Forget North Korea – the real rogue cyber operator is closer to home

This morning’s Observer column.

The company [Symantec] goes on to speculate that developing Regin took “months, if not years” and concludes that “capabilities and the level of resources behind Regin indicate that it is one of the main cyberespionage tools used by a nation state”.

Ah, but which nation states? Step forward the UK and the US and their fraternal Sigint agencies GCHQ and NSA. A while back, Edward Snowden revealed that the agencies had mounted hacking attacks on Belgacom, a Belgian phone and internet services provider, and on EU computer systems, but he did not say what kind of software was used in the attacks. Now we know: it was Regin, malware that disguises itself as legitimate Microsoft software and steals data from infected systems, which makes it an invaluable tool for intelligence agencies that wish to penetrate foreigners’ computer networks.

Quite right too, you may say. After all, the reason we have GCHQ is to spy on nasty foreigners. The agency was, don’t forget, originally an offshoot of Bletchley Park, whose mission was to spy on the Germans. So perhaps the news that the Belgians, despite the best efforts of Monty Python, are our friends – or that the UK is a member of the EU – had not yet reached Cheltenham?

Read on

The Imitation travesty

We went to see The Imitation game last night. It’s a well-made, entertaining travesty, distinguished by a terrific performance by Benedict Cumberbatch as somebody’s weird idea of Alan Turing, and marred by a few howlers — some malicious (like the idea that Turing was suspected of being a Soviet spy both in Bletchley Park and afterwards in Manchester), some merely absurd (like the idea that he christened the first Bombe ‘Christopher’ after the dead boy he idolised when they were at school in Sherborne), and some completely implausible (like the scenes in which the codebreakers have a map of the north Atlantic with paper markers setting out the positions of ships in a convoy).

Cumberbatch is clearly a great actor, and his performance is memorable. But the unsubtle, autistic Turing he portrays is substantially at odds with the Turing who, for example, was entrusted by the British government with the task of hoodwinking the American codebreaking community into thinking that the British were way behind them in breaking German ciphers.

What the film does convey powerfully, though, is the cruelty of Britain’s homophobic laws. Walking home afterwards, I was reminded of the courage of the MP Leo Abse and the hereditary peer Lord Arran, the first Parliamentarians to publicly accept the recommendations of the Wolfenden Report, and of Roy Jenkins, the only liberal (small-l) Home Secretary in living memory, who ensured that the Sexual Offences Act 1967 made it onto the statute book.

Ironically, we saw the film the day after the Chancellor, George Osborne, announced that the £42m Turing Centre would be located at the British Library next to King’s Cross.

NSA hacks mobile networks worldwide

Operation AURORAGOLD. Or how the NSA doesn’t believe in half measures.

Codenamed AURORAGOLD, the covert operation has monitored the content of messages sent and received by more than 1,200 email accounts associated with major cellphone network operators, intercepting confidential company planning papers that help the NSA hack into phone networks.

One high-profile surveillance target is the GSM Association, an influential U.K.-headquartered trade group that works closely with large U.S.-based firms including Microsoft, Facebook, AT&T, and Cisco, and is currently being funded by the U.S. government to develop privacy-enhancing technologies.

Karsten Nohl, a leading cellphone security expert and cryptographer who was consulted by The Intercept about details contained in the AURORAGOLD documents, said that the broad scope of information swept up in the operation appears aimed at ensuring virtually every cellphone network in the world is NSA accessible.

Well, if you’re looking for needles in a haystack you need the whole goddam haystack.

Net Neutrality: it’s complicated even if it looks simple

This morning’s Observer column

The composer and aesthete Lord Berners was a famous eccentric who hated sharing railway compartments with strangers and developed a sure-fire way of ensuring that he travelled alone. He would stand at the door of his chosen compartment, maniacally beckoning people in. This being England, no one ever entered.

Nowadays, the same effect may be achieved by telling people that you wish to engage them in a discussion about net neutrality. You get the glassy smile, the sideways glance checking the location of the nearest exit, the sudden remembering of things that have to be done at that very moment, and all the other evasive tactics deployed by those who find themselves in the presence of a madman.

And yet, net neutrality is important…

Read on

Back to Hobbes?

At dinner in St John’s this evening after Timothy Garton-Ash’s Hinsley Memorial Lecture, a friend sitting across from me offered this thought. Politicians in liberal democracies have traditionally made promises of better economic futures when seeking election. But given that we now appear to be moving into an era when the economic prospects of children are, on average, worse than those of their parents, then that campaigning option will be closed off. In which case, what can politicians offer their electorates?

The obvious answer is: security. More and more ‘national security’.

Which brings us neatly back to Hobbes.

So is Internet surveillance effective?

I’d really like an informed, impartial answer to this question. To date, here’s is the best we can do:

“We have not identified a single instance involving a threat to the United States in which the program made a concrete difference in the outcome of a counterterrorism investigation. Moreover, we are aware of no instance in which the program directly contributed to the discovery of a previously unknown terrorist plot or the disruption of a terrorist attack. And we believe that in only one instance over the past seven years has the program arguably contributed to the identification of an unknown terrorism suspect. Even in that case, the suspect was not involved in planning a terrorist attack and there is reason to believe that the FBI may have discovered him without the contribution of the NSA’s program”.

This comes from the January 2014 report of the US Privacy and Civil Liberties Oversight Board, an independent bipartisan agency within the US government, which carried out an investigation into two NSA surveillance programmes in the wake of the Snowden revelations.

Our National Security state

From an extraordinary account of a walk around central London:

Suspicion is a global variable. Once triggered it bubbles upward through the entire system. Walking down Park Lane, I was accosted by a man in a suit who demanded to know what I was doing. He took out his mobile phone, pointed it at my face, told me he was going to “circulate my description”.
Shortly afterwards, a colleague of his physically restrained me and called the police. Both men worked at the Grosvenor House Hotel, whose cameras were among those which had been trained on me as I walked, and so are included in my documentation.

When they arrived, the police officers explained that carrying a camera in the vicinity of Central London was grounds for suspicion. I might be a terrorist who posed a threat to the good citizens of London – my own city. Equally I might be casing the joint for some future crime, studying its defences in order to circumvent them.

Carrying a camera thus justified the suspicion of the security guards who stopped me and performed a citizen’s arrest, detaining me until the arrival of the police. This suspicion in turn justified the actions of the police, who threatened me with arrest if I did not identify myself and explain my actions. For carrying a camera, I was told, I could be taken to the station and charged with “Going Equipped”, a provision of the 1968 Theft Act which determines the imprisonment for up to three years of anyone carrying equipment which may be used to commit a burglary.

I say Biggles, those ISIS fiends are devilishly clever

GCHQ_headline

This morning’s Observer column:

A headline caught my eye last Tuesday morning. “Privacy not an absolute right, says GCHQ chief”, it read. Given that GCHQ bosses are normally sensibly taciturn types, it looked puzzling. But it turns out that Sir Iain Lobban has retired from GCHQ to spend more time with his pension, to be followed no doubt, after a discreet interval, with some lucrative non-exec directorships. His successor is a Foreign Office smoothie, name of Robert Hannigan, who obviously decided that the best form of defence against the Snowden revelations is attack, which he mounted via an op-ed piece in the Financial Times, in the course of which he wrote some very puzzling things…

LATER The Economist has a curiously wishy-washy piece about this. It recalls the row, many years ago, about the Clipper chip and points out that it isn’t just the GCHQ boss who is critical of the companies. Michael Roberts, the new NSA director, last week said much the same thing to an audience in Silicon Valley. As to what will happen, though, the Economist is uncharacteristially uncertain:

Although the shrill rhetoric on both sides suggests the opposite, it seems mostly a negotiating tactic. Mr Rogers’s speech in Silicon Valley was essentially an offer to talk. “I’m not one who jumps up and down and says either side is fundamentally wrong,” he said. “We have no choice but to come to an agreement,” says the boss of an American technology giant. A deal would be welcome, but only if the rules are transparent, enforceable—and apply not just to American agencies, but to the other members of the “Five Eyes”, the intelligence alliance which also includes Australia, Britain, Canada and New Zealand.

Will it happen? More likely, there will be muddling through—just like after the Clipper chip. Technology companies will negotiate some arrangement to satisfy information requests by governments. And intelligence services will try to exploit vulnerabilities in encryption technologies or create backdoors surreptitiously. Until, perhaps, another Snowden comes along.

Read on

RIPA, the super-elastic statute

When RIPA was going through Parliament in 1999, one of the things critics pointed out was the latitude it provided for mission creep. And so it proved — to the point where local authorities were using it to snoop on parents who were suspected of not living in the catchment area of the schools to which they wanted to send their kids.

Now, more evidence of the extent of the mission creep: Documents released by human rights organisation, Reprieve show that GCHQ and MI5 staff were told they could target lawyers’ communications. This undermines legal privilege that ensures communications between lawyers and their clients are confidential.

The news that legal privilege is being violated comes weeks after it was revealed the Met police have used RIPA to circumvent journalistic privilege that protects journalists’ sources.

The only thing that remains is the (Catholic) Confessional.