The FBI's Secret Rules

According to The Intercept...

After the famous Church Committee hearings in the 1970s exposed the FBI’s wild overreach, reforms were enacted to protect civil liberties. But in recent years, the bureau has substantially revised those rules with very little public scrutiny. That’s why the Intercept is publishing this special package of articles based on three internal FBI manuals that they exclusively obtained.

These stories illuminate how the FBI views its authority to assess terrorism suspects, recruit informants, spy on university organizations, infiltrate online chat rooms, peer through the walls of private homes, and more.

In addition to the articles collected here - which include nine new pieces and two that they previously published based on the same source material - The Intercept has annotated the manuals to highlight what they found most newsworthy in them.  They redacted the sections that could be used to identify individuals or systems for the purpose of causing harm. They’re presenting the stories alongside the manuals because we believe the public has a right to know how the U.S. government’s leading domestic law enforcement agency understands and wields its enormous power.

--
After NSA whistleblower Edward Snowden came forward with revelations of mass surveillance in 2013, journalists Glenn Greenwald, Laura Poitras, and Jeremy Scahill decided to found a new media organization dedicated to the kind of reporting those disclosures required: fearless, adversarial journalism. They called it The Intercept.

Today, The Intercept is an award-winning news organization that covers national security, politics, civil liberties, the environment, international affairs, technology, criminal justice, the media, and more.

YubiKey

YubiKey is a hardware authentication device manufactured by Yubico that supports one-time passwords, public key encryption and authentication, and the Universal 2nd Factor (U2F) protocol developed by the FIDO Alliance (FIDO U2F). It allows users to securely log into their accounts by emitting one-time passwords or using a FIDO-based public/private key pair generated by the device. YubiKey also allows for storing static passwords for use at sites that do not support one-time passwords.

There are several services that integrate with YubiKey. I use YubiKeys to secure log-on to my laptop, protect my password manager, and safeguard some on-line accounts. By using YubiKey as part of my security, an adversary now not only would need to crack my passwords, but would also need to gain physical access to my YubiKey in order to access my computer or on-line accounts.

Google's Advanced Protection Program uses YubiKey to provide "Google’s strongest security for those who need it most." . A list of other services where you can use your YubiKey can be seen here: Services that Integrate with the YubiKey.

You can purchase YubiKey for several sources, including Amazon.

YubiKey 4 

YubiKey NEO 

YubiKey 4 Nano 

FIDO U2F Security Key 

Widow of Shooter in Pulse Nightclub Terrorist Attack - Not Guilty!

Widow of Orlando nightclub shooter found not guilty of charges she aided in the massacre.

The acquittal by a federal jury of Noor Salman, the widow of the man who gunned down dozens of people at the Pulse nightclub two years ago, handed federal prosecutors on Friday the rarest of defeats: a loss in a terrorism case.

The outcome was even more striking because the not-guilty verdict came from jurors in Orlando, Fla., where Omar Mateen’s rampage left 49 people dead and 53 others injured, the worst terrorist attack on American soil since Sept. 11, 2001. (New York Times, March 30, 2018)

--
Salman, 31, was arrested in January 2017, months after her husband, Omar Mateen, killed 49 people and injured more than 50 others when he opened fire at Pulse the previous June. Police responding to the attack killed Mateen.

Prosecutors said Salman aided Mateen ahead of his killing spree, then lied to the FBI in an attempt to thwart the investigation.

Jurors began deliberating Wednesday afternoon before returning with a verdict Friday morning.

U.S. Will Require Visa Applicants to Submit Five Years of Social Media Details

The State Department wants to require all U.S. visa applicants to submit their social media usernames, previous email addresses and phone numbers, vastly expanding the Trump administration’s enhanced vetting of potential immigrants and visitors.

In documents published in Friday’s Federal Register, the department said it wants the public to comment on the proposed new requirements, which will affect nearly 15 million foreigners who apply for visas to enter the U.S. each year. Previously, social media, email and phone number histories were only sought from applicants identified for extra scrutiny, such as those who have traveled to areas controlled by terrorist organizations. An estimated 65,000 people per year are in that category.

The new rules would apply to virtually all applicants for immigrant and non-immigrant visas. The department estimates it would affect 710,000 immigrant visa applicants and 14 million non-immigrant visa applicants, including those who want to come to the U.S. for business or education, according to the documents.  (Time, March 30, 2018)

Deloitte - Cyber Security Evolved Video

In less than 5 minutes you can experience the speed and intensity of a cyber attack. Today companies can defend themselves, taking control of the situation - effectively fighting back.

Are you prepared?

Watch the Deloitte video on YouTube.

Video with closed captions - English subtitles.





 

Skype Now Has End-to-End Encrypted "Private Conversations"

In January 2018, Microsoft announced that Skype will offer end-to-end encryption for audio calls, text, and multimedia messages through a feature called Private Conversations. Skype will use the robust, open-source Signal Protocol to implement the encryption, which is set up so that only the devices sending and receiving communications in a conversation can hear or view them.

After Microsoft purchased Skype in 2010, observers noticed changes in its architecture, and people began to move away from Skype over concerns that it may allow third-party and government wiretap surveillance.

Private Conversations makes that sort of snooping impossible. Currently only Skype Insiders can use the service as part of a beta test before it rolls out more broadly. If you want to participate in the beta test and start using Skype with end-to-end encryption now, download "Skye Preview"  This works the same as the standard version of Skype, but includes the encryption beta test.

Skype end-to-end encryption isn't on by default; you initiate it by selecting "New Private Conversation" from Skype's "Compose" menu, or from another user's profile. This sends a Private Conversation invitation to the user you selected. If the user accepts the invitation Skype creates an end-to-end encrypted connection between the two devices.

Invitations to chat only last for seven days, after that they expire and need to be re-sent. Each Private Conversation is also limited to the device it started on, so if you want to chat privately on your computer and phone you’ll have to send two separate invitations to the same person. Skype blocks the text of these encrypted conversations from showing up in your notifications as well, for an extra layer of protection.

When you’re ready to end your conversation you have two options. You can delete the chat by right-clicking your mouse (or holding down, if you’re using a smartphone) and then selecting "Delete chat." This won’t delete the encrypted connection, so you can pick up the encrypted conversation again later.

If you really want to end your discussion and delete the encrypted connection, you need to go to the chat header and then scroll down to "End Private Conversation." Once you do that, you’ll need to send a new invitation to start things up again.

Even with Private Conversations turned on, Skype will still be able to access some information about your communications, like when they occur, and how long they last. You will have to decide if you trust Microsoft with your metadata, but that’s a decision you have to make with every encrypted communications service.

I also note that with Microsoft's undated Terms of Service (TOS), effective May 1, 2018, they have stated that they may examine private files and conversations that potentially breach the TOS if they receive a complaint from someone, be those private conversations a Skype chat or an email, etc. The fact that Microsoft can review your private conversations means that the standard encryption (non end-to-end encryption) used in Skype is not secure. Microsoft holds the encryption keys and can thus decrypt and read your private conversations - and presumably turn those conversations over to other agencies.

I have been using Skype end-to-end encryption and like it when it works, but find that it can still be a little bit buggy when generating the Private Conversation invitation. You may have to try a few times to get the invitation to go through, but once the end-to-end encryption channel is established, it works without any problem.

So, do I recommend switching to Skye Private Conversations as your primary means of on-line communication? No, absolutely not, this is still a beta test and requires more review, but if you are currently using Skype anyway, take advantage of the end-to-end encrypted Private Conversations to enhance the security of your communication and help bring this into Skype as a standard feature.

What the @#$%&!? Microsoft Bans Nudity, Swearing in Skype, E-mails, etc.

The Register UK reports that Microsoft has updated its terms of service (TOS) to ban nudity, swearing in Skype, emails, and Office 365 docs. Microsoft has advised customers that offensive language on Skype, in an Outlook.com email, or in an Office 365 Word document is a potentially account-closing offense under its updated terms of use. 

The new TOS agreement, which comes into effect on May 1, 2018, now includes the following code-of-conduct item:

** Don’t publicly display or use the Services to share inappropriate content or material (involving, for example, nudity, bestiality, pornography, offensive language, graphic violence, or criminal activity). **

** If you violate these Terms, we may stop providing Services to you or we may close your Microsoft account. We may also block delivery of a communication (like email, file sharing or instant message) to or from the Services in an effort to enforce these Terms or we may remove or refuse to publish Your Content for any reason. When investigating alleged violations of these Terms, Microsoft reserves the right to review Your Content in order to resolve the issue. However, we cannot monitor the entire Services and make no attempt to do so. **

Microsoft told The Register it does not listen to Skype calls, which is good to know. But Microsoft added that it may examine private files and conversations that potentially breach the code-of-conduct if they receive a complaint from someone, be it a Skype chat or an e-mail, etc.

We understand the legalese in the updated TOS needs to be broad so that Microsoft bods can step in when there’s genuine abuse or harassment being thrown around on its services.

But the new agreement is problematic because it hints at far broader and frankly creepy interventions involving rifling through people's private files, if someone is upset at another user. Which in light of recent revelations about abuse of personal data on the internet, just isn’t a good look no matter that the agreement was probably drafted with good intentions.
--

The fact that Microsoft "may examine private files and conversations" in Skype, e-mail, and Office 365 documents clearly shows that these services are NOT secure and should never be used to transmit or store sensitive information.