face new debit card limits | Reuters

Link to Article

Archived Version

Sun, 22 Dec 2013 04:53

By David Henry

NEW YORKSat Dec 21, 2013 7:34pm EST

People shop at a Target store during Black Friday sales in the Brooklyn borough of New York, in this November 29, 2013, file photo.

Credit: Reuters/Eric Thayer/File

NEW YORK (Reuters) - At least 2 million shoppers who used bank debit cards at Target Corp (TGT.N) stores during its recent data breach are facing lower limits on how much cash they can take out of teller machines and spend at stores.

JPMorgan Chase & Co (JPM.N) said on Saturday it is notifying customers who used Chase brand debit cards at Target from November 27 through December 15 that they are now limited to $100 a day of cash withdrawals and $300 a day of purchases with their cards.

The new limit effects roughly 2 million accounts, or 10 percent of Chase debit cards, according to a spokeswoman for Chase, the consumer banking business of JPMorgan, the biggest U.S. bank by assets.

Chase said it acted as a precaution to prevent criminals from taking money from customer accounts. Chase and other banks say they will cover unauthorized transactions that customers report.

"Banks are putting various precautions in place," Target spokeswoman Molly Snyder said by email, declining to be specific about what the banks are doing.

Representatives for other major banks, including Bank of America Corp (BAC.N) and Citigroup Inc (C.N), told Reuters on Saturday that their institutions take steps to protect accounts, but none described specific actions so broadly limiting to cardholders as those of Chase.

Target's Snyder said that for the debit card it issues and calls Redcard, the company has activated a "deeper fraud monitoring protocol." She did not describe the new steps.

Chase said in its notice to customers that it realized its move "could not have happened at a more inconvenient time with the holiday season upon us."

At Chase, the usual debit card daily limits are $200 to $500 for cash withdrawals and $500 for purchases, according to a bank spokeswoman.

"It seems like the banks are the 'Grinch who stole Christmas,'" said Jamie Court, president of Consumer Watchdog, a consumer advocacy group based in Los Angeles. "It is Target's fault, but children across America are going to bear the price ... The banks are protecting themselves."

Chase spelled out the new limits in an email to customers with the subject line: "Unfortunately, your debit card is at risk by the breach at Target stores."

Target said on Thursday that computer hackers had stolen data from as many as 40 million credit and debit cards of shoppers who visited its stores during the first three weeks of the holiday season.

Chase said in the letter that it plans to reissue affected debit cards over the coming weeks and in the meantime said employees at its 5,600 branches would help those who need more cash. Many branches will stay open late if needed, the letter said.

Debit cards, unlike credit cards, typically require customers to enter personal identification numbers when they make purchases at store check-out counters. Initial reports of Target's security breach said data may have been taken through devices at its counters.

Debit cards are used to spend money that has been deposited in checking and other demand accounts at banks.

(Reporting by David Henry in New York; Additional reporting by Jim Finkle and Dhanya Skariachan; Editing by Gunna Dickson and Bill Trott)

Link thisShare thisDigg thisEmailPrintReprints

Target tops ad spending among retailers | RetailingToday.com

AP Cover Up of issue-Its safe!

Link to Article

Archived Version

Sun, 22 Dec 2013 07:59

NEW YORK (AP) -- Potential victims of credit card fraud tied to Target's security breach said they had trouble contacting the discounter through its website and call centers.Angry Target customers expressed their displeasure in comments on the company's Facebook page. Some even threatened to stop shopping at the store.Target's CEO Gregg Steinhafel apologized through a statement issued on Friday. The retailer also said it's working hard to resolve the problem and is adding more workers to field calls and help solve website issues. And the discounter began offering 10 percent off for customers who shop in its stores on Saturday and Sunday and free credit-monitoring services to those who've been affected by the issue.The Minneapolis-based discounter said that while it's only heard of "very few" reports of fraud, it's reaching out to customers who made purchases by swiping their cards when the scam occurred. The company also said it's continuing its investigation into the matter."We take this crime seriously," Steinhafel said in the statement.Target's statements come after the nation's second-largest retailer acknowledged Thursday that data connected to about 40 million credit and debit card accounts was stolen as part of a breach that began over the Thanksgiving weekend.The theft is the second-largest credit card breach in U.S. history, exceeded only by a scam that began in 2005 involving retailer TJX Cos. That incident affected at least 45.7 million card users.Target disclosed the theft a day after reports that the company was investigating a breach. The retailer's data-security troubles and its ensuing public relations nightmare threaten to drive off holiday shoppers during the company's busiest time of year.Christopher Browning, of Chesterfield, Va., said he was the victim of credit card fraud earlier this week and believes it was tied to a purchase he made at Target with his Visa card on Black Friday. When he called Visa on Thursday, the card issuer could not confirm his suspicions. He said he hasn't been able to get through to Target's call center.On Monday, Browning received a call from his bank's anti-fraud unit saying there were two attempts to use his credit card in California - one at a casino in Tracy for $8,000 and the other at a casino in Pacheco, for $3,000. Both occurred on Sunday and both were denied. He canceled his credit card and plans to use cash."I won't shop at Target again until the people behind this theft are caught or the reasons for the breach are identified and fixed," he said.On Friday, Target reiterated that the stolen data included customer names, credit and debit card numbers, card expiration dates and the embedded code on the magnetic strip found on the backs of cards, Target said.There was no indication the three- or four-digit security numbers visible on the back of the card were affected, Target said. It also said Friday there was no indication that the stolen data included a customer's birth date or social security number. The data breach did not affect online purchases, the company said.Target also said it didn't believe that PIN numbers to customers' debit cards have been compromised. So that means someone cannot visit an ATM with a fraudulent card and withdraw cash, it said.Target hasn't disclosed exactly how the breach occurred but said it has fixed the problem.Given the millions of dollars that companies such as Target spend implementing credit-card security measures each year, Avivah Litan, a security analyst with Gartner Research, said she believes the theft may have been an inside job."The fact this breach can happen with all of their security in place is really alarming," Litan said.Other experts theorize that Target's network was hacked and infiltrated from the outside.Target, which has almost 1,800 stores in the U.S. and 124 in Canada, said it immediately told authorities and financial institutions once it became aware of the breach on Dec. 15. The company is teaming with a third-party forensics firm to investigate and prevent future problems.Data breaches tied to credit card fraud are on the rise, according to Javelin Strategy & Research, a San Francisco-based financial services firm.According to a report by the firm, nearly 16 million consumers were notified that their card information was compromised in 2012, while the number of victims of fraud increased more than threefold from 2010 to 2012. That resulted in $4.8 billion in fraud losses.Al Pascual, a senior analyst of security risk and fraud at Javelin, noted that 28 percent of customers who are notified that their cards were breached typically suffer fraud in the same year."This is going to spawn credit card fraud," he said.Target's credit card breach poses a serious problem and threatens to scare away shoppers who worry about the safety of their personal data."This is close to the worst time to have it happen," said Jeremy Robinson-Leon, a principal at Group Gordon, a corporate and crisis public relations firm. "If I am a Target customer, I think I would be much more likely to go to a competitor over the next few days, rather than risk the potential to have my information be compromised."Target advised customers Thursday to check their statements carefully. Those who see suspicious charges should report them to their credit card companies and call Target at 866-852-8680. Cases of identity theft can also be reported to law enforcement or the Federal Trade Commission.The incident is particularly troublesome for Target because it has used its store-branded credit and debit cards as a marketing tool to attract shoppers with a 5 percent discount.During an earnings call in November, the company said some 20 percent of store customers as of October have the Target-branded cards. In fact, households that activate a Target-branded card have increased their spending at the store by about 50 percent on average, the company said.Shares in Target Corp. rose 34 cents to $62.49 on Friday.---Associated Press writers Michelle Chapman and Bree Fowler in New York contributed to this report.Follow Anne D'Innocenzio at --http://www.Twitter.com/adinnocenzio

------------------------------------------------

TJX Companies - Wikipedia, the free encyclopedia

Link to Article

Archived Version

Sun, 22 Dec 2013 08:01

TJX NameplatesEditStanley Feldberg was one of the 1956 founders of Zayre Corp. He served as president of the company until 1978, and afterwards remained on the Board of Directors, until he retired in 1989.[2] Once the company had sold off the "Zayre" name, the company consisted of its one core remaining store brand, T.J. Maxx.[2] The next year, in 1990, TJX expanded into an additional store brand division, and at the same time it first went international, as it entered the Canadian market by acquiring the five-store Winners chain.[2] Two years later, it launched its third brand, HomeGoods, in the United States.[2] TJX's expansion beyond North America came in 1994, when the fourth brand division, T.K. Maxx, was founded in the United Kingdom, and then expanded into Ireland.[2]

In 1995, TJX doubled in size when it acquired Marshalls, its fifth brand. T.J. Maxx and Marshalls later became consolidated as two brands under a single division, The Marmaxx Group.[2] The following year, TJX Companies Inc. was added to the Standard & Poor's S&P 500 Composite Index, which consists of 500 of the largest companies in the United States.[4]

TJX launched a sixth brand, A.J. Wright, in 1998 in the eastern U.S. The brand went national in 2004 when it opened its first stores in California on the west coast.[2] The company's seventh brand division, HomeSense, formed in 2001, was a Canadian brand modeled after the existing US brand, HomeGoods.[2]

In 2002, TJX revenue reached almost $12 billion.[2] In mid-2003, TJX acquired an eighth brand division, Bob's Stores, concentrated in New England. In Canada, TJX began to configure some Winners and HomeSense stores side-by-side as superstores. The superstores feature open passageways between them, with dual branding. TJX's revenue in 2003 reached over $13 billion.[2] TJX began to test the side-by-side superstore model in the United States in 2004, combining some of each of the two Marmaxx brand stores with HomeGoods. The company reached 141st position in the 2004 Fortune 500 rankings, with almost $15 billion in revenue. That year was also marked by the death of retired Zayre founder Stanley Feldberg.[2]

In April 2008, TJX launched the HomeSense brand in the UK, with six stores opening throughout May. The brand is more upmarket than its Canadian namesake. Later that year, in August, TJX sold Bob's Stores to Versa Capital Management and Crystal Capital.[5]

In December 2010, TJX announced that the A.J. Wright stores would be closed, cutting about 4,400 jobs, and that more than half of them would reopen under other company brands.[6]

To this day, nobody knows what the initials T.J. stand for.

Computer systems intrusionEditOn January 17, 2007, TJX announced that it was the victim of an unauthorized computer systems intrusion. It discovered in mid-December 2006 that its computer systems were compromised and customer data was stolen.[7] The hackers accessed a system that stores data on credit card, debit card, check, and merchandise return transactions.[8] The intrusion was kept confidential as requested by law enforcement. TJX said that it is working with General Dynamics, IBM and Deloitte to upgrade computer security.

By the end of March 2007, the number of affected customers had reached 45.7 million [9] and has prompted credit bureaus to seek legislation requiring retailers to be responsible for compromised customer information saved in their systems. In addition to credit card numbers, personal information such as social security numbers and driver's license numbers from 451,000 customers were downloaded by the intruders. The breach was possible due to a non-secure wireless network in one of the stores.[10]

Eleven men have been charged in the theft, and one (Damon Patrick Toey) has pleaded guilty to numerous charges related to the breach.[11] One man, Jonathan James, professed his innocence and later committed suicide, apparently out of the belief that he was going to be indicted.[12]

The alleged ringleader Albert Gonzalez was indicted in August 2009 with attacking Heartland Payment Systems in which 130 million records were compromised.[13]

RestatementEditOn February 11, 2000, the company restated the quarterly sales and earnings of 1999.[14]

ReferencesEditNotesEdit^CNN Money: Fortune 500 FY2010^ abcdefghijkl2004 Annual Report^http://www.financialpost.com/open+Marshalls+Canada/3300522/story.html^Sam Stovall, Sector Investing, McGraw Hill, 1996, Appendix A, The S&P 500 Composite Index, ISBN 0-07-052239-1^Financial Wire (2008 August 20). TJX Sells Bob's Stores Chain To Versa Capital, Crystal Capital, Terms Undisclosed. Financial Wire, Retrieved September 22, 2008, from http://www.tradingmarkets.com/.site/news/Stock%20News/1836096/^US Retail News (10 December 2010). TJX Plans to Close A.J. Wright Stores, Cut 4,400 Jobs. Bloomberg.com, Retrieved December 10, 2010, from http://www.bloomberg.com/news/2010-12-10/tjx-plans-to-convert-or-shut-its-a-j-wright-stores-cut-4-400-positions.html^"THE TJX COMPANIES, INC. VICTIMIZED BY COMPUTER SYSTEMS INTRUSION; PROVIDES INFORMATION TO HELP PROTECT CUSTOMERS" (Press release). The TJX Companies, Inc. 2007-01-17. Retrieved 2009-12-12. ^Lavoie, Denise (2007-01-18). "Credit cos. watchful after TJX breach". Archived from the original on 2007-01-23. Retrieved 2007-01-18. ^Largest Customer Info Breach Grows. MyFox Twin Cities, 29 March 2007.^Joseph Pereira. Breaking the code: How Credit-Card Data Went Out Wireless Door. Wall Street Journal, May 4, 2007. Subscription might be needed^Tomsho, Rob (2008 September 12). Hacker pleads guilty in TJX security breach. The Wall Street Journal, Retrieved September 12, 2008, from http://online.wsj.com/article/SB122122769957627957.html?mod=hps_us_whats_news^Poulsen, Kevin (2009-07-09). "Former Teen Hacker's Suicide Linked to TJX Probe". Wired. Retrieved 2009-10-29. ^Hacker Charged With Heartland, Hannaford Breaches - wired.com - August 17, 2009^"The TJX Companies, Inc. Adopts Provisions of Staff Accounting Bulletin No.101 Related to Layaway Sales". SourcesEditExternal linksEdit

Last modified on 1 December 2013, at 18:58

------------------------------------------------

Target's Biggest PR Mistake With Credit Card Security Breach - Forbes

------------------------------------------------

Target Was Sued After Putting More Than 40 Million Customers At Risk

Link to Article

Archived Version

Sun, 22 Dec 2013 07:58

BOSTON (Reuters) - Target Corp said hackers have stolen data from up to 40 million credit and debit cards of shoppers who visited its stores during the first three weeks of the holiday season in the second-largest such breach reported by a U.S. retailer.

The hackers worked at unprecedented speed, carrying out their operation from the day before Thanksgiving to this past Sunday, 19 days that are the heart of the crucial Christmas holiday sales season.

Target, the third-largest U.S. retailer, said on Thursday that it was working with federal law enforcement and outside experts to prevent similar attacks in the future. It did not disclose how its systems were compromised.

The retailer was alerted its systems might have been compromised by credit card processors who had noticed a surge in fraudulent transactions involving credit cards that had been used at Target, according to a person familiar with the investigation who was not authorized to discuss the matter.

The timing of the breach could not have been worse for Target, coming just before three of the four busiest days of what has been a bruising holiday season for retailers, with the highest level of discounting in years. Target last month lowered its profit forecast for the year.

"Most of these attacks are just a cost of doing business," said Mark Rasch, a former U.S. prosecutor of cyber crimes.

"But an attack that's targeted against a major retailer during the peak of the Christmas season is much more than that because it undermines confidence."

Investigators are still trying to understand how the attack was carried out, including whether hackers found a weakness at Target's computer network or through credit card services vendors. It was not immediately clear what percent of the transactions at its brick and mortar stores had been compromised but the company said its online business had not been affected.

Massachusetts Attorney General Martha Coakley, who headed a multi-state probe into a 2007 data breach at TJX Cos, said in a statement that her office was talking to Target about the breach and planned to work with other Attorneys General to determine whether the company had proper safeguards in place.

New York Attorney General Eric Schneiderman said in a public statement that he had asked Target for more information.

A customer in California filed a class-action lawsuit against the company late on Thursday, the first of what lawyers said could be many such suits.

Samantha Wredberg said in a court filing that she was a regular shopper at Target and had used her credit card at a company store on December 8. Besides seeking damages, Wredberg asked the court to certify the lawsuit as class action.

She also asked the court to explore whether "Target unreasonably delayed in notifying affected customers of the data breach".

The theft of credit and debit card data from Target customers could end up costing hundreds of millions of dollars, but it is unclear who will bear the expense, lawyers and industry sources said.

The affected payment cards include Target's REDcard private label debit and credit cards as well as other bank cards, Target spokeswoman Molly Snyder said. She declined to say if the incident was affecting store traffic.

The largest breach against a U.S. retailer, uncovered in 2007 at TJX Cos Inc, led to the theft of data from more than 90 million credit cards over about 18 months.

Since then, companies have become far more adept at identifying intruders. But criminals have responded by developing more-powerful attack strategies, spending months on reconnaissance to launch sophisticated schemes with the goal of extracting as much data as they can in the shortest period of time.

Representatives for J.C. Penney Co Inc, Wal-Mart Stores Inc, Best Buy Co Inc and Home Depot Inc told Reuters they believed their systems had not been compromised in similar attacks.

Target will provide more details on costs related to the issue at a later date, Snyder said. She declined to comment when asked if Target expected potential fines from MasterCard, Visa and American Express or saw a possible increase in merchant fees.

"It's so early in this investigation," Snyder said.

Avivah Litan, a Gartner analyst who specializes in cyber-security and fraud detection, saw costs for Target. "They are going to pay for any fraud on the card," she said. "They will get fined (by card issuers) for non-compliance with payment card security standards. Their merchant fee will probably go up a few basis points."

Target's shares closed down 2.2 percent at $62.15 on the New York Stock Exchange on Thursday afternoon, while the Standard & Poor's 500 stock index fell 0.06 percent.

ANGRY CUSTOMERS

Target warned customers in an alert on its website that the criminals had stolen names, payment card numbers, expiration dates and security codes.

The company had identified the breach on Sunday and had begun responding to it the same day, Snyder said. She declined to explain why the retailer waited until Thursday to alert customers.

Krebs on Security, a security industry blog that broke the news on Wednesday, said the breach involved nearly all of Target's 1,797 stores in the United States.

The U.S. Secret Service is working on the investigation, according to an agency spokeswoman. A Federal Bureau of Investigation spokeswoman declined to comment.

Customers began to complain early on Thursday via Target's Facebook page.

"Thank you Target for nearly costing me and my wife our identities, we will never shop or purchase anything in your store again," said one posting.

"Shop at Target, become a target," remarked another. "Gee, thanks."

Target's Snyder said it had been getting an "extremely high" volume of calls from customers.

JPMorgan Chase & Co, one of the biggest U.S. credit card issuers, said it was monitoring the accounts involved for suspicious activity and urged customers to contact the bank if they noticed any.

An American Express spokeswoman said the company was aware of the incident and was putting fraud controls in place.

Major card brands typically offer their cardholders zero liability and cardholders should contact their issuer if they spot suspicious transactions, a Visa spokesman said, adding that a breached account did not necessarily result in a fraudulent purchase.

"This could hurt the end of the holiday season if for no other reason than many of their customers have to cancel cards ahead of holidays," said Janney Capital Markets analyst David Strasser.

The breach also comes at a time Target is trying to build its online business, which by some estimates is only 2 percent of sales.

"All consumers will hear is that Target is not a safe place to use your credit card. That impacts trust, which in turn can impact retail's fastest-growing and most trust-sensitive touch points: online and mobile," said Carol Spieckerman, president of retail strategy firm newmarketbuilders.

Still, consumers tend to have short memories with these things, so it will likely be less of an issue next quarter, said Gartner analyst Litan.

"(Consumers) care more about discounts than security," she said.

The case is Samantha Wredberg vs Target Corp, Case No. 13-cv-05901, U.S. District Court, Northern District of California.

(Additional reporting by Sakthi Prasad, Siddharth Cavale, David Henry, Marina Lopes, Phil Wahba and Peter Rudegeair; Editing by Kirti Pandey, Rodney Joyce, Lisa Von Ahn, Jilian Mincer, Peter Henderson, Phil Berlowitz, Bob Burgdorfer and Stephen Coates)

Also on HuffPost:

Outdated Magnetic Strips: How U.S. Credit Card Security Lags : All Tech Considered : NPR

Link to Article

Archived Version

Sun, 22 Dec 2013 07:46

hide captionThe U.K., Canada and other countries have been using more secure chip credit cards for years now. Why hasn't the U.S. caught up?

Martin Keene/PA Photos/LandovThe U.K., Canada and other countries have been using more secure chip credit cards for years now. Why hasn't the U.S. caught up?

Martin Keene/PA Photos/LandovCriminals may have stolen information from 40 million credit and debit cards used at Target. A possible weakness? The magnetic stripe on credit cards '-- which fraudsters can pull credit card numbers and expiration dates from to make counterfeit cards.

Other countries moved beyond this technology years ago. The U.K., Canada and Hong Kong are already using chip-based cards, which are considered more secure. (Magnetic stripe technology is decades old.) Cards using the chip-and-PIN system have an embedded microchip. Instead of swiping the part with a magnetic stripe, you put the card into a terminal, then enter a PIN or sign your name. It's more expensive for criminals to forge these cards, says Brian Krebs, a security journalist who writes for Krebs on Security and broke the story on the breach at Target.

Target didn't give details on how the breach occurred. But Krebs, citing credit card industry sources, reported that it involved "the theft of data stored on the magnetic stripe of cards used at the stores."

The newer chip-and-PIN technology "simply raises the costs for the bad guys," Krebs told NPR. "It's not that they can't break the system '-- but it makes it more expensive for them to fabricate these cards."

Visa and MasterCard have plans to introduce these cards in the U.S. in around two years. But why hasn't the U.S. already adopted this technology?

That's the wrong question to ask, says Ross Anderson, who has worked on payment technology for almost 30 years and is a professor of security engineering at the University of Cambridge.

"Simply blocking off one of the avenues of attacks by fraudsters isn't enough to make fraud vanish," he says.

It can be a game of cat and mouse. Anderson says after it became common to pay with chip-based cards in the U.K., around 2003, the level of fraud went up because thieves turned to schemes involving mail and telephone orders.

Eventually, criminals figured out how to make fake terminals that steal information from the card. Also, the cards still have magnetic strips, in case European cardholders want to travel abroad. According to Krebs, some criminals simply steal the information from the cards in Europe, and because they can't pay with magnetic stripe cards over there, they send the information to crooks in the U.S. for illegal shopping sprees.

Americans are actually lucky, says Anderson, because they have the thing that matters more than technology '-- consumer protection.

"If there's fraud, the issue is who pays for it; is it me or is it the bank? And if the bank is running the system, then I want the bank to pay for the fraud," Anderson says. "American citizens are lucky because [since the 1970s and early 1980s, they have] very strong consumer protection in the form of Regulation E, Regulation Z and various decided court cases."

If U.S. cardholders become victims of credit card fraud, they can call their bank and be done with it, losing at most $50 or so. In the U.K., for instance, cardholders have to write a letter to file their claim.

"The U.S. is ahead in terms of consumer protection, and if you're thinking about the public interest and how things affect you as a bank customer, that's by far the most important thing," Anderson says. "How the banks use technical mechanisms to limit their own exposure then simply becomes an engineering problem for them to solve."

He says this consumer protection is why online shopping took off in the U.S.

Starting Oct. 1, 2015, Visa will encourage the use of the new chip-embedded cards in the U.S. After that, if someone uses a chip card at a store that hasn't adopted the new terminals for reading chip cards, the store may be responsible for any fraud that happens.

Anderson also says this is an exciting time for payment technology. There hasn't been much innovation for the past 30 years or so, but he says mobile payment systems like Google Wallet could be widely used in five to 10 years.

Target security breach: Outdated payment system will cause credit card hacks to continue

Link to Article

Archived Version

Sun, 22 Dec 2013 07:25

NEW YORK (CNNMoney) -- There's a reason millions of credit cards can be stolen from Target at once -- and will continue happening in the future: Our payment system of plastic cards with magnetic stripes is outdated and fundamentally flawed.

LINK:Recap of Thursday's chat regarding Target breachhttp://bit.ly/1ch8gnI

The United States is the financial capital of the world, but when it comes to payment technology, it's actually in the boonies.

In recent years, more than 80 countries have upgraded to credit cards embedded with microchips. Cards with chips are inconceivably difficult to counterfeit, and there's added security in every swipe: Terminals require a user's PIN, and the information on the chip is encrypted.

Yet Americans keep using payment technology that was developed in the 1960's. That poses a big risk: Cards with magnetic stripes deliver all your data without hiding anything. Swipe your card and the computer sees everything in plain text: your name, credit card provider, card number, expiration date and more.

All hackers have to do is catch it before retailers' card swiping terminals encrypt that data into jumbled, protected code. They can then easily use that information for online purchases or make counterfeit cards by encoding the stolen account number on a blank card's magnetic stripe.

Chip-and-PIN credit card systems would likely have prevented the Target hackers from seeing anything but encrypted code. And they'd need a physical chip to make counterfeits.

The top credit card companies -- Visa, MasterCard and American Express -- would not say why the archaic magnetic strip system remains the norm.

Credit card fraud in England plummeted 34% in the six years after English banks and merchants implemented chip-and-PIN cards, according to a Federal Reserve report. During a similar period in France, fraud from in-person card use fell 35%.

But chip-and-PIN cards aren't going mainstream in the United States anytime soon. At $1 to $2 per card, they're about 10 times more expensive for banks to produce than magnetic stripe versions. Merchants would also need to upgrade their point-of-sale systems -- an expensive proposition.

"It's kind of a chicken and egg problem. Merchants need to make the upgrade, but do consumers have cards?" said Jason Oxman, CEO of the Electronics Transaction Association.

That trade group hopes the shift to chip-and-PIN will be underway by 2015, but others say 2018 is more realistic. Some banks, such as Chase and Citi, already offer the latest chip-and-PIN cards, but they're mostly marketed to customers who frequently travel abroad.

The problem is that banks and credit card companies have little motivation to change the current system, said Anisha Sekar, who reviews credit cards for finance site NerdWallet. Financial institutions earned $41.2 billion from credit card swipe fees last year, according to advisory firm Sonecon. Meanwhile, they lost just $5.33 billion to fraud, according to payment industry newsletter The Nilson Report.

"Credit card companies don't have much incentive to make cards safer," Sekar said.

Cards Stolen in Target Breach Flood Underground Markets '-- Krebs on Security

Link to Article

Archived Version

Sun, 22 Dec 2013 14:18

Credit and debit card accounts stolen in a recent data breach at retail giant Target have been flooding underground black markets in recent weeks, selling in batches of one million cards and going for anywhere from $20 to more than $100 per card, KrebsOnSecurity has learned.

Prior to breaking the story of the Target breach on Wednesday, Dec. 18, I spoke with a fraud analyst at a major bank who said his team had independently confirmed that Target had been breached after buying a huge chunk of the bank's card accounts from a well-known ''card shop'' '-- an online store advertised in cybercrime forums as a place where thieves can reliably buy stolen credit and debit cards.

There are literally hundreds of these shady stores selling stolen credit and debit cards from virtually every bank and country. But this store has earned a special reputation for selling quality ''dumps,'' data stolen from the magnetic stripe on the backs of credit and debit cards. Armed with that information, thieves can effectively clone the cards and use them in stores. If the dumps are from debit cards and the thieves also have access to the PINs for those cards, they can use the cloned cards at ATMs to pull cash out of the victim's bank account.

At least two sources at major banks said they'd heard from the credit card companies: More than a million of their cards were thought to have been compromised in the Target breach. One of those institutions noticed that one card shop in particular had recently alerted its loyal customers about a huge new batch of more than a million quality dumps that had been added to the online store. Suspecting that the advertised cache of new dumps were actually stolen in the Target breach, fraud investigators with the bank browsed this card shop's wares and effectively bought back hundreds of the bank's own cards.

When the bank examined the common point of purchase among all the dumps it had bought from the shady card shop, it found that all of them had been used in Target stores nationwide between Nov. 27 and Dec. 15. Subsequent buys of new cards added to that same shop returned the same result.

On Dec. 19, Target would confirm that crooks had stolen 40 million debit and credit cards from stores nationwide in a breach that extended from Nov. 27 to Dec. 15. Not long after that announcement, I pinged a source at a small community bank in New England to see whether his institution had been notified by Visa or MasterCard about specific cards that were potentially compromised in the Target breach.

This institution has issued a grand total of more than 120,000 debit and credit cards to its customers, but my source told me the tiny bank had not yet heard anything from the card associations about specific cards that might have been compromised as a result of the Target breach. My source was anxious to determine how many of the bank's cards were most at risk of being used for fraud, and how many should be proactively canceled and re-issued to customers. The bank wasn't exactly chomping at the bit to re-issue the cards; that process costs around $3 to $5 per card, but more importantly it didn't want to unnecessarily re-issue cards at a time when many of its customers would be racing around to buy last-minute Christmas gifts and traveling for the holidays.

On the other hand, this bank had identified nearly 6,000 customer cards '-- almost 5 percent of all cards issued to customers '-- that had been used at Target stores nationwide during the breach window described by the retailer.

''Nobody has notified us,'' my source said. ''Law enforcement hasn't said anything, our statewide banking associations haven't sent anything out'...nothing. Our senior legal counsel today was asking me if we have positive confirmation from the card associations about affected cards, but so far we haven't gotten anything.''

When I mentioned that a big bank I'd spoken with had found a 100 percent overlap with the Target breach window after purchasing its available cards off a particular black market card shop called rescator[dot]la, my source at the small bank asked would I be willing to advise his fraud team on how to do the same?

CARD SHOPPING

Ultimately, I agreed to help in exchange for permission to write about the bank's experience without actually naming the institution. The first step in finding any of the bank's cards for sale was to browse the card shop's remarkably efficient and customer-friendly Web site and search for the bank's ''BINs''; the Bank Identification Number is merely the first six digits of a debit or credit card, and each bank has its own unique BIN or multiple BINs.

According to the ''base'' name for all stolen cards sold at this card shop, the proprietor sells only cards stolen in the Target breach.

A quick search on the card shop for the bank's BINs revealed nearly 100 of its customers's cards for sale, a mix of MasterCard dumps ranging in price from $26.60 to $44.80 apiece. As one can imagine, this store doesn't let customers pay for purchases with credit cards; rather, customers can ''add money'' to their accounts using a variety of irreversible payment mechanisms, including virtual currencies like Bitcoin, Litecoin, WebMoney and PerfectMoney, as well as the more traditional wire transfers via Western Union and MoneyGram.

With my source's newly registered account funded via wire transfer to the tune of USD $450, it was time to go shopping. My source wasn't prepared to buy up all of the available cards that match his institution's BINs, so he opted to start with a batch of 20 or so of the more recently-issued cards for sale.

Like other card shops, this store allows customers to search for available cards using a number of qualifications, including BIN; dozens of card types (MasterCard, Visa, et. al.); expiration date; track type; country; and the name of the financial institution that issued the card.

A graphic advertisement for stolen cards sold under the ''Tortuga'' base.

A key feature of this particular dumps shop is that each card is assigned to a particular ''base.'' This term is underground slang that refers to an arbitrary code word chosen to describe all of the cards stolen from a specific merchant. In this case, my source at the big bank had said all of the cards his team purchased from this card shop that matched Target's N0v. 27 '' Dec. 15 breach window bore the base name Tortuga, which is Spanish for ''tortoise'' or ''turtle.''

Indeed, shortly after the Target breach began, the proprietor of this card shop '-- a miscreant nicknamed ''Rescator'' and a key figure on a Russian-language cybercrime forum known as ''Lampeduza'' '-- was advertising a brand new base of one million cards, called Tortuga.

Rescator even created a graphical logo in the Lampeduza forum's typeface and style, advertising ''valid 100% rate,'' and offering a money-back guarantee on any cards from this ''fresh'' base that were found to have been canceled by the card issuer immediately after purchase. In addition, sometime in December, this shop ceased selling cards from other bases aside from those from the Tortuga base. As the month wore on, new Tortuga bases would be added to shop, with each base incrementing by one with almost every passing day (e.g., Tortuga1, Tortuga2, Tortuga3, etc.).

Another fascinating feature of this card shop is that it appears to include the ZIP code and city of the store from which the cards were stolen. One fraud expert I spoke with who asked to remain anonymous said this information is included to help fraudsters purchasing the dumps make same-state purchases, thus avoiding any knee-jerk fraud defenses in which a financial institution might block transactions out-of-state from a known compromised card.

The New England bank decided to purchase 20 of its own cards from this shop, cards from Tortuga bases 6-9, and Tortuga 14 and 15. The store's ''shopping cart'' offers the ability to check the validity of each purchased card. Any cards that are checked and found to be invalid automatically get refunded. A check of the cards revealed that just one of the 20 had already been canceled.

The bank quickly ran a fraud and common point-of-purchase analyses on each of the 19 remaining cards. Sure enough, the bank's database showed that all had been used by customers to make purchases at Target stores around the country between Nov. 29 and Dec. 15.

''Some of these already have confirmed fraud on them, and a few of them were actually just issued recently and have only been used at Target,'' my source told me. Incredibly, a number of the cards were flagged for fraud after they were used to make unauthorized purchases at big box retailers, including '-- wait for it '-- Target. My source explained that crooks often use stolen dumps to purchase high-priced items such as Xbox consoles and high-dollar amount gift cards, goods that can be fenced, auctioned or otherwise offloaded quickly and easily for cash.

My source said his employer isn't yet sure which course of action it will take, but that it's likely the bank will re-issue some or all of the 5,300+ cards affected by the Target breach '-- most likely sometime after Dec. 25.

The bank is unconcerned that its cards compromised in the Target breach might be used for online shopping fraud because the stolen data does not include the CVV2 '-- the three digit security code printed on the backs of customer cards. Most online merchants require customers to supply the CVV2 as proof that they posses the legitimate, physical card for the corresponding account that is being used to fund the online purchase.

Update, 5:20 p.m. ET: In a message to consumers, Target CEO Gregg Steinhafel said Target would be offering free credit monitoring for affected customers. Not sure how credit monitoring helps with this specific breach, but at any rate here's the rest of his statement:

''Yesterday we shared that there was unauthorized access to payment card data at our U.S. stores. The issue has been identified and eliminated. We recognize this has been confusing and disruptive during an already busy holiday season. Our guests' trust is our top priority at Target and we are committed to making this right.

We want our guests to understand that just because they shopped at Target during the impacted time frame, it doesn't mean they are victims of fraud. In fact, in other similar situations, there are typically low levels of actual fraud. Most importantly, we want to reassure guests that they will not be held financially responsible for any credit and debit card fraud. And to provide guests with extra assurance, we will be offering free credit monitoring services. We will be in touch with those impacted by this issue soon on how and where to access the service.

We understand it's been difficult for some guests to reach us via our website and call center. We apologize and want you to understand that we are experiencing unprecedented call volume. Our Target teams are working continuously to build capacity and meet our guests' needs.

We take this crime seriously. It was a crime against Target, our team members, and most importantly, our guests. We're in this together, and in that spirit, we are extending a 10% discount '' the same amount our team members receive '' to guests who shop in U.S. stores on Dec. 21 and 22. Again, we recognize this issue has been confusing and disruptive during an already busy holiday season. We want to emphasize that the issue has been addressed and let guests know they can shop with confidence at their local Target stores.''

Tags: ATM, BINs, Bitcoin, card shop, dumps, Litecoin, mastercard, moneygram, PerfectMoney, PIN, target, target credit card hack, target data breach, tortuga, tortuga base, Visa, webmoney, western union

This entry was posted on Friday, December 20th, 2013 at 10:06 am and is filed under Other. You can follow any comments to this entry through the RSS 2.0 feed. You can skip to the end and leave a comment. Pinging is currently not allowed.

------------------------------------------------

Sources: Target Investigating Data Breach '-- Krebs on Security

Link to Article

Archived Version

Sun, 22 Dec 2013 07:20

Nationwide retail giant Target is investigating a data breach potentially involving millions of customer credit and debit card records, multiple reliable sources tell KrebsOnSecurity. The sources said the breach appears to have begun on or around Black Friday 2013 '-- by far the busiest shopping day the year.

Update, Dec. 19: 8:20 a.m. ET: Target released a statement this morning confirming a breach, saying that 40 million credit and debit card accounts may have been impacted between Nov. 27 and Dec. 15, 2013.

Original story;

According to sources at two different top 10 credit card issuers, the breach extends to nearly all Target locations nationwide, and involves the theft of data stored on the magnetic stripe of cards used at the stores.

Minneapolis, Minn. based Target Brands Inc. has not responded to multiple requests for comment. Representatives from MasterCard and Visa also could not be immediately reached for comment.

Both sources said the breach was initially thought to have extended from just after Thanksgiving 2013 to Dec. 6. But over the past few days, investigators have unearthed evidence that the breach extended at least an additional week '-- possibly as far as Dec. 15. According to sources, the breach affected an unknown number of Target customers who shopped at the company's bricks-and-mortar stores during that timeframe.

''The breach window is definitely expanding,'' said one anti-fraud analyst at a top ten U.S. bank card issuer who asked to remain anonymous. ''We can't say for sure that all stores were impacted, but we do see customers all over the U.S. that were victimized.''

There are no indications at this time that the breach affected customers who shopped at Target's online stores. The type of data stolen '-- also known as ''track data'' '-- allows crooks to create counterfeit cards by encoding the information onto any card with a magnetic stripe. If the thieves also were able to intercept PIN data for debit transactions, they would theoretically be able to reproduce stolen debit cards and use them to withdraw cash from ATMs.

It's not clear how many cards thieves may have stolen in the breach. But the sources I spoke with from two major card issuers said they have so far been notified by one of the credit card associations regarding more than one million of cards total from both issuers that were thought to have been compromised in the breach. A third source at a data breach investigation firm said it appears that ''when all is said and done, this one will put its mark up there with some of the largest retail breaches to date.''

Some of the largest retailer breaches to date may help explain what happened in this case. In 2007, retailer TJX announced that its systems had been breached by hackers. The company later learned that thieves had used the store's wireless networks to access systems at its Massachusetts headquarters that were used to store data related to payment card, check and return transactions at stores across the country, and that crooks had made off with data from more than 45 million customer credit and debit cards.

In 2009, credit card processor Heartland Payment Systems disclosed that thieves had broken into is internal card processing network, and installed malicious software that allowed them to steal track data on more than 130 million cards.

This is likely to be a fast-moving story. Stay tuned for updates as they become available.

Have you seen:Cards Stolen in Target Breach Flood Underground Markets'''...Credit and debit card accounts stolen in a recent data breach at retail giant Target have been flooding underground black markets in recent weeks, selling in batches of one million cards and going for anywhere from $20 to more than $100 per card, KrebsOnSecurity has learned.

Tags: target black friday breach, target data breach

This entry was posted on Wednesday, December 18th, 2013 at 2:33 pm and is filed under Other. You can follow any comments to this entry through the RSS 2.0 feed. You can skip to the end and leave a comment. Pinging is currently not allowed.

------------------------------------------------

Duck Dynasty's Phil Robertson and family lash back at A&E | Mail Online

Link to Article

Archived Version

Sat, 21 Dec 2013 21:13

Phil Roberston and his family believe that A & E are discriminating against them for their deeply seated 'Christian beliefs''You have to ask yourself, why this interview happened and why it ever became public,' said a source close to the familyDespite the star's suspension, the Robertson family has a merchandise empire that is estimated by Forbes to be worth about $400million - and their deal with Walmart makes up around half of thisBy Will Payne

PUBLISHED: 02:43 EST, 21 December 2013 | UPDATED: 10:49 EST, 21 December 2013

3,066shares

512

Viewcomments

Duck Dynasty star Phil Robertson and his family believe they have been 'hung out to dry' by TV network A&E after he was suspended for homophobic comments made in a magazine interview, MailOnline can reveal.

Sources within the close-knit Louisiana clan say they are convinced A&E are manipulating the controversial situation to bring them '' and particularly Robertson '' back into line after Television executives grew tired of the family pushing their deeply-held, Christian beliefs.

They also think the network could have done something to stop the controversial GQ article being made public, because an A&E representative was present during the interview with patriarch, Roberston, 67.

Scroll down for videos

Phil Robertson and his family feel that A & E should never have publicized the controversial interview

A source close to the family, who asked not to be named, told MailOnline: 'You have to ask yourself, why this interview happened and why it ever became public. Someone from A&E was there and was aware of the kind of answers Phil was giving.

'But despite that, they didn't ever try to stop it or control it. Instead, they let it hit the headlines and then released a statement condemning it.

'It is our belief that they knew what was going to happen and then used the situation to exercise control over Phil.

'It is our understanding that when the TV executives came up with the concept for the show they wanted it to be a case of people laughing at a bunch of backward rednecks.

'But when it didn't turn out like that and people actually started identifying with the way the family behaved and were laughing with them, not at them, they became uncomfortable. It did not sit will with the New York TV types.

Old school: Suspended Phil on Duck Dynasty

Family values: The Robertson family feels as though they are being discriminated against for their deeply rooted Christian beliefs

'We believe they were also uncomfortable with the family's insistence that there would be a strong religious presence in the show. They knew Phil was the driving force behind this and we think they have used this situation to bring him in line so they could steer the show back down the path they originally intended for it.

'But they may have underestimated how united the family are and how committed they are to their beliefs. They also didn't realize how much support Phil would get from the public, so things have backfired on them.'

The controversy began after outrageous extracts from Robertson's interview for the January edition of GQ were made public. The outdoorsman was quoted as saying: 'It seems like, to me, a vagina -- as a man -- would be more desirable than a man's anus.

'That's just me. I'm just thinking: There's more there! She's got more to offer. I mean, come on, dudes! You know what I'm saying? But hey, sin: It's not logical, my man. It's just not logical.'When asked what he thought was sinful, Robertson replied: 'Start with homosexual behavior and just morph out from there. Bestiality, sleeping around with this woman and that woman and that woman and those men.'

The Duck Dynasty trailer sits outside of the Duck Commander Store in West Monroe on Friday

A&E suspended him on Wednesday and released a statement, saying: 'We are extremely disappointed to have read Phil Robertson's comments in GQ, which are based on his own personal beliefs and are not reflected in the series 'Duck Dynasty'.

'His personal views in no way reflect those of A&E Networks, who have always been strong supporters and champions of the LGBT community. The network has placed Phil under hiatus from filming indefinitely.'

But on Thursday the family issued their own response which suggested they would be prepared to walk away from the highly lucrative reality show, which regularly pulls in more than 12 million viewers.They said: 'While some of Phil's unfiltered comments to the reporter were coarse, his beliefs are grounded in the teachings of the Bible. Phil is a Godly man who follows what the Bible says are the greatest commandments: ''Love the Lord your God with all your heart'' and ''Love your neighbor as yourself.'' Phil would never incite or encourage hate.

A sign supporting A & E Duck Dynasty star Phil Robertson sits at the corner of Vernon Drive and Washington Street in West Monroe

'We are disappointed that Phil has been placed on hiatus for expressing his faith, which is his constitutionally protected right. We have had a successful working relationship with A&E but, as a family, we cannot imagine the show going forward without our patriarch at the helm. We are in discussions with A&E to see what that means for the future of Duck Dynasty.'

The family source added to this, telling MailOnline: 'We believe in the word of the Bible exactly as it is written and we will call a sin a sin and a sinner a sinner. But we are all sinners, every one of us and we believe in redemption and that opening yourself up to Jesus Christ will save you.'That is what Phil believes and that will not change. We are sorry if that has offended anyone, because that was never our intention. We believe in love and truth and that is it.'Multi-millionaire Robertson's incendiary comments have been slammed by many, including gay-rights groups.

Duck commander Phil Robertson says homosexuals 'invent ways of...

GLAAD spokesman Wilson Cruz was first to condemn him, saying: 'Phil and his family claim to be Christian, but Phil's lies about an entire community fly in the face of what true Christians believe.'He clearly knows nothing about gay people or the majority of Louisianans '-- and Americans '-- who support legal recognition for loving and committed gay and lesbian couples.'

But Cruz's views certainly aren't reflected in the family's home town of West Monroe. The Robertson's are absolutely loved and revered in the deeply religious north-western Louisiana city.The family were already wealthy before their reality show, making their money from the Duck Commander business which sells hunting equipment. Phil Robertson lives in a huge gated compound on the edge of town and his son Willie owns a gigantic lakeside property.

They have employed dozens of locals for years and now their empire has grown, they provide even more jobs to the town's people. That has cemented their popularity and since the homophobia scandal broke, a number of make-shift signs have been constructed offering backing to Robertson.On Friday cars honked their horns in support as they drove passed one erected on the edge of town.

The Whites Ferry Road Church of Christ where the Robertson Family worhship

Their presence in West Monroe is inescapable, with billboards and posters celebrating them everywhere. Last weekend, around 30,000 people packed the downtown area for the 'Duck Commander Christmas Parade'. People travelled from all over the country to celebrate the festive season with the family, filling every hotel room in town.

Phil's son Willie owns a massive downtown restaurant, which is always packed and there is a huge gift store just down the road, constantly filled with fans, eager to get their hands on Duck Commander merchandise.

The controversy that has engulfed the family this week has done nothing to put a dent in business, if anything it has given it a boost.

The Madrid family drove two hours from Alexandria to show their solidarity and snap up some trademark duck calls for an upcoming hunting trip. Mother-of-two Kimberly said: 'We are Christians and we completely support Phil.

Images of ducks tatter street lamps in downtown Monroe in support of Robertson

'This country has a proud history of freedom of speech and I believe Phil is the one who is being persecuted, because he has lost his jobs because of his religious beliefs.

'The spokesman for GLADD said Phil wasn't representing the people of Louisiana, but I don't know one person who is not behind him. We will not be watching A&E again.'

Another customer, Bernard Wolleson said: 'I think you would have to get out of Louisiana, Mississippi, Arkansas and Alabama to find anyone who does not support Phil.

'I am supportive of religious freedom, regardless of the faith and that is what is at issue. They knew he was outspoken when they hired him. What he said may have sounded crude, but I believe his intent was right.'

Just days after the scandal broke, rather than hide away; Phil Robertson went to his local church, White's Ferry Road church to take part in a prayer meeting.

He is actually a very prominent elder there and his parishioners are completely behind him. On Friday Church secretary Luanne Watts told MailOnline they had been bombarded with calls and emails from American's showing their support.

She said: 'What has happened is a blessing. Phil believes in the word of God and he will not shift from that.

'We have had hundreds of messages from people all over the country and I think out of all of them only one email has been negative.

Kimberly Madrid of Alexandria, La. discusses her support of Duck Dynasty Star Phil Robertson while shopping at the Duck Commander Store with sons Nathaniel, 12, and Matthew, 9

'I went to school with his boys, so I have known him for years. He is a great man and his faith is the most important thing in his life. He is here every Wednesday and Sunday, to give sermons, or take prayer groups. He will be here this Sunday as well.

'We are all completely behind him. You will struggle to find anyone in town who does not support him.'And that view seems to be held by many Americans. On Thursday MailOnline revealed Walmart had sold out of their money-spinning Duck Dynasty range.

The Robertson family has a merchandise empire that is estimated by Forbes to be worth about $400million - and their deal with Walmart makes up around half of this.

The chain sells a huge array of Duck Dynasty merchandise- from T-shirts to camo bedding, posters, watches, toy trucks, camo chairs, clothing, jewellery and even bottle openers.

Walmart announced at their annual shareholders meeting that the best-selling item of apparel for both men and women this year was the reality show's T-shirt, according to Forbes.

Forbes writer Claire O'Connor said: 'When I was down in Arkansas for this Walmart meeting, you really do marvel at the amount of people who are wearing these Duck Dynasty T-shirts and hats.

'There are kid's pajamas, there is camo bedding and you probably won't be surprised to hear that they sell Duck Dynasty prayer devotionals.'

Aside from their continued commercial success, an online petition called #IstandwithPhil demanding Robertson's reinstatement has already attracted almost 140,000 signatures.

Share or comment on this article

Robertson Family '' ''Phil Was Set Up''

Link to Article

Archived Version

Source: The Ulsterman Report

Sat, 21 Dec 2013 21:08

Many more behind the scenes details are now emerging regarding the A&E network's recent firing of Duck Dynasty patriarch Phil Robertson over words he spoke regarding his views on his faith and homosexuality in a GQ interview published this past week.

The Robertson clan is a large, but close knit group who have long been open regarding their faith in God and Christ, and the always present dangers of sin.

______________________________________________

This weekend, the Robertson family, after several days of saying very little regarding the controversy, is now speaking out and lining up firmly alongside the Duck Commander himself, Phil Robertson.

A&E is telling reporters they warned Phil to ''tone down'' his religious themed commentary in recent months. It appears Phil was unwilling to do so. A source within the Robertson family told the media A&E was already aware of the controversial GQ interview weeks earlier, and could easily have pulled it '' even stating their was an A&E representative at the interview itself.

That appears quite plausible given the hundreds of millions of dollars the Ducky Dynasty empire now represents for the cable network and its ownership, The Hearst Corporation and Disney. This same family source made it clear that A&E had originally agreed to the Duck Dynasty show believing it would make fun of ''rednecks'', and that executives were first perplexed, and then alarmed that instead, the Robertson family became widely admired by millions of viewers for the faith and family message of each episode, and that this recent controversy is nothing more than the network trying to ''bring Phil in line.''

We believe they were also uncomfortable with the family's insistence that there would be a strong religious presence in the show. They knew Phil was the driving force behind this and we think they have used this situation to bring him in line so they could steer the show back down the path they originally intended for it.

As for Phil himself, he has spent the last few days working at the Whites Ferry Road Church of Christ that he and his family attend. Phil is a longtime elder of that church, and according to reports, has a congregation firmly behind his right to speak to his faith, especially when asked by a reporter to do so.

I am supportive of religious freedom, regardless of the faith and that is what is at issue. They knew he was outspoken when they hired him. What he said may have sounded crude, but I believe his intent was right.'

Just days after the scandal broke, rather than hide away; Phil Robertson went to his local church, White's Ferry Road church to take part in a prayer meeting.

He is actually a very prominent elder there and his parishioners are completely behind him. On Friday Church secretary Luanne Watts told MailOnline they had been bombarded with calls and emails from American's showing their support.

She said: 'What has happened is a blessing. Phil believes in the word of God and he will not shift from that.

'We have had hundreds of messages from people all over the country and I think out of all of them only one email has been negative.

LINK

________________________________________________________

''Fellow patriots take notice, Mr. Ulsterman has penned prophecy!''

-Dr. L. Darryl Armstrong

40% OFF for the Christmas season!

LINK

''First they came for their thoughts. Then they came for their guns. Then they came for their lives'...''

DOMINATUS

''The almost-prophetic characterization of the government types and their approach is enough to keep readers awake''far into the night.

Read it and be aware.'' -MERLYN

LINK

Duck Dynasty's Phil Robertson Gives Drew Magary a Tour

Link to Article

Archived Version

Sat, 21 Dec 2013 21:29

Let's start with the crossbow, because the crossbow is huge. I'm sitting in the passenger seat of a camo-painted ATV, rumbling through the northern Louisiana backwoods with Phil Robertson, founder of the Duck Commander company, patriarch at the heart of A&E's smash reality hit Duck Dynasty, and my tour guide for the afternoon. There are seat belts in this ATV, but it doesn't look like they've ever been used. Phil is not wearing one. I am not wearing one, because I don't want Phil to think I'm a pussy. (Too late!) The crossbow'--a Barnett model equipped with a steel-tipped four-blade broadhead arrow'--is perched on the dash between us. It looks like you could shoot through a goddamn mountain with it.

''That'll bury up in you and kill you dead,'' Phil says.

The bow is cocked and loaded, just in case a deer stumbles in front of us and we need to do a redneck drive-by on the poor bastard, but the safety is on. SAFETY FIRST. Still, Phil warns me, ''You don't want to be bumping that.''

As we drive out into the woods, past a sign that reads parish maintenance ends, Phil is telling me all about the land around us and how the animals are a glorious gift from God and how blowing their heads off is part of His plan for us.

''Look at this,'' he says, gesturing to the surrounding wilderness. ''The Almighty gave us this. Genesis 9 is where the animals went wild, and God gave them wildness. After the flood, that's when he made animals wild. Up until that time, everybody was vegetarian. After the flood, he said, 'I'm giving you everything now. Animals are wild.'''

There's a fly parked on Phil's long beard. It's been there the whole ride, and I desperately want to pluck it out, but I decide against it. Along with the crossbow, there's a loaded .22-caliber rifle rattling around in the footwell. And yet, much like the 14 million Americans who Nielsen says tune in to Duck Dynasty every week'--over 2 million more than the audience for the Breaking Bad finale'--I am comfortable here in these woods with Phil and his small cache of deadly weaponry. He is welcoming and gracious. He is a man who preaches the gospel of the outdoors and, to my great envy, practices what he preaches. He spends most of his time out here, daydreaming about what he calls a ''pristine earth'': a world where nothing gets in the way of nature or the hunters who lovingly maintain it. No cities. No buildings. No highways.

Oh, and no sinners, too. So here's where things get a bit uncomfortable. Phil calls himself a Bible-thumper, and holy shit, he thumps that Bible hard enough to ring the bell at a county-fair test of strength. If you watch Duck Dynasty, you can hear plenty of it in the nondenominational supper-table prayer the family recites at the end of every episode, and in the show's no-cussing, no-blaspheming tone. But there are more things Phil would like to say'--''controversial'' things, as he puts it to me'--that don't make the cut. (This March, for instance, he told the Christian-oriented Sports Spectrum magazine that he didn't approve of A&E editing out ''in Jesus'' from a family prayer scene, even though A&E says that the phrase has been uttered in at least seventeen episodes.)

Out here in these woods, without any cameras around, Phil is free to say what he wants. Maybe a little too free. He's got lots of thoughts on modern immorality, and there's no stopping them from rushing out. Like this one:

''It seems like, to me, a vagina'--as a man'--would be more desirable than a man's anus. That's just me. I'm just thinking: There's more there! She's got more to offer. I mean, come on, dudes! You know what I'm saying? But hey, sin: It's not logical, my man. It's just not logical.''

Perhaps we'll be needing that seat belt after all.

···

The Duck Dynasty origin story is the mighty river from which all other Robertson-family stories flow. And it is an awesome story, one that improves the more it is told, so here is my stab at it: Phil Robertson grew up bone poor in the northwest corner of this state'--a place where Cajun redneck culture and Ozark redneck culture intersect'--to a manic-depressive mother and a roughneck father. He was a star quarterback in high school and earned a scholarship to play at Louisiana Tech, but quit after one season because football interfered with duck-hunting season. The guy who took his roster spot at Tech was Terry Bradshaw, because that's how these kinds of stories go.

Phil On Growing Up in Pre-Civil-Rights-Era Louisiana''I never, with my eyes, saw the mistreatment of any black person. Not once. Where we lived was all farmers. The blacks worked for the farmers. I hoed cotton with them. I'm with the blacks, because we're white trash. We're going across the field.... They're singing and happy. I never heard one of them, one black person, say, 'I tell you what: These doggone white people''--not a word!... Pre-entitlement, pre-welfare, you say: Were they happy? They were godly; they were happy; no one was singing the blues.''

According to Phil's autobiography'--a ghostwritten book he says he has never read'--he spent his days after Tech doing odd jobs and his evenings getting drunk, chasing tail, and swallowing diet pills and black mollies, a form of medicinal speed. In his midtwenties, already married with three sons, a piss-drunk Robertson kicked his family out of the house. ''I'm sick of you,'' he told his wife, Kay. But Robertson soon realized the error of his ways, begged Kay to come back, and turned over his life to Jesus Christ.

In 1972, with Jesus at the wheel, Robertson founded the Duck Commander company, which sold a line of custom-made duck-hunting calls that quickly became popular among avid hunters for their uncanny accuracy in replicating the sound of a real duck. He eventually sold half the company to his son Willie, now 41, and together they made a DVD series about the family's duck hunts, which led to a show on the Outdoor Channel, which led to Duck Dynasty on A&E, which led to everything blowing right the fuck up.

The show'--a reality sitcom showcasing the semiscripted high jinks of Phil, his brother ''Uncle Si,'' his four sons, Alan, Willie, Jase, and Jep, and the perpetually exasperated but always perfectly accessorized Robertson-family ladies'--has become the biggest reality-TV hit in the history of cable television, reportedly earning the family a holy shit''worthy $200,000-an-episode paycheck. It's a funny, family-friendly show, with ''skits that we come up with,'' as Phil describes the writing process. They plunder beehives. They blow up beaver dams. And when the Robertson-family ladies go up to a rooftop in a hydraulic lift, you just know that lift will ''accidentally'' get stuck and strand them.

But the show, whose fifth season premieres on January 15, is just one part of the family's pop-cultural dominance. In 2013 four books written (kind of!) by Robertson family members made the top ten on the New York Times nonfiction best-seller list. Another book'--penned by Jase Robertson and detailing his Christian rebirth at age 14, his struggle to forgive his father's past behavior, and his young daughter's struggle through five facial-reconstruction surgeries to overcome a severe cleft lip and palate'--is forthcoming and destined to make it five best-sellers. There's also a book of devotionals somewhere in there, along with Duck Dynasty''themed birthday cards, bobblehead dolls, camo apparel (pink camo for the ladies), Cajun-spice seasoning, car fresheners, iPhone games (from the press release: ''As players successfully complete the challenges, their beards grow to epic proportions and they start to transform from a yuppie into a full-blown redneck!''), and presumably some sort of camou flage home-pregnancy test.

It's easy to see the appeal. The Robertsons are immensely likable. They're funny. They look cool. They're ''smarter than they look,'' says sportswriter Mark Schlabach, who co-writes the family's books. And they are remarkably honest both with one another and with the viewing audience: Phil's old hell-raising, Si's traumatic stint in Vietnam, the intervention that the family staged for Jep when he was boozing and doing drugs in college (Phil placed him under house arrest for three months)'--all of it is out in the open. The more they reveal, the more people feel connected to them.

And then, of course, there is their faith, which plays no small role here. During the family's initial negotiations about the show with A&E, Jase told me, ''the three no-compromises were faith, betrayal of family members, and duck season.'' That refusal to betray their faith or one another has been a staple of every media article about the Robertson family. It's their elevator pitch, and it has made them into ideal Christian icons: beloved for staking out a bit of holy ground within the mostly secular, often downright sinful, pop culture of America.

···

Phil Robertson's house is located in the sticks about twenty miles outside the city of Monroe (pronounce it mun-roe). It's a rather small house'--the kind of place its owner would proudly call ''humble.'' The kitchen table is covered with big plastic tubs of cinnamon rolls and mini muffins. There are candy dishes filled to the brim, bricks of softening butter, and packages of jerky made from unknown animals, sent by unnamed fans. (I tried some, and it was awesome.) Just inside the front door, a giant flat-screen TV shows Fox News on mute at all times, and a bunch of big squishy sofas are arranged in a rectangle around it.

Si Robertson is sitting on the couch facing the TV. Jep Robertson, age 35, the youngest son, curls up in a recliner in the corner with a pistol strapped to his waist. He barely speaks, like a countrified Silent Bob. Jase, 44, and Willie share a love seat while Phil lounges barefoot on a camo-patterned recliner in the far corner of the room. Two dogs share the recliner's footrest with Phil's heavily callused bare feet. He has severe bunions, so his big toes jut in at forty-five-degree angles. The main TV room is cluttered with mismatched furniture and photos hung haphazardly on the walls. And Phil looks like part of the clutter himself, as if he'd been wedged into that recliner a while back by some absentminded homeowner who didn't know where else to put him.

------------------------------------------------

Remarks by Director David H. Petraeus at In-Q-Tel CEO Summit '-- Central Intelligence Agency

Link to Article

Archived Version

Sat, 21 Dec 2013 05:39

Excerpts from Remarks Delivered by Director David H. Petraeus at the In-Q-Tel CEO Summit (March 1, 2012)

Thank you for that kind introduction and warm welcome. It truly is a pleasure to be here with such an impressive mix of entrepreneurs, investors, and technologists'--in fact, some of you, I'm sure, have all three titles to your credit. I'm also pleased that we have such strong representation from across the US Intelligence Community.

I had a great discussion at dinner last night with a number of venture capitalists, and I'm looking forward to continuing those exchanges today with In-Q-Tel partner companies. Indeed, I'm very impressed with the innovative technologies In-Q-Tel is fostering development of in partnership with its portfolio companies. I can tell you that they are providing enormous support to us as we execute various critical intelligence missions. And, on behalf of the Agency, I thank you all for helping us perform at the very high level that the American people expect of us.

Well, up front, I know it takes a wide variety of expertise to come up with the truly amazing applications that are associated with In-Q-Tel and its portfolio. And when I thought of that, I recalled the story of the four engineers driving home from one of our partner startups in Silicon Valley'--a mechanical engineer, a chemical engineer, an electrical engineer, and a computer engineer. And, sure enough, while heading up the West Valley Freeway, their car broke down. This is a joke, by the way, which I don't quite get'--but my team assures me it is funny, so work with me please!

They of course immediately sought to determine the cause, and the mechanical engineer naturally said, ''Sounds to me as if the pistons have seized. We'll just have to strip down the engine.''

''I'm not sure about that,'' offered the chemical engineer. ''Seems to me the fuel might be contaminated. We should flush out the fuel system.''

''No,'' the electrical engineer replied, ''I think it's a grounding problem, or maybe a faulty plug lead. We need to check the wiring.''

They all then turned to the computer engineer, who had said nothing, and asked for his opinion.

''Well,'' he said, ''this is a tough one. How about if we all get out of the car and get back in again?''

Well, thanks for laughing. You know the deal'...at this stage in life, I'm only as good as the material they give me!

I'm often asked what I find most gratifying about my job'--which, by the way, is the best job in the world and, in my case, a pretty awesome entry-level position. But the reason being CIA Director is so much fun is the extraordinary people with whom I'm privileged to serve. The CIA truly is a national treasure, with a workforce unparalleled in my experience. Within our Directorate of Science and Technology, the operative trait is diabolical creativity. The ingenuity our people bring to our S&T work'--helped by folks like you, those with whom you work, and those you lead'--is world-class, and the value they add to our operations worldwide is immeasurable. And it's great to have the Director of Science & Technology, Glenn Gaffney, here with me. Our Chief Information Officer is also here, along with other DS&T deputies and the S&T equivalent from NSA.

Indeed, I've found that our technical capabilities often far exceed what you see in Tom Cruise films. But there are a few feats he can accomplish in the movies that we can't: we haven't figured out, for example, how to change an individual's fingerprints or eyeballs just yet'--but give us time.

In any event, our partnership with In-Q-Tel is essential to helping identify and deliver groundbreaking technologies with mission-critical applications to the CIA and to our partner agencies. We don't necessarily ask you to be diabolical'--you can leave that to us'--but your creativity is vital. So, again, I truly appreciate the opportunity to be here with you today for this exchange of ideas, and I appreciate you all being here for the annual In-Q-Tel gathering.

This morning, I'd like to discuss some of the top challenges that the CIA faces'--challenges that your work is helping us to meet.

To set the context at the strategic level, the Agency is engaged in a ''tug of war,'' if you will, between the need to lead our country's war against al-Qa'ida and its affiliates, and the need for global intelligence coverage'--all of this, of course, against the backdrop of tighter budgets.

As you know, our Agency has a global charter to collect intelligence. It's our job to ensure that challenges that arise in any corner of the world are not surprises to the President or to other policymakers. Certainly, we will continue relentlessly to pursue terrorists and support the troops in several different theaters. That is imperative, and the last year has seen considerable achievement in the fight against al-Qa'ida and its affiliates. But, to use the kids' soccer analogy, we cannot turn the counterterrorist fight into a game of magnetball, in which the leadership is always focused on the counterterror mission. Everyone can't flock to the ball and lose sight of the rest of the field'--the whole rest of the world.

And it's an enormous field to cover: again, the whole world, with proliferation of weapons and technology, cyber threats, counterintelligence threats, the next developments in the evolution of the Arab Spring, Iran, North Korea, China, illegal narcotics, emerging powers, non-state organizations, and even lone wolves. Our duty is nothing less than to be on top of every potential foreign challenge and opportunity facing the United States'--and we now have to do it without the steady budget growth we saw in the years after 9/11. And this is why my job is so intellectually stimulating.

Against this backdrop, transformational changes in the nature of intelligence work have driven us to adopt the kind of innovative technologies developed by the firms represented in this room. And I'd like to briefly discuss three major challenges of this new era: the utter transparency of the digital world, the enormous task of processing so-called Big Data, and the ever-greater need for speed.

First, given the digital transparency I just mentioned, we have to rethink our notions of identity and secrecy. In the digital world, data is everywhere, as you all know well. Data is created constantly, often unknowingly and without permission. Every byte left behind reveals information about location, habits, and, by extrapolation, intent and probable behavior. The number of data points that can be collected is virtually limitless'--presenting, of course, both enormous intelligence opportunities and equally large counterintelligence challenges. We must, for example, figure out how to protect the identity of our officers who increasingly have a digital footprint from birth, given that proud parents document the arrival and growth of their future CIA officer in all forms of social media that the world can access for decades to come. Moreover, we have to figure out how to create the digital footprint for new identities for some officers.

As you all know, exploiting the intelligence opportunities'--which is an easier subject to discuss in an unclassified setting than the counterintelligence challenges'--will require a new class of in-place and remote sensors that operate across the electromagnetic spectrum. Moreover, these sensors will be increasingly interconnected.

The current ''Internet of PCs'' will move, of course, toward an ''Internet of Things'''--of devices of all types'--50 to 100 billion of which will be connected to the Internet by 2020. As you know, whereas machines in the 19th century learned to do, and those in the 20th century learned to think at a rudimentary level, in the 21st century, they are learning to perceive'--to actually sense and respond. Key applications developed by our In-Q-Tel investment companies are focused on technologies that are driving the Internet of Things. These include:

Item identification, or devices engaged in tagging;Sensors and wireless sensor networks'--devices that indeed sense and respond;Embedded systems'--those that think and evaluate;And, finally, nanotechnology, allowing these devices to be small enough to function virtually anywhere.Items of interest will be located, identified, monitored, and remotely controlled through technologies such as radio-frequency identification, sensor networks, tiny embedded servers, and energy harvesters'--all connected to the next-generation Internet using abundant, low cost, and high-power computing'--the latter now going to cloud computing, in many areas greater and greater supercomputing, and, ultimately, heading to quantum computing.

In practice, these technologies could lead to rapid integration of data from closed societies and provide near-continuous, persistent monitoring of virtually anywhere we choose. ''Transformational'' is an overused word, but I do believe it properly applies to these technologies, particularly to their effect on clandestine tradecraft. Taken together, these developments change our notions of secrecy and create innumerable challenges'--as well as opportunities.

Secondly, the CIA and our Intelligence Community partners must be able to swim in the ocean of ''Big Data.'' Indeed, we must be world class swimmers'--the best, in fact. We are inundated by constantly evolving open sources of foreign information, such as social media, that can provide invaluable, real-time insights. The Arab Spring has been a case study in how these rich streams of data can speak volumes on how a breaking crisis is liable to develop. And our Open Source Center and social media folks are on it. Of course, making sense of today's massive quantities of unstructured data presents enormous challenges as well. For any given high-interest event, the ''digital dust'' to which we have access is being delivered by the equivalent of dump trucks!

The volume of Twitter and YouTube traffic in the continuing unrest in the Middle East offers an idea of what we're up against: at the start of the Arab Spring, there were 2,200 Tweets generated every second'--that equals some 190 million Tweets generated each day. And, since the beginning of the Arab Spring, those numbers have risen dramatically.

This ocean of Big Data has implications for both intelligence collection and intelligence analysis. For collection, having access to free and open information on so many topics that used to be denied to us allows our Agency to better focus our human intelligence effort'--which often involves high costs and risks'--on learning the key secrets that justify those costs and risks.

The implications of big data loom largest, of course, for our analytic effort. I'm convinced that the CIA has the greatest, most talented concentration of all-source intelligence analysts in the entire world; individuals unequaled in their ability to pull together the product of myriad sources of intelligence'--human, signals, imagery, liaison, and so on, in addition to open sources'--and to provide analysis with true insight. We place a high premium on knowledge, including regional and cultural expertise, and skills such as foreign language fluency, and fluency with applications that enable them. Indeed, we owe our analysts tools and systems that increasingly help them to give structure and meaning to the mountain of raw intelligence and to place it in proper context for the President and our policymakers.

Moreover, our analysts must discern the non-obvious relationships embedded deeply within different types of data: finding connections between a purchase here, a phone call there, a grainy video, customs and immigration information, various embedded meta-data, and so on'--and then making sense of it. Ultimately, if you combine the open-source feeds such as those I mentioned with the increasingly massive volumes of classified data we receive, it's clear that the CIA and our Community partners require new ways to organize and unify this universe of data'--to make it usable, to accelerate automation, and to enable data traceability, relevance, and security. In short, these solutions must lead to automated discovery, rather than depending on the right analyst asking the right question.

Cloud computing provides important new capabilities for performing analysis across all data, allowing our analysts and decisionmakers to ask ad-hoc analytic questions of Big Data in a quick, precise fashion. New cloud computing technologies developed by In-Q-Tel partner companies are driving analytic transformation in the way organizations store, access, and process massive amounts of disparate data via massively parallel and distributed IT systems.

I am very encouraged by what I've seen so far. In fact, we're excited about it. For example, among the analytic projects underway with In-Q-Tel startups is one that enables collection and analysis of worldwide social media feeds, along with projects that use either cloud computing or other methods to explore and analyze Big Data. These are very welcome additions to the initiatives we have underway to enable us to be the strongest swimmers in the ocean of Big Data.

Finally, and my third point, is that we need products that help us respond to threats at the speed our mission demands. Despite our success in preventing another major attack on our shores since 9/11, we still face a resilient enemy in al-Qa'ida and its affiliates, an enemy every bit as determined to attack our country and our allies as it has ever been, and an enemy becoming increasingly sophisticated. The stakes are very high, and, quite simply, we must derive ever greater speed for our work from the systems you provide. Over the past decade, we have achieved considerable progress along the continuum from responsive and reactive to predictive and preventive, and we must sustain that momentum.

''Connecting the dots'' may be one of biggest catch phrases of the last ten years, but it truly remains at the heart of our CT mission and many others. At the end of the day, that's how we got Bin Ladin. And In-Q-Tel companies are providing capabilities that allow our analysts to develop unique insights into seemingly intractable search-and-discovery challenges'--and to do it quickly, interactively, and securely.

We require speed not only in performing our mission, but in developing and fielding tools that are as state-of-the art when they arrive in the field as when they were designed. It used to be acceptable to take years to build a new capability. Now we're lucky if we have months between identifying a need and deploying a solution. Sometimes the deadline we're facing is only weeks'--or even days.

Industry's ability to rapidly prototype new products and get them to market'--especially our market'--is a skill that government simply cannot match. And so, in many cases, we rely on the private sector for the developmental speed that intelligence work requires. In-Q-Tel and its partner companies, through the Interface Center, help accelerate our application of technology'--and, consequently, our ability to meet our global mission.

Chris Darby and the In-Q-Tel team live inside the fence, as we say, a good bit of the time. And they have become expert at translating our requirements into language that partner companies understand. And, of course, what we need often anticipates a need in the commercial arena'--and that is why In-Q-Tel attracted more than $9 in venture capital for every $1 we put in.

I have boundless confidence in what the partnership between the CIA, our Intelligence Community colleagues, In-Q-Tel, and our partner companies can accomplish in helping us meet our global intelligence missions. There is, after all, no limit to what American ingenuity can achieve, whether in commerce, on the battlefield, or in the intelligence realm. Thanks in large part to your invaluable work, our officers enjoy an operational edge that our adversaries cannot hope to match'--though they are trying! And we have to stay Number One!

Working together, we can best meet the high expectations that the American people have of us, especially in wartime. And we can put our nation's greatest strengths to work against America's most dangerous enemies.

You have my personal commitment that we will continue to make our market more available and accessible to you. I strongly support the In-Q-Tel model, and I am one of its biggest boosters. That's why I'm here today, and that's why I have asked Glenn Gaffney, our Director for Science and Technology, to expand our outreach to the startup community.

So, thanks for being here today, thanks for what you and your firms do in helping the Agency to be diabolically clever, and thanks for helping to keep America's Intelligence Community at the forefront of global innovation.

In-Q-Tel

Link to Article

Archived Version

Sat, 21 Dec 2013 05:55

A.B. ''Buzzy'' Krongard serves as an outside director on the Global Board of DLA Piper. DLA Piper is one of the world's largest law firms with over 2,800 lawyers in 49 offices in 18 countries.

A.B. ''Buzzy'' Krongard serves as an outside director on the Global Board of DLA Piper. DLA Piper is one of the world's largest law firms with over 2,800 lawyers in 49 offices in 18 countries. In addition, he is the Lead Director of Under Armour Inc. where he chairs the Audit Committee. He is also a member of the Board of Iridium Satellite Communications Inc., Apollo Global Management, and In-Q-Tel. He serves as Interim Chairman of the Johns Hopkins Health System.

Krongard retired from the Central Intelligence Agency on November 30, 2004 where he had been Executive Director since March, 2001. Prior to this appointment, Krongard served as Counselor to the Director of Central Intelligence from February 2, 1998, after a 29-year career in investment banking. Krongard's CIA awards include the Distinguished Intelligence Medal, the Director's Medal, the Directorate of Operations Donovan Award and the Warren medallion. Krongard had previously worked in various capacities at Alex. Brown Incorporated, the nation's oldest investment banking firm. In 1991, he was elected as Chief Executive Officer and assumed the additional duties of Chairman of the Board in 1994. Upon the merger of Alex. Brown with Bankers Trust Corporation in September 1997, Krongard became Vice Chairman of the Board of Bankers Trust and served in such capacity until joining the CIA.

Krongard was involved in many industry and community activities. He served as Chairman of the Securities Industry Association in 1996 and was named the Outstanding Executive in the financial services industry in 1995 and 1996 by Financial World. In 1997, he received the Golden Plate Award from the American Academy of Achievement.

Krongard received an A.B. Degree with honors from Princeton University in 1958 and a Juris Doctor Degree with honors from the University of Maryland School of Law in 1975.

He served three years of active duty as an infantry officer in the United States Marine Corps and ended his career as a captain. His hobbies include scuba diving and martial arts, in which he holds a black belt and equivalent rankings in several disciplines. He was elected to the Lacrosse Hall of Fame in 1981. Krongard is a native of Baltimore, Maryland and resides in Lutherville, Maryland. He is married to the former Cheryl G. Gordon and has three sons and seven grandchildren. His club memberships include The Ivy Club (Princeton, N.J.), The Links (New York, NY), The Metropolitan Club (Washington, D.C.), The Baltimore Country Club (Baltimore, MD), The Green Spring Hounds (Baltimore, MD) , The Woodmont Rod and Gun Club (Hancock, MD) and the Rolling Rock Club (Ligonier, PA).

------------------------------------------------

NSA spied on EU antitrust official who sparred with US tech giants - CNET Mobile

Link to Article

Archived Version

Fri, 20 Dec 2013 18:33

A report in The New York Times pulls from Edward Snowden documents to give more details about agency surveillance of foreign officials and businesses, as well as humanitarian organizations.

Brazilian President Dilma Rousseff (left) has raised strong objections to the NSA's reported spying on oil company Petrobras. Today's Times story once again raises the issue of spying for economic advantage.

(Credit: Miguel Schincariol/AFP/Getty Images)The NSA and its British counterpart, the GCHQ, spied on the official in charge of the European Commission's antitrust office, which has threatened Google with large fines and has already levied punitive fees from Microsoft and Intel, a new report says.

Relying on documents provided by former NSA contractor Edward Snowden, The New York Times today gives "a much fuller portrait" of the intelligence agencies' interests, reporting that the allied services' targets from 2008 to 2011 have included not only Joaquin Almunia, the aforementioned antitrust official, but also an Israeli prime minister and defense minister; various other heads of state (and sometimes their families); the French oil and gas giant Total; Unicef, the United Nations' Children's Fund; and the UN Institute for Disarmament studies.

This particular set of documents also lists, "though in smaller numbers," targets associated with terrorism and other "more obvious" areas, the Times says.

The documents don't specify if the spying on Almunia was done at the behest of the NSA or the GCHQ, the Times reports, adding that when the paper contacted the antitrust official about the surveillance, he said he was "very upset."

The NSA, for its part, responded to the Times' queries by saying, "We do not use our foreign intelligence capabilities to steal the trade secrets of foreign companies on behalf of -- or give intelligence we collect to -- U.S. companies to enhance their international competitiveness or increase their bottom line."

The agency representative also said some economic spying was necessary. "The intelligence community's efforts to understand economic systems and policies, and monitor anomalous economic activities, are critical to providing policy makers with the information they need to make informed decisions that are in the best interest of our national security."

In a profile of the NSA last month, the Times said the agency had "an almost unlimited agenda," spying "routinely on friends as well as foes" not only to fight terrorism but also to "achieve 'diplomatic advantage' over such allies as France and Germany and 'economic advantage' over Japan and Brazil, among other countries."

And in October, Director of National Intelligence James Clapper said during a congressional hearing that monitoring of "leadership intentions" was a "hardy perennial" of the intelligence trade and one of the first things he learned in intelligence school back in 1963. He also answered "absolutely" when asked if US allies had spied on the states.

Nevertheless, revelations about the NSA's activities have caused a stir in Europe and elsewhere, and a report released this week by an investigative panel appointed by President Obama recommended stronger limits on monitoring foreign leaders, especially those of allied countries. The NSA told the Times in regard to today's story that it's reviewing how it coordinates on allied spying.

The executive director of M(C)decins du Monde, a relief organization that services war-torn areas and that was also spied on, told the Times that "there is absolutely no reason for our operations to be secretly monitored."

Read the Times report here.

M(C)decins du Monde - Wikipedia, the free encyclopedia

Link to Article

Archived Version

Sun, 22 Dec 2013 05:40

M(C)decins du Monde (MDM) or Doctors of the World, is a French non-governmentalhumanitarian aid organisation created in March 1980 by 15 French doctors, including Bernard Kouchner after he had left M(C)decins Sans Fronti¨res (MSF, Doctors Without Borders), the aid society which he had co-founded earlier in 1971. The impetus for the foundation of MDM was Kouchner's split with MSF over certain aspects of MSF's policies. For example, he felt that MSF was giving up its founding principle of t(C)moignage ("witnessing"), which refers to aid workers making the atrocities they observe known to the public. While MSF still practices this principle under certain conditions, the organization has moved closer to a more neutral approach as a consequence of experiences from the genocide in Rwanda in 1994. In contrast to that shift in MSF's policy, MDM maintains that humanitarian aid cannot be separated from politics, lest the aid become misused by politicians (e.g. by sending bombs, and then doctors). Another reason for Kouchner's split with MSF was an aid mission for Vietnameseboat people organized and led by Kouchner in 1980. While the mission was later considered to be successful, it was seen as a single-handed operation and not supported by the majority of MSF's leadership back then.

History[edit]Kouchner was president of MDM from 1980 to 1982. In 1989, the foundation of a second national MDM association in Spain paved the way for the creation of the international network of MDM. The MDM association in the United States founded in 1990 was the first non-European association. Currently, the international network of MDM consists of fifteen associations; they are in France (founded 1980), Spain (founded 1989), Greece (founded 1990), Italy and Switzerland (both founded 1993), Sweden (founded 1994), Cyprus (founded 1995 by Elena Theoharous[1]), Argentina (founded 1998), Belgium, Canada and Portugal (all founded in 1999), as well as in Germany, the United Kingdom, Japan, the Netherlands, and the US. The international network head office coordinates the network members from its office in Paris, France.

Operations[edit]MDM has been involved in about 300 projects in more than 80 countries. In contrast to MSF, which primarily focuses its work on emergency aid work, MDM is equally active in short-term emergency aid, reconstruction and rehabilitation aid as well as long-term development projects for a period of up to three years. MDM has around 7,000 members worldwide, around 360 paid staff members and about 6,700 volunteers, about 1,200 of them working on-site in the projects of the organization. The income in 2003 was about 43.6 million euros, of which about two-thirds came from private donations and one-third from public sources. Of these funds, about 41.6 million euros were spent for its work.

Incidents[edit]In September 2008, two MDM workers were kidnapped in the Ogaden region of Ethiopia, and later released.[2]

See also[edit]References[edit]External links[edit]

Doctors of the World - International network

Link to Article

Archived Version

Sun, 22 Dec 2013 05:38

Out of a desire to bring help to the victims of the Biafra (Nigerian province) war of independence, many doctors had joined the Red Cross. In 1971 a number of them opposed to maintaining the silence and neutrality required by the Red Cross created an association with more scope to speak up and to act, Doctors Without Borders.

At the end of the seventies a crisis was unfolding in Vietnam as people began to flee Vietnam in makeshift boats. Among these doctors, some were of the opinion that a ship had to be chartered with physicians and journalists in order to provide care to the boat people and to report on the human rights violations they were witnessing. The leadership of Doctors without Frontiers considered the operation too sensationalist. about a group of fifteen doctors decided to create a new association whose mandate was to both provide care and bear witness. Doctors of the World was thus born in France in March 1980.

' History of Doctors of the World's network

Setting up the first organisation launched a dynamic force which resulted in the creation of a number of Doctors of the World organisations in Europe, North and South America and Asia.

Doctors of the World United States: 1987 Doctors of the World Spain / M(C)dicos del Mundo: 1990 Doctors of the World Greece / Giatri tou Kosmou: 1990 Doctors of the World Italy / Medici del Mundo: 1993 Doctors of the World Switzerland / Medecins du Monde: 1993 Doctors of the World Cyprus / Yiatroi Tou Kosmou Kypros: 1995 Doctors of the World Sweden / L¤kare i V¤rlden : 1991 Doctors of the World Canada / M(C)decins du Monde : 1996 Doctors of the World Netherlands / Dokters van de Wereld: 1997 Doctors of the World Argentina / M(C)dicos del Mundo: 1998 Doctors of the World United Kingdom / Doctors of the World:1998 Doctors of the World Portuga/ Medicos do Mundo : 1999 Doctors of the World Belgium / M(C)decins du Monde : 1999 Doctors of the World Germany / Artze der Welt: 1999 Doctors of the World Japan: 2000

The mandate all of these organisation chose for themselves was to provide care to the most vulnerable populations and report on their situation. They are active throughout the world, through medical programmes in their own countries and abroad.

The organisations provide care to the most vulnerable without regard for sex, age, religion, ethnic origin or political philosophy.

Each organisation member of the International Network gathers doctors who volunteer their services. Actions are carried out with professionals generally from the medical field: doctors, surgeons, midwives, nurses, psychologists, and clinicians. However other types of expertisel are also necessary: coordinators, administrators, logisticians, social workers and specialists in human rights.

While remaining faithful to our mandate for ''humanitarian emergency response'', our original tenet, Doctors of the World gradually expanded its field intervention to incorporate rehabilitation, prevention and development programmes on the five continents.

In 1994, the growing number of conflicts together with the increased number of international organisations led the international network to set up regulatory bodies. An International Secretariat was created in 1995, it became the International Network Head Office in 2008 with a view toward coordinating our organisations' actions throughout the world, raise the quality of programmes thanks to field practice exchanges and coordination, meetings of actors, common testimony...

A few key dates

1969: Biafra crisis 1971: Creation of Doctors Without Borders 1979: Operation ''Island of Light'' in Vietnam 1980: Creation of Doctors of the World 1981: El Salvador: Airlifting 60 tons of food and medicines 1986: Creation of Doctors of the World domestic mission in France with the Parisian opening of a free clinic for social support and care. Opening of the first HIV screening centre. 1987: Creation of Doctors of the World United States 1987: Adoption of the ''droit d'ing(C)rence'' 1988: Creation of Doctors of the World Switzerland 1990: Adoption of the European Charter of Humanitarian Aid known as the Cracow Charter 1990: Creation of Doctors of the World Spain and Doctors of the World Greece 1993: Creation of Doctors of the World Italy 1994: Intervention in Rwanda 1994: Setting up of the first needle exchange programmes by MdM France 1995: Creation of Doctors of the World Cyprus and Doctors of the World Sweden 1995: Setting up of the International Secretariat 1996: Doctors of the World International Network obtained advisory status with the United Nations Economic and Social Council 1997: Assassination of three Spanish volunteers in Rwanda 1997: Creation of Doctors of the World Netherlands 1998: Creation of Doctors of the World Argentina and Doctors of the World United Kingdom 1998: Adoption of the slogan ''We fight all diseases, including injustice'' 1999: Interventions in Kosovo, Timor -Leste and Chechnya 1999: Creation of Artze der Welt Germany 2000: Creation of Doctors of the World Japan 2004: First interdelegation joint mission in Zimbabwe 2005: Interventions in Indonesia and Sri Lanka after the December 2004 : tsunami 2008 : setting up of International Network Head Office / Direction du R(C)seau International (DRI) in Paris and Madrid 2009 : DoW USA and Cyprus are closed 2010 : Haiti : all MdM join their work to help Haitian population

------------------------------------------------

$10m NSA contract with security firm RSA led to encryption 'back door' | World news | theguardian.com

Link to Article

Archived Version

Sat, 21 Dec 2013 01:15

As a key part of a campaign to embed encryption software that it could crack into widely used computer products, the National Security Agency arranged a secret $10m contract with RSA, one of the most influential firms in the computer security industry, Reuters has learned.

Documents leaked by the former NSA contractor Edward Snowden show that the NSA created and promulgated a flawed formula for generating random numbers, to create a "back door" in encryption products, the New York Times reported in September. Reuters later reported that RSA became the most important distributor of that formula by rolling it into a software tool called Bsafe that is used to enhance security in personal computers and many other products.

Undisclosed until now was that RSA received $10m in a deal that set the NSA formula as the preferred, or default, method for number generation in the BSafe software, according to two sources familiar with the contract. Although that sum might seem paltry, it represented more than a third of the revenue that the relevant division at RSA had taken in during the entire previous year, securities filings show.

The earlier disclosures of RSA's entanglement with the NSA already had shocked some in the close-knit world of computer security experts. The company had a long history of championing privacy and security, and it played a leading role in blocking a 1990s effort by the NSA to require a special chip to enable spying on a wide range of computer and communications products. RSA, which is now a subsidiary of the computer storage giant EMC Corp , urged customers to stop using the NSA formula after the Snowden disclosures revealed its weakness.

RSA and EMC declined to answer questions for this story, but RSA said in a statement: "RSA always acts in the best interest of its customers and under no circumstances does RSA design or enable any back doors in our products. Decisions about the features and functionality of RSA products are our own."

The NSA declined to comment.

The RSA deal shows one way the NSA carried out what Snowden's documents describe as a key strategy for enhancing surveillance: the systematic erosion of security tools. NSA documents released in recent months called for using "commercial relationships" to advance that goal, but did not name any security companies as collaborators.

The NSA came under attack this week in a landmark report from a White House panel appointed to review US surveillance policy. The panel noted that "encryption is an essential basis for trust on the Internet", and called for a halt to any NSA efforts to undermine it.

Most of the dozen current and former RSA employees interviewed said that the company erred in agreeing to such a contract, and many cited RSA's corporate evolution away from pure cryptography products as one of the reasons it occurred. But several said that RSA also was misled by government officials, who portrayed the formula as a secure technological advance.

"They did not show their true hand," one person briefed on the deal said of the NSA, asserting that government officials did not let on that they knew how to break the encryption.

Started by MIT professors in the 1970s and led for years by an ex-marine, Jim Bidzos, RSA and its core algorithm were named for the last initials of the three founders, who revolutionized cryptography. Little known to the public, RSA's encryption tools have been licensed by most large technology companies, which in turn use them to protect computers used by hundreds of millions of people.

At the core of RSA's products was a technology known as public key cryptography. Instead of using the same key for encoding and then decoding a message, there are two keys related to each other mathematically. The first, publicly available key is used to encode a message for someone, who then uses a second, private key to reveal it.

From RSA's earliest days, the US intelligence establishment worried it would not be able to crack well-engineered public key cryptography. Martin Hellman, a former Stanford researcher who led the team that invented the technique, said NSA experts tried to talk him and others into believing that the keys did not have to be as large as they planned.

The stakes rose when more technology companies adopted RSA's methods and internet use began to soar. The Clinton administration embraced the Clipper Chip, envisioned as a mandatory component in phones and computers to enable officials to overcome encryption with a warrant. RSA led a fierce public campaign against the effort, distributing posters with a foundering sailing ship and the words "Sink Clipper!"

A key argument against the chip was that overseas buyers would shun US technology products if they were ready-made for spying. Some companies say that is just what has happened in the wake of the Snowden disclosures.

The White House abandoned the Clipper Chip and instead relied on export controls to prevent the best cryptography from crossing US borders. RSA once again rallied the industry, and it set up an Australian division that could ship what it wanted.

"We became the tip of the spear, so to speak, in this fight against government efforts," Bidzos recalled in an oral history.

RSA and others claimed victory when export restrictions relaxed. But the NSA was determined to read what it wanted, and the quest gained urgency after the 11 September 2001 attacks.

RSA, meanwhile, was changing. Bidzos stepped down as chief executive in 1999 to concentrate on VeriSign, a security certificate company that had been spun out of RSA. The elite lab Bidzos had founded in Silicon Valley moved east to Massachusetts, and many top engineers left the company, several former employees said. And the BSafe toolkit was becoming a much smaller part of the company. By 2005, BSafe and other tools for developers brought in just $27.5m of RSA's revenue, less than 9% of the $310m total.

"When I joined there were 10 people in the labs, and we were fighting the NSA," said Victor Chan, who rose to lead engineering and the Australian operation before he left in 2005. "It became a very different company later on."

By the first half of 2006, RSA was among the many technology companies seeing the US government as a partner against overseas hackers. New RSA chief executive Art Coviello and his team still wanted to be seen as part of the technological vanguard, former employees say, and the NSA had just the right pitch. Coviello declined an interview request.

An algorithm called Dual Elliptic Curve, developed inside the agency, was on the road to approval by the National Institutes of Standards and Technology as one of four acceptable methods for generating random numbers. NIST's blessing is required for many products sold to the government and often sets a broader de facto standard. RSA adopted the algorithm even before NIST approved it. The NSA then cited the early use of Dual Elliptic Curve inside the government to argue successfully for NIST approval, according to an official familiar with the proceedings.

RSA's contract made Dual Elliptic Curve the default option for producing random numbers in the RSA toolkit. No alarms were raised, former employees said, because the deal was handled by business leaders rather than pure technologists.

"The labs group had played a very intricate role at BSafe, and they were basically gone," said labs veteran Michael Wenocur, who left in 1999.

Within a year, major questions were raised about Dual Elliptic Curve. Cryptography authority Bruce Schneier wrote that the weaknesses in the formula "can only be described as a back door".

After reports of the back door in September, RSA urged its customers to stop using the Dual Elliptic Curve number generator. But unlike the Clipper Chip fight two decades ago, the company is saying little in public, and it declined to discuss how the NSA entanglements have affected its relationships with customers.

The White House, meanwhile, says it will consider this week's panel recommendation that any efforts to subvert cryptography be abandoned.

------------------------------------------------

Edward Snowden doesn't show up once in Google's list of top 2013 searches

------------------------------------------------

Destroying the Right to Be Left Alone | American Civil Liberties Union

Link to Article

Archived Version

Sun, 22 Dec 2013 13:52

The NSA Isn't the Only Government Agency Exploiting Technology to Make Privacy Obsolete

This piece was originally published at TomDispatch, where it includes an introduction by the editor.

For at least the last six years, government agents have been exploiting an AT&T database filled with the records of billions of American phone calls from as far back as 1987. The rationale behind this dragnet intrusion, codenamed Hemisphere, is to find suspicious links between people with "burner" phones (prepaid mobile phones easy to buy, use, and quickly dispose of), which are popular with drug dealers. The secret information gleaned from this relationship with the telecommunications giant has been used to convict Americans of various crimes, all without the defendants or the courts having any idea how the feds stumbled upon them in the first place. The program is so secret, so powerful, and so alarming that agents "are instructed to never refer to Hemisphere in any official document," according to a recently released government PowerPoint slide.

You're probably assuming that we're talking about another blanket National Security Agency (NSA) surveillance program focused on the communications of innocent Americans, as revealed by the whistleblower Edward Snowden. We could be, but we're not. We're talking about a program of the Drug Enforcement Administration (DEA), a domestic law enforcement agency.

While in these last months the NSA has cast a long, dark shadow over American privacy, don't for a second imagine that it's the only government agency systematically and often secretly intruding on our lives. In fact, a remarkable traffic jam of local, state, and federal government authorities turn out to be exploiting technology to wriggle into the most intimate crevices of our lives, take notes, use them for their own purposes, or simply file them away for years on end.

"Technology in this world is moving faster than government or law can keep up," the CIA's Chief Technology Officer Gus Hunt told a tech conference in March. "It's moving faster I would argue than you can keep up: You should be asking the question of what are your rights and who owns your data."

Hunt's right. The American public and the legal system have been left in the dust when it comes to infringements and intrusions on privacy. In one way, however, he was undoubtedly being coy. After all, the government is an active, eager, and early adopter of intrusive technologies that make citizens' lives transparent on demand.

Increasingly, the relationship between Americans and their government has come to resemble a one-way mirror dividing an interrogation room. Its operatives and agents can see us whenever they want, while we can never quite be sure if there's someone on the other side of the glass watching and recording what we say or what we do -- and many within local, state, and federal government want to ensure that no one ever flicks on the light on their side of the glass.

So here's a beginner's guide to some of what's happening on the other side of that mirror.

You Won't Need a Warrant for That

Have no doubt: the Fourth Amendment is fast becoming an artifact of a paper-based world.

The core idea behind that amendment, which prohibits the government from "unreasonable searches and seizures," is that its representatives only get to invade people's private space -- their "persons, houses, papers, and effects" -- after it convinces a judge that they're up to no good. The technological advances of the last few decades have, however, seriously undermined this core constitutional protection against overzealous government agents, because more and more people don't store their private information in their homes or offices, but on company servers.

Consider email.

In a series of rulings from the 1970's, the Supreme Court created "the third-party doctrine." Simply stated, information shared with third parties like banks and doctors no longer enjoys protection under the Fourth Amendment. After all, the court reasoned, if you shared that information with someone else, you must not have meant to keep it private, right? But online almost everything is shared with third parties, particularly your private e-mail.

Back in 1986, Congress recognized that this was going to be a problem. In response, it passed the Electronic Communications Privacy Act (ECPA). That law was forward-looking for its day, protecting the privacy of electronic communications transmitted by computer. Unfortunately, it hasn't aged well.

Nearly three decades ago, Congress couldn't decide if email was more like a letter or a phone call (that is, permanent or transitory), so it split the baby and decreed that communications which remain on a third party's server -- think Google -- for longer than 180 days are considered abandoned and lose any expectation of privacy. After six months are up, all the police have to do is issue an administrative subpoena -- a legal request a judge never sees -- demanding the emails it wants from the service provider, because under ECPA they're considered junk.

This made some sense back when people downloaded important emails to their home or office computers and deleted the rest since storage was expensive. If, at the time, the police had wanted to look at someone's email, a judge would have had to give them the okay to search the computer where the emails were stored.

Email doesn't work like that anymore. People's emails containing their most personal information now reside on company computers forever or, in geek speak, "in the cloud." As a result, the ECPA has become a dangerous anachronism. For instance, Google's email service, Gmail, is nearly a decade old. Under that law, without a judge's stamp of approval or the user ever knowing, the government can now demand from Google access to years of a Gmail user's correspondence, containing political rants, love letters, embarrassing personal details, sensitive financial and health records, and more.

And that shouldn't be acceptable now that email has become an intimate repository of information detailing who we are, what we believe, who we associate with, who we make love to, where we work, and where we pray. That's why commonsense legislative reforms to the ECPA, such as treating email like a piece of mail, are so necessary. Then the police would be held to the same standard electronically as in the paper-based world: prove to a judge that a suspect's email probably contains evidence of a crime or hands off.

Law enforcement, of course, remains opposed to any such changes for a reason as understandable as it is undemocratic: it makes investigators' jobs easier. There's no good reason why a letter sitting in a desk and an email stored on Google's servers don't deserve the same privacy protections, and law enforcement knows it, which is why fear-mongering is regularly called upon to stall such an easy fix to antiquated privacy laws.

As Department of Justice Associate Deputy Attorney General James Bakerput it in April 2011, "Congress should also recognize that raising the standard for obtaining information under ECPA may substantially slow criminal and national security investigations." In other words, ECPA reform would do exactly what the Fourth Amendment intended: prevent police from unnecessarily intruding into our lives.

Nowhere to Hide

"You are aware of the fact that somebody can know where you are at all times, because you carry a mobile device, even if that mobile device is turned off," the CIA's Hunt explained to the audience at that tech conference. "You know this, I hope? Yes? Well, you should."

You have to hand it to Hunt; his talk wasn't your typical stale government presentation. At times, he sounded like Big Brother with a grin.

And it's true: the smartphone in your pocket is a tracking device that also happens to allow you to make calls, read email, and tweet. Several times every minute, your mobile phone lets your cell-phone provider know where you are, producing a detail-rich history of where you have been for months, if not years, on end. GPS-enabled applications do the same. Unfortunately, there's no way to tell for sure how long the companies hang onto such location data because they won't disclose that information.

We do know, however, that law enforcement regularly feasts on these meaty databases, easily obtaining a person's location history and other subscriber information. All that's needed to allow the police to know someone's whereabouts over an extended period is an officer's word to a judge that the records sought would aid an ongoing investigation. Judges overwhelmingly comply with such police requests, forcing companies to turn over their customers' location data. The reason behind this is a familiar one: law enforcement argues that the public has no reasonable expectation of privacy because location data is freely shared with service or app providers. Customers, the argument goes, have already waived their privacy rights by voluntarily choosing to use their mobile phone or app.

Police also use cell-phone signals and GPS-enabled devices to track people in real time. Not surprisingly, there is relatively little clarity about when police do this, thanks in part to purposeful obfuscation by the government. Since 2007, the Department of Justice has recommended that its U.S. attorneys get a warrant for real-time location tracking using GPS and cell signals transmitted by suspects' phones. But such "recommendations" aren't considered binding, so many U.S. Attorneys simply ignore them.

The Supreme Court has begun to weigh in but the issue is far from settled. InUnited States v. Jones, the justices ruled that, when officers attach a GPS tracking device to a car to monitor a suspect's movements, the police are indeed conducting a "search" under the Fourth Amendment. The court, however, stopped there, deciding not to rule on whether the use of tracking devices was unreasonable without a judge's say so.

In response to that incomplete ruling, the Justice Department drew up two post-Jones memos establishing guidelines for its agents and prosecutors regarding location-tracking technology. When the American Civil Liberties Union (ACLU) filed a Freedom of Information Act request for those guidelines, the Justice Department handed over all 111 pages, every one of them redacted -- an informational blackout.

The message couldn't be any clearer: the FBI doesn't believe Americans deserve to know when they can and cannot legally be tracked. Supreme Court Justice Sonia Sotomayor drove home what's at stake in her concurring decision in the Jones case. "Awareness that the Government may be watching chills associational and expressive freedoms," she wrote. "And the Government's unrestrained power to assemble data that reveal private aspects of identity is susceptible to abuse... [and] may 'alter the relationship between citizen and government in a way that is inimical to democratic society.'"

The ability of police to secretly track people with little or no oversight is a power once only associated with odious police states overseas. Law enforcement agencies in the United States, however, do this regularly and enthusiastically, and they do their best as well to ensure that no barriers will be thrown in their way in the near future.

Sting(ray) Operations

During one of his last appearances before Congress as FBI director, Robert Mueller confirmed what many insiders already assumed. Asked by Senator Chuck Grassley whether the FBI operates drones domestically and for what purpose, Mueller responded, "Yes, and for surveillance." This was a stunning revelation, particularly since most Americans associate drone use with robotic killing in distant lands.

And, Grassley followed up, had the FBI developed drone guidelines to ensure that American privacy was protected? The Bureau, Mueller replied, was in the beginning phase of developing them. Senator Dianne Feinstein, hardly a privacy hawk, seemed startled by the answer: "I think the greatest threat to the privacy of Americans is the drone, and the use of the drone, and the very few regulations that are on it today," she said.

The senator shouldn't have been shocked. The government's adoption of new intrusive technologies without bothering to publicly explore their privacy implications -- or any safeguards that it might be advisable to put in place first -- isn't an aberration. It's standard practice. As a result, Americans are put in the position of secretly subsidizing their own surveillance with their tax dollars.

In July, for example, the ACLU published a report on the proliferating use of automatic license-plate readers by police departments and state agencies across the country. Mounted on patrol cars, bridges, and overpasses, the cameras for these readers capture the images of every license plate in view and run them against databases for license plates associated with stolen cars or cars used in a crime. Theoretically, when there's a hit, police are alerted and someone bad goes to jail. The problems arise, however, when there's no hit. Most police departments decide to hang onto those license-plate images anyway, creating yet another set of vast databases of innocent people's location history that's easy to abuse.

Since technology almost always outpaces the law, regulations on license plate readers are often lax or nonexistent. Rarely do police departments implement data-retention time limits so that the license plates of perfectly innocent people are purged from their systems. Nor do they set up rules to ensure that only authorized officers can query the database when there's evidence that a particular license plate might be attached to a crime. Often there aren't even rules to prevent the images from being widely shared with other government agencies or even private companies. These are, in other words, systems which give law enforcement another secret way to track people without judicial oversight and are ripe for privacy abuse.

As is often the case with security technology -- for instance, full-body scanners at airports -- there's little evidence that license plate readers are worthwhile enough as crime fighting tools to compensate for their cost in privacy terms. Take Maryland. In the first five months of 2012, for every million license plates read in that state, there were just 2,000 "hits." Of those 2,000, only 47 were potentially associated with serious crimes. The vast majority were for minor regulatory violations, such as a suspended or revoked vehicle registration.

And then there's the Stingray, a device first used in our distant wars and so intrusive that the FBI has tried to keep it secret -- even from the courts. A Stingray mimics a cell-phone tower, tricking all wireless devices in an area to connect to it instead of the real thing. Police can use it to track suspects in real time, even indoors, as well as nab the content of their communications. The Stingray is also indiscriminate. By fooling all wireless devices in an area into connecting to it, the government engages in what is obviously an unreasonable search and seizure of the wireless information of every person whose device gets caught up in the "sting."

And when the federal government isn't secretly using dragnet surveillance technologies, it's pushing them down to state and local governments through Department of Homeland Security (DHS) grants. The ACLU of Northern California has, for example, reported that DHS grant funds have been used by state and local police to subsidize or purchase automated license plate readers, whose images then flow into federal databases. Similarly, the city of San Diego has used such funds to buy a facial recognition system and DHS grants have been used to install local video surveillance systems statewide.

In July, Oakland accepted $2 million in federal funds to establish an around-the-clock "Domain Awareness Center," which will someday integrate existing surveillance cameras and thermal imaging devices at the Port of Oakland with the Oakland Police Department's surveillance cameras and license plate readers, as well as cameras owned by city public schools, the California Highway Patrol, and other outfits and institutions. Once completed, the system will leverage more than 1,000 camera feeds across the city.

Sometimes I Feel Like Somebody's Watching Me

What makes high-tech surveillance so pernicious is its silent, magical quality. Historically, when government agents invaded people's privacy they had to resort to the blunt instruments of force and violence, either torturing the body in the belief it could unlock the mind's secrets or kicking down doors to rifle through a target's personal effects and communications. The revolution in communications technology has made such intrusions look increasingly sloppy and obsolete. Why break a skull or kick down a door when you can read someone's search terms or web-surfing history?

In the eighteenth century, philosopher Jeremy Bentham conceived of a unique idea for a prison. He called it a "panopticon." It was to be a place where inmates would be constantly exposed to view without ever being able to see their wardens: a total surveillance prison. Today, creating an electronic version of Bentham's panopticon is an increasingly trivial technological task. Given the seductive possibilities now embedded in our world, only strong legal protections would prevent the government from feeling increasingly free to intrude on our lives.

If anything, though, our legal protections are weakening and privacy is being devalued, which means that Americans with a well-developed sense of self-preservation increasingly assume the possibility of surveillance and watch what they do online and elsewhere. Those who continue to value privacy in a big way may do things that seem a little off: put Post-it notes over their computer cameras, watch what they tweet or post on Facebook, or write their emails as if some omnipresent eye is reading over their shoulders. Increasingly, what once would have been considered paranoid seems prescient -- self-defense and commonsense all rolled into one.

It's hard to know just what the cumulative effect will be of a growing feeling that nothing is truly private anymore. Certainly, a transparent life has the potential to rob an individual of the sense of security necessary for experimentation with new ideas and new identities without fear that you are being monitored for deviations from the norm. The inevitable result for many will be self-censorship with all its corrosive effects on the rights of free speech, expression, and association.

The Unknown Unknowns

Note that we've only begun a tour through the ways in which American privacy is currently under assault by our own government. Other examples abound. There is E-Verify's proposed giant "right-to-work" list of everyone eligible to work in the United States. There are law enforcement agencies that actively monitor social media sites like Facebook and Twitter. There are the Department of Homeland Security's research and development efforts to create cameras armed with almost omniscient facial recognition technology, not to speak of passports issued with radio frequency identificationtechnology. There are networked surveillance camera feeds that flow into government systems. There is NSA surveillance data that's finding its way into domestic drug investigations, which is then hidden by the DEA from defense lawyers, prosecutors, and the courts to ensure the surveillance data stream continues unchallenged.

And here's the thing: this is only what we know about. As former Defense Secretary Donald Rumsfeld once put it, "there are also unknown unknowns -- there are things we do not know we don't know." It would be the height of na¯vet(C) to believe that government organizations across this country -- from the federal to the municipal level -- aren't engaged in other secret and shocking privacy intrusions that have yet to be revealed to us. If the last few months have taught us anything, it should be that we are in a world of unknown unknowns.

Today, government agencies act as if they deserve the benefit of the doubt as they secretly do things ripped from the pages of science-fiction novels. Once upon a time, that's not how things were to run in a land where people prized their right to be let alone and government of the people, by the people, and for the people was supposed to operate in the open. The government understands this perfectly well: Why else would its law enforcement agents and officers regularly go to remarkable lengths, sometimes at remarkable cost, to conceal their actions from the rest of us and the legal system that is supposed to oversee their acts? Which is why whistleblowers like Edward Snowden are so important: they mount the last line of defense when the powers-that-be get too accustomed to operating in the dark.

Without our very own Snowdens working in the county sheriff's departments or big city police departments or behemoth federal bureaucracies, especially with the world of newspapers capsizing, the unknowns are ever more likely to stay unknown, while what little privacy we have left vanishes.

Learn more about government surveillance and other civil liberty issues: Sign up for breaking news alerts, follow us on Twitter, and like us on Facebook.

------------------------------------------------

A First Look at NewCo's structure >> Pressthink

Link to Article

Archived Version

Sun, 22 Dec 2013 04:56

Today Pierre Omidyar announced some details about how his new venture in news will be organized. My summary and explanation'...First, the official release:

PIERRE OMIDYAR PROVIDES INITIAL FUNDING OF $50M TO ESTABLISH FIRST LOOK MEDIA

Honolulu '' Dec. 19, 2013 '' The news organization created by Pierre Omidyar (formerly dubbed ''NewCo'') has taken another step forward with an infusion of $50M in capital to fuel operations being established on both coasts.

Omidyar, who provided the funding, will also serve as the organization's publisher. Omidyar's first capital outlay represents 20 percent of his initial commitment to the media venture. First Look Media will publish robust coverage of politics, government, sports, entertainment and lifestyle, arts and culture, business, technology, and investigative news.

''This initial capital is the first step of many to bring the vision of this news organization to life,'' said Omidyar. ''I am deeply committed to the long-term effort to build a new and exciting platform for journalism '-- one that not only provides the innovation and infrastructure journalists need to do their best work, but that brings their reporting and storytelling to the widest possible audience.''

First Look Media is made up of several entities, including a company established to develop new media technology and a separate nonprofit journalism organization. The journalism operation, which will be incorporated as a 501(c)(3), will enjoy editorial independence, and any profits eventually earned by the technology company are committed to support First Look's mission of independent journalism. The name of First Look Media's initial digital publication is yet to be announced.

First Look Media is currently securing space and setting up operations in New York City, San Francisco, and Washington, D.C. The team is actively recruiting in all areas of its operations.

As I previously explained to readers of PressThink, I am an adviser to Omidyar's company, so I can provide some further explanation and a view of what this announcement says.

1. The placeholder name, NewCo, is going away. First Look Media is the name of the new company. It has by the terms of today's announcement received an initial capital infusion of $50 million from Pierre Omidyar.

2. The new company will consist of several legal entities. One is a technology company, a business run for profit, that will develop new media tools for First Look properties and other markets. Another is a 501(c)(3), a non-profit under U.S. law. Its mission will be to publish and support independent, public interest journalism.

3. The 501(c)(3) will house the journalism operation, which hasn't given a name yet to its initial publication. It will have editorial independence.

4. Profits earned by the technology company will be used to support the mission: independent public interest journalism.

So that's what the announcement says. Now I am going to provide some of my own observations that I hope will be helpful for those who are following news of the company formerly known as NewCo. This isn't the company's description, it's mine.

5. As we figure out what the pieces of the company will be, we are announcing them. Today's news settles one of the questions I have been asked a lot: ''Is NewCo going to be a business or a non-profit?'' Answer: both. The news and editorial operation will be a non-profit. The technology company will be a business run for profit. If the tech company is successful it can help fund the journalism mission, along with other possible sources of revenue.

6. There are other known combinations of business and non-profit in journalism land. The Poynter Institute is a non-profit school for journalists that owns a controlling interest in the Times Publishing Company, which publishes the Tampa Bay Times. The Guardian Media Group is a for-profit company in the UK that is owned by the Scott Trust, which exists solely to guarantee the independence and public service mission of the Guardian, in all of its forms. ProPublica is a non-profit investigative newsroom, donor supported, that sometimes shares its work with for-profit newspapers.

7. The First Look set-up is different. Here the journalism operation is a non-profit, housed within a parent company, which may have other entities inside it. The entire operation is designed to: 1.) support the mission of independent public service journalism, 2.) achieve sustainability and 3.) attract talent.

8. Another way to say it is: public service, mission-driven journalism, including investigative work, has always been subsidized by something: advertising, other kinds of news, donors to a non-profit (as with ProPublica) or a related and profitable business like the Bloomberg terminals that subsidize Bloomberg News. First Look Media is adding to the picture another possible source of support: profits from a company specifically focused on technology for producing, distributing and consuming news, views and information.

9. A good comparison point for that relationship is a company like the Atavist, which produces narrative non-fiction '-- also called long form journalism '-- and hopes to profit from a publishing platform, the Creativist, originally developed to publish the Atavist's own work. Notice I said a ''comparison point,'' not: these two are the same.

I am going on vacation and off the grid for a while, starting today at 3 pm. But the comment thread is open and I will try to respond when I can.

Pierre Omidyar Provides Initial Funding of $50M to Establish First Look Media

Link to Article

Archived Version

Source: Omidyar Group

Fri, 20 Dec 2013 17:52

Honolulu '' Dec. 19, 2013 '' The news organization created by Pierre Omidyar (formerly dubbed ''NewCo'') has taken another step forward with an infusion of $50M in capital to fuel operations being established on both coasts.

Omidyar, who provided the funding, will also serve as the organization's publisher. Omidyar's first capital outlay represents 20 percent of his initial commitment to the media venture. First Look Media will publish robust coverage of politics, government, sports, entertainment and lifestyle, arts and culture, business, technology, and investigative news.

''This initial capital is the first step of many to bring the vision of this news organization to life,'' said Omidyar. ''I am deeply committed to the long'''term effort to build a new and exciting platform for journalism '-- one that not only provides the innovation and infrastructure journalists need to do their best work, but that brings their reporting and storytelling to the widest possible audience.''

First Look Media is made up of several entities, including a company established to develop new media technology and a separate nonprofit journalism organization. The journalism operation, which will be incorporated as a 501(c)(3), will enjoy editorial independence, and any profits eventually earned by the technology company are committed to support First Look's mission of independent journalism. The name of First Look Media's initial digital publication is yet to be announced.

First Look Media is currently securing space and setting up operations in New York City, San Francisco, and Washington, D.C. The team is actively recruiting in all areas of its operations.

For more information about First Look Media, please visit: www.omidyargroup.com/pov/FirstLookMedia.

About Pierre Omidyar

Pierre Omidyar is an entrepreneur, innovator and philanthropist who is best known as the founder of eBay. He believes that a strong democracy requires an engaged society supported by effective news reporting and analysis. His passion for investigative journalism led him to launch the online news organization Honolulu Civil Beat in 2010, serving his home state of Hawaii. Pierre and his wife, Pam, are active philanthropists who believe everyone has something to contribute. You can read more about The Omidyar Group here.

Why we shouldn't give Omidyar and First Look the benefit of the doubt | PandoDaily

Link to Article

Archived Version

Sun, 22 Dec 2013 04:56

By Paul CarrOn December 20, 2013

As I've written before, coordinating Pando's coverage of Pierre Omidyar and Glenn Greenwald's new journalism venture has been a real trip. The smears from Greenwald's supporters I'm slowly coming to terms with, likewise the vitriol and even the accusations that Pando is secretly controlled by the CIA.

One thing that I still can't understand, though, is why apparently intelligent people '-- including some fellow journalists, for Christ's sake '-- have demanded that we hold off asking questions about ''NewCo'' until it has launched.

Why can't we just wait until they actually start publishing'... give the guy the benefit of the doubt? Why are we questioning whether NewCo will be a for-profit business? Why demand to know if its reporters are being required to sign non-disclosure agreements? Hell, what business is it of ours that Omidyar has invested in a shady microloans company or two?

The questions are frustrating for two reasons. First, it's clear that many of those begging for amnesty on behalf of Omidyar are doing so because they're kinda hoping he might offer them a job. They know they should probably be asking the same questions but'... well'... these are uncertain times for journalists and, well, the kids have got to eat and private school isn't cheap.

Second, can it really be true that my esteemed colleagues at other publications don't understand why pre-launch is precisely the time we should be asking the toughest questions?

That point was driven home yesterday when Jay Rosen, one of the Omidyar's first hires, published a press release issued by Omidyar Network.

The release was interesting, not so much for what it said about ''First Look Media'' but for what it didn't say.

What it did say was that First Look will be a curious hybrid beast: a for-profit technology company supporting a not-for-profit journalism business. As well as being the sole backer of First Look, Omidyar himself will act as publisher of the journalism business. Its journalists will, however, retain full editorial independence. At least some staff (including Rosen) have been asked to sign NDAs, but only concerning ''trade secrets,'' whatever that means.

What it didn't say was'... pretty much anything else.

Earlier this month, Jason Calacanis suggested that the reason Omidyar wasn't answering questions about the structure of his venture is that he hadn't yet figured out those answers. Since then I've heard from numerous sources that many of the basic questions around editorial independence, financial structure and Omidyar's own role at NewCo First Look were still up for debate.

In a blog post at Pressthink, Rosen confirmed what those sources had told us: ''As we figure out what the pieces of the company will be,'' he said, ''we are announcing them.'' Responding to a question from a commenter, he added: ''If I could tell you more, I would but it simply hasn't been decided yet.'' Finally, Rosen confirmed that he hadn't been able to answer questions about his own contract, because he'd only received the final document this week.

And that '-- that '-- is why we should be asking questions about First Look right now, and why it's such a dereliction of duty that most reporters are taking a ''wait and see'' position.

As Mark Ames explained, Pierre Omidyar's new venture now effectively controls the largest cache of American national security secrets ever leaked. The only two people with access to that entire cache '-- Glenn Greenwald and Laura Poitras '-- now work for a man whose response to reports of mass suicides caused by one of his investments was to delete that investment from his website and pretend it never happened. A man who has said publicly that he might consider handing over sources to law enforcement. A man who made his fortune founding a company that now boasts of handing user data to the government ''on a silver platter.''

Right now, the clay that will soon harden into First Look Media is still wet. There is still every chance that the final product will be, as Greenwald assures us, a bold, fearless, wonderful journalistic paradise: a place where sources are safe, reporters are independent and Snowden's Secrets (') will be published even if they contain any embarrassing revelations about eBay or Paypal.

But there is also a chance that it will be none of those things: that Omidyar's public statements on sources, his track record of selective transparency and eBay's friendliness with the government will foreshadow business as usual for this new billionaire-owned media giant.

The more of First Look's rule book that is written in the public spotlight, and the more questions Omidyar, Greenwald, Rosen et al are forced to consider before launch, the more likely the end result will be more of the former and less of the latter.

Photo credit: Matty Gibbon (Creative Commons)

------------------------------------------------

Document Friday: What a CIA Nondisclosure Agreement Looks Like | UNREDACTED

Link to Article

Archived Version

Fri, 20 Dec 2013 19:03

A comparison of pages from Operation Dark Heart. From New York Times

Jose Rodriguez has almost finished writing his book. Remember Jose Rodriguez? He was the CIA agent who ordered the destruction of 92 video tapes that recorded Abu Zabaydah being waterboarded 83 times in one month in a black site in Thailand. He justified his actions by noting, ''The heat from destroying [the torture videos] is nothing compared to what it would be if the tapes ever got into the public domain.'' Amazon's preview of the book describes Jose Rodriguez as a ''real-life Jack Bauer from television's24.'' Wow. Just. Wow'... wow.

Rodriguez was not punished for his actions.

We'll see how the CIA's pre-publication review goes for Rodriguez's likely hagiographic account of the Agency. But my guess is he'll have a much easier time publishing his memoir than former intelligence agents who have written more critically of the War on Terror.

Take for example the Defense Intelligence Agency's attempts to pull a ''Fahrenheit 451'" to stop Americans from reading former Army Intelligence Officer Anthony Shaffer's book, Operation Dark Heart: Spycraft and Special Ops on the Frontlines of Afghanistan '' and the Path to Victory. The Defense Department spent nearly $50,000 to buy up and destroy the first printing of the book. A subsequent printing redacted all sorts of information, including the fact that the author's pseudonym, Chris Stryker, was John Wayne's character in the 1949 film, The Sands of Iwo Jima. Of course after the DOD's attempted buyout, uncensored editions of the book that had been provided in advance to reviewers quickly found their way to ebay. (See first image for side-by-side comparison.)

Or take The Black Banners: The Inside Story of 9/11 and the War Against Al Qaeda,'' by former FBI agent Ali H. Soufan. In his book, Soufan argues that the CIA could have prevented 9/11 by passing information it had about two of the 9/11 hijackers to the FBI. He also details the evolution of the CIA's brutal torture methods which he believes were ''unnecessary and counterproductive.'' The FBI signed off on Black Banners, requesting only minor rewrites, which Soufan agreed to. The CIA did not. The Agency demanded Soufan cut phrases that he had used in Congressional testimony (available in print and online); not refer to overseas CIA centers as ''stations;'' and, most capriciously, demanded he remove references showing that the CIA had been sent a passport photo of one of the 9/11 hijackers in January 2001 ''even though this fact was recounted in the 9/11 Commission Report. Speaking to the New York Times, Jennifer Youngblood, a spokesperson for the CIA, denied that the CIA redacted information because it didn't like its content. She did add, however:

''Just because something is in the public domain doesn't mean it's been officially released or declassified by the US government.''

Wow. Now THAT is a sweeping claim to the information that the CIA thinks it has the right to censor.

Another recent work, The Interrogator, by Glenn Carle, a 23-year CIA veteran, was also subjected to ''extensive cuts'' by the CIA. In an interview with Salon.com, Carle provided important insight into his meeting with the CIA's Publications Review Board. He stated that he met with ''a handful'' of CIA staffers who submitted input from several CIA departments. ''My goal was not to piss them off to the extent that I couldn't get anything that I wanted,'' he told Salon. ''Their goal was to intimidate me. That was quite clear.'' He also recounted an encounter in which a member of the Review Board asked him ''in the restroom'' ''Don't you realize that people could go to jail for this?'' He was referring to passages in Carle's book where he wrote about detention and interrogation techniques which were ''in all likelihood'' illegal.

Fourth, we have the CIA's case against its former agent, Ishmael Jones (a pseudonym), who wrote The Human Factor: Inside the CIA's Dysfunctional Intelligence Culture in 2008, a harsh critique of the Agency's operations. This June, a judge found Jones guilty of breaching his secrecy agreement with the CIA because he published his book without the CIA Publications Review Board's approval. (Jones went through the review and appeal process for more than two years, before deciding to publish without permission.) The US District Court's decision ultimately hinged on the secrecy and non-disclosure agreements that Jones had signed in 1989 and 1997, respectively. These agreements ''submitted as an exhibits to the court (I found them on cryptome)'' are indeed very interesting documents.

Loose lips sink ships.

The seventeen-point secrecy agreement ''which is a ''prior condition of'... being employed by'... the Central Intelligence Agency'''' forbids the signatory from ever revealing information classified by the President's Executive Order on Classification. It also requires the employee to ''notify the Central Intelligence Agency immediately'' if he is ever required to testify before judicial or congressional authorities. Finally, the agreement stipulates that ''all royalties, remonstrations, and emoluments'' resulting from an agent's disclosure of classified information will be ''assigned'' to the United States government.

Despite the seemingly crystal clear NDAs that these intelligence agents signed, they have been put in extremely difficult positions. Must they keep their observations of the US government's missed opportunities, illegal activities, and wasteful management secret forever? Is it true that the nondisclosure agreements they signed ''before even beginning their work'' bar them from recounting missed opportunities to prevent 9-11? Exposing torture carried out in the name of US citizens? Pointing out critical flaws in the intelligence community? Revealing information already published in the Congressional Record? Do the desires of the intelligence community to keep its actions secret trump the rights of Americans to write books about the wrongs that they have witnessed? Apparently so.

We'll see how thorough the CIA's Publications Review is with Jack Bauer's Jose Rodriguez's whitewash memoir.

Like this:LikeLoading...

------------------------------------------------

Acoustic cryptanalysis

Link to Article

Archived Version

Fri, 20 Dec 2013 16:52

Acoustic cryptanalysisDaniel GenkinAdi ShamirEran TromerTechnion and Tel Aviv UniversityWeizmann Institute of ScienceTel Aviv Universityassisted by Lev Pachmanov and numerous othersSummaryMany computers emit a high-pitched noise during operation, due to vibration in some of their electronic components. These acoustic emanations are more than a nuisance: they can convey information about the software running on the computer and, in particular, leak sensitive information about security-related computations. In a preliminary presentation, we have shown that different RSA keys induce different sound patterns, but it was not clear how to extract individual key bits. The main problem was the very low bandwidth of the acoustic side channel (under 20 kHz using common microphones, and a few hundred kHz using ultrasound microphones), many orders of magnitude below the GHz-scale clock rates of the attacked computers.

Here, we describe a new acoustic cryptanalysis key extraction attack, applicable to GnuPG's current implementation of RSA. The attack can extract full 4096-bit RSA decryption keys from laptop computers (of various models), within an hour, using the sound generated by the computer during the decryption of some chosen ciphertexts. We experimentally demonstrate that such attacks can be carried out, using either a plain mobile phone placed next to the computer, or a more sensitive microphone placed 4 meters away.

Beyond acoustics, we demonstrate that a similar low-bandwidth attack can be performed by measuring the electric potential of a computer chassis. A suitably-equipped attacker need merely touch the target computer with his bare hand, or get the required leakage information from the ground wires at the remote end of VGA, USB or Ethernet cables.

PaperA detailed account of the results and their context is given in the full version of our paper (8MB PDF).

Note: these are recent results, first published on 18 December 2013. Preliminary results were announced in the Eurocrypt 2004 rump session presentation, "Acoustic cryptanalysis: on nosy people and noisy machines", and are now archived. Progress since publication of the preliminary results is summarized in Q16 below.

Q&AQ1: What information is leaked?This depends on the specific computer hardware. We have tested numerous laptops, and several desktops.

In almost all machines, it is possible to distinguish an idle CPU (x86 "HLT") from a busy CPU.On many machines, it is moreover possible to distinguish different patterns of CPU operations and different programs.Using GnuPG as our study case, we can, on some machines:distinguish between the acoustic signature of different RSA secret keys (signing or decryption), andfully extract decryption keys, by measuring the sound the machine makes during decryption of chosen ciphertexts.Q2: What is making the noise?The acoustic signal of interest is generated by vibration of electronic components (capacitors and coils) in the voltage regulation circuit, as it struggles to supply constant voltage to the CPU despite the large fluctuations in power consumption caused by different patterns of CPU operations. The relevant signal is not caused by mechanical components such as the fan or hard disk, nor by the laptop's internal speaker.

Q3: Does the attack require special equipment?It sure helps, and in the paper we describe an expensive hardware setup for getting the best sensitivity and frequency response. But in some cases, a regular mobile phone is good enough. We have used a mobile phone to acoustically extract keys from a laptop at a distance of 30cm, as in the following picture.

Q4: What is the acoustic attack range?That depends on many factors. Using a sensitive parabolic microphone, we surpassed 4 meters. In the following example, a parabolic microphone, attached to a padded case of equipment (power supply, amplifier, filters, and a laptop running the attack code) is extracting an RSA key from a target laptop (on the far side of the room).

Without the ungainly parabolic dish, we achieved a range of 1 meter. In the following, the target (A) is on the right, and the attacker is on the left. Only the capsule of the microphone, marked (B), is sensitive to position and orientation; the rest of the attacker's equipment can be hidden away.

Q5: What are some examples of attack scenarios?We discuss some prospective attacks in our paper. In a nutshell:

Install an attack app on your phone. Set up a meeting with the victim and place the phone on the desk next to his laptop (see Q2).Break into the victim's phone, install the attack app, and wait until the victim inadvertently places his phone next to the target laptop.Construct a web page use the microphone of the computer running the browser (using Flash or HTML Media Capture, under some excuse such as VoIP chat). When the user permits the microphone access, use it to steal the user's secret key.Put your stash of eavesdropping bugs and laser microphones to a new use.Send your server to a colocation facility, with a good microphone inside the box, and then acoustically extract keys from all nearby servers.Get near a TEMPEST/1-92 protected machine, such as the one pictured to the right, place a microphone next to its ventilation holes, and extract its supposedly-protected secrets.Q6: What if I don't have any microphone, or the environment is too noisy?Another low-bandwidth channel is the electric potential of the laptop's chassis. We've shown that in many computers, this "ground" potential fluctuates (even when connected to a grounded power supply) and leaks the requisite signal. This can be measured in several ways, for example:

Magic-touch attack: the attacker measures the chassis potential by merely touching the laptop chassis with his hand, while surreptitiously measuring his own body potential relative to the ground potential of the room. (This attack is especially effective in hot weather, since sweaty fingers offer a lower electric resistance.)Far-end-of-cable attack: the victim plugs in some innocuous-looking VGA or Ethernet cable into his laptop. The attacker measures the shield's electric potential on the far side of the cable (out of sight, in some cabinet or server room).Q7: Can an attacker use power analysis instead?Yes, power analysis (by measuring the current drawn from the laptop's DC power supply) is another way to perform our low-bandwidth attack.

If the attacker can measure clockrate-scale (GHz) power leakage, then traditional power analysis may also be very effective, and far faster. However, this is foiled by the common practice of filtering out high frequencies on the power supply.

Q8: How can low-frequency (kHz) acoustic leakage provide useful information about a much faster (GHz)? Individual CPU operations are too fast for a microphone to pick up, but long operations (e.g., modular exponentiation in RSA) can create a characteristic (and detectable) acoustic spectral signature over many milliseconds. In the chosen-ciphertext key extraction attack, we carefully craft the inputs to RSA decryption in order to maximize the dependence of the spectral signature on the secret key bits.

Q9 How vulnerable is GnuPG now?We have disclosed our attack to GnuPG developers under CVE-2013-4576, suggested suitable countermeasures, and worked with the developers to test them. New versions of GnuPG 1.x and of libgcrypt (which underlies GnuPG 2.x), containing these countermeasures and resistant to our current key-extraction attack, were released concurrently with the first public posting of these results. Some of the effects we found (including RSA key distinguishability) remain present.

Q10: How vulnerable are other algorithms and cryptographic implementations?We don't know. Our attack requires careful cryptographic analysis of the implementation, which so far has been conducted only for the GnuPG 1.x implementation of RSA. Implementations using ciphertext blinding (a common side channel countermeasure) appear less vulnerable. We have, however, observed that GnuPG's implementation of ElGamal encryption also allows acoustically distinguishing keys.

Q11: Is there a realistic way to perform a chosen-ciphertext attack on GnuPG?To apply the attack to GnuPG, we found a way to cause GnuPG to automatically decrypt ciphertexts chosen by the attacker. The idea is to use encrypted e-mail messages following the OpenPGP and PGP/MIME protocols. For example, Enigmail (a popular plugin to the Thunderbird e-mail client) automatically decrypts incoming e-mail (for notification purposes) using GnuPG. An attacker can e-mail suitably-crafted messages to the victims, wait until they reach the target computer, and observe the acoustic signature of their decryption (as shown above), thereby closing the adaptive attack loop.

Q12: Won't the attack be foiled by loud fan noise, or by multitasking, or by several computers in the same room?Usually not. The interesting acoustic signals are mostly above 10KHz, whereas typical computer fan noise and normal room noise are concentrated at lower frequencies and can thus be filtered out. In task-switching systems, different tasks can be distinguished by their different acoustic spectral signatures. Using multiple cores turns out to help the attack (by shifting down the signal frequencies). When several computers are present, they can be told apart by spatial localization, or by their different acoustic signatures (which vary with the hardware, the component temperatures, and other environmental conditions).

Q13: What countermeasures are available?One obvious countermeasure is to use sound dampening equipment, such as "sound-proof" boxes, designed to sufficiently attenuate all relevant frequencies. Conversely, a sufficiently strong wide-band noise source can mask the informative signals, though ergonomic concerns may render this unattractive. Careful circuit design and high-quality electronic components can probably reduce the emanations.

Alternatively, the cryptographic software can be changed, and algorithmic techniques employed to render the emanations less useful to the attacker. These techniques ensure that the rough-scale behavior of the algorithm is independent of the inputs it receives; they usually carry some performance penalty, but are often used in any case to thwart other side-channel attacks. This is what we helped implement in GnuPG (see Q9).

Q14: Why software countermeasures? Isn't it the hardware's responsibility to avoid physical leakage?It is tempting to enforce proper layering, and decree that preventing physical leakage is the responsibility of the physical hardware. Unfortunately, such low-level leakage prevention is often impractical due to the very bad cost vs. security tradeoff: (1) any leakage remnants can often be amplified by suitable manipulation at the higher levels, as we indeed do in our chosen-ciphertext attack; (2) low-level mechanisms try to protect all computation, even though most of it is insensitive or does not induce easily-exploitable leakage; and (3) leakage is often an inevitable side effect of essential performance-enhancing mechanisms (e.g., consider cache attacks).

Application-layer, algorithm-specific mitigation, in contrast, prevent the (inevitably) leaked signal from bearing any useful information. It is often cheap and effective, and most cryptographic software (including GnuPG and libgcrypt) already includes various sorts of mitigation, both through explicit code and through choice of algorithms. In fact, the side-channel resistance of software implementations is nowadays a major concern in the choice of cryptographic primitives, and was an explicit evaluation criterion in NIST's AES and SHA-3 competitions.

Q15: What about other acoustic attacks?See the discussion and references in our paper, and the Wikipedia page on Acoustic Cryptanalysis. In a nutshell:

Eavesdropping on keyboard keystrokes has been well discussed; keys can be distinguished by timing, or by their different sounds. While this attack is applicable to data that is entered manually (e.g., passwords), it is not applicable to larger secret data such as RSA keys. Another acoustic source is hard disk head seeks; this source does not appear very useful in the presence of caching, delayed writes and multitasking. Preceding modern computers is MI5's "ENGULF" technique (recounted in Peter Wright's book Spycatcher), whereby a phone tap was used to eavesdrop on the operation of an Egyptian embassy's Hagelin cipher machine, thereby recovering its secret key. Declassified US government publications describe "TEMPEST" acoustic leakage from mechanical and electromechanical devices, but do make no mention of modern electronic computers.

Q16: What's new since the Eurocrypt 2004 presentation?Full key extraction attack, exploiting deep internal details of GnuP's implementation of RSADramatic improvement in range and applicability (increased from 20cm with open chassis to 4m in normal operation)Much better hardware (some self-built), allowing longer range and better signal characterizationSignal processing and error correction, making it possible to perform the attack using a mobile phone despite the low-quality microphoneMany more targets testedNon-acoustic low-bandwidth attacks, including chassis potential analysisCountermeasures implemented and tested in GnuPG (see Q9)Detailed writeupAcknowledgementsLev Pachmanov wrote much of the software setup used in our experiments, including custom signal acquisition programs. Avi Shtibel, Ezra Shaked and Oded Smikt assisted in constructing and configuring the experimental setup. Assa Naveh assisted in various experiments, and offered valuable suggestions. Sharon Kessler provided copious editorial advice. We thank Werner Koch, lead developer of GnuPG, for the prompt response to our disclosure and the productive collaboration in adding suitable countermeasures. We are indebted to Pankaj Rohatgi for inspiring the origin of this research, and to Nir Yaniv for use of the Nir Space Station and for valuable advice on audio recording. National Instruments Israel generously donated a National Instruments PCI-6052E DAQ card and a MyDAQ device. Erik Olson's Baudline signal analysis software was used for some of the analysis. We thank numerous volunteers for access to test-target machines.This work was sponsored by the Check Point Institute for Information Security; by the Israeli Ministry of Science and Technology; by the Israeli Centers of Research Excellence I-CORE program (center 4/11); and by NATO's Public Diplomacy Division in the Framework of "Science for Peace".