Category Archives: Internet Security

OTF’s Work Is Vital for a Free and Open Internet – EFF

Keeping the internet open, free, and secure requires eternal vigilance and the constant cooperation of freedom defenders all over the web and the world. Over the past eight years, the Open Technology Fund (OTF) has fostered a global community and provided supportboth monetary and in-kindto more than four hundred projects that seek to combat censorship and repressive surveillance, enabling more than two billion people in over 60 countries to more safely access the open Internet and advocate for democracy.

OTF has earned trust over the years through its open source ethos, transparency, and a commitment to independence from its funder, the US Agency for Global Media (USAGM), which receives its funding through Congressional appropriations.

In the past week, USAGM has removed OTFs leadership and independent expert board, prompting a number of organizations and individuals to call into question OTFs ability to continue its work and maintain trust among the various communities it serves. USAGMs new leadership has been lobbied to redirect funding for OTFs open source projects to a new set of closed-source tools, leaving many well-established tools in the lurch.

Why OTF Matters

EFF has maintained a strong relationship with OTF since its inception. Several of our staff members serve or have served on its Advisory Council, and OTFs annual summits have provided crucial links between EFF and the international democracy tech community. OTFs support has been vital to the development of EFFs software projects and policy initiatives. Guidance and funding from OTF have been foundational to Certbot, helping the operators of tens of millions of websites use EFFs tool to generate and install Lets Encrypt certificates. The OTF-sponsored fellowship for Wafa Ben-Hassine produced impactful research and policy analysis about how Arab governments repress online speech.

OTFs funding is focused on tools to help individuals living under repressive governments. For example, OTF-funded circumvention technologies including Lantern and Wireguard are used by tens of millions of people around the world, including millions of daily users in China. OTF also incubated and assisted in the initial development of the Signal Protocol, the encryption back-end used by both Signal and WhatsApp. By sponsoring Lets Encrypts implementation of multi-perspective validation, OTF helped protect the 227 million sites using Lets Encrypt from BGP attacks, a favorite technique of nation-states that hijack websites for censorship and propaganda purposes.

While these tools are designed for users living under repressive governments, they are used by individuals and groups all over the world, and benefit movements as diverse as Hong Kongs Democracy movement, the movement for Black lives, and LGBTQ+ rights defenders.

OTF requires public, verifiable security audits for all of its open-source software grantees. These audits greatly reduce risk for the vulnerable people who use OTF-funded technology. Perhaps more importantly, they are a necessary step in creating trust between US-funded software and foreign activists in repressive regimes. Without that trust, it is difficult to ask people to risk their lives on OTFs work.

Help Us #SaveInternetFreedom

It is not just OTF that is under threat, but the entire ecosystem of open source, secure technologiesand the global community that builds those tools. We urge you to join EFF and more than 400 other organizations in signing the open letter, which asks members of Congress to:

EFF is proud to join the voices of hundreds of organizations and individuals across the globe calling on UGASM and OTFs board to recommit to the value of open source technology, robust security audits, and support for global Internet freedom. These core valueswhich have been a mainstay of OTF's philanthropyare vital to uplifting the voices of billions of technology users facing repression all over the world.

See more here:
OTF's Work Is Vital for a Free and Open Internet - EFF

WatchGuard Technologies Report Finds Two-Thirds of Malware is Encrypted, Invisible Without HTTPS Inspection – GlobeNewswire

Seattle, June 24, 2020 (GLOBE NEWSWIRE) -- WatchGuard Technologies, a global leader in network security and intelligence, secure Wi-Fi, multi-factor authentication and advanced endpoint protection, today announced the release of its Internet Security Report for Q1 2020. For the first time ever, this report includes data on the percentage of malware in the wild delivered via encrypted HTTPS connections. WatchGuards threat intelligence shows that 67% of all malware in Q1 was delivered via HTTPS, so organizations without security solutions capable of inspecting encrypted traffic will miss two-thirds of incoming threats. Additionally, 72% of encrypted malware was classified as zero day (meaning no antivirus signature exists for it, and it will evade signature-based protections). These findings show that HTTPS inspection and advanced behavior-based threat detection and response solutions are now requirements for every security-conscious organization. The report also includes a special section detailing the impact of COVID-19 on the threat landscape.

Some organizations are reluctant to set up HTTPS inspection due to the extra work involved, but our threat data clearly shows that a majority of malware is delivered through encrypted connections and that letting traffic go uninspected is simply no longer an option, said Corey Nachreiner, chief technology officer at WatchGuard. As malware continues to become more advanced and evasive, the only reliable approach to defense is implementing a set of layered security services, including advanced threat detection methods and HTTPS inspection.

WatchGuards Internet Security Report prepares midmarket businesses, the service providers that support them, and the end users that work for them with data on the trends, research and best practices they need to defend against modern security threats. Here are the key findings from the Q1 2020 report:

Third-party testing has found that WatchGuard products consistently maintain high throughput when inspecting HTTPS traffic. Many competitive products show a significant degradation in performance in this scenario. For example, an independent test performed by Miercom found that the Firebox M370 outperformed competitive products while inspecting HTTPS traffic with full security services enabled.

The findings in WatchGuardsInternet Security Reportsare drawn from anonymized Firebox Feed data from active WatchGuard appliances whose owners have opted in to share data to support the Threat Labs research efforts. Today, over 44,000 appliances worldwide contribute threat intelligence data to the report. In Q1 2020, they blocked over 32,148,519 malware variants in total (730 samples per device) and more than 1,660,000 network attacks (38 attacks per device).

The complete report includes key defensive best practices that organizations of all sizes can use to protect themselves in todays threat landscape and a detailed analysis of how the COVID-19 pandemic and associated shift to working from home affected the cyber security landscape.

About WatchGuard Technologies, Inc.

WatchGuard Technologies, Inc. is a global leader in network security, secure Wi-Fi, multi-factor authentication, advanced endpoint protection, and network intelligence. The companys award-winning products and services are trusted around the world by nearly 10,000 security resellers and service providers to protect more than 80,000 customers. WatchGuards mission is to make enterprise-grade security accessible to companies of all types and sizes through simplicity, making WatchGuard an ideal solution for midmarket businesses and distributed enterprises. The company is headquartered in Seattle, Washington, with offices throughout North America, Europe, Asia Pacific, and Latin America. To learn more, visit WatchGuard.com.

For additional information, promotions and updates, follow WatchGuard on Twitter@WatchGuardonFacebook or on theLinkedIn Companypage. Also, visit our InfoSec blog, Secplicity, for real-time information about the latest threats and how to cope with them atwww.secplicity.org.Subscribe to The 443 Security Simplified podcastatSecplicity.org, or wherever you find your favorite podcasts.

WatchGuard is a registered trademark of WatchGuard Technologies, Inc. All other marks are property of their respective owners.

Read the original here:
WatchGuard Technologies Report Finds Two-Thirds of Malware is Encrypted, Invisible Without HTTPS Inspection - GlobeNewswire

How To Turn Off Firewall In Windows And Mac – Ubergizmo

As we grow increasingly connected to the internet, security is becoming more important than ever. Firewalls on our computers have existed for a long time, but sometimes, it can actually be more problematic than useful, which is why turning it off can actually be a good thing. But before we decide to turn it off, what exactly is a firewall and what does it do?

A firewall can be thought off as a wall of bricks surrounding our home. This wall helps to keep unwanted visitors out while protecting the residents of the home. In tech terms, it helps to protect your computer from unwanted intrusions from the likes of hackers or malware which might be trying to compromise your system and gain access to your personal information.

It will scan incoming internet data for things that are known to cause problems, and thus prevents it from infecting your computer system and causing havoc.

So right off the bat, firewalls sound a lot like antivirus software designed to protect your computer from threats, but there are differences. Having a firewall does not negate the need for antivirus software, even though it does protect your computer to a certain degree.

In the case of antivirus, you can think of it like a metal detector of sorts. Imagine a bad person was at the airport and they were looking to fly somewhere, so they use a fake passport and somehow get past immigration (firewall). Now that theyre inside the airport, they will need to go through a metal detector (antivirus) that will pick up any illegal objects like knives or guns they might be trying to smuggle on board.

Antivirus also works great for computers or devices that arent connected to the internet, where if you try to load a program from a disk or a USB drive that has malware, it will pick up on that.

With that being said, it sounds like having a firewall is a great thing, doesnt it? But that doesnt mean that it doesnt run into issues every now and then.

This is because computers pretty much just do what theyre told to do, theyre generally not smart enough to think on their own.

This means that as long as an action, connection, or program has been deemed as bad (or even risky), it will block it, even though it might not necessarily be the case.

For example, system administrators might need to do some work like applying software updates or installing new applications, and sometimes a firewall might prevent them from doing that.

As an end-user, you might also run into similar issues where programs or applications may run incorrectly or not at all due to their connection being blocked, and this is why you might want to turn off the firewall.

IMPORTANT: Most app developers will have a guide for users that bump into a Firewall issue. We recommend trying that first, as disabling the Firewall greatly increases your security risk. But if youre set on disabling the Firewall, please continue reading

Filed in Computers. Read more about Macos, Microsoft, Security, Windows and Windows 10.

The rest is here:
How To Turn Off Firewall In Windows And Mac - Ubergizmo

Microsoft acquires CyberX to bolster Azure IoT security – Internet of Things News – IoT Tech News

Microsoft has announced the acquisition of IoT security specialist CyberX to beef up Azure IoTs capabilities and help customers assess their risk profile across industrial environments.

CyberX, which will complement existing Azure IoT security offerings, aims to solve two specific challenges, according to a blog post from Microsoft announcing the news. Customers need greater visibility into the IoT devices already connected to their networks, as well as manage security on brownfield devices which have been difficult to secure due to legacy protocols.

With CyberX, customers can discover their existing IoT assets, and both manage and improve the security posture of those devices, wrote Michal Bravermen-Blumenstyk, CVP and CTO of cloud and AI security and Sam George, CVP of cloud and AI Azure IoT in a blog. Customers can see a digital map of thousands of devices across a factory floor or within a building and gather information about their asset profile and vulnerabilities.

Gaining this visibility is not only critical for understanding where security risks may exist and then mitigating those risks, but it is also a fundamental step to securely enable smart manufacturing, smart grid, and other digitisation use cases across production facilities and the supply chain, they added.

From the CyberX perspective, Omer Schneider, co-founder and CEO, said he was thankful to the companys customers and investors, and assessed the next steps. By joining forces with Microsoft, we will rapidly scale our business and technology to securely enable digital transformation for many more organisations, said Schneider.

The seeds of Microsofts $5 billion investment in IoT, announced two years ago, continue to bear fruit, as Braverman-Blumenstyk and George explained. While the benefits of IoT are well established and significant, one of the biggest hubrldes for customers is securing IoT devices both for new digitisation initiatives as well as for legacy operational technology and industrial control system environments, they wrote.

Research from Counterpoint at the start of this month found Microsoft to be the leader in IoT platforms. The Redmond company came top or joint top in almost all areas of analysis, including integration and scalability, ecosystem growth, and application enablement.

Financial terms of the deal were not disclosed.

Interested in hearing industry leaders discuss subjects like this?Attend the co-located5G Expo,IoT Tech Expo,Blockchain Expo,AI & Big Data Expo, andCyber Security & Cloud Expo World Serieswith upcoming events in Silicon Valley, London, and Amsterdam.

More here:
Microsoft acquires CyberX to bolster Azure IoT security - Internet of Things News - IoT Tech News

Partner Content: ESET and Spire Technology on why you need a Password Manager – PCR-online.biz

With an average of 200 online accounts to create passwords for and over 75 million internet-connected devices worldwide, using a Password Manager is a modern necessity.

When it comes to basic cybersecurity tips youve no doubt heard the standard advice many, many times: install antivirus, dont click on dodgy links, dont spend your life savings to deposed foreign royalty, dont install suspect software and so on.

Near the top of any list worth its salt, theres bound to be dont reuse passwords on multiple sites. Which, like all the other tips mentioned, is great advice but much easier said than done. An average person in the UK could have roughly 200 online accounts registered to a single email address.

Memorising that many unique passwords isnt something that anyone can be reasonably expected to do, which is exactly where a Password Manager, like the one included in ESET Smart Security Premium, comes in.

As ESET Security Specialist Jake Moore explains, Password Managers are designed to do the heavy lifting when it comes to creating, storing and protecting your most important accounts.

From online clothes shops to your daily news, everything we do on the internet requires a password, how are you honestly expected to remember them? Well, theres an easy way.

Password Managers enable you to do exactly that: every single login can have a complex, unique password and you dont have to remember it. You dont actually need to make it up either, the manager will do it for you.

If you have a digital life then a Password Manager will help you organise it. Once youve got it up and running its virtually hassle free and an absolute must these days.

That isnt all Password Managers are capable of either: you can securely store credit card or bank information, so you dont have to rummage around in your wallet to find your payment details.

Any important information you may need but want to store securely can be put into a Password Manager and all you have to remember is a single ultra-secure master password.

ESETs flagship software: ESET Smart Security Premium

ESET Smart Security Premium not only features an easy to use comprehensive Password Manager but also offers multi-layered anti-malware protection for all internet users, built on ESETs trademark best balance of detection, speed and usability.

As well as award-winning ESET Antivirus and Antispyware, encrypt your files and USB storage devices, protect your webcam from misuse and easily check the security of your home Wi-Fi router and vulnerability of your smart devices connected to it.

You can pay online and access your web-based crypto-wallets more safely, locate and secure your missing laptop and get a customised monthly Security Report. With ESETs improved License Manager you can manage your connected devices and licenses via my.eset.com.

ESETs award-winning cybersecurity: online protection for any level of user

The latest versions of ESET NOD32 Antivirus, ESET Internet Security and ESET Smart Security Premium offer fortified multilayered protection, enhanced IoT protection, product referral and a new security report feature. Users can rely on the best balance of speed, detection and usability acknowledged by multiple testing bodies to protect their constantly-connected devices.

It is predicted that by 2025, there will be over 75 billion connected devices worldwide from smart home devices to e-health gadgets this poses a real threat to cybersecurity. As more connected devices are introduced to everyday life, the amount of personal and sensitive data shared increases, as does the number of entry points into networks.

Hackers will use this rise in the number of internet-connected devices to their advantage and users, therefore, cannot afford to neglect taking security measures. The addition of IoT protection to our home user product suite means our customers can be safe in the knowledge that their devices, and the home routers they connect to, are properly secured, says Matej Kritofk, Product Manager at ESET.

Similar to previous years, to fight all these threats users can choose from ESET NOD32 Antivirus for basic protection, ESET Internet Security with additional layers of security on top of the basic anti-malware solution, and ESET Smart Security Premium for users seeking the most advanced protection and features on the market. This includes technologies such as Password Manager and Banking Protection.

Built on machine learning and three decades of knowledge all ESET products run unnoticed in the background. The key offering provides users with comfortable and ultra-fast scanning without impacting the operating system or their experience.

We built our products to provide an advantage over native Windows protection to show users how a multi-layered approach to cybersecurity can battle the toughest of threats out there, said Kritofk.

The latest version offers new features as well as improvements to existing ones including:

Security report provides users with an overview of what ESETs solution has been actively detecting, blocking and mitigating in the background, while users computers run smoothly without any performance lag. Users can choose from five pre-set items based on user-given priorities and gain insight into other features such as Secure Data, Password Manager, Anti-theft or Parental Control.

Improved installation users save up to 40% on the installation time based on the set up of the device. The installation of new ESET products will now only take a couple of seconds.

Connected home monitor now allows users to test router-connected smart devices for vulnerabilities such as weak passwords and suggests possible fixes. It also allows users to scan for port vulnerabilities, known firmware vulnerabilities, malicious domains, weak or default router password and malware infections.

To find out more about ESET Smart Premium Security and our other award-winning products, visit our Premium Distribution Partner, Spire Technology https://www.spire.co.uk/vendor_stores.php?vendor=ESET&store_ID=105

This article is partner content from

Like this content? Sign up for the free PCR Daily Digest email service to get the latest tech news straight to your inbox. You can also follow PCR on Twitter and Facebook.

Read the latest edition of PCRs monthly magazine below:

Go here to read the rest:
Partner Content: ESET and Spire Technology on why you need a Password Manager - PCR-online.biz

Google is on a mission to stop you from reusing passwords – The Verge

Passwords are one of the worst things on the internet, Mark Risher, Googles senior director for account security, identity, and abuse told The Verge. Though theyre essential for security and to help people log in to many apps and websites, theyre one of the primary, if not the primary, ways that people actually end up getting compromised.

Its a strange thing for a Google security executive to say because the last time you logged into Gmail, you probably typed in a password. But the company has been trying to nudge users away from the model for years, or at least minimize the damage. And in the coming weeks, one of Googles quietest tools in that fight the Password Checkup feature will be getting a higher profile, as it joins the Security Checkup dashboard built into every Google account.

Risher is right to be concerned. Though you can use a tool like a password manager to help keep track of your logins, a lot of people just end up reusing passwords for many accounts. Fifty-two percent of people reuse the same password for multiple accounts, according to the results of a poll published in February 2019 by Google and polling firm Harris. Thirteen percent of people reuse that password for all of their accounts, that poll found. And Microsoft said in 2019 that 44 million Microsoft accounts used logins that had been leaked online.

While reusing passwords can be one way to remember a complex word, phrase, or combination of letters, numbers, and symbols that you think no one will ever be able to guess, the practice can put your personal information in danger. If that reused password gets leaked as part of a data breach, hackers could then have the key to many of your other online accounts no matter how complex the phrase is.

We know from other research weve done in the past that people whove had their data exposed by a data breach are 10 times more likely to be hijacked than a person thats not exposed by one of these breaches, said Kurt Thomas, a member of Googles anti-abuse and security research team.

Google has been trying to help users build better password habits for some time, slowly but surely. For years, the company has offered a built-in password manager in Google Accounts on Chrome and Android that can save your passwords and autofill them on websites and apps, for example.

But over the past year or so, Google has also been working to help people proactively make better passwords with Password Checkup. The tool checks logins against a database of 4 billion leaked credentials, seeing if the password youre typing in matches one thats already leaked. It launched first as a Chrome extension in February 2019, and Google baked it into Google Accounts in October and into Chrome in December.

Its not a new idea, but Google is uniquely well-positioned to offer something like Password Checkup. The company has access to billions of passwords and the scale to roll out Password Checkup to billions of users in a way that integrates with account security tools on which many people already rely.

Figuring out how to let Password Checkup flag compromised credentials in a privacy-respecting way was a tough technical problem that required a combined effort from both Google and Stanford. The challenge was finding a way to automatically check a users credentials against a database of breached logins without revealing that information to Google or giving the user access to the whole database, all while scaling that solution to Googles huge user base, researchers from both organizations told me.

To do so, Google stores a hashed and encrypted version of every known username and password exposed by a data breach. Whenever you log into an account, Google will send a hashed and encrypted version of your login info against that database. That way, Google cant see your password, and you cant see Googles list of known-compromised logins. If Google detects a match, Google will show an alert recommending that you change your password for that site.

Google gets compromised logins from multiple different sources and trusted partners, Thomas said, including underground forums where password dumps are openly shared. We have an ethical policy that we will never pay criminals for stolen data, he continued. But just by virtue of how these markets work, very often, [stolen data] will bubble up and become available. Using personas Google has in those marketplaces, the company can acquire the data, he said.

Password Checkup took about two to three years from inception to having it appear in many Google products, according to Thomas. Down the line, Google wants to have Security Checkup email you when it detects that a stored login has been compromised in a data breach, which the company plans to launch in the coming months. And later this year, Google aims to let people use Password Checkup in Chrome even if they arent logged into a Google account.

Google isnt the only company to offer some kind of password-checking functionality. Paid password manager 1Password recommends changing weak or duplicated passwords and also offers Watchtower, which checks your logins against Troy Hunts Have I Been Pwned database of more than 9 billion compromised accounts and flags any matches. And Apple announced yesterday that its next version of Safari will have a password-monitoring tool that appears to work similarly to Password Checkup.

But Google has an advantage in helping people with their passwords thanks to its massive scale. And tools like Password Checkup and the built-in password manager ladder up to a broader goal to make online security easier for users.

What I like security to be and what I think [Password Checkup] is a good example of is, how do you make it easier for regular people to do the right thing? Googles VP of security engineering Royal Hansen told The Verge. Its not about alerting you with more and more problems, he said. Its about making it easier for you to do, frankly, the most basic step.

Update June 23rd, 4:06PM ET: Added context about where Password Checkup is already available.

Originally posted here:
Google is on a mission to stop you from reusing passwords - The Verge

Internet of Things (IoT) Security Market to Witness Robust Expansion Throughout the Forecast Period 2020 2025 – 3rd Watch News

The Internet of Things (IoT) Security market report, recently added by Market Study Report, LLC, examines the industry in terms of the global expanse, highlighting the present & future growth potential of each region as well as consolidated statistics. The study also presents a precise summary of the competitive milieu, key developments, and application landscape of the Internet of Things (IoT) Security market based on the impact of the financial and non-financial facades of the industry.

.

Request a sample Report of Internet of Things (IoT) Security Market at:https://www.marketstudyreport.com/request-a-sample/2439253?utm_source=3wnews.org&utm_medium=AN

According to the latest research report, the Internet of Things (IoT) Security market emerges as one of the most proactive business verticals. This research report anticipates this space to garner substantial returns over the forecast period, on account of the broad range of driving forces that is set to transform the market outlook throughout the projected duration. An essence of these driving forces, in conjunction with and excess of additional dynamics related to the Internet of Things (IoT) Security market, such as the threats that are prevalent across this market as well as the growth opportunities, have also been emphasized in the report.

One of the key pointers that makes the Internet of Things (IoT) Security market report worth a buy is the extensive overview it delivers regarding the competitive landscape of the industry. Based on the competitive hierarchy, the study expertly segments the Internet of Things (IoT) Security market into The major players covered in Internet of Things (IoT) Security are:, Cisco Systems, ARM Holdings, Symantec Corporation, Intel Corporation, Infineon Technologies, IBM Corporation, Kaspersky Lab, Digicert, Trend Micro, Gemalto NV, Trustwave, CheckPoint Software Technologies, INSIDE Secure SA, Verizon Enterprise Solutions, Sophos Plc and Advantech. These companies have been competing with one another in a bid to attain a successful status in the global market.

A brief outline of the Internet of Things (IoT) Security market scope includes:

Ask for Discount on Internet of Things (IoT) Security Market Report at:https://www.marketstudyreport.com/check-for-discount/2439253?utm_source=3wnews.org&utm_medium=AN

The report provides enough data regarding the market share that all of these companies presently account for throughout this vertical, alongside the market share that they are expected to acquire over the estimated period. The study also expounds on particulars related to the product manufactured by each of these companies, that would help industry entrants and key stakeholders develop their competitive analysis and strategy portfolios. Additionally, their decision-making process is set to become more convenient due to the fact that the Internet of Things (IoT) Security market report also highlights an essence of the trends in product pricing and the revenue margins of the major players in the industry.

Important question regarding the regional spectrum of the Internet of Things (IoT) Security market covered by the report:

Some common questions the report answers with regards to the segmentation of the Internet of Things (IoT) Security market

Key takeaways from the study:

For More Details On this Report:https://www.marketstudyreport.com/reports/global-internet-of-things-iot-security-market-2020-by-company-regions-type-and-application-forecast-to-2025

Some of the Major Highlights of TOC covers:

Development Trend of Analysis of Internet of Things (IoT) Security Market

Marketing Channel

Market Dynamics

Methodology/Research Approach

Related Reports:

1. Global PC System Utilities Software Market 2020 by Company, Regions, Type and Application, Forecast to 2025PC System Utilities Software market research report provides the newest industry data and industry future trends, allowing you to identify the products and end users driving Revenue growth and profitability. The industry report lists the leading competitors and provides the insights strategic industry Analysis of the key factors influencing the market.Read More: https://www.marketstudyreport.com/reports/global-pc-system-utilities-software-market-2020-by-company-regions-type-and-application-forecast-to-2025

2. Global Music Publishing Market 2020 by Company, Regions, Type and Application, Forecast to 2025Music Publishing Market report characterize imperative Portion and contenders of the market regarding market estimate, volume, esteem. This report likewise covers every one of the locales and nations of the world, which demonstrates a territorial improvement status, it additionally incorporates Business Profile, Introduction, Revenue and so on.Read More: https://www.marketstudyreport.com/reports/global-music-publishing-market-2020-by-company-regions-type-and-application-forecast-to-2025

Related Report : https://www.marketwatch.com/press-release/noise-measuring-equipment-market-size-to-reach-usd-1731-million-by-2025-2020-06-24

Contact Us:Corporate Sales,Market Study Report LLCPhone:1-302-273-0910Toll Free:1-866-764-2150Email:[emailprotected]

Read the original:
Internet of Things (IoT) Security Market to Witness Robust Expansion Throughout the Forecast Period 2020 2025 - 3rd Watch News

Marking the 30th Anniversary of the Internet and Cybersecurity Treaty – CircleID

Richard E. Butler and the author in the secretariat workroom of the Old Melbourne City Hall writing the cybersecurity treaty provisions, December 1988. Photo courtesy of the author's legal assistant, Laina Raveendran-Greene.

Next week, July 1, 2020 marks the 30th anniversary of one of the most significant treaty instruments in modern times. On 1 July 1990, the Melbourne Treaty came into force as the first and only global treaty that enabled worldwide internets and mobile networks to exist, together with the cybersecurity provisions designed to protect those infrastructures. The achievement remains as an enduring tribute to Richard Edmund Butler of Australia who was one of the most influential, and best-loved Secretaries-General of the ITU.

Dick Butler as he was known by everyone had an almost encyclopedic familiarity with public international telecommunications law, technology, and the long arc of history. He was also universally admired as a dedicated international civil servant which, combined with his friendly Aussie persistence and considerable height, made him the ideal, formidable man for the task.

After he was elected Secretary-General in 1982, Dick decided that he would begin pulling together a team of trusted colleagues to embark on the preparation of a new treaty instrument for enabling global internets and mobile networks. At that time, it was unlawful for international leased circuits to be used for creating internets for data or mobile services available to the public. At the time, all internets were, by definition, private networks and only implemented within enterprises or governments. Like all the many internets, the DARPA Internet only existed internationally as a government network.

As my job in the FCC and across multiple Federal agencies significantly involved the ITU, Dick and I traded ideas about the conference for several years. As his team of compatriots floated concepts in published articles and at conferences, they were merged into the planning process. The model ultimately pursued was that for radio internets developed by the U.S. 60 years earlier by Herbert Hoover and William F. Friedman. At the FCC, I also reported to the former Director of DARPA who had previously authorized and oversaw internet development there, as well as headed up U.S. intelligence community advisory and coordination activities. Deciding the associated internet policies, regulations, and shaping international law were key components of the FCC work during those renaissance years, and supported by CIA and NSA experts. The significantly increased interest in the mid-80s in global internet and mobile networks resulted in Dick picking his hometown of Melbourne and Nov-Dec 1988 for the treaty conference.

In late 1987, things were sufficiently far along that Dick asked me to move from Boston to Geneva to join him as his counselor and Chief of Telecommunication Regulations to further develop the treaty provisions and help negotiate them at the Melbourne treaty conference the next year. In Boston, my job involved collaborating with multiple internet related entities that included the prime contractor for NSA's key cybersecurity platform SDNS (Secure Data Network System).

Standing with Peter Stephen Wilenski (right) who Dick asked to take over as Conference chair on the second day to help save it from disaster along with the changes described. Peter was a really unusual and incredibly talented Australian civil servant like Dick, who escaped from Poland to Australia in 1943. He died rather young in 1994. Photo courtesy of the author's legal assistant, Laina Raveendran-Greene.

As 1988 got underway, things became even more complicated and hectic when GATT (now the WTO) located near the ITU decided it also would develop treaty provisions entwined with the envisioned ITU internet treaty. One of the fortunate assets to assist the effort literally came walking in the door in the form of an energetic young lawyer from Singapore named Laina Raveendran who was doing graduate studies in Geneva and focused on harmonizing the two treaty developments in play. We hired her.

During 1988, all manner of legal and technical research, including historical precedents going back to 1850, was done to ensure the success of the first treaty for global internets and mobile networks. Countless hours were spent attending external meetings, presenting papers and writing articles worldwide. Dick spent day and night traveling and talking by phone to get senior officials from every country in the world, as well as the major industry user organizations, to agree on the provisions that were continually refined and redistributed every week using what the first network-based information system supporting a treaty conference was.

As the representatives from 133 nations were getting ready to head off to Melbourne in November 1988 to ink the first internet treaty, everything appeared good to go. The stated objective in the ITU press release was at hand an enduring treaty to "provide the basic foundation of norms and administrative mechanisms required not only for implementing the 'Networks of the 90's' and beyond but also for assuring the continued availability of traditional existing telecommunications services among the public throughout the world."

However, one of the worst possible events occurred in early November that spelled disaster. A Cornell University graduate student named Robert Tappen Morris created a worm that took down the entire DARPA internet infrastructure. To make this disaster even worse, the legendary New York Times investigative technology journalist John Gregory Markoff took an interest in the incident, and his articles were carried throughout the world almost every day by the International Herald Tribune. It didn't take John long to discover that the identity of Morris' equally legendary but publicly unknown father was NSA's Chief Scientist.

Shortly after Dick's team arrived in Melbourne, the delegates from the USSR several of whom were very knowledgeable KGB and GRU engineers - made it plain they were prepared to call for an end of the conference as a result of the Morris incident. Over several long days, Dick's team developed key provisions for what is the first and to this day the only, global cybersecurity treaty.

It was clever. The same NSA group that Morris' father led at NSA, had the previous year made public the solutions necessary for internet security the SDNS initiative. Furthermore, these solutions were being brought into the CCITT (now ITU-T). The quid pro quo for allowing global public internets to come into existence was adherence to the SDNS provisions being moved into ITU international standards. Dick approached the USSR delegation, who agreed, and it saved the treaty. The photo here is a historical one Dick and I writing the cybersecurity provisions into the draft treaty text.

The conference was extended for several days. All 131 nations signed the treaty at Melbourne, and almost every country in the world subsequently ratified it. It remains an unparalleled achievement.

Dick decided to leave on a high note. He penned an article marking what had been achieved that was published in the Telecommunication Journal in 1989 with its last paragraph noting:

"The CCITT [now ITU-T] Plenary Assembly has helped to provide a concrete technological and operational foundation for the orderly development of the network while the World Administrative Telegraph and Telephone Conference (WATTC88) provided a regulatory framework appropriate for the diverse technological, operational and national policy environments which are so rapidly evolving today."

With the treaty initiative accomplished and yearning to return to his native Australia with his beloved wife Pat after spending decades in Geneva, he announced shortly after the Melbourne conference he would be stepping down as Secretary-General and privately championed Pekka Tarjanne from Finland as his successor. Dick waved good-bye to his team at the ITU in December 1989. He passed away at 86 in 2012 but in the years between helped leverage his incredible knowledge and negotiating skills to bring about many new satellites and high-altitude radio systems for the poor and underserved areas of the world.

Conference Secretariat team, December 1988. Photo courtesy of the author's legal assistant, Laina Raveendran-Greene.

On 1 July 1990 30 years ago the Melbourne Treaty came into force. As my position at the ITU also included being the Chief of International Telecommunication Regulations, under the new Secretary-General who carried on Dick's mission, I issued advisories to signatory nations to implement the internet and cybersecurity treaty provisions. Private leased lines began to be made available pursuant to the treaty, and new dynamic network globalization ensued. NSA's SDNS cybersecurity platform moved into CCITT standards and was implemented in demonstration networks.

Unfortunately, the ground-breaking, historic Melbourne internet and cybersecurity treaty did not fare well in the following years. The Clinton-Gore Administration subsequently decided it would simply ignore the treaty provisions, and halted the NSA SDNS initiative and implementations, along with all government domestic oversight and regulations of internets. Everything was left to the "Information Superhighway" and constant anarchy of an unfettered marketplace. It indeed brought about almost 30 years of cyber chaos to produce what exists today.

Subsequent U.S. Administrations and lobbyists took up the Clinton-Gore gambit of disparaging and ignoring the Melbourne Treaty conveniently sweeping it under the carpet of ignorance, jingoism, and xenophobia that pervades Washington. However, Russia and many other countries have not forgotten what happened. They occasionally exploit the resulting international legal vacuum to remind the U.S. But then, combined with the international disgraces of the current U.S. Administration, trust in the U.S. honoring its international agreements has evaporated anyway. International stature, integrity and trust - once destroyed are not easily acquired again. Reconstruction after the Trump Plague will be difficult.

The Melbourne Treaty's enduring value proposition is increasingly underscored by the emergence of extraterritorial network architectures and services in a 5G world and the occasional pleas of transnational corporate general counsels for a multilateral treaty instrument. The answer is as Dick would say in his emails until his passing - go see U.S. Treaty Document 102-13. The supreme irony is that the model for the Melbourne Treaty was that devised by the U.S. itself a hundred years ago.

Perhaps on the 1 July 2020, some reflection might occur on what was a finer hour in public international law led by a humble visionary man from Australia with enormous integrity and facilitated by the U.S. national security community.

See more here:
Marking the 30th Anniversary of the Internet and Cybersecurity Treaty - CircleID

The Cyberlaw Podcast: Using the Internet to Cause Emotional Distress is a Felony? – Lawfare

This is the week when the movement to reform Section 230 of the Communications Decency Act got serious. The Justice Department released a substantive report suggesting multiple reforms. I was positive about many of them (my views here). Meanwhile, Sen. Josh Hawley (R-MO) has proposed a somewhat similar set of changes in his bill, introduced this week. Nate Jones and I dig into the provisions, and both of us expect interest from Democrats as well as Republicans.

The National Security Agency has launched a pilot program to provide secure domain name system (DNS) resolver services for US defense contractors. If thats such a good idea, I ask, why doesnt everybody do it, and Nick Weaver tells us they can. Phil Reitingers Global Cyberalliance offers Quad9 for this purpose.

Gus Hurwitz brings us up to date on a host of European cyberlaw developments, from terror takedowns (Reuters, Tech Crunch) to competition law to the rise of a disturbingly unaccountable and self-confident judiciary. Microsofts Brad Smith, meanwhile, wins the prize for best marriage of business self-interest and Zeitgeist in the twenty-first century.

Hackers used LinkedIns private messaging feature to send documents containing malicious code which defense contractor employees were tricked into opening. Nick points out just what a boon LinkedIn is for cyberespionage (including his own), and I caution listeners not to display their tattoos on LinkedIn.

Speaking of fools who kind of have it coming, Nick tells the story of the now former eBay executives who have been charged with sustained and imaginatively-over-the-top harassment of the owners of a newsletter that had not been deferential to eBay. (Wired, DOJ)

Its hard to like the defendants in that case, I argue, but the law theyve been charged under is remarkably sweeping. Apparently its a felony to intentionally use the internet to cause substantial emotional distress. Who knew? Most of us who use Twitter thought that was its main purpose. I also discover that special protections under the law are extended not only to prevent internet threats and harassment of service animals but also horses of any kind. Other livestock are apparently left unprotected. PETA, call your office.

Child abusers cheered when Zoom buckled to criticism of its limits on end-to-end encryption, but Nick insists that the new policy offers safeguards for policing misuse of the platform. (Ars Technica, Zoom)

I take a minute to roast Republicans in Congress who have announced that no FISA reauthorization will be adopted until John Durhams investigation of FISA abuses is done, which makes sense until you realize that the FISA provisions up for reauthorization have nothing to do with the abuses Durham is investigating. So were giving international terrorists a break from scrutiny simply because the President cant keep the difference straight.

Nate notes that a story previewed in April has now been confirmed: Team Telecom is recommending the blocking of a Hong Kong-US undersea cable over national security concerns.

Gus reminds us that a bitter trade fight between the US and Europe over taxes on Silicon Valley services is coming. (Politico, Ars Technica)

Nick and I mourn the complete meltdown of mobile phone contact tracing. I argue that from here on out, some portion of coronavirus deaths should be classified as mechanogenic (caused by engineering malpractice). Nick proposes instead a naming convention built around the Therac-25.

And we close with a quick look at the latest data dump from Distributed Denial of Secrets. Nick thinks its strikingly contemporaneous but also surprisingly unscandalizing.

Download the 321st Episode (mp3).

You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to [emailprotected]. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!

The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

View original post here:
The Cyberlaw Podcast: Using the Internet to Cause Emotional Distress is a Felony? - Lawfare

Julian Assange Extradition and the Freedom of Bitcoin Bitcoin… – Bitcoin Magazine

WikiLeaks founder Julian Assange is currently being held on remand in a London maximum-security prison, solely on the basis of a U.S. extradition request. Assange has been charged with 17 counts of espionage related to WikiLeaks 2010 to 2011 publications concerning the U.S. wars in Iraq and Afghanistan, embarrassing U.S. diplomatic communications and evidence of torture in the Guantanamo Bay detention camp.

Assanges U.S. extradition case is recognized by free speech groups as the most important press freedom case of the 21st century. As the aggressive judicial overreach of this U.S. government is already creating a chilling effect on reporters and media organizations, some recognize consequences far beyond the future of journalism.

Julian Assanges father, John Shipton, who regularly attends cryptocurrency conferences, has warned those who are involved in the development of new technologies that they are not immune to suffering the same fate as his son.

How does the prosecution of Assange threaten the crypto movement? And why does the Bitcoin community need to be concerned about his plight for freedom?

At its heart, WikiLeaks is an innovative endeavor. Started as a project of Sunshine Press, it was an invention of a new form of journalism built on the platform of the internet. On its websites About page, WikiLeaks described how it started with an online dialogue between activists around the world, who shared their aspiration to eliminate injustice and human suffering caused by the abuses of power of corporations and governments, especially oppressive regimes.

WikiLeaks also acknowledges the efforts of Philip Zimmerman, the creator of an encryption software program known as Pretty Good Privacy, or PGP, and how the vision of this lone computer programmer in Colorado instigated a global revolution for mass distribution of privacy technologies.

Inspired by this pioneer of private and secure online communication, the founding members of WikiLeaks sought for a way to deploy information technologies to create a robust system of publishing that protects the anonymity of sources and enables transparency of the powerful. This new journalistic organization aimed to make document leaking technology available at a global scale in order to better bring accountability to governments and other institutions.

History has shown how new ideas and inventions are often met with opposition and fierce condemnation by the state. At the start of the 1990s, when Zimmermann released PGP, the U.S. government considered what he had done the equivalent of exporting munitions. It launched a three-year criminal investigation against him, creating a battle over encryption that became known to some as The Crypto Wars. The case was eventually dropped when U.S. courts ruled that software source code qualifies as speech protected by the First Amendment of the U.S. Constitution.

Two decades later, WikiLeaks efforts to amplify information technologies to tackle the problem of government secrecy created another global revolution, this time disrupting the media landscape. Like its forerunner, this new free press of the digital age soon became a target of political retaliation.

After WikiLeaks released classified documents that revealed U.S. war crimes, the U.S. government decided that its editor-in-chief had damaged national security, though it produced no shred of evidence that the published documents caused any harm. It effectively declared war on the First Amendment, charging an Australian journalist under the Espionage Act in the District Court for the Eastern District of Virginia. Just as in the first Crypto War, where it tried to ban encryption, it was now trying to shut down WikiLeaks.

What is this new Crypto War now being waged against the whistleblowing site all about? This battle is not just about Assange as an individual. While mainstream media fixates on Assange and his character, WikiLeaks is not driven solely by one charismatic man. Behind the organization, there are thousands of ordinary people worldwide who are dedicated to the principle of freedom of speech.

At the end of 2010, when WikiLeaks began publishing troves of sensitive U.S. diplomatic cables, its website came under heavy pressure by the U.S. government and its allies. Insurgency swiftly emerged from deep inside the web to help WikiLeaks counteract distributed-denial-of-service (DDOS) attacks. By keeping multiple copies of its website, and setting up mirror sites, anonymous networks allowed information to continue to flow.

Inspiring those collective acts of resistance in an underground subculture of the internet are shared values and ideals, embodied in the cypherpunk philosophy. Emerging in the late 1980s, the cypherpunk movement is a loosely tied group of mathematicians, computer scientists and online activists who advocate privacy through the use of strong cryptography.

Assange is known to have joined the cypherpunk mailing list in late 1993 or early 1994. His engagement with those on the edges on the internet had a large influence on his intellectual development. The native Australian software programmer and expert in cryptography once summed up the core values behind WikiLeaks by saying, capable, generous men do not create victims, they nurture victims.

He acknowledged this is something that he learned from his own father and other capable, generous men in his life. This moral value, installed at an early age, found practical application in the cypherpunks core belief: Cryptography can be a key tool for protecting individual autonomy threatened by power.

In his 2006 essay Conspiracy as Governance, a kind of manifesto from which WikiLeaks was conceived, Assange analyzed the structure of power and means to shift the balance of power between the individual and the state. By using cryptography as a non-violent democratic weapon that gives claws to the weak, Assange found a way to provide information to the public, to hold the powerful accountable, and to help ordinary people empower themselves with knowledge.

Cypherpunks saw the political implications of their work and strove for proper use of the power inherent in cryptography. This attitude has shaped the ethics of cryptographers and defined cypherpunk cryptography as crypto with values.

Eric Hughes who, in 1992, co-founded the influential cypherpunk mailing list, together with Timothy C. May and John Gilmore, described those values as openness, the free flow of information and decentralization. In A Cypherpunks Manifesto, published in 1993, he declared that code is free for all to use, worldwide. Assange also articulated the moral values of cypherpunks, noting the whole point of free software is to liberate it in all senses. He added that, Its part of the intellectual heritage of man. True intellectual heritage cant be bound up in intellectual property.

Instead of claiming ownership of their knowledge, cypherpunks aimed to build software on a ground of free sharing and open platforms, in which everyone can participate and make contributions to the development and utilization.

Zimmermann gave PGP away online, making the source code free and freely available. Through people all over the world simply downloading and using it, the decentralization of that technology helped to secure the right to privacy at a large scale. By deploying an anonymous, secure drop box, WikiLeaks made it possible for people around the globe to speak out against their governments wrongdoing without fear of their identity being revealed. Courage of whistleblowers became contagious, creating waves of disclosures. WikiLeaks, powered by free software, began to liberate information that had been captured under the proprietary ownership of corporations and governments.

It is with this cypherpunk vision of ethics that Satoshi Nakamoto, the pseudonymous creator of Bitcoin, also published its white paper online. The invention of Bitcoin, a peer-to-peer electronic cash system, unleashed the revolutionary power of cryptography. This community-driven, free software project set in motion a decentralized movement to liberate money from the monopoly of central banks. By people across the world simply choosing to run full nodes, each containing a complete record of all Bitcoin transactions, a network secures this stateless digital cash as a form of free speech that belongs to everyone.

Years before the U.S. governments assault on free speech escalated into the indictment against the WikiLeaks founder, the mysterious creator of Bitcoin recognized the potential fate that would befall the worlds first global Fourth Estate.

In December 2010, WikiLeaks faced the unlawful financial blockade imposed by private payment processing companies, and the organization was considering using Bitcoin to circumvent it. Satoshi, who was concerned about the risk of drawing unwanted government attention to his then infant currency, appealed to WikiLeaks not to take such action.

In an online post, Satoshi noted that, WikiLeaks has kicked the hornets nest, and the swarm is headed towards us.

WikiLeaks eventually did turn to Bitcoin to achieve financial sovereignty. And now the swarm is now getting larger, bringing a new war on cryptography.

The citizens of the internet have been longing for another world, independent from the old world of exploitation, violence and control. Dreams for freenet, for the internet to become an emancipatory tool for building peer-to-peer systems, have united people around the world together in the frontier of cyberspace.

Meanwhile, the U.S. governments prosecution of Assange is a direct attack on freedom of expression; peoples ability to form and exchange ideas and collaborate creatively. What is now being threatened is our shared values and a vision for the future of the internet at the heart of Bitcoins decentralized consensus.

Bitcoin, from its inception, was a political act. This is shown in the highly politicized message in the genesis block, referring to a banking bailout. In the lively discussion of public cryptography in 1992 on the cypherpunk mailing list, the late Hal Finney, a noted cryptographer who is considered to be one of the earliest Bitcoin pioneers, reminded us of the ethical responsibility of cryptographers:

The computer can be used as a tool to liberate and protect people, rather than to control them, Finney, who received the very first bitcoin transaction sent by Satoshi, wrote, urging Bitcoin early adopters to put their unearned wealth to good use.

Now, as Assanges U.S. extradition battle intensifies, the internet is calling for the rise of cypherpunks Assanges fellow capable generous men, who exercise their power for social good to unite once again and take up their moral duty. The future of the internet believes in Bitcoin, the potential of this crypto with values to become the currency of resistance to defend its freedom.

Authors Note: WikiLeaks has launched the official campaign page, Dont Extradite Assange. You can get information on how you can help stop Assanges extradition. Please consider donating to the WikiLeaks official Defense Fund and take action.

This is a guest post by Nozomi Hayase. Opinions expressed are entirely her own and do not necessarily reflect those of BTC Inc or Bitcoin Magazine.

Read the original post:
Julian Assange Extradition and the Freedom of Bitcoin Bitcoin... - Bitcoin Magazine