Saturday, May 26, 2018

Ghostery E-mail Breach

Ghostery sent out an e-mail on May 25, 2018 that resulted in the exposure of account holders’ e-mail addresses to other Ghostery account holders and Ghostery users. Only e-mail addresses were exposed. You are not affected if you use Ghostery but did not provide an e-mail address to them. You are not affected if you did not receive the GDPR e-mail from Ghostery.

COMSEC Beyond Encryption & OPSEC: Because Jail is for wuftpd


COMSEC Beyond Encryption
By Ben Nagy (@rantyben) and The Grugq (@thegrugq)

OPSEC for Russians - By The Grugq

OPSEC: Because Jail is for wuftpd (YouTube Video) - By The Grugq

The Grugq's presentation OPSEC: Because Jail is for wuftpd is a must see presentation. You can download the slide-deck "OPSEC for Russians" that goes along with this talk.

Also, read COMSEC Beyond Encryption. These are great slides, important for anyone interested in data privacy and personal security. 


You may also want to read RATS by Claire Wolfe.

-- and  --

Infiltrators, Informers and Grasses -
How, Why and What To Do If Your Group is Targeted



Friday, May 25, 2018

FBI Tells Router Users to Reboot Now to Kill Malware Infecting 500k Devices


Researchers from Cisco’s Talos security team first disclosed the existence of the malware on Wednesday. The detailed report said the malware infected more than 500,000 devices made by Linksys, Mikrotik, Netgear, QNAP, and TP-Link. Known as VPNFilter, the malware allowed attackers to collect communications, launch attacks on others, and permanently destroy the devices with a single command. The report said the malware was developed by hackers working for an advanced nation, possibly Russia, and advised users of affected router models to perform a factory reset, or at a minimum to reboot.

Amazon Alexa Recorded Private Conversation - Sent It to Random Contact


According to Fox13 News (May 24, 2018) Amazon Alexa recorded private conversation and sent it to a random contact. - A Portland, Oregon, family contacted Amazon to investigate after they say a private conversation in their home was recorded by Amazon's Alexa – the voice-controlled smart speaker – and the recorded audio was sent to the phone of a random person in Seattle, who was in the family’s contact list. "A husband and wife in the privacy of their home have conversations that they're not expecting to be sent to someone (in) their address book."

"Amazon said, 'Our engineers went through your logs, and they saw exactly what you told us; they saw exactly what you said happened, and we're sorry.' He apologized like 15 times in a matter of 30 minutes, and he said, 'We really appreciate you bringing this to our attention; this is something we need to fix!'"

EU GDPR - May 25, 2018



GDPR is a piece of legislation that was approved in April 2016. European authorities have given companies two years to comply and it will come into force on May 25, 2018.

It replaces a previous law called the Data Protection Directive and is aimed at harmonizing rules across the 28-nation EU bloc.

The aim is to give consumers control of their personal data as it is collected by companies. Not only will it affect organizations located within the EU, but it will also apply to companies outside of the region if they offer goods or services to, or monitor the behavior of, people in the EU.

 
 
While you don't receive the full benefits of the EU GDPR is you live outside of the EU the effect of this new law will benefit everyone that deals with giant Internet corporations like Google and Facebook. Also, while the EU GDPR may not be binding on courts outside of the EU; courts may find it persuasive when considering cases within their own jurisdictions.
 
 
 
 


Thursday, May 24, 2018

FBI Repeatedly Overstated Encryption Threat Figures to Congress & Public


The FBI has repeatedly provided grossly inflated statistics to Congress and the public about the extent of problems posed by encrypted cellphones, claiming investigators were locked out of nearly 7,800 devices connected to crimes last year when the correct number was much smaller, probably between 1,000 and 2,000, The Washington Post (May 22, 2018) has learned.

Over a period of seven months, FBI Director Christopher A. Wray cited the inflated figure as the most compelling evidence for the need to address what the FBI calls “Going Dark” — the spread of encrypted software that can block investigators’ access to digital data even with a court order.

The FBI’s assertion that 7,775 phones could not be opened by their investigators last year has always struck a discordant note with critics and privacy advocates, who noted that just a year earlier, the FBI had claimed the figure was 880. Such a giant leap in locked phones could not be explained by changes in technology or criminal behavior, those critics reasoned.

Lawmakers have tried unsuccessfully to get more details about the FBI’s claims.
--

"Going Dark" claims from law enforcement are complete B.S. and always have been. Encryption prevents mass-surveillance, and prevents witch hunts where the government is looking for a crime where there is no good evidence that one exists (the actions of a police state); but it is much less effective in preventing law enforcement from investigating an actual crime (good police work).

Russia Imposes Fines for Search Engines That Show Links to Banned Sites


From Telegram News... Если вы не знали, то в России работает федеральная государственная информационная система (ФГИС), созданная для ограничения доступа к заблокированным ресурсам. В ФГИС также добавляют VPN-сервисы и другие средства анонимизации, которые по запросам правоохранительных органов или спецслужб не ограничивают доступ к запрещенным интернет-ресурсам. К ФГИС обязаны подключаться и операторы поисковых систем для прекращения выдачи ссылок на заблокированные сайты.

Тем временем Госдума готовится ввести штрафы за выдачу поисковиками ссылок на запрещенные сайты. Такая норма содержится в принятом 22 мая во втором чтении законопроекте об ответственности за нарушение закона об анонимайзерах. Согласно ей, за запрещенные сайты в поисковой выдаче могут грозить штрафы 3–5 тыс. руб. для граждан, 30–50 тыс. руб. для должностных лиц и 500–700 тыс. руб. для юридических лиц.


If you did not know, in Russia there is a Federal State Information System (FGIS), created to limit access to blocked resources. This includes VPN-services and other means of anonymization, which, at the request of law enforcement agencies or special services do not restrict access to banned Internet resources. Search engines are required to stop showing links to blocked sites.

Currently, the State Duma is preparing to impose fines for search engines that show links to banned sites. Such a rule is contained in the draft law on responsibility for violating the law on anonymizers passed on May 22 in the second reading. According to the law, fines of 3-5 thousand rubles can be imposed for banned sites in search results for citizens; 30-50 thousand rubles for officials; and 500-700 thousand rubles for legal entities (businesses).
--

Although there is a vast amount of information available on the Internet, we generally rely on a search engine of some type to locate that information. When links to information are removed from search results information becomes inaccessible - not because it is no longer on-line, but because it cannot be found.

It is important to keep your own list of URLs (links) to sites that you use to support your data privacy and personal security. This can be as basic as a list of links in a text file, or a more complex encrypted database of links.  You may also want to keep the IP addresses of important sites so that you can access them directly if they are blocked in the DNS. For example, http://149.154.167.99 will take you to the Telegram web-site.

There are several ways to keep your bookmarks secure. If you use the Firefox Browser, one option is the Link Password Add-On.

Gifts for the Privacy & Security Minded


Apricorn Aegis Padlock 1 TB USB 3.0 256-bit AES Encrypted Portable Hard Drive

YubiKey 4

Faraday Bag - RFID Signal Blocking Bag

Surveillance Tradecraft: The Professional's Guide to Surveillance Training

The Complete Privacy & Security Desk Reference: Volume I: Digital

Vanilla Visa

The Surveillance State: Big Data, Freedom, and You

Columbia River Knife and Tool Williams Tactical Pen

Guardline Wireless Driveway Alarm

CRKT Sting 3B Spear Point Plain Edge Fixed Blade Knife


DoorJammer Portable Door Lock Brace

Sabre Red Pepper Gel

Mace Brand Wearable 130dB Personal Protection Alarm

MTM SAC Survivor Ammo Can



State of Privacy and Security Awareness in Government

 
Citizens are increasingly concerned about the sensitive data held and used by government entities, fueled partly by stories of cyber-espionage, rumors of voter fraud, and social media’s impact on U.S. elections.  But with all the focus on state-affiliated actors and cybercriminals, one major hole is being overlooked: employees. Privileged misuse and miscellaneous errors by insiders account for a third of breaches... It makes us wonder: when was the last time these government agencies deployed a refresher training course on appropriate use of social media, proper data handling, or using a VPN?  (Media Pro, May 21, 2018)

 
 
--

Are Police Body Cameras Racist?


According to a November 14, 2017 report in Newsweek "police body camera's can threaten civil rights of black and brown people".

"Unrestricted footage review places civil rights at risk and undermines the goals of transparency and accountability," said Vanita Gupta, former head of the Department of Justice’s Civil Rights Division and current head of the Leadership Conference, in the report’s introduction.

Because an officer’s memory of an event may be altered by watching body camera footage, doing so will likely alter what officers write in their reports. That, in turn, can make it more difficult for investigators or courts to assess whether the officer’s actions were reasonable based on what he or she perceived at the time of the incident, states the report, "The Illusion of Accuracy: How Body-Worn Camera Footage Can Distort Evidence."


The report advises that police departments institute a "clean reporting" policy, under which officers write an initial incident report before reviewing any footage. Only afterward would they watch the footage and write a second, supplementary report.

"We make the case that in the interests of consistency, fairness, transparency and accountability, clean reporting should be adopted as a standard practice for all police departments with body-worn camera programs," writes Gupta in the introduction.


In April 2018, the president of a local chapter of the NAACP in South Carolina said he was racially profiled by a police officer when he was pulled over for a traffic violation.

"Tonight, I was racially profiled by Timmonsville Officer CAUSE I WAS DRIVING A MERCEDES BENZ AND GOING HOME IN A NICE NEIGHBORHOOD," Timmonsville NAACP President Rev. Jerrod Moultrie said in an April 13 Facebook post, according to Fox 5 Atlanta.

"He made a comment that the officer accused him of having drugs in the car,” Timmonsville Police Chief Billy Brown said, according to the station. “He said that his wife and grandchild was in the car. He asked them not to move because the officer looked as if he might shoot them or something. He also made mention that the officer continued to ask him about his neighborhood. Why was he in that neighborhood? And threaten[ed] to put him in jail in reference to something dealing with the registration to the vehicle."

But body camera footage released by the Timmonsville Police Department contradicts the reverend’s claims. It doesn't even appear that a citation was written (?) Take four minutes and check out this example of a police body camera in use.



On April 27th, 2018 a South Carolinian woman was pulled to the side of the road by police in Virginia. Dawn H. W. immediately went live on Facebook after the incident, sharing her experience through tears. “I was just bullied by a racist cop, who threatened to pull me out of the car,” she said about her encounter with the officer, “I was going 70 mph in a 65 zone”. In her 11-minute video, Dawn stressed how traumatic it felt, and how she feared being shot, tasered or “Sandra Blanded”. As well as detailing the encounter, the woman mentioned that she “did a lot of protesting, a lot of fighting in her day, so things like that wouldn’t happen”.

The officer’s body cam recording was then released to the public and it became clear that he acted in a professional manner. In the video, the deputy clarified that the reason he stopped her wasn’t racial profiling, as Dawn H. W. had claimed, but the fact that she was going at 70mph when the speed limit was 55mph. He then gave her a ticket and wished her a safe day. The body camera video can be seen here, posted to YouTube.


On May 8, 2018 the Rialto [CA] Police Department released the video after three black guests threatened to sue, claiming the department had overreacted when a 911 caller wrongly reported a burglary at their Airbnb rental April 30. The police department responded, saying its officers acted "respectfully, honestly and professionally" throughout the entire encounter with the group, which included Donisha Prendergast, whom they said identified herself as the granddaughter of reggae music legend Bob Marley. "The videos speak for themselves," Rialto’s interim police chief, Mark Kling, said at a news conference Tuesday. "Our officers handled the situation with professionalism, dignity and respect." A KCAL 9 News report showing that video can be seen here on YouTube.


And on May 23, 2018 an article and video in the Tribunist showed that a drunk driver who accused an officer of sexual assault lied! DPS says Trooper Daniel Hubbard saw a 2013 Chevrolet Malibu driving south on Interstate 35 in Ellis County near U.S. 287 and the car was stopped for a traffic violation. Based on the traffic stop, the driver was arrested for driving while intoxicated. She was taken to the Ellis County jail and charged with DWI. Following the arrest, allegations were made against Hubbard. DPS says it took those allegations seriously, immediately reviewing the traffic stop and arrest. It ultimately concluded there was no evidence to support the allegations that any wrong-doing occurred.

Accusations of police abuse of power are currently widespread. In a few cases the claims seem to have some merit. However, in more and more of these cases it seems that the accusations are baseless. It would appear that we have another case of the latter following the release of body cam footage in Texas earlier yesterday (May 23, 2018).
--

Body cameras create a record of what occurred during a police contact. The body camera itself cannot be bias or racist, it just records what is happening in front of it. "The Illusion of Accuracy: How Body-Worn Camera Footage Can Distort Evidence" report provides additional insight into the use of police body cameras, and I believe that this report is worth reading. However, as we have seen in the above examples - recorded by police body cameras - accusations against police officers are often false and having body camera video available can show what actually happened during a police contact.


Wednesday, May 23, 2018

President Trump Can't Block Users on Twitter


Victory For The First Amendment: Court Rules That Government Officials Who Tweet to the Public Can't Block Users Who They Disagree With.

The Electronic Frontier Foundation (EFF) reported today (May 23, 2018) that a judge has ruled that viewpoint-based exclusion by the president on Twitter is “impermissible under the First Amendment.”

In an amicus brief filed on behalf of the plaintiffs, EFF argued governmental use of social media platforms to communicate to and with the public, and allow the public to communicate with each other, is now the rule of democratic engagement, not the exception.

President Donald Trump's blocking of people on Twitter because they criticize him violates the First Amendment, a federal judge in New York ruled today in a resounding victory for freedom of speech and the public’s right to communicate opposing political views directly to elected officials and government agencies.

--
This ruling will likely carry over to other government agencies that use social media to communicate with the public. If your agency has a Twitter, Facebook, or e-mail distribution list, etc. that it used to communicate with the public, you can't block people just because they disagree with or challenge your public comments.

Pentagon Stiffens Cell-Phone Policy but Avoids Full Ban


The Washington Times, 23 May 2018: The Defense Department this week stiffened its policy on cellphone use inside the Pentagon but stopped short of the complete ban that had been under consideration and which would’ve marked a major day-to-day change for the tens of thousands of employees who work inside the sprawling facility. The new protocol was first reported by The Associated Press, citing an internal Pentagon memo that was made public late Tuesday. The document applies to “laptops, tablets, cellular phones, smart-watches, and other devices,” and represents the latest effort by government and military officials who oversee the nation’s secrets to figure out how best to handle powerful technological devices that have become ubiquitous in American life. Under the revamped policy — which had been a matter of debate for months inside the Defense Department — cellphone use will still be allowed in common areas of the building, such as cafeterias and restaurants, and in any office where no classified information is present. Inside offices where classified information is being discussed, or where such information can be found on computers on documents, the Pentagon will tighten policies that require all electronic devices to be turned off and left in secured storage containers outside the room. The policy will be enforced through random inspections inside those classified areas. It’s almost certain the tougher policy will require the construction of new secure containers throughout the building, though officials said they don’t yet have a cost estimate for that project. At its core, the new policy aims to address the ever-increasing capabilities of modern cellphones and to protect the military’s most closely held information. Throughout much of the massive complex, cellphone reception is virtually nonexistent.
--

The policy of no cell-phones / wireless devices in areas containing classified material has been in place for many years (it just tended to be ignored).

DOD Directive 8100.2 (April 14, 2004) states: para. 4.2. Cellular/PCS and/or other RF or Infrared (IR) wireless devices shall not be allowed into an area where classified information is discussed or processed without written approval from the DAA in consultation with the Cognizant Security Authority (CSA) Certified TEMPEST Technical Authority (CTTA).

Security managers are frequently faced with some self-important delicate little violet who feels the need to chat on his Blackberry while typing on the SIPR Net. Reporting these violations usually does no good as leadership is more concerned about not upsetting the person violating the regulation than protecting the nations secrets. I am glad to see that the Pentagon - and hopefully the rest of DOD - is starting to pay attention its own security regulations (many of which have been in place for years).


 

Police Target Protesters with Military Surveillance Technology


A May 15, 2018 article by the Electronic Frontier Foundation (EFF) stated "In recent years, protesters have come face to face with police forces that are increasingly well-equipped with battlefield surveillance technologies. That’s because U.S. police are getting more and more equipment from the U.S. military - including sophisticated surveillance equipment. The trend has led to disturbing scenes like those from 2014 protests against police shootings, in which peaceful protesters were confronted by law enforcement equipped with sophisticated military equipment.
 
According to recent data from the Department of Defense, California police agencies are already in possession of more than $136 million worth of military equipment, including thermal imaging equipment, drones, and “long-range acoustic devices,” which are a type of sonic weapon.
 
Spying tools used against foreign military adversaries shouldn’t be casually handed over to U.S. police. Once these tools are adopted locally, it’s hard to stop their use."


--

According to the ACLU (June 19, 2009) "The Department of Defense (DOD) considers protests an example of "low-level terrorism," at least according to an exam DOD employees were required to take this year. You would have thought that the Pentagon learned its lesson after its nationwide surveillance program targeting peace activists, called TALON, was exposed in 2005 and roundly condemned. The program and the secretive Pentagon unit that ran it, the Counterintelligence Field Activity Agency (CIFA), were both shuttered in 2007. Apparently it is easier to kill a program than change an attitude." 

In January 2011, the Olympian Newspaper (Olympia, WA) reported that "a former Joint Base Lewis-McChord employee who spied on war protests in Olympia helped compile detailed information on protesters, including their names, photos, addresses and, in some cases, Social Security numbers..." 

An April 2017 article in the Huffington Post stated "With the militarization of police on the rise, the necessarily stark line between the military and domestic law enforcement is becoming increasingly blurred. And it’s not entirely surprising—given ongoing revelations around mass surveillance—that the military would abuse its authority and spy on activists in order to undermine their political objectives."



Have You Encountered Neo-Nazis or White Supremacists in the Military?


ProPublica wants to know more about Neo-Nazis and White Supremacists in the Military. They want to know what the Army, Navy, Air Force and Marines are doing about them.

Are you an active duty or retired service member, or the family or friend of someone in the military who has encountered white supremacy or neo-Nazis in the armed forces? ProPublica wants to hear your story.

ProPublica has set up a questionnaire, as well as providing a contact number for WhatsApp and Signal. - (347) 244-2134.  You can also email ProPublica at getinvolved@propublica.org.  Additional contact information for ProPublica is available on their SecureDrop site.

--
Earlier this month I posted about that the Notorious Hate Group Atomwaffen Includes Active-Duty Military.  Atomwaffen is active in Washington State, which ranks seventh for number of military personnel assigned within the state.

If you encounter extremist activity on a military installation, I recommend that you first report this through the military chain-of-command, and/or to the installation's Provost Marshal. In most cases this will be the most effective way of addressing the issue. 

Only if the chain-of-command or the Provost Marshal fails to take significant and definitive action (which is unlikely) to investigate extremist activity in the military ranks (or if someone interferers in or disrupts an investigation into extremist activity) would it be appropriate for a Service Member to provide information to the press.

Tuesday, May 22, 2018

CryptoTrust OnlyKey USB


CryptoTrust OnlyKey USB functions as an open source password manager, a two-factor security key, and secure communication token. Six buttons support multiple authentication methods, such as FIDO U2F and One Time Passwords used by Google Authenticator/Yubikey.

OnlyKey is a fairly new product, but one that I think offers good security innovations. Setting up OnlyKey takes a little bit of skill, or the ability to follow the on-line instructions, but overall it's not to difficult.

If you currently use Yubikey - and I recommend that you do - then you will probably have no problem using OnlyKey with its additional security features. For those of us interested in new technology and advances in data privacy and personal security, OnlyKey is worth a look.

Facial Recognition Tools Used By Police - Staggeringly Inaccurate

 

According to BBC News (May 15, 2018) facial recognition tools used by police are 'staggeringly inaccurate'.  Big Brother Watch (a UK civil rights group) said it was concerned that facial recognition cameras would affect "individuals' right to a private life and freedom of expression". It also raised concerns that photos of any "false alarms" were sometimes kept by police for weeks. In figures given to Big Brother Watch, South Wales Police said its technology had made 2,685 "matches" between May 2017 and March 2018 - but 2,451 were false alarms." Automated facial recognition technology is currently used by UK police forces without a clear legal basis, oversight or governmental strategy," the group said.


The State of Cyber-Stress


A Kaspersky Lab survey report - The State of Cyber-Stress - shows that 81 percent of Americans and 72 percent of Canadians admit to feeling stressed by the news of data breaches.

The Kaspersky Lab report found that consumers’ lack of awareness of how to protect themselves from online threats is leading to increased stress levels around technology usage and cybersecurity as a whole.

Kaspersky Lab conducted a survey of over 2,000 internet users in the United States and Canada to gain insight into the perceptions of consumers regarding cybersecurity, including people’s stress levels about data breaches and passwords, and what actions they take to protect their data from online threats. The results of this research revealed:
  • The stress levels of consumers relating to digital security and technology
  • How many people have experienced a cyberattack on their internet-connected devices
  • How people feel about businesses or people close to them having access to their data
  • What consumers and businesses can do to reduce their cyber-stress

“Research has shown that it's not the big, acute, one-time challenges that cause the majority of stress-related disease and disorder, but the everyday, nagging, accumulating pressure and tension we feel when we don't have enough capacity to cope with the demands of life,” explained Heidi Hanna, Ph.D., executive director of the American Institute of Stress. “Especially when we feel unsafe, out of control, or unable to keep up with the pace of change, something that is inherent in our constantly-connected, digital lifestyle.”



Date Rape Drugs


Previous research has suggested that the risk of being drugged is an overblown urban myth. But a new study says that drink spiking is very real and often leads to sexual assault for women on college campuses.

Published in the American Psychological Association's Psychology of Violence journal, the resulting study—"Just a Dare or Unaware? Outcomes and Motives of Drugging ('Drink Spiking') Among Students at Three College Campuses"—asserts that drink spiking is a very real threat to women on campus.


A team of researchers surveyed over 6,000 students across three universities—the University of South Carolina, the University of Kentucky, and the University of Cincinnati. They first asked how many times the student suspected they had been drugged, with the options ranging from "zero" to "over six times," and asked follow-up questions from there, including the location of the drugging and consequences.

The results were, in a word, disturbing. Nearly eight percent of all students said they had experienced being drugged with Rohypnol ("roofies"), Xanax, or other substances. That's about 462 students. And of those students, broken down by gender, 16.8 percent of women reported that they had had "unwanted sex" after being given a spiked drink. (Broadly, May 24, 2018)


The four most common date rape drugs are Rohypnol® (flunitrazepam), GHB (gamma hydroxybutryic acid), ketamine, and chloral hydrate.

Rohypnol (also known as roofies, forget-me-pill, and R-2) is a type of prescription pill known as a benzodiazepine—it’s chemically similar to drugs such as Valium or Xanax, but unlike these drugs, it is not approved for medical use in this the United States.
  • It has no taste or smell and is sometimes colorless when dissolved in a drink.
  • People who take it can feel very sleepy and confused and forget what happens after its effects kick in.
  • It can also cause weakness and trouble breathing, and can make it difficult for those who have taken it to move their body.
  • The effects of Rohypnol can be felt within 30 minutes of being drugged and can last for several hours.
  • To prevent misuse of Rohypnol, the manufacturer recently changed the pill to look like an oblong olive green tablet with a speckled blue core. When dissolved in light-colored drinks, the new pills dye the liquid blue and alert people that their drink has been tampered with. Unfortunately, generic versions of Rohypnol may not contain the blue dye.

GHB (also known as cherry meth, scoop, and goop) is a type of drug that acts as a central nervous system depressant and is prescribed for the treatment of narcolepsy (a sleep disorder).
  • It can cause a person to throw up; it can also slow their heart rate and make it hard to breathe.
  • At high doses, it can result in a coma or death. 
  • It's a tasteless, odorless drug that can be a powder or liquid. It’s colorless when dissolved in a drink.
  • Mixing it with alcohol makes these effects worse.
  • GHB can take effect in 15 to 30 minutes, and the effects may last for 3 to 6 hours.
 
 Ketamine (also known as cat valium, k-hole, and purple) is a dissociative anesthetic. That means it distorts perceptions of sight and sound, and makes a person feel detached from their environment and themselves. It also reduces pain and overall feeling. Like other anesthetic drugs, it's used during surgical procedures in both humans and animals.
  • It's a tasteless, odorless drug that can be a powder or liquid.
  • It can cause hallucinations and make people feel totally out of it.
  • It can also increase heartbeat, raise blood pressure, and cause nausea.
  • The effects of ketamine may last for 30 to 60 minutes.
 
Chloral Hydrate is the oldest of the hypnotic (sleep inducing) depressants, chloral hydrate was first synthesized in 1832.
  • A solution of chloral hydrate and alcohol constituted the infamous "knockout drops" or "Mickey Finn." This form of chloral hydrate is used in drug facilitated sexual assault, or "date rape".
  • Signs of overdose include confusion (continuing); convulsions (seizures); difficulty in swallowing; drowsiness (severe); low body temperature ; nausea, vomiting, or stomach pain (severe); shortness of breath or troubled breathing; slow or irregular heartbeat; slurred speech; staggering; and weakness (severe).

If you're at a party where people are drinking alcohol, you should be aware that there could be predators hoping to make you drunk or vulnerable. No matter what you're drinking, even if it’s soda or juice, people can slip drugs in your drinks—so pour all drinks yourself and never leave them unattended.



Date rape drug detection tests are available. These tests consist of paper sheets containing a chemical test compound. Place a few drops of a suspected drink on the test sheet, and if the drink contains a date rape drug (GHB or Ketamine) the test sheet will react by changing color.

Monday, May 21, 2018

Take the DHS Challenge


Do you pay attention to your surroundings? And more importantly, what would you do if you saw something suspicious? The Department of Homeland Security (DHS) (along with other agencies) uses the "See Something - Say Something" campaign to encourage people to report suspicious activity to their local police departments and to their state Fusion Centers.

Check out these DHS videos and test your observational skills.


TeenSafe App Exposes Your Child's Information to On-line Predators

 
The mobile app, TeenSafe, bills itself as a "secure" monitoring app for iOS and Android, which lets parents view their child's text messages and location, monitor who they're calling and when, access their web browsing history, and find out which apps they have installed.

But the Los Angeles, Calif.-based company left its servers, hosted on Amazon's cloud, unprotected and accessible by anyone without a password.

The database stores the parent's email address associated with TeenSafe, as well as their corresponding child's Apple ID email address. It also includes the child's device name -- which is often just their name -- and their device's unique identifier. The data contains the plaintext passwords for the child's Apple ID. Because the app requires that two-factor authentication is turned off, a malicious actor viewing this data only needs to use the credentials to break into the child's account to access their personal content data.  (ZDNet, May 20, 2018)


District Court Violation Notice (DCVN)


When is a traffic ticket not an ordinary traffic ticket? When the violation occurs on a military base and you are charged with a federal crime. A district court violation notice (DCVN) or "ticket" may be issued by a federal law enforcement officer for violations of certain federal laws and, if occurring on federal property, certain state laws. Violations include improper parking, illegal camping, speeding, civil disturbances, fish and wildlife infractions, and other offenses.

According to 32 CFR 634.32 - Traffic Violation Reports - (a) Most traffic violations occurring on DOD installations (within the United States or its territories) should be referred to the proper U.S. Magistrate.

Note however that, violations are not referred [to the U.S. Magistrate] when "(4) A U.S. Magistrate is available but the accused refuses to consent to the jurisdiction of the court and the U.S. Attorney refuses to process the case before a U.S. District Court."

According to the US Courts web-site: "The Central Violations Bureau (CVB) is a national center charged with processing violation notices (tickets) issued and payments received for petty offenses committed on federal property."


 

If you choose to contest the DCVN and appear in court, you will initially be scheduled to appear before a U.S. Magistrate. 
 
Once the complaint of information is filed, a date is set for the defendant to appear before the United States Magistrate Judge for arraignment. In cases where an arrest has been made prior to the filing of a complaint or information, the arraignment occurs immediately.
 
The arraignment before the United States Magistrate Judge is a hearing during which the defendant is informed of his or her rights, advised of the right against self-incrimination, informed about assistance of counsel, notified of his or her right to have the case heard before a United States District Court Judge or before a United States Magistrate Judge, and notified of the dates for further proceedings in the case.
 
You will be asked to consent to the jurisdiction of the magistrate judge and will be presented with a consent form. You may consent to the jurisdiction of the magistrate judge or you may elect to have your case assigned to a U.S. District Court judge.

Now, in any case before the court you should always consult with legal counsel (an attorney). There are good reasons both to consent to and deny the jurisdiction of the magistrate judge.

In the case of a DCVN issued on a military installation, you may want to have your case heard before a U.S. District Court Judge. The United States Attorney may choose to drop a case rather than proceed before the U.S. District Court, but I think more importantly the District Court Judge will be more likely to consider your case favorably. This is not to say anything negative about the U.S. Magistrate judges - they are certainly very honorable men and women - but they hear the majority of DCVN cases and may be (maybe) more inclined to side with the police officer over the defendant.

The National Motorists Association (NMA) (March 23, 2018) asked: "Did you ever feel that when you received a traffic ticket you were already considered guilty even though under the U.S. Constitution you are innocent until proven guilty? ... Traffic ticket defendants are [treated as if they are] guilty until they prove their innocence, police officer testimony is automatically given more credence than that of ticket recipients, and those same officers are allowed to testify via scripts that have little bearing on reality or facts... But what if you feel you did not violate the law? The NMA always encourages anyone whether they feel they are guilty or not, to FIGHT YOUR TICKET!  If just ten percent of all traffic tickets went to trial, the court system would cease to function."

And if just ten percent of all DCVNs were taken to U.S. District Court... ? 

Of course, the best way to deal with a DCVN is not to get one in the first place.

Sunday, May 20, 2018

Meet Sunder, a New Way to Share Secrets


The moment a news organization is given access to highly sensitive materials - such as the Panama Papers, the NSA disclosures or the Drone Papers - the journalist and their source may be targeted by state and non-state actors, with the goal of preventing disclosures. How can whistleblowers and news organizations prepare for the worst?

The Freedom of the Press Foundation is requesting public comments and testing of a new open source tool that may help with this and similar use cases: Sunder, a desktop application for dividing access to secret information between multiple participants.


Russian Tor Node Administrator Acquitted of Terrorism Charges


The administrator of an anonymous online network has been acquitted of terrorism charges one year after Russian authorities detained him for allegedly calling for riots on Moscow's Red Square. Dmitry Bogatov, 26, was detained in April 2017 and charged with inciting terrorism in posts online. The math teacher denied writing the posts, adding that anyone could have used his IP address because he hosted a Tor node, which allows other Internet users to surf anonymously through his computer. (Moscow Times)
--

If you run a TOR Node the activities of others may be attributed to you.  The EFF states: "Exit relays raise special concerns because the traffic that exits from them can be traced back to the relay's IP address. While we believe that running an exit relay is legal, it is statistically likely that an exit relay will at some point be used for illegal purposes, which may attract the attention of private litigants or law enforcement. An exit relay may forward traffic that is considered unlawful, and that traffic may be attributed to the operator of a relay. If you are not willing to deal with that risk, a bridge or middle relay may be a better fit for you. These relays do not directly forward traffic to the Internet and so can't be easily mistaken for the origin of allegedly unlawful content."

Russian Roskomnadzor Blacklists WhatsApp IP Addresses


According to the Moscow Times (May 17, 2018), Russia’s state media watchdog, Roskomnadzor, briefly blocked the WhatsApp messaging service in what appears to be a continuation of its campaign to block the Telegram application. Users of both WhatsApp and Viber reported accessibility issues in Russia and Central Europe on Thursday afternoon (May 17, 2018). The WhatsApp addresses were removed from Roskomnadzor’s registry of banned sites about a half-hour after the disruption began. 

Roskomnadzor is trying to interfere with Telegram’s operations, by blocking IP addresses belonging to Amazon, Google and other popular hosting providers. Many services and online games have been experiencing difficulties because of this. Meanwhile, Telegram has lost just a few percent of its Russian-speaking users in the first month of the ban.


Inside the Massive U.S. 'Border Zone'


Did you know that you can be stopped and searched by the US Border Patrol while traveling from Seattle, WA to Portland, OR?

At its core, the law allows immigration officers to access private lands—except “dwellings”—within the 25 air miles (28.7 miles) of the border. Congress also authorized CBP to set permanent and temporary checkpoints, patrol highways, and board buses, trains, and other vehicles “within a reasonable distance” of the U.S. border, which regulations in 1953 set as “up to a 100 miles.”

CBP can set up checkpoints anywhere it wants within the 100-mile zone and “can temporarily seize all vehicles that drive up to an immigration checkpoint... to conduct an immigration inspection,” a spokesperson said. If they feel they have probable cause, they can search the vehicles. Agents at checkpoints also have wide discretion to pull people aside for a secondary inspection, which could last, per some accounts, for up to 40 minutes. 

“It really is kind of a constitution-free zone," says Patrick Eddington, a policy analyst who has been compiling data on border patrol’s internal checkpoints at the CATO Institute, a libertarian think tank. “I guess the best way to phrase it is that in this area, [border patrol agents] are being allowed to nullify people's rights.”  (CityLab, May 14, 2018)