Category: Electronic Vulnerability

Faith in Internet voting? Prepare for “ShellShock”!

Continuing with facts to put in front of those with blind faith in the Interned, a disease that attacks those with little knowledge of computers, data communications, and software.

Shellshock can be used to take over the entire machine. And Heartbleed went unnoticed for two years and affected an estimated 500,000 machines, but Shellshock was not discovered for 22 years.

New York Times: Security Experts Expect ‘Shellshock’ Software Bug in Bash to Be Significant <read>

Continuing with facts to put in front of those with blind faith in the Interned, a disease that attacks those with little knowledge of computers, data communications, and software.

From the article:

On Thursday, security experts warned that Bash contained a particularly alarming software bug that could be used to take control of hundreds of millions of machines around the world, potentially including Macintosh computers and smartphones that use the Android operating system.

The bug, named “Shellshock,” drew comparisons to the Heartbleed bug that was discovered in a crucial piece of software last spring.

But Shellshock could be a bigger threat. While Heartbleed could be used to do things like steal passwords from a server, Shellshock can be used to take over the entire machine. And Heartbleed went unnoticed for two years and affected an estimated 500,000 machines, but Shellshock was not discovered for 22 years.

That a flawed piece of code could go unnoticed for more than two decades could be surprising to many. But not to programmers.

A bit of good news, followed by more bad news:

Working with Mr. Ramey and people who work on open-source security, Mr. Chazelas had a patch within hours. Then they contacted major software makers while trying to avoid tipping off hackers.

An official alert from the National Institute of Standards and Technology warned that the vulnerability was a 10 out of 10, in terms of its severity, impact and exploitability, but low in terms of its complexity, meaning that it could be easily used by hackers.

Security researchers say that as soon as the bug was reported they detected widespread Internet scanning by so-called white hat hackers — most likely security researchers — as well as people thought to be cybercriminals. The worry is that it is only a matter of time before somebody writes a program that will use Shellshock to take them over.

That a flawed piece of code could go unnoticed for more than two decades could be surprising to many. But not to programmers…

“I don’t think this is an open-source problem,” Mr. Zemlin said. “Software is eating the world. The bad news is software is hard and complex.”

So to those who trust software, without knowledge, and lots of faith, please don’t apply your blind faith to elections effecting our democracy.

If I can’t register to vote online, why can I vote online?

The University of Maryland shut down its voter registration system based on a breech of their student ID system. Not quite the end of the World. Yet, online voting would be another matter.

The University of Maryland shut down its voter registration system based on a breech of their student ID system. From The Diamondback:   University officials shut down online voter registration system following data breach <read>

[Student affairs vice-president] Zacker said online voter registration caused a significant increase in registered students from the 2008 election, when a total of 2,500 students registered to vote.

University officials said they decided to shut down the system because it posed a risk to students’ information. The online registration system functioned by using the electronic signature and social security number saved in the database for the student ID cards, which were compromised in the data breach.

“Following the ID card system breach, the existing infrastructure was determined to be vulnerable and was subsequently shut down,” Chief Information Officer Eric Denna wrote in an email. “The voter registration system cannot work without accessing the ID card system.”…

“They said at this time, ‘No,’ just because security for students is the number one thing, obviously, just making sure their information is secure, so they turned it down,” [Student Government Association President] Ronk said.

Of course, the University has the resources to likely get the system back up if they choose to in the near future.  Actually its not quite the end of the world, since students can still register to vote long before the November election.  Hopefully, something similar will never happen to the Connecticut online voter registration system, once again, not the end of the world.

Yet, online voting would be another matter, there is not a lot of leeway if online voting were breached, knocked down, risked other State systems, or subject to a denial of service attack shortly before an election…especially if it was designed to help those in the Military or overseas vote.

But that is Maryland, who would question Connecticut’s ability to protect our own systems?

Crumbling infrastructure – its not just highways and bridges anymore

The big news in Connecticut these days is Congress’s patched-up highway bill to continue patching-up our highways, while Connecticut has the the worst highway conditions in the nation.

But we are also just as dependent on electricity and the Internet. A Washington Post editorial highlights the risks, while Ed Snowden through Glenn Greenwald confirms the reality.

The big news in Connecticut these days is Congress’s patched-up highway bill to continue patching-up our highways, while Connecticut has the the worst highway conditions in the nation. CTMirror: White House says CT roads and bridges deficient <read>

The White House issued an alarming report Monday that said 41 percent of Connecticut’s roads are in poor condition and more than 9,500 jobs in the state will be lost unless Congress acts quickly to replenish a fund that pays for a lion’s share of the state’s infrastructure construction and repair.

But we are also just as dependent on electricity and the Internet.  A Washington Post editorial highlights the risks: Congress is overdue in dealing with the cybersecurity threat <read>

THE INTERNET security company Symantec revealed recently that a group of hackers known as Dragonfly infiltrated malware into legitimate software belonging to three manufacturers of industrial control systems — the stuff that controls factories and power grids. In one case, the contaminated control software was downloaded 250 times by unsuspecting users before the compromise was discovered.
This kind of cyberattack is not new, but it is audacious and dangerous. One of the first such assaults was the Stuxnet campaign, which had sabotage as its primary goal, against the Iranian nuclear program. By contrast, Dragonfly was a multi-pronged infiltrator, aimed at cyber- espionage and gaining long-term access to computers, with sabotage as a future option, perhaps flicking off the electrical power to a city or shutting down a factory. Dragonfly probably was state-sponsored from somewhere in Eastern Europe…
A torrent of cyberattacks — disruption, espionage, theft — is costing U.S. business and government billions of dollars. This is reality, not science fiction. In March, Chinese hackers broke into the U.S. government agency that houses the personal information of all federal employees.
For several years, it has been clear to many in government and the private sector that the nation needs to vastly improve protection of its private networks and that only government has the sophisticated tools to do that. But Congress has balked at legislation that would ease the necessary cooperation….

State Sponsored – is that some kind of official conspiracy theory to spend gobs of money on another threat beyond terrorism? Of course that could be the result even if the threat is real.  But we don’t have to believe the Government – we could read  proof from the Snowden documents:  Hacking Online Polls and Other Ways British Spies Seek to Control the Internet<read>

The secretive British spy agency GCHQ has developed covert tools to seed the internet with false information, including the ability to manipulate the results of online polls, artificially inflate pageview counts on web sites, “amplif[y]” sanctioned messages on YouTube, and censor video content judged to be “extremist.” The capabilities, detailed in documents provided by NSA whistleblower Edward Snowden, even include an old standby for pre-adolescent prank callers everywhere: A way to connect two unsuspecting phone users together in a call.

The tools were created by GCHQ’s Joint Threat Research Intelligence Group (JTRIG), and constitute some of the most startling methods of propaganda and internet deception contained within the Snowden archive. Previously disclosed documents have detailed JTRIG’s use of “fake victim blog posts,” “false flag operations,” “honey traps” and psychological manipulation to target online activists, monitor visitors to WikiLeaks, and spy on YouTube and Facebook users. [Hi English spy guys, welcome back to CTVotersCount]

Prime Minister David Cameron has justified as an “emergency” to “help keep us safe,” a newly released top-secret GCHQ document called “JTRIG Tools and Techniques” provides a comprehensive, birds-eye view of just how underhanded and invasive this unit’s operations are. The document..is designed to notify other GCHQ units of JTRIG’s “weaponised capability” when it comes to the dark internet arts, and serves as a sort of hacker’s buffet for wreaking online havoc.

Yes, nothing to worry about, just our friends the British and probably our friend Israel is even farther along, every body does it…ask Germany about their friend in North America.  What chance is there that the Russians and Chinese are up to the same things, along with all sorts on non-government friends and non-friends as well? And of course nobody inside the U.S. Government itself would have any interest in influencing election outcomes, would they?

Internet voting, that is probably as safe and trustworthy as Facebook.

If Internet voting is so safe, why is the power grid so vulnerable?

Of course the answer is that Internet voting is not safe, much more vulnerable than the power grid. But why don’t we know that?

How are grid vulnerabilities different from the vulnerabilities of electronic voting and Internet voting in particular? Lets look at a story from the LA Times highlighting vulnerabilities in the power grid

Of course the answer is that Internet voting is not safe, much more vulnerable than the power grid. But why don’t we know that? Could it be that voting is largely a Government managed function and therefor Government articulation of vulnerabilities, and public expenditures on security would be less welcome?

Today we have a story from the LA Times highlighting vulnerabilities in the power grid: Security holes in power grid have federal officials scrambling <read>

Adam Crain assumed that tapping into the computer networks used by power companies to keep electricity zipping through transmission lines would be nearly impossible in these days of heightened vigilance over cybersecurity.

When he discovered how wrong he was, his work sent Homeland Security Department officials into a scramble.

Crain, the owner of a small tech firm in Raleigh, N.C., along with a research partner, found penetrating transmission systems used by dozens of utilities to be startlingly easy.

How are grid vulnerabilities different from the vulnerabilities of electronic voting and Internet voting in particular? We can start with the article subtitle:

In Congress, the vulnerability of the power grid has emerged as among the most pressing domestic security concerns

Internet voting is hardly a concern in the Connecticut Legislature which unanimously passed Internet voting two years in a row mandating the Secretary of the State and Military Department do what the DoD, experts from Homeland Security, and the National Institute of standards say is impossible.  And even here grid security is a big concern of state government.

Then again maybe they are also the same in some ways:

“There are a lot of people going through various stages of denial” about how easily terrorists could disrupt the power grid, he said. “If I could write a tool that does this, you can be sure a nation state or someone with more resources could.”…

Some members of Congress want to empower regulators to force specific security upgrades at utilities. Others are attacking whistle-blowers and the media, demanding an investigation into disclosures of how easily the country’s power grid could be shut down.

Here is a difference. Who would even attempt insuring the safety of our election system? Let alone Internet voting?

Lloyds’ appraisers have been making a lot of visits lately to power companies seeking protection against the risk of cyberattack. Their takeaway: Security at about half the companies they visit is too weak for Lloyds to offer a policy.

Power companies are actual monopolies, but so are local election departments. Some of the same issues apply:

The problem, said Scott White, a security technology scholar at Drexel University in Philadelphia, is that “you are basically dealing with these monopolies that are determining for themselves which expenditures are a priority. Security has not generally been one.”

Utilities deny they’ve ignored the problem, pointing to the billions of dollars they say they’ve spent to upgrade outdated computer systems and close security holes.

Here is a difference, something seldom seen when Internet voting is adopted and declared successful:

They are signing contracts with security firms like Booz Allen Hamilton to investigate such things as to how to keep potentially mischievous devices out of the equipment they buy, often from foreign suppliers. The security firms help clients sift through reams of confidential intelligence provided by federal agencies. They simulate cyberattacks.

“It is the equivalent of war gaming, like the military does,” said Steve Senterfit, vice president of commercial energy at Booz Allen Hamilton.

Here in Connecticut we pride ourselves in the safety of 169 autonomous elected election departments. But that also has its downsides. Like the power grid, electronic voting involves users’ computers or distributed military computers:

But critics, including many in Congress, say more needs to be done to shore up a grid increasingly exposed to attacks. They note that so-called smart grid technology, which allows operators to calibrate the flow of energy from an increasingly diverse pool of sources, has opened new security risks.

The technology relies on devices in remote locations that constantly send signals to substations to help control when juice needs to be brought on and offline. The smarter the grid becomes, though, the more entry points an attacker can exploit.

“The whole idea of a smart grid is to push equipment further and further away from the substations,” Crain said. “Some of it is even in people’s homes. It’s physically impossible to secure it all.”

Here is a difference: The grid is apparently not on the Internet, so it is actually just a little harder to compromise:

The vulnerabilities Crain exposed, for example, had been overlooked because taking advantage of them requires an attacker to have access to closed, local networks. Now, a cyberterrorist with a little knowledge and the right laptop can gain that access and cause chaos in a regional power system merely by linking up with the control panel at a secluded electric vehicle charging station.

 

 

How can the NSA, Microsoft, Google etc. vote?

A post got us thinking: Every Scary, Weird Thing We Know the NSA Can Do. Lets add some corollaries relevant to voting and elections:

A post got us thinking: Every Scary, Weird Thing We Know the NSA Can Do.  <read>

It seems they missed that the NSA and others with access can vote!

This post originally appeared on the website of The Brian Lehrer Show.

The trove of documents leaked by Edward Snowden has revealed the elaborate tricks the NSA can use to monitor communications and data around the world. Here, a running list of things we now know the NSA can do, based on media reports and other publicly available documents—so far. If we missed any, let us know in the comments page or by tweeting @brianlehrer.

  • It can track the numbers of both parties on a phone call, as well location, time and duration. (More)
  • It can hack Chinese phones and text messages. (More)
  • It can set up fake Internet cafes. (More)
  • It can spy on foreign leaders’ cellphones. (More)
  • It can tap underwater fiber-optic cables. (More)
  • It can track communication within media organizations like Al-Jazeera. (More)
  • It can hack into the U.N. video conferencing system. (More)
  • It can track bank transactions. (More)
  • It can monitor text messages. (More)
  • It can access your email, chat, and Web browsing history. (More)
  • It can map your social networks. (More)
  • It can access your smartphone app data. (More)
  • It is trying to get into secret networks like Tor, diverting users to less secure channels. (More)
  • It can go undercover within embassies to have closer access to foreign networks. (More)
  • It can set up listening posts on the roofs of buildings to monitor communications in a city. (More)
  • It can set up a fake LinkedIn. (More)
  • It can track the reservations at upscale hotels. (More)
  • It can intercept the talking points for Ban Ki-moon’s meeting with Obama. (More)
  • It can crack cellphone encryption codes. (More)
  • It can hack computers that aren’t connected to the internet using radio waves. (More)
  • It can intercept phone calls by setting up fake base stations. (More)
  • It can remotely access a computer by setting up a fake wireless connection. (More)
  • It can install fake SIM cards to then control a cell phone. (More)
  • It can fake a USB thumb drive that’s actually a monitoring device. (More)
  • It can crack all types of sophisticated computer encryption. (Update: It is trying to build this capability.) (More)
  • It can go into online games and monitor communication. (More)
  • It can intercept communications between aircraft and airports. (More)
  • (Update) It can physically intercept deliveries, open packages, and make changes to devices. (More) (h/t)

Did we miss any? Mischaracterize any capabilities? Let us know in the comments, or tweet @brianlehrer.

Lets add some corollaries relevant to voting and elections:

  • It can set up fake Internet cafes
    • They can use those to monitor, identify, change and drop votes submitted over the Internet or by email. And change ballots presented to voters.
  • It can tap underwater fiber-optic cables
    • And monitor, identify, change and drop votes submitted over the Internet, by email or fax. And change ballots presented to voters.
  • It can monitor text messages.
  • It can access your email, chat, and Web browsing history
  • It can map your social network
  • It can access your smartphone app data
    • They could determine your politics and intercept your electronic or absentee vote and eliminate it before it is counted.
      Because—>
  • It can physically intercept deliveries, open packages, and make changes to devices

They could use these facilities in a variety of ways to disrupt elections:

  • Change electronic results as they are transmitted or posted, confusing or changing the initially reported winner.
  • Discover embarrassing past statements or activities of candidates and caused these to be published.
  • Discover embarrassing past statements or activities of candidates and use them to intimidate candidates once elected.
  • Plant rumors about candidates.

Chinese successfully attack U.S. Election Watchdog

Just a little practice for Internet voting. Or are attackers just a but more careful when they attack actual elections?

The Center for Public Integrity: FEC hamstrung by political bickering, case backlogs, staff departures — even Chinese hackers <read>

Just after the federal government shut down Oct. 1, and one of the government’s more dysfunctional agencies stopped functioning altogether, Chinese hackers picked their moment to attack.

They waylaid the Federal Election Commission’s networks. They crashed computer systems that publicly disclose how billions of dollars are raised and spent each election cycle by candidates, parties and political action committees.

As minutes turned to hours, the FEC found itself largely defenseless against what may be the worst act of sabotage in its 38-year history…

Just more to contemplate as we in Connecticut head into supporting Internet voting via mandate that the Secretary of the State and the Military Department (of CT) figure out how to make it secure.

I also note an interesting comment on the article:

The take away lesson from this article should be that computer driven American elections can be as easily hijacked as FEC computers. And the powers that be, be they Democrat or Republican don’t really give a damn. I offer my experience as prima fascia evidence of my comment: I am a weapons systems analyst wholly knowledgeable in the failings of the so-called high tech weapon system and therefore cognizant of the inherent weakness of the average electronic voting system. In 2004 I was a registered voter in the State of Nevada. Concerned that my vote had not been counted I challenged the 2004 election of George Bush by bringing suit against the State of Nevada and Sequoia Voting Systems with a demand for independent testing of Nevada’s Sequoia computerized voting system. Ironically, just prior to the 2008 Presidential primary the Court ruled that I, a fully franchised registered voter, had no standing in this matter and dismissed my lawsuit thereby securing the way to electronic treason. Many thanks to this fine reporter for exposing the truth about the FEC and our holey ‘free and fair’ elections.

Patricia Axelrod, Director, The Desert Storm Think Tank and All Veterans’ Advocate (seeded by a grant from the John D. and Catherine T. MacArthur Foundation).

Cognitive Dissonance? Not in Connecticut when it comes to the Internet

In psychology, cognitive dissonance is the discomfort experienced when simultaneously holding two or more conflicting cognitions: ideas, beliefs, values or emotional reactions. In a state of dissonance, people may sometimes feel “disequilibrium”: frustration, hunger, dread, guilt, anger, embarrassment, anxiety, etc – Wikipedia

The state fails at protecting data, legislators to get lesson in Internet security, N.I.S.T experts say unsafe the Internet is not safe for voting, the N.S.A. and others can look at practically anything, yet local registrars, the Secretary of the State, and the State Military Department can protect Internet voting by Legislative decree.

In psychology, cognitive dissonance is the discomfort experienced when simultaneously holding two or more conflicting cognitions: ideas, beliefs, values or emotional reactions. In a state of dissonance, people may sometimes feel “disequilibrium”: frustration, hunger, dread, guilt, anger, embarrassment, anxiety, etc – Wikipedia

The state fails at protecting data, legislators to get lesson in Internet security, N.I.S.T experts say unsafe the Internet is not safe for voting, the N.S.A. and others can look at practically anything, yet local registrars, the Secretary of the State, and the State Military Department can protect Internet voting by Legislative decree.

As CTVotersCount readers know, the Legislature passed Internet voting over the objections of the Secretary of the State. Choosing not to define it but to leave it up the Secretary and Military Department to define a secure way to accomplish it. Despite the concerns of virtually every Computer Scientist and experts from the National Institute of Standards. Who will implement the actual voting? 169 local municipalities, many with (very) part-time registrars? The Secretary of the State with the help of the State IT function?  Two more interesting events this week:

The Motor Vehicle Department inadvertently released the names of job applicants on its web site, making hacking into their computers unnecessary. Courant:  DMV Snafu Posts 400 Job Applicants’ Personal Info On State Website <read>

The state Department of Motor Vehicles’ commissioner has sent individual letters of apology to about 400 job applicants whose names, home addresses, phone numbers, email addresses and exam scores were posted on the DMV’s official website by mistake…

The DMV had intended to post a job announcement on its website about 1 p.m. on Aug. 27 for the position of “Information Technology Analyst 2.” But the following morning, someone from the DMV’s human resources unit discovered that instead of the job-vacancy posting, “a file with a spreadsheet containing the names and other information of candidates who had passed the examination for this title had been posted,” [Commissioner Melody A.] Currey said in the letter.

Wednesday at 1:00pm, in the Legislative Office Building: State Capitol Police Dept.: Internet Safety for Legislators & Staff. Apparently consisting of:

An “Internet Safety” training program available to all legislators and legislative employees. This comprehensive program is designed to heighten awareness on protecting yourself and your family from internet and technology crimes.

Sounds like a good idea. But would a similar training be available or even feasible for military and their dependents eligible for Internet voting, across the counter, the world, under the sea, and in combat situations?  Let alone election officials in 169 towns, if they become responsible for Internet voting?

For more read some of your past posts on Internet Voting or Internet Security

 

Secret Vote? Not on “our” Internet — just the insiders and bad guys know how you intended to vote

There is perhaps something even worse than the risks of the secret vote or the risks of the public vote. Voting via Internet in a way that has many of the risks of public voting, without the benefits, along with the risks of secret voting and lack of confidence in the system.

From Public Media:  Internet S.O.S. <read>

Is the Internet on life support?

Last week we learned that U.S. and British intelligence agencies have broken the back of digital encryption — the coded technology hundreds of millions of Internet users rely on to keep their communications private.

Over the weekend, Der Spiegel reported that the NSA and its British counterpart are also hacking into smartphones to monitor our daily lives in ways that wouldn’t have been possible before the age of the iPhone.

This news, just the latest revelations from the files of Edward Snowden, only heighten our sense that we can no longer assume anything we say or do online is secure.

But that’s not all. In a case that was heard in a U.S. federal appeals court on Monday, telecommunications colossus Verizon is arguing that it has the First Amendment right to block and censor Internet users. (That’s right. Verizon is claiming that, as a corporation, it has the free speech right to silence the online expression of everybody else.)

Government and corporate forces have joined to chip away at two pillars of the open Internet.It’s come to this. Government and corporate forces have joined to chip away at two pillars of the open Internet: the control of our personal data and our right to connect and communicate without censorship or interference.

The Surveillance Industrial Complex

A series of reports coordinated among the Guardian, the New York Times and ProPublica revealed that the NSA and its British counterpart have secretly unlocked encryption technologies used by popular online services, including Google, Facebook and Microsoft…

The secret vote has not always been guaranteed in the U.S. People used to vote in public, the way the Connecticut Legislature and the U.S. Congress does, where we know every vote. Public voting systems have advantages in integrity – it is easy to know the votes were recorded and tabulated correctly when they are given and posted publicly. What could go wrong…

The problems with a public vote are vote buying and intimidation. In the old days before the Civil War, it was superficially who would provide the most food or the best beer. Yet, it was more likely intimidation that led citizens to vote the way their friends, employers, benefactors, or bullies would want. Today, most people believe the secret vote is in the public interest.

For the benefits it provides, the secret vote has some costs and risks. Polling places, ballots, and absentee ballots are constructed and managed in ways that make it difficult, hopefully close to impossible, for any voter’s vote to be determined by others and proven to others by the voter. (Absentee votes being an exception, where voters can easily, yet illegally, demonstrate their vote to a buyer, friend, or intimidator). Extra work is required in counting secret votes, keeping them secret, and risks that they are not correctly recorded or tabulated, based on fraud or error. Thus, for the secret ballot we have increased cost, risk incorrect results, and reduced credibility.

There is perhaps something even worse than the risks of the secret vote or the risks of the public vote. Voting via Internet in a way that has many of the risks of public voting, without the benefits, along with the risks of secret voting and lack of confidence in the system. That would be Internet voting with election official insiders, outside hackers, outside political interests, outside business interests, and the Government itself able to see your vote and possibly manipulate the result; no credibility and plenty of perceived intimidation.

What is perceived intimidation?  We can easily envision the soldier going into a room to vote on the Internet, told by his superior several times, perhaps with a wink, “Nothing to worry about troop, the system is secure. I could not possibly know how you voted”. We can envision similar scenarios for Government employees, business employees, or church members “encouraged” to vote on computers owned by their employer, union, or church. No actual Interned insecurity required, just perceived intimidation.  Less easy to envision, is that it would actually be the same for the rest of us voting at home over the Internet, knowing that many can know our vote, but we cannot be sure that our vote or anyone’s is correctly counted.

Encryption, exposed as almost useless except to spys

Several weeks ago, Glen Greenwald said there was much more to come based on the information obtained by Edward Snowdon. For several of those weeks we have had disturbing, yet relatively minor disclosures. Yet once again, Snowdon has providing something huge. We need, once again to become a nation of laws.

Yesterday the New York Times, ProPublica, and the Guardian broke a major story. Several weeks ago, Glen Greenwald said there was much more to come based on the information obtained by Edward Snowdon. For several of those weeks we have had disturbing, yet relatively minor disclosures. Yet once again, Snowdon has providing something huge. From the Times: N.S.A. Able to Foil Basic Safeguards of Privacy on Web <read>

 Because strong encryption can be so effective, classified N.S.A. documents make clear, the agency’s success depends on working with Internet companies — by getting their voluntary collaboration, forcing their cooperation with court orders or surreptitiously stealing their encryption keys or altering their software or hardware.

According to an intelligence budget document leaked by Mr. Snowden, the N.S.A. spends more than $250 million a year on its Sigint Enabling Project, which “actively engages the U.S. and foreign IT industries to covertly influence and/or overtly leverage their commercial products’ designs” to make them “exploitable.” Sigint is the acronym for signals intelligence, the technical term for electronic eavesdropping…

In one case, after the government learned that a foreign intelligence target had ordered new computer hardware, the American manufacturer agreed to insert a back door into the product before it was shipped, someone familiar with the request told The Times.

To state the obvious, this should end the myth that encryption actually protects the secret vote, and vote integrity, if it really could have in the first place. Basically:

  • The NSA can hack almost any encrypted communications
  • They have coerced companys to put in back doors in software and hardware
  • They compromised encryption standards
  • The UK and other countries share in the secret and results
  • Edward Snowdon did not have authorized access to the information, yet was able to obtain it
  • Internet banking, purchases, stock trades, etc. are all exposed and vulnerable for the public and corporations

You can also listen to Glen Greenwald and Bruce Schneier on DemocracyNow!. <read/view>  They are providing further insights.  Not only that we have no reason to trust companies who claim useful encryption software, but that the holes created for the NSA are available to others for whatever purpose they might want. Some sophisticated users may be able to use open-source encryption and still protect their communications.

Perhaps worse, encryption standards have been hacked by the NSA, while scientists have been hoodwinked or compromised:

Cryptographers have long suspected that the agency planted vulnerabilities in a standard adopted in 2006 by the National Institute of Standards and Technology and later by the International Organization for Standardization, which has 163 countries as members.

Classified N.S.A. memos appear to confirm that the fatal weakness, discovered by two Microsoft cryptographers in 2007, was engineered by the agency. The N.S.A. wrote the standard and aggressively pushed it on the international group, privately calling the effort ‘a challenge in finesse.’

‘Eventually, N.S.A. became the sole editor,’ the memo says.

In the 90’s we had a battle in congress over the government requiring back doors in encryption hardware and software. The spies lost, the public won. But in the end we have learned that we cannot trust our government. We need, once again to become a nation of laws, as Greenwald pointed out in his book, published before he had met Edward Snowdon.

A follow-up story in the Times today: Legislation Seeks to Bar N.S.A. Tactic in Encryption <read>

An example of the usual response from the NSA. This is not news, everyone knows we do it, yet its really damaging.

A statement from the director of national intelligence, James R. Clapper Jr., criticized the reports, saying that it was “not news” that the N.S.A. works to break encryption, and that the articles would damage American intelligence collection.

The reports, the statement said, “reveal specific and classified details about how we conduct this critical intelligence activity.”

“Anything that yesterday’s disclosures add to the ongoing public debate,” it continued, “is outweighed by the road map they give to our adversaries about the specific techniques we are using to try to intercept their communications in our attempts to keep America and our allies safe and to provide our leaders with the information they need to make difficult and critical national security decisions.”

But if intelligence officials felt a sense of betrayal by the disclosures, Internet security experts felt a similar letdown — at the N.S.A. actions.

It does hurt. It is the truth that hurts:

But the perception of an N.S.A. intrusion into the networks of major Internet companies, whether surreptitious or with the companies’ cooperation, could hurt business, especially in international markets.

“What buyer is going to purchase a product that has been deliberately made less secure?” asked Mr. Holt, the congressman. “Even if N.S.A. does it with the purest motive, it can ruin the reputations of billion-dollar companies.”

In addition, news that the N.S.A. is inserting vulnerabilities into widely used technologies could put American lawmakers and technology companies in a bind with regard to China.

Over the last two years, American lawmakers have accused two of China’s largest telecommunications companies, Huawei Technologies and ZTE, of doing something parallel to what the N.S.A. has done: planting back doors into their equipment to allow for eavesdropping by the Chinese government and military.

Both companies have denied collaborating with the Chinese government, but the allegations have eliminated the companies’ hopes for significant business growth in the United States. After an investigation last year, the House Intelligence Committee concluded that government agencies should be barred from doing business with Huawei and ZTE, and that American companies should avoid buying their equipment.

We will leave for another day, a discussion of the implications for voting integrity and democracy.

An instructive story – Suppression, Conspiracy, Intrigue, Incredible, unfortunately True

This is a tale of three individuals focusing on the less known of the three, and her struggles with a country bent on suppressing information required of its citizens to participate in, direct, and obtain democracy. It would be quite a movie trailer or book sample text, yet perhaps too unbelievable.

Editor’s Note:  The three most basic issues upon which all others depend are media reform, the rule of law, and election integrity. If I could waive a wand and magically choose just one, it would be media reform – with media reform election integrity and the rule of law would be possible and likely, without it election integrity is of little consequence.  I spend my time on election integrity because the problems and workable solutions come naturally to me based on my knowledge, education, and experience.” Today, I would add a third basic issue upon which all others depend, the rule of law and not of people [or corporations. Two previous book reviews focus on the rule of law and media reform/freedom.

Highly recommended reading. New York Times magazine, yesterday: How Laura Poitras Helped Snowden Spill His Secrets <read>

This is a tale of three individuals Laura Poitras, Glenn Greenwald, and Edward Snowdon focusing on the less known of the three, Poitras, and her struggles with a country bent on suppressing information required of its citizens to participate in, direct, and obtain democracy.  It would be quite a movie trailer or book sample text, yet perhaps too unbelievable. As reality it is deeply disturbing, a profound call to action. Well written and engaging we recommend reading the entire article.

Once again we are in agreement with a Hartford Icon:

“It’s no wonder that truth is stranger than fiction. Fiction has to make sense.” – Mark Twain

*******Update #1.The intimidation spreads to family and to the UK, Glenn Greenwald writes: Detaining my partner: a failed attempt at intimidation <read>

This is obviously a rather profound escalation of their attacks on the news-gathering process and journalism. It’s bad enough to prosecute and imprison sources. It’s worse still to imprison journalists who report the truth. But to start detaining the family members and loved ones of journalists is simply despotic. Even the Mafia had ethical rules against targeting the family members of people they felt threatened by. But the UK puppets and their owners in the US national security state obviously are unconstrained by even those minimal scruples.

If the UK and US governments believe that tactics like this are going to deter or intimidate us in any way from continuing to report aggressively on what these documents reveal, they are beyond deluded. If anything, it will have only the opposite effect: to embolden us even further. Beyond that, every time the US and UK governments show their true character to the world – when they prevent the Bolivian President’s plane from flying safely home, when they threaten journalists with prosecution, when they engage in behavior like what they did today – all they do is helpfully underscore why it’s so dangerous to allow them to exercise vast, unchecked spying power in the dark.

 

******** Update #2. Meanwhile a “journalist” by everyone’s definition but the media’s dishes it out but cannot take it: Assassination TIME: Sr. journalist ‘can’t wait’ to justify drone strike that will kill Assange <read>