The Cyber Threat and Its Implications for Our Privacy

“The time has come — indeed, if it has not already passed — to think seriously about some fundamental questions with respect to our reliance on cyber technologies: How much connected technology do we really want in our daily lives? Do we want the adoption of new connected technologies to be driven purely by innovation and market forces, or should we impose some regulatory constraints?” asked NSA General Counsel Glenn Gerstell in a Wednesday presentation at Georgetown University. “Although we continue to forge ahead in the development of new connected technologies, it is clear that the legal framework underpinning those technologies has not kept pace. Despite our reliance on the internet and connected technologies, we simply haven’t confronted, as a U.S. society, what it means to have privacy in a digital age.”

Mr. Gerstell's speech is available here. 

Collins v. Virginia

In Collins v. Virginia (Argued January 9, 2018 - Decided May 29, 2018 ), the USSC held that the scope of the automobile exception extends no further than the automobile itself; its proposed "expansion would undervalue the core Fourth Amendment protection afforded to the home and its curtilage and untether the exception from its justifications."

JUSTICE SOTOMAYOR delivered the opinion of the Court. This case presents the question whether the automobile exception to the Fourth Amendment permits a police officer, uninvited and without a warrant, to enter the curtilage of a home in order to search a vehicle parked therein. It does not.

The key to this decision is balance; compare the government interest in law enforcement against the sanctity of the home.

The essential facts of the case are simple: police made a warrantless entry into the curtilage of a home seeking and then collecting evidence related to a collection of traffic violations, and possibly a stolen motorcycle that had been used to commit those violations.

Two aspects of 4th Amendment law are involved:

1)  Consider that, after the person himself, his house is the next explicitly listed object protected from intrusion by the government.  His effects, even if considered instrumentalities of a crime, enjoy a lower standard.  Remember, the curtilage of a home enjoys the same intrusion protections as the home itself.  The fact that the suspect motorcycle could be seen from a legal vantage point still did not justify the physical intrusion into the curtilage.  For a good discussion of the privacy of a home and its curtilage, see Florida v. Jardines.

2)  In 1925, the USSC created the infamous automobile exception to the warrant requirement, stating that if there was probable cause to believe contraband was in a car (in the Carroll case, alcohol being imported from Canada), due to its inherent mobility, the exigency of the moment weighed in favor of an exception to requiring a warrant before conducting a search of the car.

In the instant case, there was no exigency to justify the warrantless intrusions on both the parked motorcycle and, in particular, the curtilage of the home; and in a 8-to-1 decision, the USSC ruled the privacy of the home outweighed the government benefit allowed by the 1925 Carroll automobile exception.

FLETC Legal Resources

FLETC Legal Resources. Legal resources for federal law enforcement officers. Podcasts on a variety of legal matters related to law enforcement. Video series pertaining to the 4th and 5th amendments, enhancing witness skills, and surviving an active shooter event... and more.

Link Password

Link Password is a Firefox Add-on that encrypts your bookmarks and links. Do you sometimes need password-protected individual bookmarks or links? Perhaps a link to a secret site that no one else will be able to follow?

Is Your Identity Up For Grabs?

 

In an age of data breaches and sophisticated identity thieves, protecting your digital information is more important than ever. A new state survey from AARP shows Washington consumers are falling further behind in the battle to protect their identities. According to AARP’s report, six-in-ten Washington adults (60%) failed a quiz testing their “Digital Identity IQ.”

Take the quiz to see if you know how to protect your digital identity.

Learn more about the AARP study here:  Up for Grabs: Taking Charge of Your Digital Identity: Survey of Washington Internet Users Age 18+

TSA's Secret Watchlist

The Transportation Security Administration has created a new secret watch list to monitor people who may be targeted as potential threats at airport checkpoints simply because they have swatted away security screeners’ hands or otherwise appeared unruly.

According to a confidential memo, any behavior that is "offensive and without legal justification" can land a traveler on the list, as can any "challenges to the safe and effective completion of screening." Anyone who has ever "loitered" near a checkpoint could also make the list. So could any woman who pushes a screener's hands away from her breasts.

Hugh Handeyside, an attorney for the American Civil Liberties Union, stated the policy gives the agency wide latitude to "blacklist people arbitrarily and essentially punish them for asserting their rights".

According to the LA Times "The watchlist would seem less perilous if the TSA were not one of most incompetent agencies on Earth. After a series of undercover tests at multiple airports across the country, the Department of Homeland Security concluded last year that TSA officers and equipment had failed to detect mock threats roughly 80% of the time. (In Minneapolis, an undercover team succeeded in smuggling weapons and mock bombs past airport screeners 95% of the time.) An earlier DHS investigation found the TSA utterly unable to detect weapons, fake explosives and other contraband, regardless of how extensive its pat-downs were."

The TSA has a long history of intimidation. In 2002, it created a system of fines to penalize travelers with bad attitudes, charging up to $1,500 for any alleged "nonphysical interference." This included any "situation that in any way would interfere with the screener and his or her ability to continue to work or interfere with their ability to do their jobs."

Peerio: Privacy for Everyone

Peerio is a state of the art encryption tool for everyone - designed to be as simple as it is secure. With a one-minute signup, end-to-end encryption by default, and cloud backup, you can easily
share private messages and files and access them from anywhere.

Peerio: Privacy for Everyone (YouTube Video)

Nadim Kobeissi, the brain behind Cryptocat and miniLock, is back with yet another tool designed to make your day-to-day life more secure. Peerio - a cloud-based, end-to-end encrypted communications suite that lets you send messages and share files as easily as you use Gmail or Skype's IM tool.

E-mail Privacy Act 2018

 

The House of Representatives passed a bill this week called the National Defense Authorization Act (NDAA), which authorizes the nation’s military and defense programs. Earlier in the week, scores of Representatives offered amendments to this must-pass bill in hopes of ensuring that their ideas get a chance to become law.

Rep. Kevin Yoder (R-KS) used this opportunity to include as an amendment the Email Privacy Act, a piece of legislation long-favored by EFF. The Email Privacy Act would codify the rule announced by the Sixth Circuit—and now followed by providers nationwide—that requires government agents to first obtain a probable cause warrant when seeking the content of communications stored by companies like Google, Facebook, Slack, Dropbox, and Microsoft.  Read more from the EFF.

National Security Requests to Apple Spike

The number of data requests from the U.S. government to Apple Inc. more than doubled last year, according to a biannual transparency report released by the consumer tech giant Friday.

Apple received 16,249 national security requests across 8,249 accounts between July 1, 2017 and Dec. 31, 2017, almost three times higher than the amount of requests received during the same period in 2016, when the company saw just 5,999 such requests.

Broadly speaking, a national security data request is usually made to compel access to private user information that’s stored by the company. These requests sometimes allow the government to learn more about suspected terrorists, criminals or other targets in order to pursue legal charges. (Cyberscoop, May 29, 2018)

California's New E-Ink License Plates (with built-in tracking)

We talked about digital drivers' licenses, and now there are digital license plates...

California is now testing a unique license plate option: a digital license plate that sports a Kindle-like E-ink display. Here’s the basic run down of the new (currently in pilot-testing) license plates. The plate can be changed automatically - but not to switch out your license number like you’re a spy racing across international borders - to update the displayed registration data and (theoretically if the State of California approves) display advertisements or other data when the car is stopped.

In addition to the flexibility of the display, the digital plates also sport a tracking device that will alert the police to the location of a stolen vehicle and allow for general vehicle tracking. (KGTV 10, April 20, 2018).
--

With the current price of the e-Link plate ($699 + $7 monthly connection fee) few people are signing up for them. But, this may change as the cost comes down, and may in time become the standard license plate format.

The tracking ability built into these plates creates significant privacy issues.  As we have previously seen, license plate tracking of our current standard plate is a concern. Having automatic vehicle tracking built into the license plate of the future is a privacy nightmare.

And now Washington State is in the early stages, considering whether to adopt these digital plates. The plates will cost about $300 in WA, and come with the same concerns about government tracking and data privacy.

Your Complete Amazon Purchase History

Did you know that Amazon stores your complete purchase history from 2006 through today on its web-site? Well, it does, and as a service to its customers, Amazon makes that information available to you. Just log into your Amazon account here, set the date range for your orders and Amazon makes your purchase history available to you as a MS Excel spreadsheet.

The spreadsheet contains a list of the items you purchased, the amount that you paid, how you paid (i.e. what credit card you used), the address where the item was shipped, and more.

This is a great way to keep track of all of your Amazon purchases over the years, but there is a problem - you can't delete this information. Amazon will always have a complete, and very detailed history of the purchases you have made.

To avoid having a purchase from Amazon associated with you, you will need to use a separate Amazon account, fund it with a source different than that used for your primary account. (Use an Amazon Gift Card, or fund your new Amazon account through Privacy.Com). You should also have the items delivered somewhere other than your home address (think Amazon Locker here).

Now maybe you don't care that Amazon maintains a detailed list of all your purchases. Maybe you think it's a good service to let you review you entire purchase history - it is. But, what does that purchase history tell others about you?  Groups like the American Library Association have long opposed the government gaining access to your reading history at libraries. Is your Amazon reading (purchase) history really that much different?

Cryptomator

Cryptomator encrypts file contents and names using AES. Your passphrase is protected against bruteforcing attempts using scrypt. Directory structures get obfuscated. The only thing which cannot be encrypted without breaking your cloud synchronization is the modification date of your files.

The program creates an AES-encrypted file in your Dropbox folder, Google Drive, or whatever other location you like. Just specify the file name, location and a passphrase, and you're done.

Once the vault is set up, Cryptomator mounts it as a virtual drive on your computer.

Save any documents to that drive, and they're automatically encrypted, then uploaded to the cloud (or to wherever your storage folder is located).

When you're finished, lock the vault, the virtual drive disappears, and no-one will even know it's there.

Cryptomator is a free and open source software licensed under the GPLv3. Cryptomator’s software works on Windows, Mac, and Linux, in both 32 and 64-bit flavors. A Java version is also available, for cross-platform compatibility.

Cryptomator Tutorial: Get Started (YouTube Video)

Some people have expressed a concern that a masterkey file is stored in the Cryptomator vault. This is supposed to be there. - "Inside the storage location of a Cryptomator vault, you will find a file called masterkey.cryptomator. This file is stored in the cloud to allow convenient access to a vault on different devices. This file contains encrypted data, which is needed to derive the masterkey from your password. The file does not contain the decrypted masterkey itself. In addition, some metadata about the vault (e.g., the version of Cryptomator used to create it) is also stored in this file. The encrypted key in masterkey.cryptomator is not more sensitive than the encrypted files themselves."

Digital Driver's Licenses

There's an app for almost everything these days, whether it's shopping, tracking your eating or exercise or finding your way. Now driver's licenses are making the transition from a card carried in a pocket or purse to a digital application on your mobile phone.

Colorado, Delaware, Idaho, Maryland, Wyoming and the District of Columbia are carrying out limited trials of digital driver's licenses. Iowa and Louisiana are planning to issue digital licenses to every motorist who wants one beginning this year.

What about the security of digital licenses in an age when it seems everything can be hacked? Digital licenses are protected by password, PINs and other security features in addition to the usual security built into phones, and state authorities can wipe a digital license remotely if a driver reports it lost to the Department of Motor Vehicles. (NBC News, May 24, 2018)
--

For data privacy, digital driver's licenses are an extremely bad idea. If you are stopped by the police for some minor traffic violation, the police officer will ask to see your driver's license, vehicle registration, proof of insurance, etc. But what does the police officer do with your documents? He or she takes them back to the police vehicle, runs your information through a data terminal mounted in the vehicle or radios the information into to a dispatcher who runs it.

If you driver's license is on your phone, the police officer now takes your unlocked phone back to the police vehicle. There is nothing to now prevent the police from taking a quick look through the content of your phone. Some police departments may even copy the entire content of your cell-phone as we see in this 2011 article in Geek. According to the article:

"If you’re a Michigan citizen, you may want to be careful about what you have on your cell phone. Apparently Michigan State Police have been using a high-tech mobile forensics device that can pull information from over 3,000 types of cell phones in under only two minutes.

The information the device is able to export is basically everything from your smartphone, including call history, deleted phone data, text messages, contacts, images, and GPS data. And don’t think you’ll be safe if your phone is password-protected, the device can get around that too.

The police don’t even need a warrant to scan your phone. They can pull your information without your consent, and without any reasonable cause. The Cellebrite UFED scanner has been used by MSP since at least August 2008.

It would be one thing if these scanners are being used on people who were suspected of a crime, but police officers are scanning the phones of drivers stopped in minor traffic violations."

Pornhub Launches VPNhub

PornHub launches VPNhub - a free and unlimited VPN service for anything (including p*rn)

PornHub wants you to keep your porn viewing activities private, and it is ready to help you out with its all-new VPN service.

Yes, you heard that right.

Adult entertainment giant PornHub has launched its very own VPN service today with "free and unlimited bandwidth" to help you keep prying eyes away from your browsing activity.

Dubbed VPNhub, the VPN service by PornHub is available for both mobile as well as desktop platform, including Android, iOS, MacOS, and Windows.

VPN, or Virtual Private Network, allows users to transmit data anonymously, avoids ISP-level website blocking or tracking and keeps your browsing activity private by encrypting your data, even when you are on public Wi-Fi connections.

VPNhub promises never to store, collect, sell, or share your personal information with any third parties for their marketing, advertising or research purposes.

VPNhub is available in countries across the globe except for Burma/Myanmar, Cuba, Iran, North Korea, Sudan, and Syria, due to the ban imposed by the U.S. government.

While mobile users (both iOS and Android) can download and use the VPNhub app for free, desktop users (MacOS and Windows) have to purchase a premium account.

You can also upgrade your free account to a premium subscription for $13 a month or $90 for a full year, which eliminates ads, provides faster connection speeds, and opens up "servers from a wide range of countries."

You can give premium VPNhub a try by using its use 7-day free trial.  (Hacker News, May 24, 2018)

Ways to Protect Your Privacy from Amazon Echo

KOMO 4 News (May 27, 2018)  provided tips that can help you protect your privacy when using voice controlled devices, like Amazon Echo. The article states "There's no way to eliminate these sorts of privacy risks short of unplugging entirely. But you can minimize the odds of unpleasant privacy surprises with these tips:

— KILL THE MIC
— LIMIT THE MIC
— ABOUT THAT CAMERA
— BLOCK THE SIGNALS
— BE INFORMED

Of course, the safest approach is not to buy a new gadget in the first place. That might not be practical for smartphones these days, but do you really need a smart speaker or a television set that's connected to the internet?"

Smart Meters - Surveillance of Your Home

According to the Seattle Times (May 13, 2018): Utility regulators are pushing utilities to adopt automated meter technology. But the American Civil Liberties Union and others warn it potentially threatens privacy and could pose health risks because of the radio signals used to transmit the information.

In 2017, the ACLU of Washington urged the Seattle City Council to consider requiring privacy protections before allowing the devices to be installed.

The meters, the ACLU argued, collect data in such ways that can reveal whether someone is home, and to some extent what they are doing in their home based on energy usage. And that data can be sold for marketing purposes, the ACLU and others warned. "The potential surveillance capabilities ... make clear and binding guidelines essential," ACLU Technology and Liberty Project Director Shankar Narayan wrote to the Seattle council. "In considering what safeguards might be appropriate, the City Council must consider the outer envelope of this (or any other) technology’s capabilities and ensure third-party verification of those capabilities, rather than rely on the assurances of the very vendors that stand to benefit from potential sales of Seattleites’ data."

The ACLU stated in its letter: 

"We have consistently advocated for privacy protections and against government surveillance without appropriate checks and balances. Advanced Metering Infrastructure (AMI) is a surveillance-capable infrastructure that is being rapidly implemented in Seattle with little public transparency as to its privacy impacts and how they will be mitigated; without appropriate regard for the principles of Seattle’s own Privacy Program; and without a meaningful opportunity for individuals to offer informed consent."

According to the Electronic Frontier Foundation:

Smart meters also reveal intimate details about what’s going on inside the home. By collecting energy use data at high frequencies - typically every 5, 15, or 30 minutes - smart meters know exactly how much electricity is being used, and when. Patterns in your smart meter data can reveal when you are home, when you are sleeping, when you take a shower, and even whether you cook dinner on the stove or in the microwave. These are all private details about what’s going on inside your home...

The Washington Utilities and Transportation Commission says customers can choose not to have the advanced meters hooked up to their homes or businesses.

Credit Security Freeze May Soon Be Free

According to CNN Money (May 22, 2018) - You will soon be able to freeze your credit report for free, a step that can help protect you from identity theft. The provision was included in a broader bill passed by the House on Tuesday, which rolled back regulations on banks created by Dodd-Frank. The bill now heads to President Donald Trump's desk.

The new legislation will make placing, lifting, and permanently removing freezes free no matter where you live. It also requires consumer rating companies to fulfill your request within one business day if made online or over the phone, and within three business days if requested by mail.

The changes will take effect about four months after the bill is signed.

In February 2018, I wrote about using a Credit Freeze for Privacy and Security.

Amazon Teams Up With Law Enforcement to Deploy Face Recognition Technology

The ACLU stated on May 22, 2018: Amazon, which got its start selling books and still bills itself as “Earth’s most customer-centric company,” has officially entered the surveillance business.

The company has developed a powerful and dangerous new facial recognition system and is actively helping governments deploy it. Amazon calls the service “Rekognition.”

Marketing materials and documents obtained by ACLU affiliates in three states reveal a product that can be readily used to violate civil liberties and civil rights. Powered by artificial intelligence, Rekognition can identify, track, and analyze people in real time and recognize up to 100 people in a single image. It can quickly scan information it collects against databases featuring tens of millions of faces, according to Amazon.

The ACLU released an open letter to Amazon CEO Jeff Bezos Tuesday, demanding Amazon to "stop powering a government surveillance infrastructure that poses a grave threat to customers and communities across the country."

Ghostery E-mail Breach

Ghostery sent out an e-mail on May 25, 2018 that resulted in the exposure of account holders’ e-mail addresses to other Ghostery account holders and Ghostery users. Only e-mail addresses were exposed. You are not affected if you use Ghostery but did not provide an e-mail address to them. You are not affected if you did not receive the GDPR e-mail from Ghostery.

COMSEC Beyond Encryption & OPSEC: Because Jail is for wuftpd

COMSEC Beyond Encryption
By Ben Nagy (@rantyben) and The Grugq (@thegrugq)

OPSEC for Russians - By The Grugq

OPSEC: Because Jail is for wuftpd (YouTube Video) - By The Grugq

The Grugq's presentation OPSEC: Because Jail is for wuftpd is a must see presentation. You can download the slide-deck "OPSEC for Russians" that goes along with this talk.

Also, read COMSEC Beyond Encryption. These are great slides, important for anyone interested in data privacy and personal security. 

You may also want to read RATS by Claire Wolfe.

-- and  --

Infiltrators, Informers and Grasses -
How, Why and What To Do If Your Group is Targeted

FBI Tells Router Users to Reboot Now to Kill Malware Infecting 500k Devices

Researchers from Cisco’s Talos security team first disclosed the existence of the malware on Wednesday. The detailed report said the malware infected more than 500,000 devices made by Linksys, Mikrotik, Netgear, QNAP, and TP-Link. Known as VPNFilter, the malware allowed attackers to collect communications, launch attacks on others, and permanently destroy the devices with a single command. The report said the malware was developed by hackers working for an advanced nation, possibly Russia, and advised users of affected router models to perform a factory reset, or at a minimum to reboot.

Amazon Alexa Recorded Private Conversation - Sent It to Random Contact

According to Fox13 News (May 24, 2018) Amazon Alexa recorded private conversation and sent it to a random contact. - A Portland, Oregon, family contacted Amazon to investigate after they say a private conversation in their home was recorded by Amazon's Alexa – the voice-controlled smart speaker – and the recorded audio was sent to the phone of a random person in Seattle, who was in the family’s contact list. "A husband and wife in the privacy of their home have conversations that they're not expecting to be sent to someone (in) their address book."

"Amazon said, 'Our engineers went through your logs, and they saw exactly what you told us; they saw exactly what you said happened, and we're sorry.' He apologized like 15 times in a matter of 30 minutes, and he said, 'We really appreciate you bringing this to our attention; this is something we need to fix!'"

EU GDPR - May 25, 2018

GDPR is a piece of legislation that was approved in April 2016. European authorities have given companies two years to comply and it will come into force on May 25, 2018.

It replaces a previous law called the Data Protection Directive and is aimed at harmonizing rules across the 28-nation EU bloc.

The aim is to give consumers control of their personal data as it is collected by companies. Not only will it affect organizations located within the EU, but it will also apply to companies outside of the region if they offer goods or services to, or monitor the behavior of, people in the EU.

 

 

While you don't receive the full benefits of the EU GDPR is you live outside of the EU the effect of this new law will benefit everyone that deals with giant Internet corporations like Google and Facebook. Also, while the EU GDPR may not be binding on courts outside of the EU; courts may find it persuasive when considering cases within their own jurisdictions.

 

You can learn more about the EU GDPR here.

 

 

 



FBI Repeatedly Overstated Encryption Threat Figures to Congress & Public

The FBI has repeatedly provided grossly inflated statistics to Congress and the public about the extent of problems posed by encrypted cellphones, claiming investigators were locked out of nearly 7,800 devices connected to crimes last year when the correct number was much smaller, probably between 1,000 and 2,000, The Washington Post (May 22, 2018) has learned.

Over a period of seven months, FBI Director Christopher A. Wray cited the inflated figure as the most compelling evidence for the need to address what the FBI calls “Going Dark” — the spread of encrypted software that can block investigators’ access to digital data even with a court order.

The FBI’s assertion that 7,775 phones could not be opened by their investigators last year has always struck a discordant note with critics and privacy advocates, who noted that just a year earlier, the FBI had claimed the figure was 880. Such a giant leap in locked phones could not be explained by changes in technology or criminal behavior, those critics reasoned.

Lawmakers have tried unsuccessfully to get more details about the FBI’s claims.
--

"Going Dark" claims from law enforcement are complete B.S. and always have been. Encryption prevents mass-surveillance, and prevents witch hunts where the government is looking for a crime where there is no good evidence that one exists (the actions of a police state); but it is much less effective in preventing law enforcement from investigating an actual crime (good police work).

Russia Imposes Fines for Search Engines That Show Links to Banned Sites

From Telegram News... Если вы не знали, то в России работает федеральная государственная информационная система (ФГИС), созданная для ограничения доступа к заблокированным ресурсам. В ФГИС также добавляют VPN-сервисы и другие средства анонимизации, которые по запросам правоохранительных органов или спецслужб не ограничивают доступ к запрещенным интернет-ресурсам. К ФГИС обязаны подключаться и операторы поисковых систем для прекращения выдачи ссылок на заблокированные сайты.

Тем временем Госдума готовится ввести штрафы за выдачу поисковиками ссылок на запрещенные сайты. Такая норма содержится в принятом 22 мая во втором чтении законопроекте об ответственности за нарушение закона об анонимайзерах. Согласно ей, за запрещенные сайты в поисковой выдаче могут грозить штрафы 3–5 тыс. руб. для граждан, 30–50 тыс. руб. для должностных лиц и 500–700 тыс. руб. для юридических лиц.


If you did not know, in Russia there is a Federal State Information System (FGIS), created to limit access to blocked resources. This includes VPN-services and other means of anonymization, which, at the request of law enforcement agencies or special services do not restrict access to banned Internet resources. Search engines are required to stop showing links to blocked sites.

Currently, the State Duma is preparing to impose fines for search engines that show links to banned sites. Such a rule is contained in the draft law on responsibility for violating the law on anonymizers passed on May 22 in the second reading. According to the law, fines of 3-5 thousand rubles can be imposed for banned sites in search results for citizens; 30-50 thousand rubles for officials; and 500-700 thousand rubles for legal entities (businesses).
--

Although there is a vast amount of information available on the Internet, we generally rely on a search engine of some type to locate that information. When links to information are removed from search results information becomes inaccessible - not because it is no longer on-line, but because it cannot be found.

It is important to keep your own list of URLs (links) to sites that you use to support your data privacy and personal security. This can be as basic as a list of links in a text file, or a more complex encrypted database of links.  You may also want to keep the IP addresses of important sites so that you can access them directly if they are blocked in the DNS. For example, http://149.154.167.99 will take you to the Telegram web-site.

There are several ways to keep your bookmarks secure. If you use the Firefox Browser, one option is the Link Password Add-On.

Gifts for the Privacy & Security Minded

Apricorn Aegis Padlock 1 TB USB 3.0 256-bit AES Encrypted Portable Hard Drive

YubiKey 4

Faraday Bag - RFID Signal Blocking Bag

Surveillance Tradecraft: The Professional's Guide to Surveillance Training

The Complete Privacy & Security Desk Reference: Volume I: Digital

Vanilla Visa

The Surveillance State: Big Data, Freedom, and You

Columbia River Knife and Tool Williams Tactical Pen

Guardline Wireless Driveway Alarm

CRKT Sting 3B Spear Point Plain Edge Fixed Blade Knife

DoorJammer Portable Door Lock Brace

Sabre Red Pepper Gel

Mace Brand Wearable 130dB Personal Protection Alarm

MTM SAC Survivor Ammo Can

State of Privacy and Security Awareness in Government

 

Citizens are increasingly concerned about the sensitive data held and used by government entities, fueled partly by stories of cyber-espionage, rumors of voter fraud, and social media’s impact on U.S. elections.  But with all the focus on state-affiliated actors and cybercriminals, one major hole is being overlooked: employees. Privileged misuse and miscellaneous errors by insiders account for a third of breaches... It makes us wonder: when was the last time these government agencies deployed a refresher training course on appropriate use of social media, proper data handling, or using a VPN?  (Media Pro, May 21, 2018)

 

 

--

Are Police Body Cameras Racist?

According to a November 14, 2017 report in Newsweek "police body camera's can threaten civil rights of black and brown people".

"Unrestricted footage review places civil rights at risk and undermines the goals of transparency and accountability," said Vanita Gupta, former head of the Department of Justice’s Civil Rights Division and current head of the Leadership Conference, in the report’s introduction.

Because an officer’s memory of an event may be altered by watching body camera footage, doing so will likely alter what officers write in their reports. That, in turn, can make it more difficult for investigators or courts to assess whether the officer’s actions were reasonable based on what he or she perceived at the time of the incident, states the report, "The Illusion of Accuracy: How Body-Worn Camera Footage Can Distort Evidence."

The report advises that police departments institute a "clean reporting" policy, under which officers write an initial incident report before reviewing any footage. Only afterward would they watch the footage and write a second, supplementary report.

"We make the case that in the interests of consistency, fairness, transparency and accountability, clean reporting should be adopted as a standard practice for all police departments with body-worn camera programs," writes Gupta in the introduction.

In April 2018, the president of a local chapter of the NAACP in South Carolina said he was racially profiled by a police officer when he was pulled over for a traffic violation.

"Tonight, I was racially profiled by Timmonsville Officer CAUSE I WAS DRIVING A MERCEDES BENZ AND GOING HOME IN A NICE NEIGHBORHOOD," Timmonsville NAACP President Rev. Jerrod Moultrie said in an April 13 Facebook post, according to Fox 5 Atlanta.

"He made a comment that the officer accused him of having drugs in the car,” Timmonsville Police Chief Billy Brown said, according to the station. “He said that his wife and grandchild was in the car. He asked them not to move because the officer looked as if he might shoot them or something. He also made mention that the officer continued to ask him about his neighborhood. Why was he in that neighborhood? And threaten[ed] to put him in jail in reference to something dealing with the registration to the vehicle."

But body camera footage released by the Timmonsville Police Department contradicts the reverend’s claims. It doesn't even appear that a citation was written (?) Take four minutes and check out this example of a police body camera in use.

On April 27th, 2018 a South Carolinian woman was pulled to the side of the road by police in Virginia. Dawn H. W. immediately went live on Facebook after the incident, sharing her experience through tears. “I was just bullied by a racist cop, who threatened to pull me out of the car,” she said about her encounter with the officer, “I was going 70 mph in a 65 zone”. In her 11-minute video, Dawn stressed how traumatic it felt, and how she feared being shot, tasered or “Sandra Blanded”. As well as detailing the encounter, the woman mentioned that she “did a lot of protesting, a lot of fighting in her day, so things like that wouldn’t happen”.

The officer’s body cam recording was then released to the public and it became clear that he acted in a professional manner. In the video, the deputy clarified that the reason he stopped her wasn’t racial profiling, as Dawn H. W. had claimed, but the fact that she was going at 70mph when the speed limit was 55mph. He then gave her a ticket and wished her a safe day. The body camera video can be seen here, posted to YouTube.

On May 8, 2018 the Rialto [CA] Police Department released the video after three black guests threatened to sue, claiming the department had overreacted when a 911 caller wrongly reported a burglary at their Airbnb rental April 30. The police department responded, saying its officers acted "respectfully, honestly and professionally" throughout the entire encounter with the group, which included Donisha Prendergast, whom they said identified herself as the granddaughter of reggae music legend Bob Marley. "The videos speak for themselves," Rialto’s interim police chief, Mark Kling, said at a news conference Tuesday. "Our officers handled the situation with professionalism, dignity and respect." A KCAL 9 News report showing that video can be seen here on YouTube.

And on May 23, 2018 an article and video in the Tribunist showed that a drunk driver who accused an officer of sexual assault lied! DPS says Trooper Daniel Hubbard saw a 2013 Chevrolet Malibu driving south on Interstate 35 in Ellis County near U.S. 287 and the car was stopped for a traffic violation. Based on the traffic stop, the driver was arrested for driving while intoxicated. She was taken to the Ellis County jail and charged with DWI. Following the arrest, allegations were made against Hubbard. DPS says it took those allegations seriously, immediately reviewing the traffic stop and arrest. It ultimately concluded there was no evidence to support the allegations that any wrong-doing occurred.

Accusations of police abuse of power are currently widespread. In a few cases the claims seem to have some merit. However, in more and more of these cases it seems that the accusations are baseless. It would appear that we have another case of the latter following the release of body cam footage in Texas earlier yesterday (May 23, 2018).
--

Body cameras create a record of what occurred during a police contact. The body camera itself cannot be bias or racist, it just records what is happening in front of it. "The Illusion of Accuracy: How Body-Worn Camera Footage Can Distort Evidence" report provides additional insight into the use of police body cameras, and I believe that this report is worth reading. However, as we have seen in the above examples - recorded by police body cameras - accusations against police officers are often false and having body camera video available can show what actually happened during a police contact.

President Trump Can't Block Users on Twitter

Victory For The First Amendment: Court Rules That Government Officials Who Tweet to the Public Can't Block Users Who They Disagree With.

The Electronic Frontier Foundation (EFF) reported today (May 23, 2018) that a judge has ruled that viewpoint-based exclusion by the president on Twitter is “impermissible under the First Amendment.”

In an amicus brief filed on behalf of the plaintiffs, EFF argued governmental use of social media platforms to communicate to and with the public, and allow the public to communicate with each other, is now the rule of democratic engagement, not the exception.

President Donald Trump's blocking of people on Twitter because they criticize him violates the First Amendment, a federal judge in New York ruled today in a resounding victory for freedom of speech and the public’s right to communicate opposing political views directly to elected officials and government agencies.

--
This ruling will likely carry over to other government agencies that use social media to communicate with the public. If your agency has a Twitter, Facebook, or e-mail distribution list, etc. that it used to communicate with the public, you can't block people just because they disagree with or challenge your public comments.

Pentagon Stiffens Cell-Phone Policy but Avoids Full Ban

The Washington Times, 23 May 2018: The Defense Department this week stiffened its policy on cellphone use inside the Pentagon but stopped short of the complete ban that had been under consideration and which would’ve marked a major day-to-day change for the tens of thousands of employees who work inside the sprawling facility. The new protocol was first reported by The Associated Press, citing an internal Pentagon memo that was made public late Tuesday. The document applies to “laptops, tablets, cellular phones, smart-watches, and other devices,” and represents the latest effort by government and military officials who oversee the nation’s secrets to figure out how best to handle powerful technological devices that have become ubiquitous in American life. Under the revamped policy — which had been a matter of debate for months inside the Defense Department — cellphone use will still be allowed in common areas of the building, such as cafeterias and restaurants, and in any office where no classified information is present. Inside offices where classified information is being discussed, or where such information can be found on computers on documents, the Pentagon will tighten policies that require all electronic devices to be turned off and left in secured storage containers outside the room. The policy will be enforced through random inspections inside those classified areas. It’s almost certain the tougher policy will require the construction of new secure containers throughout the building, though officials said they don’t yet have a cost estimate for that project. At its core, the new policy aims to address the ever-increasing capabilities of modern cellphones and to protect the military’s most closely held information. Throughout much of the massive complex, cellphone reception is virtually nonexistent.
--

The policy of no cell-phones / wireless devices in areas containing classified material has been in place for many years (it just tended to be ignored).

DOD Directive 8100.2 (April 14, 2004) states: para. 4.2. Cellular/PCS and/or other RF or Infrared (IR) wireless devices shall not be allowed into an area where classified information is discussed or processed without written approval from the DAA in consultation with the Cognizant Security Authority (CSA) Certified TEMPEST Technical Authority (CTTA).

Security managers are frequently faced with some self-important delicate little violet who feels the need to chat on his Blackberry while typing on the SIPR Net. Reporting these violations usually does no good as leadership is more concerned about not upsetting the person violating the regulation than protecting the nations secrets. I am glad to see that the Pentagon - and hopefully the rest of DOD - is starting to pay attention its own security regulations (many of which have been in place for years).


 

Police Target Protesters with Military Surveillance Technology

A May 15, 2018 article by the Electronic Frontier Foundation (EFF) stated "In recent years, protesters have come face to face with police forces that are increasingly well-equipped with battlefield surveillance technologies. That’s because U.S. police are getting more and more equipment from the U.S. military - including sophisticated surveillance equipment. The trend has led to disturbing scenes like those from 2014 protests against police shootings, in which peaceful protesters were confronted by law enforcement equipped with sophisticated military equipment.

 

According to recent data from the Department of Defense, California police agencies are already in possession of more than $136 million worth of military equipment, including thermal imaging equipment, drones, and “long-range acoustic devices,” which are a type of sonic weapon.

 

Spying tools used against foreign military adversaries shouldn’t be casually handed over to U.S. police. Once these tools are adopted locally, it’s hard to stop their use."



--

According to the ACLU (June 19, 2009) "The Department of Defense (DOD) considers protests an example of "low-level terrorism," at least according to an exam DOD employees were required to take this year. You would have thought that the Pentagon learned its lesson after its nationwide surveillance program targeting peace activists, called TALON, was exposed in 2005 and roundly condemned. The program and the secretive Pentagon unit that ran it, the Counterintelligence Field Activity Agency (CIFA), were both shuttered in 2007. Apparently it is easier to kill a program than change an attitude." 

In January 2011, the Olympian Newspaper (Olympia, WA) reported that "a former Joint Base Lewis-McChord employee who spied on war protests in Olympia helped compile detailed information on protesters, including their names, photos, addresses and, in some cases, Social Security numbers..." 

An April 2017 article in the Huffington Post stated "With the militarization of police on the rise, the necessarily stark line between the military and domestic law enforcement is becoming increasingly blurred. And it’s not entirely surprising—given ongoing revelations around mass surveillance—that the military would abuse its authority and spy on activists in order to undermine their political objectives."

Have You Encountered Neo-Nazis or White Supremacists in the Military?

ProPublica wants to know more about Neo-Nazis and White Supremacists in the Military. They want to know what the Army, Navy, Air Force and Marines are doing about them.

Are you an active duty or retired service member, or the family or friend of someone in the military who has encountered white supremacy or neo-Nazis in the armed forces? ProPublica wants to hear your story.

ProPublica has set up a questionnaire, as well as providing a contact number for WhatsApp and Signal. - (347) 244-2134.  You can also email ProPublica at getinvolved@propublica.org.  Additional contact information for ProPublica is available on their SecureDrop site.

--
Earlier this month I posted about that the Notorious Hate Group Atomwaffen Includes Active-Duty Military.  Atomwaffen is active in Washington State, which ranks seventh for number of military personnel assigned within the state.

If you encounter extremist activity on a military installation, I recommend that you first report this through the military chain-of-command, and/or to the installation's Provost Marshal. In most cases this will be the most effective way of addressing the issue. 

Only if the chain-of-command or the Provost Marshal fails to take significant and definitive action (which is unlikely) to investigate extremist activity in the military ranks (or if someone interferers in or disrupts an investigation into extremist activity) would it be appropriate for a Service Member to provide information to the press.

CryptoTrust OnlyKey USB

CryptoTrust OnlyKey USB functions as an open source password manager, a two-factor security key, and secure communication token. Six buttons support multiple authentication methods, such as FIDO U2F and One Time Passwords used by Google Authenticator/Yubikey.

OnlyKey is a fairly new product, but one that I think offers good security innovations. Setting up OnlyKey takes a little bit of skill, or the ability to follow the on-line instructions, but overall it's not to difficult.

If you currently use Yubikey - and I recommend that you do - then you will probably have no problem using OnlyKey with its additional security features. For those of us interested in new technology and advances in data privacy and personal security, OnlyKey is worth a look.

Facial Recognition Tools Used By Police - Staggeringly Inaccurate

 

According to BBC News (May 15, 2018) facial recognition tools used by police are 'staggeringly inaccurate'.  Big Brother Watch (a UK civil rights group) said it was concerned that facial recognition cameras would affect "individuals' right to a private life and freedom of expression". It also raised concerns that photos of any "false alarms" were sometimes kept by police for weeks. In figures given to Big Brother Watch, South Wales Police said its technology had made 2,685 "matches" between May 2017 and March 2018 - but 2,451 were false alarms." Automated facial recognition technology is currently used by UK police forces without a clear legal basis, oversight or governmental strategy," the group said.



The State of Cyber-Stress

A Kaspersky Lab survey report - The State of Cyber-Stress - shows that 81 percent of Americans and 72 percent of Canadians admit to feeling stressed by the news of data breaches.

The Kaspersky Lab report found that consumers’ lack of awareness of how to protect themselves from online threats is leading to increased stress levels around technology usage and cybersecurity as a whole.

Kaspersky Lab conducted a survey of over 2,000 internet users in the United States and Canada to gain insight into the perceptions of consumers regarding cybersecurity, including people’s stress levels about data breaches and passwords, and what actions they take to protect their data from online threats. The results of this research revealed:

• The stress levels of consumers relating to digital security and technology
• How many people have experienced a cyberattack on their internet-connected devices
• How people feel about businesses or people close to them having access to their data
• What consumers and businesses can do to reduce their cyber-stress

“Research has shown that it's not the big, acute, one-time challenges that cause the majority of stress-related disease and disorder, but the everyday, nagging, accumulating pressure and tension we feel when we don't have enough capacity to cope with the demands of life,” explained Heidi Hanna, Ph.D., executive director of the American Institute of Stress. “Especially when we feel unsafe, out of control, or unable to keep up with the pace of change, something that is inherent in our constantly-connected, digital lifestyle.”

Date Rape Drugs

Previous research has suggested that the risk of being drugged is an overblown urban myth. But a new study says that drink spiking is very real and often leads to sexual assault for women on college campuses.

Published in the American Psychological Association's Psychology of Violence journal, the resulting study—"Just a Dare or Unaware? Outcomes and Motives of Drugging ('Drink Spiking') Among Students at Three College Campuses"—asserts that drink spiking is a very real threat to women on campus.

A team of researchers surveyed over 6,000 students across three universities—the University of South Carolina, the University of Kentucky, and the University of Cincinnati. They first asked how many times the student suspected they had been drugged, with the options ranging from "zero" to "over six times," and asked follow-up questions from there, including the location of the drugging and consequences.

The results were, in a word, disturbing. Nearly eight percent of all students said they had experienced being drugged with Rohypnol ("roofies"), Xanax, or other substances. That's about 462 students. And of those students, broken down by gender, 16.8 percent of women reported that they had had "unwanted sex" after being given a spiked drink. (Broadly, May 24, 2018)

The four most common date rape drugs are Rohypnol® (flunitrazepam), GHB (gamma hydroxybutryic acid), ketamine, and chloral hydrate.

Rohypnol (also known as roofies, forget-me-pill, and R-2) is a type of prescription pill known as a benzodiazepine—it’s chemically similar to drugs such as Valium or Xanax, but unlike these drugs, it is not approved for medical use in this the United States.

• It has no taste or smell and is sometimes colorless when dissolved in a drink.
• People who take it can feel very sleepy and confused and forget what happens after its effects kick in.
• It can also cause weakness and trouble breathing, and can make it difficult for those who have taken it to move their body.
• The effects of Rohypnol can be felt within 30 minutes of being drugged and can last for several hours.
• To prevent misuse of Rohypnol, the manufacturer recently changed the pill to look like an oblong olive green tablet with a speckled blue core. When dissolved in light-colored drinks, the new pills dye the liquid blue and alert people that their drink has been tampered with. Unfortunately, generic versions of Rohypnol may not contain the blue dye.

GHB (also known as cherry meth, scoop, and goop) is a type of drug that acts as a central nervous system depressant and is prescribed for the treatment of narcolepsy (a sleep disorder).

• It can cause a person to throw up; it can also slow their heart rate and make it hard to breathe.
• At high doses, it can result in a coma or death. 
• It's a tasteless, odorless drug that can be a powder or liquid. It’s colorless when dissolved in a drink.
• Mixing it with alcohol makes these effects worse.
• GHB can take effect in 15 to 30 minutes, and the effects may last for 3 to 6 hours.

 

 Ketamine (also known as cat valium, k-hole, and purple) is a dissociative anesthetic. That means it distorts perceptions of sight and sound, and makes a person feel detached from their environment and themselves. It also reduces pain and overall feeling. Like other anesthetic drugs, it's used during surgical procedures in both humans and animals.

• It's a tasteless, odorless drug that can be a powder or liquid.
• It can cause hallucinations and make people feel totally out of it.
• It can also increase heartbeat, raise blood pressure, and cause nausea.
• The effects of ketamine may last for 30 to 60 minutes.

 

Chloral Hydrate is the oldest of the hypnotic (sleep inducing) depressants, chloral hydrate was first synthesized in 1832.

• A solution of chloral hydrate and alcohol constituted the infamous "knockout drops" or "Mickey Finn." This form of chloral hydrate is used in drug facilitated sexual assault, or "date rape".
• Signs of overdose include confusion (continuing); convulsions (seizures); difficulty in swallowing; drowsiness (severe); low body temperature ; nausea, vomiting, or stomach pain (severe); shortness of breath or troubled breathing; slow or irregular heartbeat; slurred speech; staggering; and weakness (severe).

If you're at a party where people are drinking alcohol, you should be aware that there could be predators hoping to make you drunk or vulnerable. No matter what you're drinking, even if it’s soda or juice, people can slip drugs in your drinks—so pour all drinks yourself and never leave them unattended.

Date rape drug detection tests are available. These tests consist of paper sheets containing a chemical test compound. Place a few drops of a suspected drink on the test sheet, and if the drink contains a date rape drug (GHB or Ketamine) the test sheet will react by changing color.