Selling flak jackets in the cyberwars

SAN FRANCISCO (Reuters) - When the Israeli army and Hamas trade virtual blows in cyberspace, or when hacker groups like Anonymous rise from the digital ether, or when WikiLeaks dumps a trove of classified documents, some see a lawless Internet.
But Matthew Prince, chief executive at CloudFlare, a little-known Internet start-up that serves some of the Web's most controversial characters, sees a business opportunity.
Founded in 2010, CloudFlare markets itself as an Internet intermediary that shields websites from distributed denial-of-service, or DDoS, attacks, the crude but effective weapon that hackers use to bludgeon websites until they go dark. The 40-person company claims to route up to 5 percent of all Internet traffic through its global network.
Prince calls his company the "Switzerland" of cyberspace - assiduously neutral and open to all comers. But just as companies like Twitter, YouTube and Facebook have faced profound questions about the balance between free speech and openness on the Internet and national security and law enforcement concerns, CloudFlare's business has posed another thorny question: what kinds of services, if any, should an American company be allowed to offer designated terrorists and cyber criminals?
CloudFlare's unusual position at the heart of this debate came to the fore last month, when the Israel Defense Forces sought help from CloudFlare after its website was struck by attackers based in Gaza. The IDF was turning to the same company that provides those services to Hamas and the al-Quds Brigades, according to publicly searchable domain information. Both Hamas and al-Quds, the military wing of the Palestinian Islamic Jihad, are designated by the United States as terrorist groups.
Under the USA Patriot Act, U.S. firms are forbidden from providing "material support" to groups deemed foreign terrorist organizations. But what constitutes material support - like many other facets of the law itself - has been subject to intense debate.
CloudFlare's dealings have attracted heated criticism in the blogosphere from both Israelis and Palestinians, but Prince defended his company as a champion of free speech.
"Both sides have an absolute right to tell their story," said Prince, a 38-year old former lawyer. "We're not providing material support for anybody. We're not sending money, or helping people arm themselves."
Prince noted that his company only provides defensive capabilities that enable websites to stay online.
"We can't be sitting in a role where we decide what is good or what is bad based on our own personal biases," he said. "That's a huge slippery slope."
Many U.S. agencies are customers, but so is WikiLeaks, the whistle-blowing organization. CloudFlare has consulted for many Wall Street institutions, yet also protects Anonymous, the "hacktivist" group associated with the Occupy movement.
Prince's stance could be tested at a time when some lawmakers in the United States and Europe, armed with evidence that militant groups rely on the Web for critical operations and recruitment purposes, have pressured Internet companies to censor content or cut off customers.
Last month, conservative political lobbies, as well as seven lawmakers led by Ted Poe, a Republican from Texas, urged the FBI to shut down the Hamas Twitter account. The account remains active; Twitter declined to comment.
MATERIAL SUPPORT
Although it has never prosecuted an Internet company under the Patriot Act, the government's use of the material support argument has steadily risen since 2006. Since September 11, 2001, more than 260 cases have been charged under the provision, according to Fordham Law School's Terrorism Trends database.
Catherine Lotrionte, the director of Georgetown University's Institute for Law, Science and Global Security and a former Central Intelligence Agency lawyer, argued that Internet companies should be more closely regulated.
"Material support includes web services," Lotrionte said. "Denying them services makes it more costly for the terrorists. You're cornering them."
But others have warned that an aggressive government approach would have a chilling effect on free speech.
"We're resurrecting the kind of broad-brush approaches we used in the McCarthy era," said David Cole, who represented the Humanitarian Law Project, a non-profit organization that was charged by the Justice Department for teaching law to the Kurdistan Workers' Party, which is designated by the United States as a terrorist group. The group took its case to the Supreme Court but lost in 2010.
The material support law is vague and ill-crafted, to the point where basic telecom providers, for instance, could be found guilty by association if a terrorist logs onto the Web to plot an attack, Cole said.
In that case, he asked, "Do we really think that AT&T or Google should be held accountable?"
CloudFlare said it has not been contacted about its services by the U.S. government. Spokespeople for Hamas and the Palestinian Islamic Jihad, told Reuters they contracted a cyber-security company in Gaza that out-sources work to foreign companies, but declined to comment further. The IDF confirmed it had hired CloudFlare, but declined to discuss "internal security" matters.
CloudFlare offers many of its services for free, but the company says websites seeking advanced protection and features can see their bill rise to more than $3,000 a month. Prince declined to discuss the business arrangements with specific customers.
While not yet profitable, CloudFlare has more than doubled its revenue in the past four months, according to Prince, and is picking up 3,000 new customers a day. The company has raked in more than $22 million from venture capital firms including New Enterprise Associates, Venrock and Pelion Venture Partners.
Prince, a Midwestern native with mussed brown hair who holds a law degree from the University of Chicago, said he has a track record of working on the right side of the law.
A decade ago, Prince provided free legal aid to Spamhaus, an international group that tracked email spammers and identity thieves. He went on to create Project Honey Pot, an open source spam-tracking endeavor that turned over findings to police.
Prince's latest company, CloudFlare, has been hailed by groups such as the Committee to Protect Journalists for protecting speech. Another client, the World Economic Forum, named CloudFlare among its 2012 "technology pioneers" for its work. But it also owes its profile to its most controversial customers.
CloudFlare has served 4Chan, the online messaging community that spawned Anonymous. LulzSec, the hacker group best known for targeting Sony Corp, is another customer. And since last May, the company has propped up WikiLeaks after a vigilante hacker group crashed the document repository.
Last year, members of the hacker collective UgNazi, whose exploits include pilfering user account information from eBay and crashing the CIA.gov website, broke into Prince's cell phone and email accounts.
"It was a personal affront," Prince said. "But we never kicked them off either."
Prince said CloudFlare would comply with a valid court order to remove a customer, but that the Federal Bureau of Investigation has never requested a takedown. The company has agreed to turn over information to authorities on "exceedingly rare" occasions, he acknowledged, declining to elaborate.
"Any company that doesn't do that won't be in business long," Prince said. But in an email, he added: "We have a deep and abiding respect for our users' privacy, disclose to our users whenever possible if we are ordered to turn over information and would fight an order that we believed was not proper."
Juliannne Sohn, an FBI spokeswoman, declined to comment.
Michael Sussmann, a former Justice Department lawyer who prosecuted computer crimes, said U.S. law enforcement agencies may in fact prefer that the Web's most wanted are parked behind CloudFlare rather than a foreign service over which they have no jurisdiction.
Federal investigators "want to gather information from as many sources as they can, and they're happy to get it," Sussmann said.
In an era of rampant cyber warfare, Prince acknowledged he is something of a war profiteer, but with a wrinkle.
"We're not selling bullets," he said. "We're selling flak jackets."

Read More..

Samsung Smart TVs: The next frontier for data theft and hacking [video]

Smart TVs, particularly Samsung’s (005930) last few generations of flat screens, can be hacked to give attackers remote access according to a security startup called ReVuln. The company says it discovered a “zero-day exploit” that hackers could potentially use to perform malicious activities that range from stealing accounts linked through apps to using built-in webcams and microphones to spy on unsuspecting couch potatoes. Don’t panic just yet, though. In order for the exploit to be activated, a hacker needs to plug a USB drive loaded with malicious software into the actual TV to bypass the Linux-based OS/firmware on Samsung’s Smart TVs. But, if a hacker were to pull that off, every piece of data stored on a Smart TV could theoretically be retrieved.
[More from BGR: Has the iPhone peaked? Apple’s iPhone 4S seen outselling iPhone 5]
[More from BGR: Dell confirms it will exit smartphone business, drop Android]
As if the possibility of someone stealing your information and spying on you isn’t scary enough, according to ComputerWorld, “it is also possible to copy the configuration of a TV’s remote control, which would allow a hacker to copy the remote control’s settings, and remotely change the channel.”
ReVuln told The Register it hasn’t informed Samsung of the vulnerability and plans to sell the details of in hopes of “speeding up” development of a fix. A video of the exploit as proof from ReVuln follows below.

Read More..

92K Missourians affected by insurance data breach

JEFFERSON CITY, Mo. (AP) -- State officials say the personal information of more than 92,000 Missourians was accessed by potential identity thieves who hacked the computer systems of Nationwide Insurance, which also does business as Allied Insurance.
Missouri's insurance department said Friday the Oct. 3 data breach could affect more than 1.1 million people across the country who did business with Nationwide or Allied.
Missouri's insurance director says the breach affected the records of people who got quotes for auto insurance after August 2011. The department says Nationwide believes the hackers accessed names, Social Security numbers, driver's license numbers and birth dates, among other things.
Nationwide is offering free credit monitoring and identity theft protection to people affected by the data breach. The insurer says it's not aware that the information has been misused.

Read More..

18 million Android devices could get whacked with malware in 2013

One security firm on Thursday claimed that 2013 will be the year of mobile malware for Android users, however no specific numbers had been given. The team at Lookout Mobile Security has painted a similar picture for Google’s (GOOG) operating system. The firm notes that more than 1.2 billion mobile devices are expected to be purchased in 2013 and in the following year users are forecasted to download over 70 billion mobile apps. Due to Android’s popularity, it is estimated that 18 million devices running the operating system may encounter some form of mobile malware. The likelihood that users will encounter malware or spyware, however, is heavily dependent on geographical location and behavior. Research from the security firm reveals that users in the U.S. have a 0.40% chance of seeing malware, compared those in Russia with a 34.7% chance.

Read More..

PUC approves writing rules for smart meter opt-out

EL PASO, Texas (AP) -- The Public Utility Commission has decided to develop a set of rules so consumers can opt out of the smart meters installed in millions of Texas homes and businesses.
Consumers have opposed the new meters, citing possible health hazards and privacy concerns. Some have installed steel cages around their analog meters to prevent utility workers from replacing them with the new digital units and one Houston woman held a gun to impede a utility worker from replacing her meter.
PUC spokesman Terry Hadley said Friday that an opt-out would leave already-installed smart meters in place but disable the devices' radio frequency capabilities.
A draft of the new rules will be written and submitted for public comment, Hadley said. After that, the PUC will vote again on whether to adopt them, which means there's still a chance the opt-out will fail. But, he said, "at this point the Commission is leaning toward an opt-out."
It will take several months until the new proposal is drafted and voted, Hadley said.
Smart meters allow for remote metering via radio frequency and are make the billing process cheaper since there is no need to send utility workers to read them. The meters also provide real-time information on energy consumption and help utilities prevent grid overloads during peak times. They also report to the utility when there is a power outage, making reconnection faster.
In websites and meetings organized by PUC, those against smart meters have spoken of possible government snooping and violations of the Fourth Amendment —unreasonable search and seizure — as well as the chance that hackers could access people's information from the meters.
On a petition template that's posted on www.bantexassmartmeters.com , meters are called "surveillance devices" because they record the household occupants' activities and can be used to "gain a highly invasive and detailed view" of their lives. Smart meters record consumption in 15-minute intervals.
Health hazards from the radio frequencies emitted by the meters have also been cited. The Public Utilities Commission says the meters have a lower impact than cellphones and microwave ovens and are well within Federal Communications Commission's standards for radio frequency devices.
It's likely that consumers who opt out will have to pay to have their meters read. As part of the rule-writing process, the Commission will gather information on how much it costs to send employees to read the meters and what disabling the radio frequency device would cost.
Users in California and Nevada pay between $75 and $107 to have the devices replaced along with monthly fees ranging from $8 to $10 to have the meters read. Meanwhile, Vermont legislators decided in May that utilities cannot charge users that opt out.
About 93 percent of the nearly 7 million smart meters in Texas' competitive markets for electricity, mainly in Houston and the Dallas-Fort Worth area, have been deployed, Hadley said.

Read More..

Ofwat backs down on water licence changes

LONDON (Reuters) - Britain's water regulator Ofwat backed down over controversial changes to make water company licences more flexible after the firms affected rejected the original proposals.
Ofwat, which oversees Britain's water and sewage operators, is trying to change licences to increase the flexibility it has over controlling water prices, but on Friday compromised on some of those changes.
Pennon Group and United Utilities Group both welcomed the move which means that any future amendments to licenses will have to go through a separate process.
"It's a compromise by Ofwat and its going to be received very positively by the markets," said Dominic Nash from Liberum Capital, who has a "buy" rating on United Utilities and Pennon.
Shares in British water companies gained and were amongst the top risers in Britain's bluechip index. Severn Trent was up 1.4 percent, United Utilities was up 1.4 percent and Pennon rose 0.6 percent in mid-morning trading.
The UK water sector has fallen 10 to 20 percent since the October announcement, according to Nash.
In a bid to increase efficiency and transparency at Britain's water companies, Ofwat gave water companies four weeks in October to accept proposals to make price-setting more flexible or be referred to competition authorities.
The majority of firms, 16 out of 25 written responses received by Ofwat, rejected the idea, saying that it created unnecessary uncertainty for investors.
Currently Ofwat sets five-year price limits by targeting how much revenue firms can make according to a formula which accounts for inflation.
The coalition government committed to opening up competition on the retail side of water companies in its draft water bill published in July.

Read More..

Pope takes anti-gay marriage stance to new level

VATICAN CITY (AP) — The pope took his opposition to gay marriage to new heights Friday, denouncing what he described as people manipulating their God-given gender to suit their sexual choices — and destroying the very "essence of the human creature" in the process.
Benedict XVI made the comments in his annual Christmas speech to the Vatican bureaucracy — one of his most important speeches of the year. He dedicated it this year to promoting family values in the face of vocal campaigns in France, the United States, Britain and elsewhere to legalize same-sex marriage.
In his remarks, Benedict quoted the chief rabbi of France, Gilles Bernheim, in saying the campaign for granting gays the right to marry and adopt children was an "attack" on the traditional family made up of a father, mother and children.
"People dispute the idea that they have a nature, given to them by their bodily identity, that serves as a defining element of the human being," he said. "They deny their nature and decide that it is not something previously given to them, but that they make it for themselves."
"The manipulation of nature, which we deplore today where our environment is concerned, now becomes man's fundamental choice where he himself is concerned," he said.
It was the second time in a week that Benedict has taken on the question of gay marriage, which is dividing France after proponents scored big electoral wins in the United States last month. In his recently released annual peace message, Benedict said gay marriage, like abortion and euthanasia, was a threat to world peace.
After the peace message was released last week, gay activists staged a small protest in St. Peter's Square.
Church teaching holds that homosexual acts are "intrinsically disordered," though it stresses that gays should be treated with compassion and dignity. As pope and as head of the Vatican's orthodoxy watchdog before that, Benedict has been a strong enforcer of that teaching: One of the first major documents of his pontificate said men with "deep-seated" homosexual tendencies shouldn't be ordained priests.
For the Vatican, though, the gay marriage issue goes beyond questions of homosexuality, threatening what the church considers to be the bedrock of society: a family based on a man, woman and their children.
But the Vatican's opposition has been falling on deaf ears. Under then-Socialist leader Jose Luis Rodriguez Zapatero, the largely Roman Catholic Spain legalized gay marriage. Earlier this month, the British government announced it will introduce a bill next year legalizing gay marriage, though it would ban the Church of England from conducting same-sex ceremonies.
In France, President Francois Hollande has said he would enact his "marriage for everyone" plan within a year of taking office last May. The text will go to parliament next month. But the country has been divided by vocal opposition from religious leaders, prime among them Bernheim, as well as some politicians and parts of rural France.
The Socialist government's plan also envisions legalizing same-sex adoptions. Benedict quoted Bernheim as denouncing that in his view, under the plan, a child is now essentially considered an object people have a right to obtain.
"When freedom to be creative becomes the freedom to create oneself, then necessarily the Maker himself is denied and ultimately man too is stripped of his dignity as a creature of God," Benedict said.

Read More..

UK High Court blocks drone intelligence challenge

LONDON (AP) — Britain's High Court on Friday blocked a legal bid for an inquiry into the possible role of the country's spy agencies in aiding covert CIA drone strikes in Pakistan's northwest tribal region.
Noor Khan, a 27-year-old whose father was killed by a drone strike in northwest Pakistan in March 2011, had asked the High Court to examine whether Britain intelligence officials assisted the action and whether they may be liable for prosecution.
High Court judges on Friday refused to allow Khan to bring a legal challenge, saying his lawyer's arguments had been an "attempt to shroud" a real goal of getting the court to publicly denounce U.S. drone strikes.
"The real aim is to persuade this court to make a public pronouncement designed to condemn the activities of the United States in North Waziristan, as a step in persuading them to halt such activity," judge Alan Moses said, adding that Khan's lawyer "knows he could not obtain permission overtly for such a purpose."
Law firm Leigh Day & Co., which is representing Khan along with legal aid charity Reprieve, said it was disappointed by the ruling and that Khan planned to appeal.
Khan's lawyers had claimed that civilian staff at Britain's electronic listening agency, GCHQ, could be "secondary parties to murder" for providing "locational intelligence" to the CIA in directing its drone attack program.
The ruling was a victory for the British government, whose lawyers had said that ties between Britain, the U.S. and Pakistan could be jeopardized if a judge granted Khan's request.
Khan's father, Malik Daud Khan, was attending a meeting of local elders in Datta Khel, in North Waziristan, when it was hit by a missile fired from an unmanned drone, killing around 40 people.
Since 2004, CIA drones have targeted suspected militants with missile strikes in the Pakistani tribal regions, killing hundreds of people. The program is controversial because of questions about its legality, the number of civilians it has killed and its impact on Pakistan's sovereignty.

Read More..

Russian parliament wants winter time restored

MOSCOW (AP) — On the darkest day of the year, Russia's parliament is pleading with the government for a little more light.
The Duma on Friday formally asked Speaker Sergei Naryshkin to query the government about abandoning year-round daylight-savings time.
The 2011 decision by then-President Dmitry Medvedev to keep Russian clocks set as if the country enjoyed perpetual summer was one of the least popular but probably most memorable moves of his bland four years in office.
It means that in the depths of winter in Moscow, the sun comes up just before 10 a.m. and departs at 5 p.m.
"You get up and lie down in complete darkness, you go to work in darkness," the state news agency RIA Novosti quoted parliament member and former cosmonaut Svetlana Savitskaya as saying.

Read More..

UK told to add break-up threat to bank reform

LONDON (Reuters) - Britain needs to introduce legislation that could break up banks if standards slip because current reform proposals fall short of what is needed, an influential parliamentary panel said.
The Parliamentary Commission on Banking Standards also said on Friday the government could set tougher rules for how much leverage banks were allowed, adding that the committee itself would consider whether to propose banning proprietary trading.
Britain, going further than most countries in pushing through change, is forcing banks to separate, or "ring-fence", their domestic retail arms from riskier investment banking.
"The proposals, as they stand, fall well short of what is required. Over time, the ring-fence will be tested and challenged by the banks," PCBS chairman Andrew Tyrie said.
"That is why we recommend electrification. The legislation needs to set out a reserve power for separation; the regulator needs to know he can use it."
The Treasury said Chancellor George Osborne will consider the proposals and respond when reforms are brought to Parliament early next year.
Osborne appears unlikely to go as far as the PCBS wants. A previous Commission, led by John Vickers, said a full break-up of banks was not needed, and Osborne may decide that if the ring-fence plan proved to be flawed, the Treasury could then introduce fresh legislation to strengthen it.
Britain wants to prevent a repeat of the need for taxpayers to bail out lenders, as happened in 2008 with a 65 billion pound ($106 billion) double rescue of Lloyds Banking Group and Royal Bank of Scotland.
The PCBS, asked to assess government plans before their introduction, said legislation should be introduced now because banks had to be discouraged from gaming the new rules for the ring-fence to succeed.
"All history tells us they will do this unless incentivised not to," Tyrie said, adding politicians could be lobbied to put holes in the ring-fence too.
"Additional powers are essential to provide adequate incentives for the banks to comply not just with the rules of the ring-fence, but also with their spirit," the Commission said in its 146-page report.
Bank shares fell up to 2.5 percent, underperforming a 1.1 percent lower European bank index.
"I would be concerned ... that a future, politically-motivated government or regulator could take draconian action with impunity. It would be putting in place a simple mechanism for banks to be picked on and to be broken up," Investec Securities analyst Ian Gordon said.
"One could argue that threat is there anyway and could be implemented," he said, adding the PCBS had added to uncertainty about reforms.
The threat of break-up would be most damaging to Barclays - whose shares fell 2.5 percent - and to a lesser degree to HSBC and RBS, analysts said.
In a concession to most banks, the PCBS said banks should be allowed to sell simple derivatives within their ring-fenced operation, which had been a point of contention.
"MORE NEEDS TO BE DONE"
The PCBS was set up after Barclays was fined for rigging global interest rates and banks were slammed for a series of mis-selling scandals.
Tyrie said the market rigging and corruption shown this week at Swiss bank UBS "beggar belief. It is the clearest illustration yet that a great deal more needs to be done to restore standards in banking.
Among plans to rein in risk-taking is a cap on leverage, which Britain plans to set at 33 times banks' capital - weaker than an original proposal for a maximum of 25 times.
The PCBS said it was "not persuaded by the government's relaxation" of that leverage rule, adding the future regulator, the Financial Policy Committee, should set the leverage cap.
Tyrie said it may also be appropriate for Britain to block banks from any proprietary trading - known as the Volcker Rule in the United States - and the PCBS will take evidence on that early next year.
The cross-party commission, which includes Justin Welby, the next Archbishop of Canterbury - the Church of England's most senior bishop - has spent the past three months deliberating the reform plans, taking evidence from the bosses of major banks as well as regulators, politicians and central bankers.
It said it was concerned too many reforms will be left to the discretion of the future regulator, and said the power to force bondholders to take losses when a bank hits trouble should be included in primary legislation.

Read More..