Page 2,401«..1020..2,4002,4012,4022,403..2,4102,420..»

FBI says ransomware is on the rise: what is it and who’s vulnerable? – Q13 FOX (Seattle)

FBI says prevention is protection from ransomware attacks

Ransomware is now the weapon of choice for cyber criminals

Seattle - The Federal Bureau of Investigation is raising awareness on the prevalence and threat of ransomware attacks.

Ransomware is when a criminal demands money in exchange to unlock a system or prevent a data leak.

"I would say that ransomware is the most prevalent attack that were seeing today, and the reason why were seeing that is because its very lucrative to our criminals," said L.T. Chu, the Senior Supervisory Intelligence Analyst in the FBI Seattle Field Office. "In 2019, we saw one ransomware variant that dominated the cyber landscape which was known as Ryuk. Today, the FBI has investigations for over 100 ransomware variants."

Access to ransomware is becoming easier for cybercriminals, according to Chu.

"Were seeing a change in technique where criminals are not only charging you to unlock your information, but theyre also charging you to not leak the information to the public," said Chu. "The FBI understands criminal organizations and how to take them down. Our strategy is to target three main things. Thats the actors, their infrastructure and their money."

In May, the Colonial Pipeline was hit with a major pipeline attack where criminals demanded more than $4 million in ransom to unlock its computer systems, and according to Chu, the FBI investigation recovered $2.3 million of the ransom paid.

"The unique part of this investigation was our partnerships were so strong with this company that they were able to call the FBI early on and share the information that they had with indicators of compromise," said Chu. "Everybody is vulnerable. From private citizens to corporations to government agencies, and thats why its so important that we protect ourselves from these attacks."

In recent months, and even days, weve also seen media companies attacked with ransomware.

Mike Hamilton is the Founder of Critical Insight, Inc. A cyber security company that does managing and consulting security services. He believes the attacks on media groups are a calculated move on the part of cybercriminals.

"I think theyre intentionally going after media markets Marketron was one, Sinclair was one, Cox was one. So this is starting to look like a trend now," said Hamilton. "If you disrupt a media organization or a manufacturing line or something like that, the bills start piling up right away. The loss can be calculated on a per-minute basis and youre going to do anything you need to do to get your organization back in working order and making money again."

Hamilton also started a nonprofit called PISCES, which stands for Public Infrastructure Security Cyber Education System. PISCES provides security monitoring for small cities and counties in return for collecting information from their networks, or metadata, that is used to train up and coming cyber security students.

"It goes over to the Washington State Academic Cyber Range where five universities teach classes on cyber. Analysts use live fire from real critical infrastructure in our state. That way we develop a workforce faster and better than any other place in the country," said Hamilton.

As for protecting ourselves, Chu believes that prevention is protection and said, "Make sure that your software is updated and patched. Secondly, back up your information and make multiple backups. Not only that, store your backups on a different server from your main server. Last but not least, refrain from clicking on any suspicious links at all costs."

Hamilton also recommends multifactor authentication, a plan in case of a security breach that has been tested and awareness about the Internet.

"The user interactive Internet exists to sell to you, to steal from you and to manipulate your opinion, and you should know that about the Internet. its not a nice, friendly place," said Hamilton.

If you become the target of a cyberattack, the FBI said to report it by submitting a complaint on the Internet Crime Complaint Center.

Stay connected withFOX 13News on all platforms:DOWNLOAD:FOX 13 News and Weather AppsWATCH:FOX 13 News LiveSUBSCRIBE:FOX 13 on YouTubeDAILY BRIEF: Sign Up For Our NewsletterFOLLOW:Facebook|Twitter|Instagram

Link:
FBI says ransomware is on the rise: what is it and who's vulnerable? - Q13 FOX (Seattle)

Read More..

Keep cyber secure this National Cybersecurity Awareness Month – Open Access Government

With four in ten businesses reporting a cyber attack in the last twelve months, and as businesses move toward a new era of hybrid operations post-pandemic, promoting good cybersecurity is more important now than ever.

National Cybersecurity Awareness Month, celebrated every October to raise the importance of internet security and cybersecurity measures for businesses and consumers, is an excellent opportunity for everyone to reflect on their cybersecurity practices, and ensure theyre doing all that they can.

With that in mind, we spoke to ten cybersecurity experts, about the evolving threat landscape, and to learn their top tips for bolstering cybersecurity.

The cybersecurity landscape is constantly evolving, and all organisations need to adapt to survive the pernicious threats they face.

Evolving your cybersecurity posture requires top-down engagement from the board, urges Michael Carr, Head of Strategic Development at Six Degrees. The simple fact of the matter is that cybersecurity is a core business issue that requires daily prioritisation to reduce the serious exposure your organisation faces financially and operationally, as well as long-term reputational consequences.

During this years Cybersecurity Awareness Month, I very much hope executive teams realise that employees should not be the only line of defence against cyber attacks, adds Danny Lopez, CEO at Glasswall Solutions. With the growing technological sophistication of data breaches and the sheer volume of threats today, any individual within a network can easily become a target. Unfortunately, most employees are unfamiliar with how to properly protect themselves.

The best option is to remove the threat entirely before the user needs to make a choice. Increasingly, traditional sandboxing and antivirus software arent enough. Implementing solution-based file protection software like Content Disarm and Reconstruction (CDR) can rebuild files to a higher security standard so users can benefit from safe, clean files and organisational leadership can have peace of mind.

National Cybersecurity Awareness Month serves as a reminder for enterprises to make security a strategic imperative, reinforces Anurag Kahol, CTO at Bitglass. A vigilant security posture starts with implementing a unified cloud security platform, like secure access service edge (SASE) and security service edge (SSE), that replaces various disjointed point products and extends consistent security to all sanctioned cloud resources, while following a Zero Trust framework to prevent unauthorised network access.

Jakub Lewandowski, Global Data Governance Officer at Commvault, highlights that prevention is better than a cure. He urges, the best defence is to be proactive, rather than reactive. Dont wait until an attack has happened and the attacker is in your system before you attempt to remove them. Create a strong defence that prevents an attack from penetrating your system in the first place.

He adds, organisations should also always have the ability to recover their data should it be lost because of a ransomware attack backups should therefore be vital elements of any company strategy to prevent disruption, should an attack slip through the defences.

Backup and disaster recovery coupled with regularly audited security measures are the best form of defence, agrees Hugh Scantlebury, Founder and CEO of Aqilla, but adds that firms shouldnt assume that your cloud-based SaaS solutions automatically offer these services.

Aqillas software does. But if youre using cloud-based accounting and financial software indeed, any cloud-based solution wed recommend you check that your solution operates from a secure and well-managed data centre. Ask your provider if they store your data in accordance with the National CyberSecurity Centres 14 Cloud Security Principles.

Finally, check whether disaster recovery and automated backup are taking place (and with what frequency) within your SaaS environments.

Andy Fernandez, Senior Manager, Product Marketing at Zerto, a Hewlett Packard Enterprise company, reinforces the importance of restoring data as quickly as possible after an attack: Hackers are finding ways to prolong unplanned downtime and increase data loss, and getting operational as quickly as possible is key. Yet legacy data protection solutions arent focused on the speed of recoveryonly on recovering that data. Many organizations pay the ransom simply because of how long it would take their backup systems to restore encrypted data. From web experiences to employee tools, time is money and reducing unplanned downtime is key.

Last year, in the blink of an eye, organisations transitioned entire workforces and operations to an at-home, remote model almost overnight. Dottie Schindlinger, Executive Director at Diligent Institute, highlights: Suddenly collaboration tools and video conferencing were more vital than ever before, but in the haste to deploy them, their security became an afterthought.

As employees navigated their new working environments, a lack in consistently applied good cybersecurity practices was unsurprising but these mishaps, which are often unintentional, lead to bad outcomes. The resulting increase in incidents of ransomware and other malicious cyber attacks that occurred were spurred on by the use of unsecured collaboration tools systems that increased the risk of internal leaks in circumstances where access privileges and security protocols were not rigorously followed or enforced.

Within the working environment, employees sharing personal and private data internally and externally is a constant stress for security teams and IT operations, explains Phil Dunlop, General Manager, EMEA, Progress. The data security risks associated with social platforms like Slack, Teams and WhatsApp only add to the pressure. Whats needed are robust tools and technology to make collaboration as seamless as possible, internally and externally, without sidestepping data security. Without the proper precautions in place, an open, collaborative environment can also be an insecure one, especially where sensitive data is involved.

In todays digital age, companies must continuously train their employees and build a security-minded workforce thats aware of the multitude of threats they face. Indeed, with threats rising across expanding attack surfaces, having a good understanding of cybersecurity is no longer just a nice to have, Don Mowbray, EMEA Lead, Technology & Development at Skillsoft, points out.

New Skillsoft data shows that since 2019, weve observed a 53% increase in the total number of hours that corporate learners are dedicating to security training on an annual basis a positive step in the right direction. Having a creative approach to training can make a significant difference in both engaging employees and making them more proficient in identifying cyber threats. Leveraging blended learning mixes styles, tactics, and content delivery modalities that make for a robust, effective and tailored environment for all.

Terry Storrar, Managing Director UK at Leaseweb, echoes the importance of educating employees. This National Cybersecurity Awareness Month provides the perfect opportunity to remind ourselves and co-workers to do our part and #BeCyberSmart. The simplest way we can do this is by developing good daily routines that work to manage the most common cybersecurity risks facing our organisations. Examples of this include keeping software up to date, backing up data, and maintaining good password practices.

He concludes, At the end of the day, lack of education and human error are two of the largest contributors to data breaches. Businesses need to start implementing more safeguarding protocols and make cyber training not just accessible for all employees, but a basic part of onboarding.

Editor's Recommended Articles

Go here to read the rest:
Keep cyber secure this National Cybersecurity Awareness Month - Open Access Government

Read More..

We are in the middle of a cyber pandemic. Digital security standards need reinforcing – ThePrint

We are in the midst of a cyber pandemic. In 2020, COVID-19 accelerated a transition towards remote working and the software being used for these attacks has become easier to execute, ransomware attacks have risen rapidly and continue to accelerate in 2021:

A prime target for cybercriminals has been the Operational Technology (OT) networks which interconnect the Industrial Control Systems (ICS) that manage our critical infrastructure. As services like power grids, water treatment facilities, transport and healthcare systems increasingly integrate their operational technology systems with the internet of things for example through remote sensors and monitoring this creates a new frontier of risks where millions more vulnerability points and new vectors can be exploited by hackers.

These attacks have huge implications not only on businesses but also on communities, cities, states, and entire countries. The consequences can be dire. In April 2020, hackers targeted Israels water treatment facilities through their IoT system, which gave attackers the ability to change the water pressure, temperature, and chlorine levels of the water. If the attack had fully succeeded, this could have led to whole communities becoming sick from the water supply or triggering a failsafe which would have left thousands of people without water entirely.

IoT devices and connected systems can be a large security risk for critical infrastructure services when security best practices are not implemented, as they come with a few intrinsic flaws:

As a result, there are a number of ways for hackers to exploit these devices and either perpetrate attacks on bigger targets or move laterally to harm mission-critical systems and steal information of customers and employees, intellectual property, or other sensitive assets.

A new botnet attack called Mozi has been extremely active in the past 18 months, accounting for 90% of total IoT attacks in 2020 and controlling nearly 500,000 connected devices. Each compromised device is instructed to find more devices to infect, which enables cyber criminals to gain control over entire networks and its data and hold it for ransom.

In March 2021, Silicon Valley start-up Verkadasuffered a massive IoT cyber-attack. The hackers were able to obtain administrative privileges to a large number of security surveillance cameras, meaning they could execute their own malicious code on the devices.

Once a hacker can breach a networked device, they can then use the device as a launching point for attacks laterally, exposing systems that are critical to operations. As industries further integrate IT and OT networks to gain new insights, these devices pose an even greater danger for operations that rely on industrial control systems. Without a greater push for security that addresses these connected devices, we are likely to continue seeing more attacks that target critical infrastructure industries.

Critical infrastructure remains largely private-owned and will require a coordinated effort between the public and private sectors to deter ransomware and IoT threats. To address gaps in security protocols and standards within critical industries, governments are taking it upon themselves to introduce and expand on existing cyber security policies for IoT devices.

The European Union Agency for Cybersecurity(ENISA) published guidelines on security IoT supply chains in 2020 and is now developing specific security measures for IoT operators and critical infrastructure industries. Meanwhile, the IoT Cyber Security Improvement Act was enacted in late 2020, which requires US public sector users of IoT, including those used in critical infrastructure, to extend robust cyber defenses to their IoT deployments.

The standard for this has been developed by theNational Institute for Standards in Technology(NIST), who has been central in developing approaches for improving cyber security across the US for several years. NIST has developed a number of guidance documents in consultation with stakeholders in government, industry and the private sector, and in coordination with other nations international standardization efforts. Given the size of the US government as a customer, the NIST standards adopted for the public sector could also act as a broader de-facto industry standard for all types of IoT devices in the US and beyond.

Looking beyond the IoT Cybersecurity Improvement Act which focuses on the US Federal Government market, Public Law 116-283 which passed at the end of 2020 called for an IoT Steering Committee made up of private sector stakeholders to advise a US Federal government-wide interagency group. The Steering Committee and Federal Working Group are tasked to identify the benefits of IoT, improve IoT regulation and remove barriers to adoption. In a parallel effort, the Presidents May 2021 Executive Order on cybersecurity calls for the piloting of a labelling programme for consumer IoT products that identifies how they meet cybersecurity criteria, which will be operational by February 2022.

These efforts to establish security requirements for IoT devices goes beyond federal agencies and contractors to address the need for security in critical infrastructure. Industries that are most exposed to these attacks seek uniformity and efficiency, and thus look to these laws and policies as guidelines to adopt baseline security requirements.

As cyberattacks rise in critical industries, governments and the private sectors have a shared responsibility to protect these systems. Adopters of IoT devices can work alongside policy-makers and cybersecurity suppliers to build greater consensus on IoT security standards while also developing trust in security across critical infrastructure.

Jeremy Kaye,Head, Executive Briefing Center, Check Point Software Technologies

Mitch Muro,IoT Security Product Marketing Manager, Check Point Software Technologies

Katerina Megas,Program Manager for Cyber Security for IoT, National Institute of Standards and Technology (NIST)

The article was originally published in the World Economic Forum. You can view ithere.

Also read: What caused the unprecedented Facebook outage? The few clues point to a problem from within

Why news media is in crisis & How you can fix it

India needs free, fair, non-hyphenated and questioning journalism even more as it faces multiple crises.

But the news media is in a crisis of its own. There have been brutal layoffs and pay-cuts. The best of journalism is shrinking, yielding to crude prime-time spectacle.

ThePrint has the finest young reporters, columnists and editors working for it. Sustaining journalism of this quality needs smart and thinking people like you to pay for it. Whether you live in India or overseas, you can do it here.

Support Our Journalism

Visit link:
We are in the middle of a cyber pandemic. Digital security standards need reinforcing - ThePrint

Read More..

Education Cyber Security Market Giants Spending Is Going To Boom | Broadcom, Cisco Systems, Fortinet, Proofpoint The Host – The Host

A Latest intelligence report published by AMA Research with title Education Cyber Security Market Outlook to 2026. A detailed study accumulated to offer Latest insights about acute features of the Global Education Cyber Security market. This report provides a detailed overview of key factors in the Education Cyber Security Market and factors such as driver, restraint, past and current trends, regulatory scenarios and technology development. A thorough analysis of these factors including economic slowdown, local & global reforms and COVID-19 Impact has been conducted to determine future growth prospects in the global market.

Major Players in This Report Include,

F5 Networks, Inc. (United States),Broadcom, Inc. (United States),Check Point Software Technologies (Israel),Cisco Systems, Inc (United States),Fortinet, Inc. (United States),IBM (United States),Microsoft (United States),Palo Alto Networks Inc. (United States) ,Proofpoint Inc. (United States),Sophos Ltd. (United Kingdom),Zscaler, Inc. (United States)

Free Sample Report + All Related Graphs & Charts @: https://www.advancemarketanalytics.com/sample-report/30370-global-education-cyber-security-market

Education Cyber Security Market Definition:

The Australian education cybersecurity market is expected to grow at a healthy pace during the forecast period, according to the AMA study. The rising demand for precautions from the cybersecurity attacks such as DDoS attacks, data theft, financial gain, Espionage, and the growing demand for tracking of threats such as data leaks are expected to be some of the major factors aiding the growth of the market. However, the market is expected to witness a decline in growth during FY 2020 but it is again expected to rise at a healthy pace after the COVID-19 pandemic is over.

Keep yourself up-to-date with latest market trends and changing dynamics due to COVID Impact and Economic Slowdown globally. Maintain a competitive edge by sizing up with available business opportunity in Global Education Cyber Security Market various segments and emerging territory.

Market Trend:

Market Drivers:

Market Opportunities:

The Global Education Cyber Security Market segments and Market Data Break Down are illuminated below:

by Application (Network Security, Cloud Application Security, End-Point Security, Secure Web Gateway, Internet Security, Others), End Users (Private Educational Institutions, Government Educational Institutions), Enterprise Size (SMEs, Large Enterprises), Service (Managed, Professional)

Education Cyber Security the manufacturing cost structure analysis of the market is based on the core chain structure, engineering process, raw materials and suppliers. The manufacturing plant has been developed for market needs and new technology development. In addition, Education Cyber Security Market attractiveness according to country, end-user, and other measures is also provided, permitting the reader to gauge the most useful or commercial areas for investments. The study also provides special chapter designed (qualitative) to highlights issues faced by industry players in their production cycle and supply chain. However overall estimates and sizing, various tables and graphs presented in the study gives and impression how big is the impact of COVID.

Region Included are: North America, Europe, Asia Pacific, Oceania, South America, Middle East & Africa

Country Level Break-Up: United States, Canada, Mexico, Brazil, Argentina, Colombia, Chile, South Africa, Nigeria, Tunisia, Morocco, Germany, United Kingdom (UK), the Netherlands, Spain, Italy, Belgium, Austria, Turkey, Russia, France, Poland, Israel, United Arab Emirates, Qatar, Saudi Arabia, China, Japan, Taiwan, South Korea, Singapore, India, Australia and New Zealand etc.

Enquire for customization in Report @: https://www.advancemarketanalytics.com/enquiry-before-buy/30370-global-education-cyber-security-market

Strategic Points Covered in Table of Content of Global Education Cyber Security Market:

Chapter 1: Introduction, market driving force product Objective of Study and Research Scope the Education Cyber Security market

Chapter 2: Exclusive Summary the basic information of the Education Cyber Security Market.

Chapter 3: Displaying the Market Dynamics- Drivers, Trends and Challenges of the Education Cyber Security

Chapter 4: Presenting the Education Cyber Security Market Factor Analysis Porters Five Forces, Supply/Value Chain, PESTEL analysis, Market Entropy, Patent/Trademark Analysis.

Chapter 5: Displaying market size by Type, End User and Region 2015-2020

Chapter 6: Evaluating the leading manufacturers of the Education Cyber Security market which consists of its Competitive Landscape, Peer Group Analysis, BCG Matrix & Company Profile

Chapter 7: To evaluate the market by segments, by countries and by manufacturers with revenue share and sales by key countries (2021-2026).

Chapter 8 & 9: Displaying the Appendix, Methodology and Data Source

Finally, Education Cyber Security Market is a valuable source of guidance for individuals and companies in decision framework.

Data Sources & MethodologyThe primary sources involves the industry experts from the Global Education Cyber Security Market including the management organizations, processing organizations, analytics service providers of the industrys value chain. All primary sources were interviewed to gather and authenticate qualitative & quantitative information and determine the future prospects.

In the extensive primary research process undertaken for this study, the primary sources Postal Surveys, telephone, Online & Face-to-Face Survey were considered to obtain and verify both qualitative and quantitative aspects of this research study. When it comes to secondary sources Companys Annual reports, press Releases, Websites, Investor Presentation, Conference Call transcripts, Webinar, Journals, Regulators, National Customs and Industry Associations were given primary weight-age.

For Early Buyers | Get Up to 20% Discount on This Premium Report: https://www.advancemarketanalytics.com/request-discount/30370-global-education-cyber-security-market

What benefits does AMA research study is going to provide?

Definitively, this report will give you an unmistakable perspective on every single reality of the market without a need to allude to some other research report or an information source. Our report will give all of you the realities about the past, present, and eventual fate of the concerned Market.

Thanks for reading this article; you can also get individual chapter wise section or region wise report version like North America, Europe or Southeast Asia.

Contact Us:

Craig Francis (PR & Marketing Manager)AMA Research & Media LLPUnit No. 429, Parsonage Road Edison, NJNew Jersey USA 08837Phone: +1 (206) 317 1218[emailprotected]

The rest is here:
Education Cyber Security Market Giants Spending Is Going To Boom | Broadcom, Cisco Systems, Fortinet, Proofpoint The Host - The Host

Read More..

The Fall and Rise of Techno-Globalism: Democracies Should Not Let the Dream of the Open Internet Die – Foreign Affairs Magazine

Two key words were missing from the statements that followed the inaugural in-person summit in September of the Quadrilateral Security Dialogue, also known as the Quad, which features Australia, India, Japan, and the United States. The first absent word was predictable: China. Although the countrys growing strength is the clear geopolitical impetus for this Indo-Pacific grouping, officials are at pains to portray their efforts as positive and not about containing a rival. The other omitted word, however, was both less obvious and more important. The four governments released a set of joint principles on technology, emphasizing shared values, fair competition, and an open, accessible, and secure technology ecosystem. That rhetoric may sound familiar enough from four countries meeting to champion a free, open, rules-based order. But for years, each of these governments, almost reflexively, would also have advocated for an even bigger technological vision: a global one.

Almost from its inception, idealists saw in the Internet the radical potential to help bridge divides among people. Digital connectivity spread rapidly during the heady postCold War period in which globalization surged and democracy, to many, seemed triumphant. Techno-globalism took root as an ideal among diplomats, scholars, and technologists who believed in free and open exchange both as a virtue in and of itself and as a means to spread political and economic freedoms.

The most utopian techno-globalist visions were never realized. Indeed, one reason political leaders embraced a free and open global Internet was to advocate against efforts to wall off parts of the Web: authoritarian governments, especially in China, worked quickly and effectively to erect digital barriers that prevented their citizens from freely accessing the Internet. Even as U.S. diplomats preached openness, the countrys defense and intelligence sectors perceived new risks and used the Internet to advance more parochial national security interests. Today, far short of the leveled playing field many hoped for, access to the Internet and the benefits that flow from it remains highly unequal around the world.

The recent statements and actions at the Quad and beyond suggest that many long-standing supporters of a global Internet now have moved toward a new vision of technological development: a world fractured between competing national or ideological blocs, each relying on its own trusted hardware and software suppliers to defend against malign interference. To abandon the global ideal in favor of clubs of techno-democracies or techno-autocracies, however, is to abandon a crucial recognition of the Internet agethat despite real divides, humanity and its technologies are stubbornly interconnected.

A permanent technological divide is unlikely, costly, and impractical. Moreover, it is undesirable. Without interdependence, rivals will treat each other with less restraint, increasing the likelihood of serious confrontation. The United States already has a special responsibility to think in global terms about the Internet and digital technology; from Facebook to Google, American titans of industry bestride the world. The Internets ability to advance human rights may have been hugely exaggerated, but its capacity to do harm has not, and Washington must think and act globally in keeping its technology giants in check.

Like it or not, the Internet and its associated technologies are global endeavors. Their developmentespecially in the United Stateshas depended on human ingenuity, raw materials, and labor sourced from around the world. They have required knowledge sharing, open-source development, and scientific collaboration across borders. Internet technologys most radical contribution to historynear-instantaneous communications networks that reach a huge portion of humanityrelies upon fiber-optic cables that span borders and traverse the sea floor, a place the UN Convention on the Law of the Sea dubs the common heritage of mankind.

For decades, diplomats and intellectuals from the United States and many other countries promoted the ideal of one internet, one global community, and a common body of knowledge that benefits and unites us all, as Secretary of State Hillary Clinton put it in her landmark 2010 Internet freedom speech. The Obama administrations 2011 International Strategy for Cyberspace warned that the alternative to global openness and interoperability is a fragmented Internet, where large swaths of the worlds population would be denied access to sophisticated applications and rich content because of a few nations political interests.

Until recently, other Quad countries shared the same enthusiasm for this techno-globalist view. Australias 2017 international strategy for cyber-engagement is thick with references to a global community, global rule making, and a global online marketplace. Cybersecurity strategies issued by India and Japan in 2013 likewise spoke approvingly of a worldwide Internet community. These governments, in words if not always in deeds, advocated for an open and global technology environment as opposed to the more fenced-off and draconian corners of the Internet in China, Russia, and elsewhere.

A global Internet, however, need not be an ungoverned one. Countries that advanced a techno-globalist vision of the Internet and decried the cyber-sovereignty claims of authoritarians still exercised sovereign powers of their own, for instance in restricting child pornography. Some governments in Europe have instituted strong limits on hate speech, such as Germanys Network Enforcement Act, which requires the swift deletion of illegal speech online. Still, until recently, these countries strategies took openness to the world as a starting point and sought to protect against a limited number of specific risks.

The liberal principles of openness, universal human rights, and fair market access still appear in current diplomatic initiatives, such as in the Quads statement of principles regarding technology or at the EU-U.S. Trade and Technology Council launched in September. But this rhetoric does not negate a tilt away from techno-globalism. The United States and its allies are increasingly aware of new vulnerabilities emanating from their connections to the world. The Internets dangerssuch as the potential for cyberattacks and the dissemination of disinformation on a vast scalehave become clearer, inspiring a nationalist turn in several key democratic countries.

The democratic countries where techno-globalists were once unrestrained in their advocacy of an open Internet now have become preoccupied with technologys risks. The Internet has allowed hostile state and nonstate actors to traverse borders. Criminal groups have launched ransomware attacks that paralyzed transnational shipping companies and wreaked havoc on global trade. Systemic problems in the digital device market have led to basic security vulnerabilities in everything from connected thermostats to industrial control systems used by power and water utilities. From elections to vaccines, disinformation presents acute domestic and global challenges.

As a result, leaders in India, the United States, and other erstwhile champions of a global Internet have in the last four years sought to impose more control over networks. Mirroring the actions of authoritarian governments, they seek to sever operational and supply chain ties, especially with China and especially in Internet sectors. The perceived threat of infiltration or sabotage is no longer confined to critical infrastructure vendors such as the Chinese firm Huawei but radiates now from other areas, such as social media and the consumer drone industry.

Amid this shift, official rhetoric has dropped the global in speaking of technology and the Internet. The Trump administrations 2018 National Cyber Strategy aspired to promote an open, interoperable, reliable, and secure Internetbut not necessarily a global one. Secretary of State Mike Pompeos Clean Network initiative called for expelling untrusted Chinese applications from U.S. app stores and keeping U.S. data away from Chinese-run cloud systems. The government of Narendra Modi, Indias nationalist prime minister, recently upheld its 2020 ban on dozens of Chinese software applications.

Distrust of the global Internet goes beyond nationalist politicians. A wide range of cybersecurity, data governance, and industrial policy experts identify integration between the United States and China in hardware supply chains and online services as a risk to national security. Questions around the integrity of the 2016 U.S. presidential election sparked broad fears that the Internet could undermine democratic institutions. Many thinkers who recoiled at the Trump administrations caustic stylefor instance, the presidents crude insistence on terms such as the Wuhan virus for the novel coronavirusnevertheless believe China represents a model of digital authoritarianism that must be confronted, or at least isolated. In this darkening light, the global Internet can appear like a naive dream of years past.

Today, many democracies are making messy efforts to build consensus around countering China and other countries identified with digital authoritarianism. The British-led D-10, for example, seeks alternatives to Chinas telecommunications firm Huawei in the rollout of 5G technology. In December, the White House will hold a Summit for Democracy, which advocates hope will advance a multilateral democratic counterweight to authoritarian technological practices. These efforts are not without merit, but they represent a defensive and reactive response to a deeper problem. At best, these initiatives might allow like-minded countries to regroup and find common ground before turning to face global challenges; just as likely, they could prove to be simply diplomatic busywork as stubborn disagreements persist among democratic governments and interest groups.

A better approach would recognize from the outset that the Internet and the development of technology are invariably global and cannot be easily fractured between competing political blocs. Dividing the Internet at the infrastructure level into two or more independent networks would mean duplicating entire highly complex supply chains, which would be extremely costly, carbon-inefficient, and impractical, if even possible in the first place. Such fissures would also not prevent innovations or indeed threatsincluding malicious attacks and natural disastersfrom crossing political divides.

A stark technological divide is not just unrealistic but also undesirable. Embracing a trend toward politically delineated technological ecosystems will undermine the open ethos that fuels and benefits freer societiesand bolster the top-down, controlling ethos favored by repressive regimes. And if rivals are less interdependent, they have less incentive to refrain from crippling attacks on each others critical infrastructures.

Only a renewed and pragmatic embrace of techno-globalism will offer comprehensive solutions to the real problems of technological governance. Policymakers must adopt a global vision that avoids the folly of believing that technical systems and industrial supply chains can be totally walled off from countries such as China. They should develop solutions that recognize the value and inevitability of international connection. Moreover, as home to many of the companies and individuals that most influence the experience of the Internet around the world, the United States has a special role it cannot ignore. Firms such as Google and Facebook shape how rights to privacy and free expression are protectedor abusedand their motivations cannot be assumed to be virtuous, nor their stewardship of online communities ethical, simply because they reside in the United States. Cyber-utopians once dreamed of liberation spreading from an Ethernet cable; now Washington must ensure that its companies dont spread exploitation and insecurity instead.

Responsible techno-globalism starts at home. The U.S. Congress must pass a comprehensive federal data privacy law to protect Americans from the overreach of technology companies and to demonstrate a commitment to democratic governance in the Internet age. U.S. thinkers and policymakers should take a global view in analyzing the human rights and security implications of surveillance technology produced in both democratic and authoritarian contexts. Officials must seek ways to enjoy the maximum benefits of open scientific exchange and cooperation while protecting important national security interests, for instance by narrowly targeting security-related areas for special scrutiny but actively reaffirming openness in other fields, including for students and researchers with connections to countries of concern such as China.

This urgent domestic work can form a platform for positive international efforts. With a new State Department bureau dedicated to cybersecurity and digital policy issues, the U.S. government should consult and cooperate with other democracies that are experiencing technology-related challenges and social eruptions. It may not always be easy to find consensus. The United States and the European Union, for instance, have long been at loggerheads over data governance, despite their many shared interests and values. But efforts to piece together an international, democratic, rights-respecting coalition on technology governance will fail before they get off the ground if they do not acknowledgein assessing the challenges and shaping the solutionsthat such a project is inherently a global one.

Loading...Please enable JavaScript for this site to function properly.

The rest is here:
The Fall and Rise of Techno-Globalism: Democracies Should Not Let the Dream of the Open Internet Die - Foreign Affairs Magazine

Read More..

VirnetX Zero Trust Networking Technology Implemented by Credit Union Advisor for Ransomware Protection – PRNewswire

ZEPHYR COVE, Nev., Oct. 26, 2021 /PRNewswire/ -- VirnetX Holding Corporation (NYSE: VHC), an Internet security software and technology company, announced today that the National Credit Union ISAO ("NCU-ISAO"), enhancing Credit Union cyber resilience through information sharing, intelligence, operational guidance, and workforce education, has implemented VirnetX's Zero Trust Networking Technology with Asgard's Zero-Trust EverSafe Backup and Disaster Recovery Service for ransomware protection. EverSafe is built on VirnetX's Zero Trust Networking Technology platform.

VirnetX's Zero Trust Networking Technology with Asgard's Zero-Trust EverSafe Backup and Disaster Recovery Service protects data backups, data in transit, and data at rest on private secure domains, separate and invisible from the public Internet, therefore ensuring data integrity and availability.

Ransomware is the biggest threat to banking organizations with a 1,318% increase in attacks year over year from 2020 to 2021 and depends on the vulnerability of data backups for a successful attack to ensure payment of ransoms. Secure backup and recovery capabilities are the last line of defense against ransomware. Additionally, zero trust security is now recognized as a critical component of any security strategy with 76% of organizations in the process of implementing zero trust security.

"We believe in VirnetX's Zero Trust Networking Technology and were interested to learn more about how Asgard's EverSafe solution could leverage it to create a safe, zero trust backup solution," said Brian Hinze, NCU-ISAO Director and Vice President. "After implementing the solution at NCU-ISAO, the value of the product quickly became clear when we could not see a visible path to our backups, as was advertised.A trusted partner of ours recently said, 'You can't hack what you can't see,' and it certainly holds true in action."

"VirnetX Zero Trust Networking Technology enables EverSafe to improve upon Veeam's best in class backup and recovery platform with unparalleled zero trust security delivering the most secure data protection available anywhere to our clients," said Asgard Chief Executive Officer Brian Waltermire.

About VirnetX

VirnetX Holding Corporation is an Internet security software and technology company with patented technology for secure communications including 4G LTE and 5G security. The Company's software and technology solutions, including its secure domain name registry and Gabriel Connection Technology, are designed to facilitate secure communications and to create a secure environment for real-time communication applications such as instant messaging, VoIP, smart phones, e-Readers and video conferencing. The Company's patent portfolio includes over 190 U.S. and foreign granted patents, validations and pending applications. For more information, please visit http://www.virnetx.com/.

About the National Credit Union ISAO

The mission of the NCU-ISAO is to enable and sustain Credit Union critical infrastructure cyber resilience and preserve the public trust by advancing trusted security coordination and collaboration to identify, protect, detect, respond and recover from threats and vulnerabilities. For more information, please visit https://ncuisao.org/.

About Asgard

Asgard is the leader in zero trust cloud backup and data recovery solutions servicing clients ranging from government municipalities to the small enterprise organization. Located in New York, New York, Asgard leverages data centers around the world to provide these much needed zero trust data recovery solutions to its valued clients wherever they may be. For more information, please visit http://www.asgardmsp.com.

Forward-Looking Statements

Statements in this press release that are not statements of historical or current fact, including the statement regarding VirnetX's technology, may constitute "forward-looking statements" within the meaning of the Private Securities Litigation Reform Act of 1995. Such forward-looking statements are based on expectations, estimates and projections, and certain assumptions made by management and involve known and unknown risks, uncertainties and other unknown factors that could cause the actual results of VirnetXto be materially different from the historical results or from any future results expressed or implied by such forward-looking statements, including but not limited to,including but not limited to (1) the outcome of any legal proceedings that have been or may be initiated by VirnetXor that may be initiated against VirnetX; (2) the ability to capitalize on patent portfolio and generate licensing fees and revenues; (3) the ability of VirnetXto be successful in entering into licensing relationships with its targeted customers on commercially acceptable terms; (4) potential challenges to the validity of VirnetX's patents underlying its licensing opportunities; (5) the ability of the VirnetXto achieve widespread customer adoption of its Gabriel Communication Technology and its secure domain name registry; (6) the level of adoption of the 3GPP Series 33 security specifications; (7) whether or not VirnetX's patents or patent applications may be determined to be or become essential to any standards or specifications in the 3GPP LTE, SAE project or otherwise; (8) the extent to which specifications relating to any of VirnetX's patents or patent applicationsmay beadopted as a final standard, if at all; and (9) the possibility VirnetXmay be adversely affected by other economic, business, and/or competitive factors. The forward-looking statements contained herein are also subject generally to other risks and uncertainties that are described from time to time in VirnetX's reports and registration statements filed with the Securities and Exchange Commission, including those under the heading "Risk Factors" in VirnetX's Quarterly Report on Form 10-Q filed on August 6, 2021 and subsequent filings with the Securities and Exchange Commission, as applicable. Many of the factors that will determine the outcome of the subject matter of this press release are beyond VirnetX's ability to control or predict. Except as required by law, VirnetXis under no duty to update any of the forward-looking statements after the date of this press release to conform to actual results.

Contact:Investor RelationsVirnetX Holding Corporation415.505.0456[emailprotected]

SOURCE VirnetX Holding Corporation

https://virnetx.com/

See the original post:
VirnetX Zero Trust Networking Technology Implemented by Credit Union Advisor for Ransomware Protection - PRNewswire

Read More..

Taiwan on charm offensive in Europe as China stumbles – Yahoo News

Tensions have been flying high between Taiwan and China just as a Taiwanese delegation is visiting central and eastern Europe to boost business ties in a region also targeted by Chinese investors.

The 66-member delegation on a tour of Slovakia, the Czech Republic and Lithuania has signed 18 memorandums of cooperation in the three countries.

Taiwan's charm offensive in the region once oppressed by Soviet-led Communism has targeted industrial innovation, research and development, as well as the space industry and internet security.

The trip has angered China, already dismayed over Lithuania's decision earlier this year to pull out of the 17+1 cooperation forum of China and regional states and then allow the opening of a Taiwan representative office.

"The political elite of many countries in the region (has) been in contact with Taiwan since the liberation of the entire region from Soviet communism," said Vilnius University analyst Konstantinas Andrijauskas.

He added that within the "geopolitical competition" between China and Taiwan in the region, Taiwanese investment was more predictable and independent of political will.

China is a wealthier investor, but its problem is that it "wants to invest in sectors which are regarded as sensitive for national security in most NATO countries," Andrijauskas told AFP.

China's investment pledges have also been stumbling on cumbersome delivery in the region.

During Chinese President Xi Jinping's visit to Prague in 2016, Czech President Milos Zeman, his ally, promised massive Chinese investment in his country.

"They have promised a lot and delivered much less," said Lukas Martin from the Czech Confederation of Industry.

"Chinese investment rather targets non-industrial segments, sports teams, real estate, and it creates fewer jobs and added value," he told AFP.

Chinese companies own the Slavia Prague football club, the media company Medea Group, the engineering firm ZDAS and several buildings in Prague, as well as the Changhong consumer electronics producer.

Story continues

Taiwan has in contrast targeted industry -- including electronics with its Foxconn plants -- and creates jobs.

In Slovakia, Taiwan's foreign minister Joseph Wu in a speech on Tuesday spoke of the potential for cooperation in the automotive industry -- the backbone of Slovakia's economy.

- 'Eight times more jobs' -

The Czech government's investment agency CzechInvest has mediated around the same number of investment projects by Taiwanese and Chinese companies -- around 30 for each by 2019, said Martin.

"But Taiwan's investment has created about eight times more jobs and its value is about 60 percent higher than that of the Chinese investment," he said, adding Taiwanese plants also generated profits for smaller Czech sub-suppliers.

The recent visit is a thorn in China's side as the country is trying to keep Taipei isolated on the world stage and prevents any sign of international legitimacy for the island.

Its Prague embassy slammed "the reckless establishment of contacts between some Czech institutions and officials and Taiwan's authorities, and their rough interference in China's internal affairs" in a statement issued this week.

But with Taiwan's proclaimed plans to move its businesses from China to safer territories including Europe, the EU seems to pay little attention.

Even though the EU as a whole acknowledges the One-China policy, the European Parliament last week urged closer ties between the bloc and Taiwan, slamming China for its treatment of the island.

A group of French senators visited Taiwan earlier this month to give it a boost, while a Slovak delegation is due to travel to Taiwan in December.

"We are not violating anything when we develop our cooperation with Taiwan," said Czech senate speaker Milos Vystrcil, who led a delegation of about 90 Czech politicians, entrepreneurs, scientists and journalists to Taiwan last year.

Both politicians and analysts, however, insist it would not make sense to sever ties with China.

"The country is important for our investors so we can't neglect it," said Martin. "But, on the other hand, we must not lay too much stress on it either."

frj-bur/dt/mas/spm

More here:
Taiwan on charm offensive in Europe as China stumbles - Yahoo News

Read More..

UNO, UNL Researchers Awarded Dept. of Defense Grant to Improve Bridge Safety – University of Nebraska Omaha

University of Nebraska at Omaha (UNO) and the University of Nebraska-Lincoln (UNL) researchers have been awarded $5 million by the Department of Defense Army Corps of Engineers (USACE) to conduct research that will extend the lifespan of bridges through new monitoring technology.

There is an increasing national interest in using electronic information systems that can provide data on a bridges structural performance between regular in-person inspections. New systems would allow officials to more closely monitor the health and safety of its bridges at a time when a recent analysis of U.S. Department of Transportation data shows more than one-third of U.S. bridges are in disrepair. While these systems would provide some efficiencies like early detection of potential safety hazards they could be vulnerable to cyber security threats.

U.S. Senator Deb Fischer was instrumental in advancing the project. Senator Fischer is the ranking member of the Senate Commerce Surface Transportation Subcommittee and a high-ranking member of the Senate Armed Services Committee.

New monitoring technology has the potential to increase the safety of our nations bridges and make infrastructure repairs less costly. I was proud to secure a $5 million investment in this project at UNO as part of the FY 21 defense appropriations bill. Through this important research, Nebraska will lead the way in the development of these sensors to help address transportation challenges in the future, Senator Fischer said.

UNO College of Information Science and Technology Professor and Director of the School of Interdisciplinary Informatics Robin Gandhi, Ph.D., and UNL College of Engineering Professor and Associate Dean for Graduate and International Programs Daniel Linzell, Ph.D., will conduct the research project, titled Multilevel Analytics and Data Sharing for Operations Planning (MADS-OPP), that will demonstrate how to identify and reduce risks and the cost benefit of integrating technology on aging rural bridges.

UNO Chancellor Joanne Li, Ph.D., underscored the value the project adds to the state.

This research encapsulates so well what we strive to do as an institution: pursue research with solid partnerships that delivers tangible results for Nebraskans, Chancellor Li said. I extend my thanks to Sen. Fischer for her support of this project, and Dr. Gandhi for having the foresight and the knowledge to address this important challenge.

Using rural Nebraska bridges as full-scale testbeds, Gandhi, Linzell and other UNO and UNL researchers, in collaboration with the Kinnami Software Corporation, will conduct research and development relating to data collection at the edge using internet of things including sensors, UAVs and more; secure data processing and management from the edge to the cloud; visualizations and analytics of data using machine learning; socio-technical impacts (e.g., fairness of data, algorithms, and analysis), and decision support systems.

The project will allow for predictions of remaining bridge life and guidance for maintenance using secure communications and protected data systems. Their work will also provide mission critical data that can be utilized by the Department of Defense as well as public and private stakeholders to better prioritize their budgets, protect bridges, and, most importantly, ensure the safety of citizens who travel on them.

With the ability to electronically monitor the structural safety and stability of our infrastructure comes the responsibility to protect it from cyber security risks, Gandhi said. This research aims to add to a growing body of knowledge in both of these areas.

Linzell added that while bridges in the U.S. have admirably served the traveling public for decades, they are at a point where advanced age, increased demand, extreme weather, and finite resources necessitate modifications to how their health is assessed and how bridge systems are managed.

Leveraging advances in engineering, technology and data science to intelligently and quantitatively inform stakeholders about potential problems will improve bridge assessment and management practices, Linzell said. Our teams findings will augment current processes and allow for optimal allocation of labor and financial resources while, most importantly, maintaining safety. New technologies will be robust enough to support management of other large, infrastructure systems and could provide unique economic development opportunities in Nebraska.

The UNO Office of Research and Creative Activity spearheaded the effort to secure funding for the research. Associate Vice Chancellor for Research and Creative Activity Ken Bayles, Ph.D., said the funding speaks to the impact and quality of UNOs past research.

Our ability to secure funding for this project illustrates the positive impact Dr. Gandhis research has for the United States, Bayles said. It is also a testament to the quality of research that takes place on our campus and our willingness to collaborate across institutions.

This project would not have happened without the vision and support of several individuals and organizations, Gandhi said. In 2015, deans of the College of Information Science and Technology at UNO and the College of Engineering at UNL identified infrastructure safety as a priority area for both colleges. Since then, I have had the honor of working with a fantastic group of people including Dan and other team members.

Gandhi said those individuals include Drs. Deepak Khazanchi (UNO), Brian Ricks (UNO), and Chungwook Sim (UNL), who have been instrumental to the success of the project with their collective expertise in the socio-technical impact of continuous infrastructure monitoring, machine learning, visualization and simulation, and infrastructure health monitoring with next-generation sensing for advancing the conversation regarding a data-driven platform for understanding infrastructure health and maintenance needs.

Gandhi credited a large network of people and institutions who contributed to making this research effort possible, which includes Kinnami Software Corporation, who will be developing their resilient data platform, AmiShare, to protect and manage the sensitive data related to this project.

Were excited to be part of this important research and development work that Dr. Gandhi is leading, said Sujeesh Krishnan, CEO of Kinnami Software. Kinnamis resilient data platform, AmiShare, provides the high level of protection and security that US critical infrastructure requires. We are pleased to be able to broaden AmiShares footprint in national security interests in this collaboration with UNO and UNL. This work is complementary to our other efforts inside the DoD to deliver secure and resilient, real-time data for situational awareness, mission support and sustainment. Transitioning this data and analysis to transportation departments as well as other state and local agencies will transform their ability to monitor and maintain these assets into the future.

This is not the first time Linzell and Gandhi have paired on a research effort. The duo was part of a team that received a $1 million National Science Foundation (NSF) grant to establish a Big Data Spoke headquartered at UNO focused on producing a smart big data pipeline for rural bridge health management. The project is entitled Smart Big Data Pipeline for Aging Rural Bridge Transportation Infrastructure (SMARTI).

Funding for the project was included in the FY2021 Senate Defense Appropriations Bill that was approved in December 2020.

This material is based upon work supported by the University of Nebraska at Omaha and its subcontractors under Contract No. W912HZ21C0060. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the University of Nebraska at Omaha and its subcontractors.

Read the original:
UNO, UNL Researchers Awarded Dept. of Defense Grant to Improve Bridge Safety - University of Nebraska Omaha

Read More..

Internet of Things (IoT): Regulatory Trends identified by GlobalData – Verdict

The existing fragmented security regulations are a major roadblock for the adoption of Internet of Things (IoT) technology. There are widespread fears around data privacy and the possibility of malicious attacks that can disrupt critical operations of businesses.

Listed below are the key regulatory trends impacting the IoT theme, as identified by GlobalData.

The rapid growth of the IoT market has raised several security concerns, which typically revolve around the lack of regulation and the lack of common IoT standards. Legislation covering IoT security remains a fragmented patchwork of laws.

Governments have started to focus on this issue as IoT deployments grow, with new governance measures gaining traction. In May 2020, the USs National Institute of Standards and Technology (NIST) released the Foundational Cybersecurity Activities for IoT Device Manufacturers guidelines. Similarly, the European Telecommunications Standards Institute (ETSI) has released a technical specification guide on Cyber Security for the Consumer IoT segment, which outlines leading security practices for consumer IoT devices.

One of the most critical government initiatives was the US IoT Cybersecurity Improvement Act, signed in December 2020. Until regulators coordinate efforts to agree on international IoT security standards, IoT ecosystems will continue to expose many enterprises to unacceptable levels of security risk.

IoT ecosystems raise data privacy concerns for both consumers and employees in addition to cybersecurity risk. A case in point was the data leak suffered by Ring in 2019, where hackers breached Ring home security cameras to digitally intrude into family homes, harass children, and even demand ransoms.

A 2020 survey by the World Economic Forum identified safety, privacy, and trust as the biggest risks for consumers using IoT devices. The survey also highlighted consumers lack of awareness about the data collected by IoT devices, a problem that persists across the IoT value chain. Regulators will have to address the data privacy concerns that are widespread within the consumer IoT domain in addition to the development of common IoT security standards.

This is an edited extract from the Internet of Things Thematic Research report produced by GlobalData Thematic Research. Related Report Download the full report from GlobalData's Report StoreGet the Report

Latest report from Visit GlobalData Store

Continued here:
Internet of Things (IoT): Regulatory Trends identified by GlobalData - Verdict

Read More..

Client-Side Scanning: A New Front In the War on User Control of Technology – Just Security

As technology has improved to provide users more secure, encrypted communication options, law enforcement and intelligence agencies have pursued various ways to gain access to citizens communications, particularly under the guise of stopping the spread of child sexual abuse material (CSAM). I have previously discussed the problems with these approaches, including encryption back doors and regulating the content of app stores. A newly proposed technique known as client-side scanning (CSS) presents a possible solution to the challenge of investigating the trafficking of child sexual abuse material (CSAM), nominally without the need to degrade user security. But the issue of whether CSS actually resolves the law enforcement vs. strong encryption debate underscores an often overlooked and foundational question about how much control people should have over the technologies they own. The importance of this issue stems from two sources, the ubiquity of technological devices in our lives and the sheer bulk of personal information we entrust to them.

For nearly thirty years, U.S. law enforcement and national security agencies have criticized the use of strong encryption in computing and communications, claiming that cryptographic systems will severely curtail legitimate law enforcement activity by making data unreadable and thus rendering digital police investigations useless. This argument has met with little success, due mainly to the lack of evidence that law enforcement investigations have been impeded as much as had been claimed, as well as a broad acknowledgement of the critical role encryption has come to play in our everyday security. Indeed, Julian Sanchez has recently explained the important role encryption has played in American society since the founding of the nation.

The distribution of child pornography online, however, has sent law enforcement agencies back to technology companies once again to find a way around the encryption conundrum. Specifically, because strong cryptography can stymie police efforts to investigate the trafficking of CSAM across the internet by rendering data unreadable to anyone without access to the key, law enforcement agencies will be unable to detect or disrupt CSAM distribution networks.

CSS gets around the encryption challenge in investigating CSAM by identifying targeted files through data scans on the users computing device before the user can encrypt them. By conducting these searches locally on the users computer at key moments in data processing when the information is still readable, rather than through a wiretap or device seizure, CSS allows law enforcement agencies to avoid the going dark problem posed by strong encryption. CSS thus appears to be a solution to the extended fight between law enforcement and technology companies over the use of encryption.

A recent article by several widely respected computer security experts has questioned the wisdom of CSSs use, however. In addition to illustrating several ways CSS can fail, such as by mistaking innocuous content for targeted material, or be circumvented or hijacked by bad actors, the articles authors point out that CSS weakens a key purpose of encryptionthe desire of law-abiding users to avoid extralegal or unwanted surveillance. Others have pointed to the dangers of abuse of CSS, where private data can be scanned by others, even if the user has not given explicit permission to do so. But in addition to these valid points, there is an even larger issue raised by CSS, one that goes to the core of what it means to own a computing device today.

The nature of computers makes everything but the interfaces we use to interact with them opaque to most of us, and that is by design. There is quite a lot going on inside our devices that we would rather not have to worry about just to get our computers to do what we want. Those of us who are old enough to remember manually installing device drivers and editing configuration files probably do not relish a return to those days. But that does not necessarily mean we wish to relinquish control over our devices as part of this usability bargain. Like the strong encryption question, this debate about user control over the technologies we own has also been going on for decades, but often less visibly. In fact, technology users have been slowly losing this debate without necessarily knowing of its existence or what is at stake.

Until relatively recently, computers were general-purpose machines. That is, their owners could use them as they pleased, installing or removing components or software as it suited them, and controlling which processes could or could not run on the device. This landscape began to change when technology and entertainment industries created technologies to control user access to content, and strategies like digital rights management started to move certain parts of our devices out of the owners reach. This is something like buying a house where one room is permanently locked and only the builder has access. You can hear machinery operating in that room, but you have no way of knowing what those machines are doing, and there is no way for you to turn them off. Existing laws and policies have driven these changes, which have in turn quietly adjusted our customary ideas about ownership, at least with respect to digital devices and content.

These changes have taken place largely due to efforts to protect intellectual property, and efforts by law enforcement and national security agencies to influence similar changes have generally failed. But for technologies like CSS to work, portions of every computing device must also be walled off from user visibility and control. Search algorithms must be installed on every computing device to enable the scanning of data going in or out. If we allow this partitioning of device access and control for reasons of intellectual property protection, why not law enforcement or national security?

It is a fair question, and there are many who argue that we have already given up too much device control to the former. But CSS poses particularly troubling problems that go beyond existing objections. While CSS algorithms can be configured to scan for CSAM, they can also be configured to search for any other data others might be interested in knowing you have on your device, including private communications, location data, and personal documents. It does not require too active an imagination to foresee how such a system could be abused. And even though you own the device, there is nothing you can do about it.

One can understand the idea that technology ownership is an artifact of simpler days gone by, and that change is necessary to fairly balance the many interests at stake in our increasingly complex society. As technologies change and our uses of them evolve, we should frequently pause to evaluate their costs and benefits to society. Given the worthy goal of countering CSAM trafficking, we could conclude that using CSS on our devices is an appropriate solution. But before reaching that conclusion, we should fully understand what it means when we no longer control the technologies we think we own.

Our use of these devices has rapidly expanded to nearly every corner of our lives, and this has meant that their use is all but a requirement for participating in contemporary society. Because of their importance, we rarely think twice about giving these technologies unfettered access to our most sensitive data. But this requires a significant measure of trust that access to our devices is within our controlwe decide who can or cannot see what information we put there. Maintaining that trust means ensuring users retain control over the devices they own.

Originally posted here:
Client-Side Scanning: A New Front In the War on User Control of Technology - Just Security

Read More..