It's TRUE: Your 'Internet Enabled' Devices Will Spy On You — Lights, Garage Doors, Security Cams and Everything Else

"In the future, intelligence services might use the [Internet of Things] for identification, surveillance, monitoring, location tracking, and targeting for recruitment, or to gain access to networks or user credentials... "We're going to use your toothbrush to snoop on you."
—James Clapper, Director of National Intelligence

The "Internet of Things": Tie all of your home's devices to the web and the U.S. government (and anyone else) can and will watch and catalog everything you do.

By Jon Queally
Sworn testimony delivered to the U.S. Congress by Director of National Intelligence James Clapper raised eyebrows on Tuesday as he acknowledged publicly for the first time that surveillance agencies are almost certain to exploit (if they aren't already) the increasing number of web-connected devices—also known as the "Internet of Things"—as a way to keep tabs on the population in the coming years.

"In the future, intelligence services might use the [Internet of Things] for identification, surveillance, monitoring, location tracking, and targeting for recruitment, or to gain access to networks or user credentials," Clapper said in his submitted testimony.

In a piece at The Register—titled "We're going to use your toothbrush to snoop on you, says US spy boss"—tech-security journalist Kieran McCarthy reports Clapper's acknowledgement that the Internet of Things (IoT) is a "potential goldmine for surveillance" echoes "a similar conclusion reached by academics last week." The testimony on Tuesday, McCarthy adds, follows "repeated warnings over the poor security standards included in smart-home products, even the most well-resourced and well-known. Recently, the Ring doorbell and the Nest thermostat were discovered to have security vulnerabilities that could provide an attacker with your Wi-Fi password – and so access to your home network.

According to Guardian journalist Spencer Ackerman, Clapper's admission about the surveillance potential of networked home devices—which also include wi-fi enabled smoke detectors, larger appliances, and entertainment systems—"is rare for a US official." Not commonly discussed in public, Ackerman points to a 2012 speech by then CIA director David Petraeus who described the surveillance implications of such devices as "transformational … particularly to their effect on clandestine tradecraft."

Though Clapper did "not specifically name any intelligence agency as involved in household-device surveillance", reports Ackerman, "security experts examining the internet of things take as a given that the US and other surveillance services will intercept the signals the newly networked devices emit, much as they do with those from cellphones. Amateurs are already interested in easily compromised hardware; computer programmer John Matherly’s search engine Shodan indexes thousands of completely unsecured web-connected devices."

As McCarthy adds:

The data from IoT products can potentially be hugely valuable. Many include microphones and motion sensors, for example, such as new smart TVs, kids' toys and voice-controlled products like Amazon's Echo.

It wasn't just the internet of things that Clapper is worried/excited about. He also references that artificial intelligence is provided a similar risk/opportunity. By meddling with or anticipating the results of algorithms, a huge number of AI systems "are susceptible to a range of disruptive and deceptive tactics that might be difficult to anticipate or quickly understand." On the flipside, however, they also "might create or enable further opportunities to disrupt or damage critical infrastructure or national security networks."

And it's not just the government spies that people worry about. In a post at ZDNet last year, Steve Ranger explores the many pitfalls and concerns presented by IoT, including the way in which private corporations will exploit the connectedness of new technologies.

"The IoT could be one of the purest outgrowths of late capitalism imaginable," explained Ranger, "one that can packages your every waking minute into a product (and the sleeping ones too, of course -- there's many a way of making money out of the data you generate in your slumber).

"There's a real danger that it could form part of the ongoing erosion and corporatisation of private spaces in the quest for profit. In a surveillance economy, privacy represents an opportunity for profit forgone."

Reprinted with permission from Common Dreams.

'Invisibility Cloak' On Verge of Becoming Reality — You Should Assume The US Military Already Has One

The US military-industrial complex is assumed to be from 25 to 50 years ahead of civilian science. With their virtually unlimited budget, it would be wise to assume the US military already has classified "invisibility" technology.—Ronald David Jackson

_________________

Light reflects off the cloak (red arrows) as if it were reflecting off a flat mirror in this 3D illustration of a
metasurfaceskin cloak made from an ultrathin layer of nanoantennas (gold blocks) covering an arbitrarily
shaped object is shown in this handout image courtesy Reuters/Xiang Zhang group/Lawrence Berkeley
National Laboratory

 

Now You See It, Now You Don't: Invisibility Cloak Nears Reality

 

By Will Dunham
A cloak of invisibility may be common in science fiction but it is not so easy in the real world. New research suggests such a device may be moving closer to reality.

Scientists said on Thursday they have successfully tested an ultra-thin invisibility cloak made of microscopic rectangular gold blocks that, like skin, conform to the shape of an object and can render it undetectable with visible light.

_________________

_________________

The researchers said while their experiments involved cloaking a miniscule object they believe the technology could be made to conceal larger objects, with military and other possible applications.

The cloak, 80 nanometers in thickness, was wrapped around a three-dimensional object shaped with bumps and dents. The cloak's surface rerouted light waves scattered from the object to make it invisible to optical detection.

It may take five to 10 years to make the technology practical to use, according to Xiang Zhang, director of the Materials Sciences Division of the U.S. Department of Energy's Lawrence Berkeley National Laboratory and a professor at the University of California, Berkeley.

"We do not see fundamental roadblocks. But much more work needs to be done," said Zhang, whose research was published in the journal Science.

The technology involves so-called metamaterials, which possess properties not present in nature. Their surfaces bear features much smaller than the size of a wavelength of light. They redirect incoming light waves, shifting them away from the object being cloaked.

The cloaking "skin" boasts microscopic light-scattering antennae that make light bouncing off an object look as if it were reflected by a flat mirror, rendering the object invisible.

Read More

Police Militarization Takes Big Jump: Weaponized Drones Authorized — With Tasers, Tear Gas, Rubber Bullet, Bean Bags, Will Also Be Used To Spy On Citizens

The law allowing drones to attack and spy on citizens was allegedly "forced" on North Dakota state legislators by "pro-police" groups. It was signed into law by the governor. The original law was supposed to keep weapons off drones. This demonstrates how the money of lobbyists can achieve the opposite of what was originally intended by sponsors of a bill.

Police in North Dakota can now legally target American citizens with  remote controlled aerial vehicles.
(Photo by Debra Sweet)

By Laura Wagner
With the passage of a new law earlier this year, North Dakota has become the first state to legalize law enforcement use of armed drones.

RELATED STORY: First State Legalizes Taser Drones for Cops, Thanks to a Lobbyist

Though the law limits the type of weapons permitted to those of the "less than lethal" variety — weapons such as tear gas, rubber bullets, beanbags, pepper spray and Tasers — the original bill actually aimed to ensure that no weapons at all were allowed on law enforcement drones.

The sponsor of the original bill, Republican state Rep. Rick Becker, said he wasn't happy with how that part of the law turned out.

A typical police commando unit (SWAT) is more heavily armed than US troops were
in Iraq. (Photo by OR Dept of Trans)

"In my opinion there should be a nice, red line: Drones should not be weaponized. Period," Becker said at a hearing in March, according to The Daily Beast.

Originally, the intent of the bill was to require police to obtain a search warrant before using a drone to look for evidence. It also prohibited weapons aboard drones.

But to get a measure passed that would require search warrants, Becker had to compromise on the weapons issue.

Read More

UK Government Wants to Ban WhatsApp and All Other Encrypted Communications

Photo by Tom Bech.

By Carey Wedler
(ANTIMEDIA) The U.K. government is eager to expand already extensive spying powers to ban iMessage, Whatsapp, and Snapchat because the government cannot bypass their encryption features. The proposed ban was added to a revived version of a previously repealed British surveillance bill.

Cameron first indicated his advocacy of the ban following the Charlie Hebdo attack in Paris in January, justifying it by asking—without a hint of embarrassment—“In our country, do we want to allow a means of communication between people which […] we cannot read?” He quickly answered his own question: “‘No, we must not.’”

Cameron’s suggestion was part of a larger push to revive the sweeping Communications Data Bill, which detractors commonly refer to as the “Snooper’s Charter.”

By May, the government had announced it would introduce an investigatory powers bill that extended the powers granted in the Communications Data Bill and strengthened the government’s ability to engage in bulk data collection. The Home Office claimed it would “better equip law enforcement and intelligence agencies to meet their key operational requirements” by allowing them to monitor communications more invasively.

Now, the bill is pushing forward. It includes a provision to ban WhatsApp, iMessage, and Snapchat “to stop people from sending any form of encrypted messages.” The bill also requires internet companies to keep full records of all communications on their platforms. This includes Facebook and Google, which would be required to hand over whatever information the government wants, when it wants it.

In arguing in favor of the expanded powers, Cameron said, “We have always been able, on the authority of the Home Secretary, to sign a warrant and intercept a phone call, a mobile phone call or other media communications.” According to Big Brother Watch, British police file a request for communications data every two minutes. Their requests are granted 96% of the time by the Home Office, a rate almost as high as that of American “rubber stamp” FISA courts. Like Cameron, American officials have criticized encryption as a danger to national security.

By banning all forms of communication exempt from government surveillance, the U.K. government is straddling a dangerous line between “national security,” as it claims to bolster, and the basic privacy rights of its citizens. Many would argue it has long since crossed that line, as intensive surveillance measures have been in place for years. Cameron pontificated this week that “…the question we must ask ourselves is whether, as technology develops, we are content to leave a safe space – a new means of communication – for terrorists to communicate with each other.”

Not everyone in the U.K. agrees with the prime minister’s privacy-versus-security dichotomy. “We take no issue with the use of intrusive surveillance powers per se – targeted surveillance can play an important part in preventing and detecting serious crime,” said Liberty, a human rights and civil liberties advocacy group in the U.K. “But the current regime just doesn’t provide sufficient safeguards to ensure that such surveillance is conducted lawfully, and in a necessary and proportionate way.”

Former Deputy Prime Minister Nick Clegg, who helped to block the previous version of the Communications Data Bill when he was in office, echoed a similar sentiment about the impending new policy.

“It’s not harmless. It would be a new and dramatic shift in the relationship between the state and the individual,” he said.

“People who blithely say they are happy for their communications to be open to scrutiny because they have ‘nothing to hide’ have failed to grasp something fundamental about open democratic societies: We do not make ourselves safer by making ourselves less free.”

Conservatives in Parliament are expected to pass the bill (previously killed by liberal Democrats in the previous administration) with enforcement as early as 2016, even as computing experts warn the policies may enable the very terrorists they are intended to thwart.

Reprinted with permission from Anti-Media

Notorious Corporate 'Hacking Team' Gets Hacked: Massive Dump of Their Documents Onto the Internet (Documents)

The leaked documents provide a list of "Hacking Team" customers and amounts paid for hacking services against dissidents, journalists, opposition leaders, criminals, and governments. There is also a list of hacking tools for sale and the operating systems and smart phone systems that are vulnerable.

Screen capture from "The Hacking Team" promotional video.

Hacking Team hacked, attackers claim 400GB in dumped data

By Steve Ragan
Specializing in surveillance technology, Hacking Team is now learning how it feels to have their internal matters exposed to the world, and privacy advocates are enjoying a bit of schadenfreude at their expense.

RELATED STORY: New Software Will Invade Your Computer, WiFi, Crack Passwords, Watch You, and Evade Anti-Virus Software — Secret Manuals

Hacking Team is an Italian company that sells intrusion and surveillance tools to governments and law enforcement agencies.

The lawful interception tools developed by this company have been linked to several cases of privacy invasion by researchers and the media.

Reporters Without Borders has listed the company on its Enemies of the Internet index due largely to Hacking Teams' business practices and their primary surveillance tool Da Vinci.

It isn't known who hacked Hacking Team; however, the attackers have published a Torrent file with 400GB of internal documents, source code, and email communications to the public at large.

Read More

__________________

Killer Cops, Blood Money: How Privatization is Funding the Racist Logic of America’s Police

What do police violence in Oklahoma and NYC have in common? An infusion of private cash and a culture of death

(Click to see full-sized image)
When private funds pay for devices like the "Stingray," police
don't have to tell you they're using it.

By Brittney Cooper
On April 2 in Tulsa, Oklahoma, a sheriff’s deputy named Robert Bates shot and killed Eric Harris, a man fleeing a crime scene where he was about to be captured for selling illegal weapons. Bates, a reserve deputy who is allowed to work on cases because he is a big donor to the sheriff’s office, was charged this week with second-degree manslaughter, after claiming that he meant to reach for a taser and not a gun.

___________________

Cops Must Swear Silence to Access Vehicle Tracking System: Corporations
Insist License Plate Tracking Stay Hidden from Media and Public

(click to see full-size image)

___________________

As Harris lay struggling and dying, he told the surrounding officers, “I’m losing my breath.” One officer yelled back at him, “Fuck your breath!” Then he insisted that the dying man be handcuffed.

“Fuck your breath!” encapsulates in only three words the systemic disregard that police regularly show to Black people in America. Just last week, we watched Michael Slager execute Walter Scott in South Carolina for daring to run away. Now this week, we are also tuning into the trial of former Chicago Police Officer Dante Servin, who is charged with involuntary manslaughter in the killing of 22-year-old Rekia Boyd in March 2012. In the cases of Eric Garner in Staten Island, Tamir Rice in Cleveland, Walter Scott in South Carolina, and Eric Harris in Tulsa, we have seen video of law enforcement officers not only critically injuring citizens but also refusing to administer medical care, with fatal consequences.

Given the origins of policing in this country and their connections to slave patrols and other forms of racialized social control, I am under no illusions that the police have ever held Black life in high regard. Police complicity and participation in lynchings and in the KKK make that clear. But the explicit, tacit refusal of Black people’s right to breathe is still significant. The fact that the Tulsa County Sheriff’s Office is a pay-to-play force is significant. The fact that white men can sign up with government approval for the right to play cops and robbers on the weekends is appalling. That Black lives provide fodder for state-sanctioned sport should have us in the streets.

Michael Slager, Robert Bates (Credit: AP/Charleston County
Sheriff's Office/Tulsa County Sheriff's Office)

There is something about the logics of self-governance under the terms of neoliberalism that make this moment feel more pessimistic than our trite narrative of linear progress on racial issues would have us conclude. In 2012, the United Arab Emirates gave $1 million to the New York City Police Foundation. According to an NYPD spokesperson, the money was used to upgrade equipment and aid in criminal investigations. In both New York City and Tulsa, private funding of law enforcement significantly impacts the way local policing is done. In Tulsa, it results in the pay-to-play scheme. In New York City, it allows for large infusions of cash donations whose specific uses do not come under public scrutiny because they are private funds.

These forms of neoliberal policing — in which private citizens and private monies impact the culture of policing but escape governmental checks and balances — endanger us all.

In New York, such actions enable the purchase of unspecified forms of “equipment” that might, for instance, be used to exacerbate the culture of militarized policing in the NYPD. Part of this money allows the NYPD to travel to the UAE to learn counterterrorism measures. In the wake of 9/11, some external training might be helpful, but essentially, this sounds like a case of the NYPD being allowed money to play global cops and robbers, and to then test out these tactics on the Black and Brown people who are policed heavily within the city.

In the case of Tulsa, this privately underwritten form of law enforcement placed an underprepared “pretend” deputy into a serious confrontation. As a result, Eric Harris lost his life.

Read More

Police Whistleblowers Target of Police Spying?: Cops' Representative Give Attorney External Hard Drive Infected With Spyware

By Bill Bowden
A lawyer representing three Fort Smith police officers in a whistleblower case said Monday that someone tried to hack into his computer by giving him an external hard drive contaminated with malicious software.

Matthew Campbell of the Pinnacle Law Firm in North Little Rock has been representing three current and former Fort Smith police officers in the lawsuit since January 2014.

Campbell had requested emails from the Fort Smith Police Department, and Sebastian County Circuit Judge James O. Cox ordered on May 9, 2014, that they be provided to Campbell as part of discovery in the case.

Campbell said he became suspicious when Douglas Carson, the attorney representing Fort Smith and its Police Department, sent him the computer hard drive in June 2014 by Federal Express. Normally, Campbell said, the defendants had provided him with requested documents via email, the U.S. Postal Service or through a cloud-based Internet storage service.

Campbell said he sent the hard drive to his information technology expert, Geoff Mueller of Austin, Texas, who is manager of information security at the Lower Colorado River Authority.

"Something didn't add up in the way they approached it, so I sent it to my software guy first," Campbell said. "I thought 'I'm not plugging that into my computer,' so I sent it to him to inspect."

Mueller told Campbell the hard drive contained four "Trojans," one of which was a duplicate.

Trojans are programs that appear legitimate but perform some illicit activity when run, according to PC Magazine.

"One would have kept my Internet active even if I tried to turn it off, one would have stolen any passwords that I entered in, and the other would have allowed the installation of other malicious software," Campbell said. "It's not like these are my only clients, either. I've got all my client files in my computer. I don't know what they were looking for, but just the fact that they would do it is pretty scary."

In an affidavit filed with the motion Friday, Mueller stated: "Upon informing Mr. Campbell of the presence of these Trojans, he provided me with information that the Fort Smith Police Department claimed to be running a secure system with real-time virus and malware protection. In my experience, if the FSPD system is actually as described, these Trojans would not exist on the system."

Mueller said the placement of the Trojans in a subfolder named "D:Bales Court Order," and not in the root directory, "means the Trojans were not already on the external hard drive that was sent to Mr. Campbell and were more likely placed in that folder intentionally with the goal of taking command of Mr. Campbell's computer while also stealing passwords to his account."

Campbell said he doesn't know who put the malware on the hard drive provided to him.

Read More

After Withstanding Mulitple Super-Cyber Attacks by the US and Israel — Iran Develops Own Cyber Army

Every action has an opposite and equal reaction, according Isaac Newton's 'Third Law'.  The Stuxnet cyber attack launched by the US and Israel against Iran's nuclear power infrastructure (and discovered in 2010) might well offer an example of Newton's Third Law in action.
—Ronald David Jackson

_________________

 

Illustration by Daniel Rehn.

Iran is building a non-nuclear threat faster than experts 'would have ever imagined'

By Natasha Bertrand
In just over two years, the Iranian government has managed to build up a sophisticated cyberarmy that experts now say is capable of crippling key global infrastructure.

"Five years ago, I would have never imagined Iran to be where they are today," cybersecurity expert David Kennedy, founder of information security firm TrustedSec, told Business Insider. "Iran was once considered a D-grade cyber threat. Now it's almost on the same level as Russia or China."

Iran has increased its cybersecurity spending 12-fold since President Hassan Rouhani assumed office in 2013, according to a report released Monday by British technology research firm Small Media. Vowing to ramp up the country's cyber capabilities, Rouhani has given the Islamic Revolutionary Guard Corps (IRGC) an annual cybersecurity budget of roughly $19.8 million.

While Iran's initial cyber efforts were focused on countering internal dissidence, the government put its cyber experts on the offensive after an American computer worm, Stuxnet, infiltrated Iranian government servers and ruined almost one-fifth of the country's nuclear centrifuges in June 2010.

By November 2010, the Basij Cyber Council had trained 1,500 cyber-warriors who, according to IRGC commander Hossein Hamedani, "have assumed their duties and will in the future carry out many operations," according to a report released in 2013 by the Middle East Media Research Institute.

“Out of any country on the planet, I can’t think of a country that has been more focused than Iran from the high levels of government on cyber, and that includes the United States,” Dmitri Alperovitch, co-founder of cybersecurity firm CrowdStrike, told The Hill back in November.

And they'll only get better.

"In 10 years time, Iran's cyber capabilities will be more troubling than its nuclear program," geopolitical expert Ian Bremmer, president of the Eurasiaa group, tweeted earlier this week. He also noted that aggressive cyber operations by the US can be turned around on them by weaker adversaries.

Read More

NYC Police 'Bug' City With Microphones — Pretend They're Listening for Gun Shots

The NYPD's street eavesdropping system will attach hundreds of hidden microphones to spy cameras around New York City.

Photo by Joe Loong.

By Rocco Parascandola
It’s been almost a week since New York Police Department deployed a new ShotSpotter gunshot detection system. However, the innovation has raised privacy concerns among New Yorkers while tracking loud bangs, the system records private conversations.

Questions arose after New York Police Department deployed 300 hidden microphone sensors around the city. They are aimed at identifying the sound of gun shots, and then activate nearby cameras and immediately alert law enforcement officials.

The two-year pilot program will cost New York a total of $1.5million annually.

Both the mayor Bill de Blasio and police commissioner William Bratton say that ShotSpotter should help officers to respond more quickly to shootings. According to statistics, in 75 percent of cases when people hear a gun shot sound, they do not report it to the police.

The ShotSpotter is aimed at fixing that. Its sensors are connected to thousands of cameras set up around the city as part of the its Domain Awareness System, an all-seeing intelligence-analysis complex that collects and analyzes data captured by surveillance cameras, gunshot detectors, license plate readers, Geographic Information Systems mapping and social media feeds.

Read More

Virginia Passes Law Requiring Warrant for Use of Stingray Spy Technology — Because the CIA, Based in Virginia, Doesn't Want It's Employees Followed?

By SOSadmin
Kudos, Virginia, land of spies! The state has enacted a privacy law requiring a warrant for state and local law enforcement content surveillance and location tracking. The statute explicitly includes a warrant requirement for police use of controversial cell site simulator or stingray technology, which allows cops to bypass phone companies and track phones directly.

Unfortunately, state legislatures cannot prevent federal authorities from using stingrays to track people without warrants. When state and local authorities are deputized as federal agents under task force operations, they may decide to use the federal standard when conducting investigations. That means there might be times when state and local cops, working under federal authority, still use stingrays without warrants.

Virginia's new law is nonetheless a huge step in the right direction.
Read More

Protests Grow Against Expansive Canadian Surveillance Bill

Day of action set for 'every province across Canada' against so-called anti-terrorism bill

Anti C-51 Protest, March 14, 2015. (Photo by Jeremy  Board)

By Nadia Prupis
Canadian activists are taking part in a weekend of action against the controversial C-51 surveillance bill currently making its way through Parliament.

Supporters of the bill say it would protect the nation against terrorist attacks, but critics charge that it would give the government ever more expansive and invasive spying powers.

If passed, C-51 would give up to 17 government agencies access to Canadian citizens' private information, including their financial status, medical history, and religious and political beliefs. The Canadian Security Intelligence Service would also be given the power to spy on Canadians and foreign nationals living in the country, while the Royal Canadian Mounted Police would be granted increased powers of preventive arrest.

Protests against C-51 are slated to take place in "every province across Canada," organizers said on Friday. Many of those actions will take place outside the offices of 13 conservative Ministers of Parliament who support the bill.

"This bill disproportionately targets indigenous communities, environmental activists, dissidents, and Muslims, many of whom are already subjected to questionable and overreaching powers by security officials, [and] will make it easier and ostensibly lawful for government to continue infringing upon the rights of peaceful people," reads a statement from the organizers.

Among those raising their voices against the bill are human rights and free speech groups like Amnesty International, Canadian Journalists for Free Expression, and OpenMedia.

Steve Anderson, executive director for OpenMedia, told Yahoo! News on Friday, "More and more Canadians from all walks of life are concerned about this bill.

"We’re just hoping to make that more clear to the government and educate more Canadians, because … the real kind of challenge for those of us who understand the dangers of the bill is to educate [other] Canadians," he added.

Canadian Journalists for Free Expression last week hosted a teleconference with NSA whistleblower Edward Snowden, who warned that C-51 was "an emulation of the American Patriot Act" and that Canadian intelligence agencies have the weakest oversight in the Western world.

"No matter what we do, no matter what laws we pass, we cannot throw away all of our rights, all of our liberties, all of our traditional freedoms because we are afraid of rare instances of criminal activity," he said at the time.

On Saturday, the message to Canadian officials was clear. "We think that the government should go back to the drawing board…work in consultation with the privacy commissioner [and] seek the opinions of experts," Anderson continued.

Hearings on C-51 are scheduled to continue when the House reopens on March 23.

On Twitter, the actions are being updated under the hashtag #StopC51. #stopc51 Tweets

Reprinted with permission from Common Dreams.

Is This the REAL Apple Corporation?: iPhone Has Secret Software — Can be Remotely Activated to Spy on People Says NSA Whistle Blower

By Andrew Griffin
The iPhone has secret spyware that lets governments watch users without their knowledge, according to Edward Snowden.

The NSA whistleblower doesn’t use a phone because of the secret software, which Snowden’s lawyer says can be remotely activated to watch the user.

"Edward never uses an iPhone, he’s got a simple phone," Anatoly Kucherena told Russian news agency RIA Novosti. "The iPhone has special software that can activate itself without the owner having to press a button and gather information about him, that’s why on security grounds he refused to have this phone."

Read More

Cell Phone Corps Have Zero Respect For Your Privacy: Cell Phone Providers Using Super Tracking Cookie That Can't Be Deleted or Blocked

An online advertising clearinghouse relied on by Google, Yahoo and Facebook is using controversial cookies that come back from the dead to track the web surfing of Verizon customers.

Illustration provided by Saad Faruque.

By Julia Angwin and Mike Tigas

The company, called Turn, is taking advantage of a hidden undeletable number that Verizon uses to monitor customers' habits on their smartphones and tablets. Turn uses the Verizon number to respawn tracking cookies that users have deleted.

Click from your smartphone or tablet (with Wi-Fi turned off) to see if your telecom provider is adding a tracking number. We don't save any information.

Al Shaw and Jonathan Stray, ProPublica

Your personal tracking code is

token

This is being sent by your carrier to every site you visit using this device.

You are not being tracked by your carrier, or not viewing this on a mobile network.

"We are trying to use the most persistent identifier that we can in order to do what we do," Max Ochoa, Turn's chief privacy officer, told ProPublica.

Turn's zombie cookie comes amid a controversy about a new form of tracking the telecom industry has deployed to shadow mobile phone users. Last year, Verizon and AT&T users noticed their carriers were inserting a tracking number into all the Web traffic that transmits from a users' phone 2013 even if the user has tried to opt out.

Users complained that the tracking number could be used by any website they visited from their phone to build a dossier about their behavior 2013 what sites they went to, what apps they used.

In November, AT&T stopped using the number. But Verizon did not, instead assuring users on its website that "it is unlikely that sites and ad entities will attempt to build customer profiles" using its identifiers.

When asked about Turn's use of the Verizon number to respawn tracking cookies, a Verizon spokeswoman said, "We're reviewing the information you shared and will evaluate and take appropriate measures to address."

Turn privacy officer Ochoa said that his company had conversations with Verizon about Turn's use of the Verizon tracking number and said "they were quite satisfied."

Turn's actions were spotted by Stanford researcher Jonathan Mayer, and confirmed by ProPublica's testing.

Turn and Verizon also have a separate marketing partnership that allows Verizon to share anonymized information about its mobile customers. In April, Verizon sponsored a Turn event in New York City called " Bringing Sexy Back to Measurement."

Turn, which calls itself a "Digital Hub," may not be a household name but it is a huge back-end processor of ads on websites.

It works like this: When a user visits a website that contains Turn tracking code, the company holds an auction within milliseconds for advertisers to target that user. The highest bidder's ad instantly appears on the user's screen as the web page loads. Turn says it receives 2 million requests for online advertising placements per second.

For its auctions to work, Turn needs to identify web users by cookies, which are small text files that are stored on their computers. The cookies allow Turn to identify a user's web browsing habits, such as an interest in sports or shopping, which it uses to lure advertisers to the auction.

Some users try to block such tracking by turning off or deleting cookies. But Turn says that when users clear their cookies, it does not consider that a signal that users want to opt out from being tracked.

"There are definitely people who feel that if they clear their cookies, they won't be tracked, and that is not strictly accurate," said Joshua Koran, senior vice president of product management at Turn.

Turn executives said the only way users can opt out is to install a Turn opt-out cookie on their machine. That cookie is not designed to prevent Turn from collecting data about a user - only to prevent Turn from showing targeted ads to that user.

ProPublica's tests showed that even Verizon users who installed the Turn opt-out cookie continued to receive the Turn tracking cookie as well. Turn said despite the appearance of the tracking cookie, it continues to honor the opt-out cookie.

Initially, Turn officials also told ProPublica that its zombie cookie had a benefit for users: They said they were using the Verizon number to keep track of people who installed the Turn opt-out cookie, so that if they mistakenly deleted it, Turn could continue to honor their decisions to opt out.

But when ProPublica tested that claim on the industry's opt-out system, we found that it did not show Verizon users as opted out. Turn subsequently contacted us to say it had fixed what it said was a glitch, but our tests did not show it had been fixed.

Either way, this fix does not address the respawning of cookies that have been deleted2013 since Turn says it does not consider that an expression of user intent.

"It is our absolute desire to honor people's choices," said Ochoa, Turn's chief privacy officer.

For more coverage, read ProPublica's previous reporting on Verizon's indestructible tracking and AT&T's decision to stop using the technique.


ProPublica is a Pulitzer Prize-winning investigative newsroom. Sign up for their newsletter.

Reprinted with permission from ProPublica

NYPD Must Release Records on X-Ray Vans — Judge Orders: Vans Used To Detect Bombs, May Pose Radiation Risk

By Michael Grabell ProPublica
A state judge has ordered the New York City Police Department to release records on a secretive program that uses unmarked vans equipped with X-ray machines to detect bombs.

The ruling follows a nearly three-year legal battle by ProPublica, which had requested police reports, training materials, contracts and any health and safety tests on the vans under the state's Freedom of Information Law.

ProPublica filed the request as part of its investigation into the proliferation of security equipment, including airport body scanners, that expose people to ionizing radiation, which can mutate DNA and increase the risk of cancer.

Richard Daddario, then the NYPD's deputy commissioner of counterterrorism, told the court in 2013 that releasing the documents would hamper the department's ability to conduct operations and endanger the lives of New Yorkers.

Disclosing them, he said, would "permit those seeking to evade detection to conform their conduct to the times, places and methods that avoid NYPD presence and are thus most likely to yield a successful attack."

But Supreme Court Judge Doris Ling-Cohan called the NYPD's argument "mere speculation" and "patently insufficient" to outweigh the public's right to know.

"While this court is cognizant and sensitive to concerns about terrorism, being located less than a mile from the 9/11 site, and having seen firsthand the effects of terrorist destruction, nonetheless, the hallmark of our great nation is that it is a democracy, with a transparent government," she wrote in her decision last month.

Nick Paolucci, a spokesman for the city's law department, said Thursday that the NYPD would appeal "because disclosing this sensitive information would compromise public safety."

The X-ray vans at issue are essentially a version of older airport body scanners mounted on a truck.

Only three years ago, airline passengers routinely went through X-ray machines known as "backscatters" at major airports, such as Los Angeles International, New York's John F. Kennedy and Chicago O'Hare. But citing privacy concerns, the TSA removed body scanners that emit X-rays and replaced them with machines that use technology that is considered less invasive and safer.

But X-ray vans continue to be used by law enforcement agencies. They were developed shortly after the 9/11 terrorist attacks by American Science & Engineering Inc. in Billerica, Mass., and deployed by the U.S. military in Iraq and Afghanistan to sweep areas for roadside and car bombs. Because they typically look like blank, white panel trucks, soldiers in Iraq nicknamed them "white devils."

U.S. Customs and Border Protection recently began using them at border crossings, ports, Border Patrol checkpoints and special events such as the Super Bowl.

Very little has ever been reported about the NYPD's use of X-ray vans. In fact, until ProPublica's lawsuit, the police department had never said anything publicly about them other than to confirm their existence.

The most extensive reference to the vans came in a book written by two ABC News reporters who chronicled a year inside the agency's bomb squad.

Describing the security around the 2004 Republican convention in New York, they wrote that every vehicle entering a street in front of the convention hotel was ordered to drive between two white vans, which X-rayed each vehicle for explosives.

While the NYPD has refused to release information about its use of the vans2014even how many it has, how much they cost or how it ensures the safety of the public2014other government agencies have not been so secretive.

For example, Customs provided ProPublica with more than 150 pages of records under the federal Freedom of Information law just three months after a reporter filed an identical request with them in 2012.

Moreover, multiple researchers have published studies revealing security flaws in the X-ray technology, in one case, after buying a backscatter machine on eBay.

"The information contained in the records requested from the NYPD will allow the public to assess the potential health, cost, and privacy concerns raised by the NYPD's use of this vehicle," ProPublica told the court.

ProPublica is represented in the case by Yale Law School's Media Freedom and Information Access Clinic and David Schulz of Levine, Sullivan, Koch & Schulz.

The Customs documents and technical specifications2014which are on the manufacturer's website2014show that the van emits less than 10 microrems of radiation per scan. That's about twice as much as the old airport body scanners. But it's extremely low compared to medical X-rays and well within industry standards for acceptable exposure.

The National Academy of Sciences is expected to release a report this month on radiation exposures from the TSA's old scanners. Although those machines also met industry standards, a number of prominent scientists said TSA had failed to follow the health and safety principle to keep radiation doses "as low as reasonably achievable." The TSA had the ability to use a different scanner that could also find plastic explosives and weapons, but did not use X-rays.

"It's not that the radiation from these machines is very high," Peter Rez, an Arizona State University physicist, told ProPublica in 2012. "It's 'Does the benefit outweigh the risk?' "

The long-term health risks of low levels of radiation are unknown. But the National Academy has taken the position that the danger comes from cumulative exposure and that even trivial amounts increase the risk of cancer.

The X-ray vans2014which reportedly cost between $729,000 and $825,000 each2014are designed to find organic materials such as drugs and explosives. The rays penetrate the metal in a car or concrete in a building and scatter back to a detector, producing an image of what's inside. The van can scan while driving alongside a row of shipping containers or while parked as cars pass by. Customs agencies around the world have used them to fight drug and human smuggling.

But most Federal Drug Administration regulations for medical X-rays do not apply to security equipment, leaving the decision of when and how to use the scanners up to law enforcement agencies such as the NYPD.

The NYPD's policies are of particular interest because many agencies have adopted strict policies to address potential harm from backscatter X-ray scans. When Customs began using the vans extensively in 2010, the agency prohibited their use on occupied vehicles and required that people get out of the vehicles before they were X-rayed.

But because the NYPD has refused to release the department's policies and procedures, it's unclear how widely the vans are being used2014if at all, whether they're being used to scan people or even if police are deploying them for routine patrols on busy city streets.

For example, the NYPD asserted in court records that it did not have any records detailing its policies for privacy protections, how long images from the X-ray vans could be kept or who in the NYPD could view the images.

That conflicted with a court affidavit from Daddario, the counterterrorism chief, who discussed such documents and why they shouldn't be disclosed.

Judge Ling-Cohan ordered the NYPD to pay ProPublica's attorney fees and explain in writing what effort they made to search for documents responsive to the request.

ProPublica's president Richard Tofel said he was "gratified that the State Supreme Court has so clearly rejected the Police Department's efforts to stonewall this important request for information that could affect public health and that has certainly cost taxpayers a lot of money."

"As the court makes clear, vague and wholly conclusory allusions to possible terrorist threats do not and should not create exceptions to our laws on government transparency," he said. "We are sorry to learn the NYPD had decided to waste more citizen time and taxpayer money by appealing this ruling."


________________
ProPublica is a Pulitzer Prize-winning investigative newsroom. Sign up for their newsletter.

Reprinted with permission from ProPublica

For Years the US Warned of Cyber Attacks by Governments on Governments: And the First Such Cyber Attack? — It Was By the US and Israel

The Inside Story of How Stuxnet Was Discovered

If Iran had attacked US nuclear facilities with a computer virus,
it would have been considered an act of war.

By Leslie Horn
It was January 2010 when officials with the International Atomic Energy Agency (IAEA), the United Nations body charged with monitoring Iran's nuclear program, first began to notice something unusual happening at the uranium enrichment plant outside Natanz in central Iran.Inside the facility's large centrifuge hall, buried like a bunker more than fifty feet beneath the desert surface, thousands of gleaming aluminum centrifuges were spinning at supersonic speed, enriching uranium hexafluoride gas as they had been for nearly two years. But over the last weeks, workers at the plant had been removing batches of centrifuges and replacing them with new ones. And they were doing so at a startling rate. At Natanz each centrifuge, known as an IR-1, has a life expectancy of about ten years. But the devices are fragile and prone to break easily. Even under normal conditions, Iran has to replace up to 10 percent of the centrifuges each year due to material defects, maintenance issues, and worker accidents.

RELATED STORY: Stuxnet Was Work of U.S. and Israeli Experts, Officials Say

In November 2009, Iran had about 8,700 centrifuges installed at Natanz, so it would have been perfectly normal to see technicians decommission about 800 of them over the course of the year as the devices failed for one reason or another. But as IAEA officials added up the centrifuges removed over several weeks in December 2009 and early January, they realized that Iran was plowing through them at an unusual rate.

[...]

What the inspectors didn't know was that the answer to their question was right beneath their noses, buried in the bits and memory of the computers in Natanz's industrial control room. Months earlier, in June 2009, someone had quietly unleashed a destructive digital warhead on computers in Iran, where it had silently slithered its way into critical systems at Natanz, all with a single goal in mind—to sabotage Iran's uranium enrichment program and prevent President Mahmoud Ahmadinejad from building a nuclear bomb.

Read More

Cell Phone Web Browsing Logged and Tracked By Verizon and AT&T: Using 'Undetectable-Unerasable Super Cookies'

Even those who did opt out of the Verizon program still have a unique identifying code attached to all of their Web traffic.

Everyplace you go on the Internet with your cellphone - Verizon and AT&T keeps a record.

By Craig Timberg
Verizon and AT&T have been quietly tracking the Internet activity of more than 100 million cellular customers with what critics have dubbed “supercookies” — markers so powerful that it’s difficult for even savvy users to escape them.

The technology has allowed the companies to monitor which sites their customers visit, cataloging their tastes and interests. Consumers cannot erase these supercookies or evade them by using browser settings, such as the “private” or “incognito” modes that are popular among users wary of corporate or government surveillance.


Verizon and AT&T say they have taken steps to alert their customers to the tracking and to protect customer privacy as the companies develop programs intended to help advertisers hone their pitches based on individual Internet behavior. But as word has spread about the supercookies in recent days, privacy advocates have reacted with alarm, saying the tracking could expose user Internet behavior to a wide range of outsiders — including intelligence services — and may also violate federal telecommunications and wiretapping laws.


One civil liberties group, the Electronic Frontier Foundation, says it has raised its concerns with the Federal Communications Commission and is contemplating formal legal action to block Verizon. AT&T’s program is not as advanced and, according to the company, is still in testing.

The stakes are particularly high, privacy advocates say, because Verizon’s experimentation with supercookies is almost certain to spur copycats eager to compete for a larger share of the multibillion-dollar advertising profits won by Google, Facebook and others.

Read More